#! /bin/sh
set -e
# Must load the confmodule for our template to be installed correctly.
. /usr/share/debconf/confmodule
efivars=/sys/firmware/efi/efivars
secureboot_var=SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
moksbstatert_var=MokSBStateRT-605dab50-e046-4300-abb6-3dd810dd8b23
efi_archs="x64 aa64"
on_secure_boot() {
# Validate any queued actions before we go try to do them.
local moksbstatert=0
if ! [ -d $efivars ]; then
return 1
fi
if ! [ -f $efivars/$secureboot_var ] \
|| [ "$(od -An -t u1 $efivars/$secureboot_var | awk '{ print $NF }')" -ne 1 ]
then
return 1
fi
if [ -f /proc/sys/kernel/moksbstate_disabled ]; then
moksbstatert=$(cat /proc/sys/kernel/moksbstate_disabled 2>/dev/null || echo 0)
elif [ -f $efivars/$moksbstatert_var ]; then
# MokSBStateRT set to 1 means validation is disabled
moksbstatert=$(od -An -t u1 $efivars/$moksbstatert_var | \
awk '{ print $NF; }')
fi
if [ $moksbstatert -eq 1 ]; then
return 1
fi
return 0
}
# Check that our current kernel and every newer one has not been revoked
find_revoked() {
uname_r="$(uname -r)"
exit=1
for kernel in $(ls -1 /boot/vmlinuz-* | sort -V -r); do
# no kernels :(
if [ "$kernel" = "/boot/vmlinuz-*" ]; then
break
fi
this_uname_r="$(echo "$kernel" | sed -r 's#^/boot/vmlinuz-(.*)#\1#; s#\.efi\.signed$##')"
if dpkg --compare-versions "$this_uname_r" lt "$uname_r"; then
continue
fi
if [ -e "$kernel.efi.signed" ]; then
continue
fi
if ! /usr/lib/shim/is-not-revoked "$kernel"; then
exit=0
fi
done
return $exit
}
setup_alternatives() {
for efi_arch in ${efi_archs}; do
test -e /usr/lib/shim/shim${efi_arch}.efi.signed.latest || continue
if ! on_secure_boot || ! find_revoked; then
update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shim${efi_arch}.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.latest 100
update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shim${efi_arch}.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.previous 50
else
update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shim${efi_arch}.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.latest 50
update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shim${efi_arch}.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.previous 100
fi
done
}
config_item ()
{
if [ -f /etc/default/grub ]; then
. /etc/default/grub || return
for x in /etc/default/grub.d/*.cfg; do
if [ -e "$x" ]; then
. "$x"
fi
done
fi
eval echo "\$$1"
}
sign_dkms_modules()
{
for kern in `dpkg -l linux-image-[0-9]\* | awk '/^ii/ { sub("linux-image-","",$2); print $2 }'`;
do
for dkms in `dkms status -k $(uname -r) | grep 'installed' | awk -F,\ '{print $1"/"$2}'`;
do
dkms uninstall -k "$kern" "$dkms" || :
if ! dkms status -k "$kern" "$dkms" | grep -q 'built$'
then
cat <