113 lines
3.3 KiB
Bash
Executable File
113 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
CONFIG=/etc/cachyos-updater/secureboot.conf
|
|
if [[ -r "$CONFIG" ]]; then
|
|
# Le fichier est installé et contrôlé par root.
|
|
# shellcheck source=/dev/null
|
|
source "$CONFIG"
|
|
fi
|
|
|
|
KEY=${SECURE_BOOT_KEY:-/root/secureboot-mok/MOK.key}
|
|
CERT=${SECURE_BOOT_CERT:-/root/secureboot-mok/MOK.crt}
|
|
ESP=${SECURE_BOOT_ESP:-/boot/efi}
|
|
SBAT=${SECURE_BOOT_SBAT:-/usr/share/grub/sbat.csv}
|
|
GRUB_MODULES="all_video bli boot chain configfile echo efi_gop efi_uga ext2 fat font gettext gfxmenu gfxterm gzio linux loadenv normal part_gpt part_msdos png search search_fs_uuid search_label terminal video video_bochs video_cirrus"
|
|
|
|
die() {
|
|
echo "Secure Boot : $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
[[ $EUID -eq 0 ]] || die "le signer doit être exécuté en root"
|
|
|
|
for command in findmnt grub-install install sbverify sbsign; do
|
|
command -v "$command" >/dev/null 2>&1 \
|
|
|| die "commande requise introuvable : $command"
|
|
done
|
|
|
|
[[ -r "$KEY" ]] || die "clé privée introuvable : $KEY"
|
|
[[ -r "$CERT" ]] || die "certificat introuvable : $CERT"
|
|
[[ -r "$SBAT" ]] || die "fichier SBAT introuvable : $SBAT"
|
|
|
|
if ! findmnt --mountpoint "$ESP" >/dev/null 2>&1; then
|
|
echo "Secure Boot : montage de $ESP"
|
|
mount "$ESP"
|
|
fi
|
|
|
|
ESP_FS=$(findmnt --noheadings --output FSTYPE --mountpoint "$ESP" | tr -d '[:space:]')
|
|
[[ "$ESP_FS" == "vfat" ]] \
|
|
|| die "$ESP n'est pas une partition EFI vfat montée (type : ${ESP_FS:-inconnu})"
|
|
|
|
if [[ ${1:-} == "--prepare" ]]; then
|
|
echo "Secure Boot : pré-vérification réussie sur $ESP"
|
|
exit 0
|
|
elif [[ $# -gt 0 ]]; then
|
|
die "option inconnue : $1"
|
|
fi
|
|
|
|
sign_if_needed() {
|
|
local file=$1
|
|
local tmp
|
|
|
|
[[ -f "$file" ]] || return 0
|
|
if sbverify --cert "$CERT" "$file" >/dev/null 2>&1; then
|
|
return 0
|
|
fi
|
|
|
|
tmp="${file}.signed.$$"
|
|
trap 'rm -f "$tmp"' RETURN
|
|
sbsign --key "$KEY" --cert "$CERT" --output "$tmp" "$file" >/dev/null
|
|
chown --reference="$file" "$tmp"
|
|
chmod --reference="$file" "$tmp"
|
|
mv "$tmp" "$file"
|
|
trap - RETURN
|
|
}
|
|
|
|
verify_signature() {
|
|
local file=$1
|
|
sbverify --cert "$CERT" "$file" >/dev/null 2>&1 \
|
|
|| die "signature MOK invalide : $file"
|
|
}
|
|
|
|
grub-install \
|
|
--target=x86_64-efi \
|
|
--efi-directory="$ESP" \
|
|
--bootloader-id=CACHYOS \
|
|
--modules="$GRUB_MODULES" \
|
|
--sbat="$SBAT" \
|
|
--no-nvram
|
|
|
|
install -d "$ESP/EFI/CACHYOS" "$ESP/EFI/BOOT"
|
|
for component in shimx64.efi mmx64.efi fbx64.efi; do
|
|
[[ -r "/usr/share/shim-signed/$component" ]] \
|
|
|| die "composant shim introuvable : $component"
|
|
install -m 0644 \
|
|
"/usr/share/shim-signed/$component" \
|
|
"$ESP/EFI/CACHYOS/${component^^}"
|
|
install -m 0644 \
|
|
"/usr/share/shim-signed/$component" \
|
|
"$ESP/EFI/BOOT/${component^^}"
|
|
done
|
|
|
|
sign_if_needed "$ESP/EFI/CACHYOS/GRUBX64.EFI"
|
|
install -m 0644 \
|
|
"$ESP/EFI/CACHYOS/GRUBX64.EFI" \
|
|
"$ESP/EFI/BOOT/GRUBX64.EFI"
|
|
|
|
shopt -s nullglob
|
|
kernels=(/boot/vmlinuz-*)
|
|
[[ ${#kernels[@]} -gt 0 ]] || die "aucun noyau trouvé dans /boot"
|
|
for kernel in "${kernels[@]}"; do
|
|
sign_if_needed "$kernel"
|
|
done
|
|
|
|
verify_signature "$ESP/EFI/CACHYOS/GRUBX64.EFI"
|
|
verify_signature "$ESP/EFI/BOOT/GRUBX64.EFI"
|
|
for kernel in "${kernels[@]}"; do
|
|
verify_signature "$kernel"
|
|
done
|
|
|
|
sync
|
|
echo "Secure Boot : GRUB et ${#kernels[@]} noyau(x) signés et vérifiés"
|