SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #22840 from poettering/efivars-tweaks

Browse Source 
util-lib: efi variable access refactorings
This commit is contained in:
Lennart Poettering
2022-03-24 18:39:46 +01:00
committed by GitHub
parent e1f0c1367c 7be4b23649
commit 3824ce0522
12 changed files with 688 additions and 646 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/basic/efivars.c
+26 -18
View File
@@ -142,7 +142,7 @@ int efi_get_variable(
return 0;
}
int efi_get_variable_string(const char *variable, char **p) {
int efi_get_variable_string(const char *variable, char **ret) {
_cleanup_free_ void *s = NULL;
size_t ss = 0;
int r;
@@ -156,7 +156,7 @@ int efi_get_variable_string(const char *variable, char **p) {
if (!x)
return -ENOMEM;
*p = x;
*ret = x;
return 0;
}
@@ -310,9 +310,17 @@ static int read_flag(const char *variable) {
bool is_efi_secure_boot(void) {
static int cache = -1;
int r;
if (cache < 0)
cache = read_flag(EFI_GLOBAL_VARIABLE(SecureBoot));
if (cache < 0) {
r = read_flag(EFI_GLOBAL_VARIABLE(SecureBoot));
if (r == -ENOENT)
cache = false;
else if (r < 0)
log_debug_errno(r, "Error reading SecureBoot EFI variable, assuming not in SecureBoot mode: %m");
else
cache = r;
}
return cache > 0;
}
@@ -326,7 +334,8 @@ SecureBootMode efi_get_secure_boot_mode(void) {
int secure = read_flag(EFI_GLOBAL_VARIABLE(SecureBoot));
if (secure < 0) {
if (secure != -ENOENT)
log_debug_errno(secure, "Error reading SecureBoot EFI variable: %m");
log_debug_errno(secure, "Error reading SecureBoot EFI variable, assuming not in SecureBoot mode: %m");
return (cache = SECURE_BOOT_UNSUPPORTED);
}
@@ -341,7 +350,7 @@ SecureBootMode efi_get_secure_boot_mode(void) {
return (cache = decode_secure_boot_mode(secure, audit > 0, deployed > 0, setup > 0));
}
static int read_efi_options_variable(char **line) {
static int read_efi_options_variable(char **ret) {
int r;
/* In SecureBoot mode this is probably not what you want. As your cmdline is cryptographically signed
@@ -361,7 +370,7 @@ static int read_efi_options_variable(char **line) {
return -EPERM;
}
r = efi_get_variable_string(EFI_SYSTEMD_VARIABLE(SystemdOptions), line);
r = efi_get_variable_string(EFI_SYSTEMD_VARIABLE(SystemdOptions), ret);
if (r == -ENOENT)
return -ENODATA;
return r;
@@ -379,13 +388,13 @@ int cache_efi_options_variable(void) {
WRITE_STRING_FILE_ATOMIC|WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_MKDIR_0755);
}
int systemd_efi_options_variable(char **line) {
int systemd_efi_options_variable(char **ret) {
const char *e;
int r;
/* Returns the contents of the variable for current boot from the cache. */
assert(line);
assert(ret);
/* For testing purposes it is sometimes useful to be able to override this */
e = secure_getenv("SYSTEMD_EFI_OPTIONS");
@@ -396,11 +405,11 @@ int systemd_efi_options_variable(char **line) {
if (!m)
return -ENOMEM;
*line = m;
*ret = m;
return 0;
}
r = read_one_line_file(EFIVAR_CACHE_PATH(EFI_SYSTEMD_VARIABLE(SystemdOptions)), line);
r = read_one_line_file(EFIVAR_CACHE_PATH(EFI_SYSTEMD_VARIABLE(SystemdOptions)), ret);
if (r == -ENOENT)
return -ENODATA;
return r;
@@ -410,7 +419,7 @@ static inline int compare_stat_mtime(const struct stat *a, const struct stat *b)
return CMP(timespec_load(&a->st_mtim), timespec_load(&b->st_mtim));
}
int systemd_efi_options_efivarfs_if_newer(char **line) {
int systemd_efi_options_efivarfs_if_newer(char **ret) {
struct stat a = {}, b;
int r;
@@ -424,15 +433,14 @@ int systemd_efi_options_efivarfs_if_newer(char **line) {
log_debug("Variable SystemdOptions in evifarfs is newer than in cache.");
else {
log_debug("Variable SystemdOptions in cache is up to date.");
*line = NULL;
*ret = NULL;
return 0;
}
r = read_efi_options_variable(line);
r = read_efi_options_variable(ret);
if (r < 0)
log_warning_errno(r, "Failed to read SystemdOptions EFI variable: %m");
if (r == -ENOENT)
return -ENODATA;
return r;
return log_debug_errno(r, "Failed to read SystemdOptions EFI variable: %m");
return 0;
}
#endif
src/basic/efivars.h
+9 -8
View File
@@ -19,9 +19,10 @@
#define EFI_VENDOR_GLOBAL_STR SD_ID128_MAKE_UUID_STR(8b,e4,df,61,93,ca,11,d2,aa,0d,00,e0,98,03,2b,8c)
#define EFI_VENDOR_SYSTEMD SD_ID128_MAKE(8c,f2,64,4b,4b,0b,42,8f,93,87,6d,87,60,50,dc,67)
#define EFI_VENDOR_SYSTEMD_STR SD_ID128_MAKE_UUID_STR(8c,f2,64,4b,4b,0b,42,8f,93,87,6d,87,60,50,dc,67)
#define EFI_VARIABLE_NON_VOLATILE 0x0000000000000001
#define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x0000000000000002
#define EFI_VARIABLE_RUNTIME_ACCESS 0x0000000000000004
#define EFI_VARIABLE_NON_VOLATILE UINT32_C(0x00000001)
#define EFI_VARIABLE_BOOTSERVICE_ACCESS UINT32_C(0x00000002)
#define EFI_VARIABLE_RUNTIME_ACCESS UINT32_C(0x00000004)
/* Note that the <lowercaseuuid>-<varname> naming scheme is an efivarfs convention, i.e. part of the Linux
* API file system implementation for EFI. EFI itself processes UIDS in binary form.
@@ -42,8 +43,8 @@
#if ENABLE_EFI
int efi_get_variable(const char *variable, uint32_t *attribute, void **value, size_t *size);
int efi_get_variable_string(const char *variable, char **p);
int efi_get_variable(const char *variable, uint32_t *attribute, void **ret_value, size_t *ret_size);
int efi_get_variable_string(const char *variable, char **ret);
int efi_set_variable(const char *variable, const void *value, size_t size);
int efi_set_variable_string(const char *variable, const char *p);
@@ -52,8 +53,8 @@ bool is_efi_secure_boot(void);
SecureBootMode efi_get_secure_boot_mode(void);
int cache_efi_options_variable(void);
int systemd_efi_options_variable(char **line);
int systemd_efi_options_efivarfs_if_newer(char **line);
int systemd_efi_options_variable(char **ret);
int systemd_efi_options_efivarfs_if_newer(char **ret);
#else
@@ -61,7 +62,7 @@ static inline int efi_get_variable(const char *variable, uint32_t *attribute, vo
return -EOPNOTSUPP;
}
static inline int efi_get_variable_string(const char *variable, char **p) {
static inline int efi_get_variable_string(const char *variable, char **ret) {
return -EOPNOTSUPP;
}