almalinux/kiwi-el8
14
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix fallback secure boot setup

Browse Source 
Don't copy the same file. This case happens when rebuilding
an image using --allow-existing-root when the fallback setup
has done its job already in the first run
This commit is contained in:
Marcus Schäfer 2023-07-25 12:43:31 +02:00
parent 6d40c6f26c
commit f97b47e8fb
No known key found for this signature in database
GPG Key ID: A16C1128698C8CAC
2 changed files with 43 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
kiwi/bootloader/config/grub2.py
View File

@ -809,35 +809,47 @@ class BootLoaderConfigGrub2(BootLoaderConfigBase):
# a grub image that got signed by the shim. The shim image
# is the one that gets loaded by the firmware which itself
# loads the second stage grub image
log.info(
f'--> Using shim image: {shim_image.filename}'
)
log.info(
f'--> Using grub image: {grub_image.filename}'
)
Command.run(
['cp', shim_image.filename, self._get_efi_image_name()]
)
Command.run(
[
'cp', grub_image.filename,
os.sep.join([self.efi_boot_path, grub_image.binaryname])
]
target_efi_image_name = self._get_efi_image_name()
target_grub_image_name = os.sep.join(
[self.efi_boot_path, grub_image.binaryname]
)
if not os.path.isfile(target_efi_image_name):
log.info(
f'--> Using shim image: {shim_image.filename}'
)
Command.run(
['cp', shim_image.filename, target_efi_image_name]
)
if not os.path.isfile(target_grub_image_name):
log.info(
f'--> Using grub image: {grub_image.filename}'
)
Command.run(
['cp', grub_image.filename, target_grub_image_name]
)
mok_manager = Defaults.get_mok_manager(lookup_path)
if mok_manager:
Command.run(
['cp', mok_manager, self.efi_boot_path]
target_mok_manager = os.sep.join(
[self.efi_boot_path, os.path.basename(mok_manager)]
)
if not os.path.isfile(target_mok_manager):
log.info(
f'--> Using mok image: {mok_manager}'
)
Command.run(
['cp', mok_manager, self.efi_boot_path]
)
else:
# Without shim a self signed grub image is used that
# gets loaded by the firmware
log.info(
f'--> No shim image, using grub image: {grub_image.filename}'
)
Command.run(
['cp', grub_image.filename, self._get_efi_image_name()]
)
target_efi_image_name = self._get_efi_image_name()
if not os.path.isfile(target_efi_image_name):
log.info(
f'--> No shim image, using grub image: {grub_image.filename}'
)
Command.run(
['cp', grub_image.filename, target_efi_image_name]
)
self._create_efi_config_search(uuid, mbrid)
def _setup_efi_image(

12
test/unit/bootloader/config/grub2_test.py
View File

@ -1494,8 +1494,9 @@ class TestBootLoaderConfigGrub2:
@patch('glob.iglob')
@patch('os.chmod')
@patch('os.stat')
@patch('os.path.isfile')
def test_setup_disk_boot_images_bios_plus_efi_secure_boot_no_shim_install(
self, mock_stat, mock_chmod, mock_glob,
self, mock_isfile, mock_stat, mock_chmod, mock_glob,
mock_exists, mock_command, mock_which, mock_get_boot_path
):
# we expect the copy of shim.efi and grub.efi from the fallback
@ -1503,6 +1504,7 @@ class TestBootLoaderConfigGrub2:
Defaults.set_platform_name('x86_64')
mock_get_boot_path.return_value = '/boot'
mock_which.return_value = None
mock_isfile.return_value = False
self.firmware.efi_mode = Mock(
return_value='uefi'
)
@ -1587,8 +1589,9 @@ class TestBootLoaderConfigGrub2:
@patch('glob.iglob')
@patch('os.chmod')
@patch('os.stat')
@patch('os.path.isfile')
def test_setup_disk_boot_images_bios_plus_efi_secure_boot_no_shim_at_all(
self, mock_stat, mock_chmod, mock_glob,
self, mock_isfile, mock_stat, mock_chmod, mock_glob,
mock_exists, mock_command, mock_which, mock_get_boot_path,
mock_get_shim_loader
):
@ -1599,6 +1602,7 @@ class TestBootLoaderConfigGrub2:
Defaults.set_platform_name('x86_64')
mock_get_boot_path.return_value = '/boot'
mock_which.return_value = None
mock_isfile.return_value = False
self.firmware.efi_mode = Mock(
return_value='uefi'
)
@ -1878,12 +1882,14 @@ class TestBootLoaderConfigGrub2:
@patch('glob.iglob')
@patch('os.chmod')
@patch('os.stat')
@patch('os.path.isfile')
def test_setup_install_boot_images_efi_secure_boot(
self, mock_stat, mock_chmod, mock_glob,
self, mock_isfile, mock_stat, mock_chmod, mock_glob,
mock_exists, mock_command, mock_supports_bios_modules
):
Defaults.set_platform_name('x86_64')
mock_supports_bios_modules.return_value = False
mock_isfile.return_value = False
self.os_exists['root_dir'] = True
self.firmware.efi_mode = Mock(
return_value='uefi'