Browse Source

Switch to detect `grub*.efi` instead of `shim*.efi`.

The presence of the shim depends on whether Secure Boot is enabled or
not, plus the configuration of the distro. GRUB itself however, will
always be present if the distro uses GRUB with UEFI at all. So check
for that instead.

Of course, without the shim, Secure Boot will not work out of the box,
but this is a misconfigured platform, not a problem with Mender.

Cancel-Changelog: 2b805e29dc

Changelog: If `grub*.efi` preexists on the EFI partition, keep it
instead of installing our own. In all other cases, we fall back to the
old functionality of installing mender-grub and nuking the existing
bootloader.

Signed-off-by: Kristian Amlie <kristian.amlie@northern.tech>
change-dependabot-prefix
Kristian Amlie 3 years ago
parent
commit
f0d96f777d
No known key found for this signature in database GPG Key ID: F464407C996AF03F
  1. 4
      mender-convert-modify
  2. 2
      modules/grub.sh
  3. 10
      modules/probe.sh

4
mender-convert-modify

@ -140,10 +140,10 @@ if [ "${MENDER_GRUB_EFI_INTEGRATION}" == "y" ]; then
# Check for known U-Boot problems in all files on the boot partition.
check_for_broken_uboot_uefi_support work/boot
if has_secureboot_shim "work/boot"; then
if has_grub_efi "work/boot"; then
# No need to install Grub, use the one already present, and only install
# our grub.cfg
grub_install_with_shim_present
grub_install_with_grub_efi_present
else
grub_install_mender_grub
fi

2
modules/grub.sh

@ -78,7 +78,7 @@ function grub_install_grub_editenv_binary() {
#
# Keep the existing boot shim, and bootloader, and only install the mender-grub
# config
function grub_install_with_shim_present() {
function grub_install_with_grub_efi_present() {
grub_create_grub_config

10
modules/probe.sh

@ -345,11 +345,11 @@ is_efi_compatible_kernel() {
return 0
}
# has_secureboot_shim
# has_grub_efi
#
# $1 - the boot partition to search for a secureboot shim
# $1 - the boot partition to search for a grub*.efi
#
# Checks the EFI/* filesystem for the presence of a signed boot shim
has_secureboot_shim() {
find "${1}" -type f -name 'shim*.efi' -print0 | grep -qz shim
# Checks the EFI/* filesystem for the presence of a GRUB bootloader
has_grub_efi() {
find "${1}" -type f -name 'grub*.efi' -print0 | grep -qz grub
}

Loading…
Cancel
Save