From bfb9c44298aa202c176fef8dc5ea48f9b0e76e5e Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 2 Feb 2021 19:59:48 +0100 Subject: [PATCH] kern/lockdown: Set a variable if the GRUB is locked down It may be useful for scripts to determine whether the GRUB is locked down or not. Add the lockdown variable which is set to "y" when the GRUB is locked down. Suggested-by: Dimitri John Ledkov Signed-off-by: Javier Martinez Canillas Reviewed-by: Daniel Kiper Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d90367471779c240e002e62edfb6b31fc85b4908] CVE: CVE-2020-14372 Signed-off-by: Marta Rybczynska --- docs/grub.texi | 3 +++ grub-core/kern/lockdown.c | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/docs/grub.texi b/docs/grub.texi index d778bfb..5e6cace 100644 --- a/docs/grub.texi +++ b/docs/grub.texi @@ -5802,6 +5802,9 @@ The GRUB can be locked down when booted on a secure boot environment, for exampl if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will be restricted and some operations/commands cannot be executed. +The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down. +Otherwise it does not exit. + @node Platform limitations @chapter Platform limitations diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c index 1e56c0b..0bc70fd 100644 --- a/grub-core/kern/lockdown.c +++ b/grub-core/kern/lockdown.c @@ -18,6 +18,7 @@ */ #include +#include #include #include #include @@ -71,6 +72,9 @@ grub_lockdown (void) lockdown = GRUB_LOCKDOWN_ENABLED; grub_verifier_register (&lockdown_verifier); + + grub_env_set ("lockdown", "y"); + grub_env_export ("lockdown"); } int