The gnu-efi headers emit some warnings in clang when not compiled with
-ffreestanding. This is normally not an issue for has_header_symbol()
unless meson is run with CFLAGS="-Werror". Note that this differs
from the --werror option, which does not get passed to clang.
Work around this by adding some compile args to the has_header_symbol()
invocation.
Some types of credentials that a user would want to pass
into the initrd do not depend on the specific kernel/initrd
version. For instance, this can include SSH keys, rootfs
encryption keys, dm-integrity keys, and so on. This
introduces a directory where such credentials can be placed
so that any kernel image will load them
if /usr/lib/systemd/boot/efi/systemd-bootx64.efi.signed exists
install that instead of /usr/lib/systemd/boot/efi/systemd-bootx64.efi
the idea is that SecureBoot tooling can create the efi.signed file
whenever /usr/lib/systemd/boot/efi/systemd-bootx64.efi from the package
is updated.
Previously, mangle_filename would write the null terminator, but
then wouldn't increment the pointer. Thus, the pad4 call that comes
immediately after mangle_filename would trample over the null
terminator that mangle_filename wrote. Since the padding is all
0s, this happened to work for the filenames it was tested for
However, in some cases, this would cause the pointer to be a different
position than predicted. Basically, the predicted size would be one
byte bigger than the actual size (the missing null terminator). Usually,
this disappeared into the alignment padding at the end of the buffer,
but if the buffer was already unexpectedly aligned (b/c it was a byte
shorter than expected), this would cause assertion failures.
Also, the c_namesize field in the cpio header was incorrect. It
didn't include the null terminator, as required by the spec.
For LTO to work, the linker has to be called with some magic sauce arguments.
And the easiest way to get those is to just let the compiler to the job for us.
Any recent shim will refuse starting an image that does not have an sbat section
and will do so with a generic "Security Violation" message. And it is very easy
to forget passing -Dsbat-distro=auto to meson when creating a fresh build dir.
Adding sbat info when shim is not used or secure boot is disabled does not hurt
anyone, so default to auto. This still ensures to not add auto-detected info in
case we are cross building.
Let's make sure IMAGE_ID/IMAGE_VERSION are properly honoured, and
explain in a long comment why.
Let's also use ID= field again, which was lost by accident.
(While we are at it do some minimal OOM checks wherever we touch
something)
Unfortunately they forgot the "const" decoration on the MetaiMatch()
prototype, but let that omission not leak into our code, let's hide it
away in the innermost use.
Moving all of the gnu-efi detection into src/boot/efi/meson.build makes
more sense than having it partially split.
And thanks to subdir_done() we can simplify the code a lot.
Fixes: #21258
This allows starting systemd-boot from \EFI\Linux for easier testing
and bisection without risking an unbootable system as the user does not
need to replace their working loader.
efi_arch is set to whatever meson returns from host_machine.cpu_family() and
gnu_efi_arch is then set accordingly.
On x86, efi_arch == x86 and gnu_efi_arch == ia32. Surprisingly, compilation
worked (without disabling some instruction sets) and nobody ever complained
about systemd-bootia32.efi not working.
This brings the final list of compiler arguments more in line with
how meson does things. In particular, --buildtype=plain will not
add any optimizations on its own (and would have to be provided
through CFLAGS=).
These flags are used by gnu-efi. Adding --no-undefined even allows
us to drop the no-undefined-symbols.sh test in favor of immediate
compile time errors.
This is not a hosted environment and we should not pretend otherwise
if -ffreestanding is not supported.
With EFI strings being in UCS2, it is not supported to build without
-fshort-wchar as gcc/clang default to a w_char_t size of 4 bytes.
This also makes the charset for wide chars explicit on gcc. This way
we get a nice error message if anyone ever tries to add 💩 to strings.
Let's make sure '@' is never written as entry ID into any EFI variable,
as we want the ability to add new ids like this later on, with them
resulting in a clear error on older implementations.
This is useful if the auto-firmware setting has been disabled. The
keys used here are based on what the majority of firmware employ in
the wild.
This also ensures there's a chance for the user to discover this in
case they were too slow during POST or simply used the wrong ones.
Jan Janssen
Zbigniew Jędrzejewski-Szmek
Adrian Vovk
Дамјан Георгиевски
Yu Watanabe
Lennart Poettering
Luca Boccassi