The Mok Management EFI executable (generally mmx64.efi) is needed in a few cases (when secure boot is enabled):
- When using a third-party shim requiring you to enroll your own cert on first boot
- When using a custom kernel or bootloader allowing the user the enroll the hash of it in order to boot
According to the layout comment on the top of the file this should already be expected to be on the ESP, fix that.
When running `get-timeout` without root, it will fail with an error ('failed to create a new libblkid probe').
Require root permissions for the `get-timeout` subcommand to clarify this.
We check for a microcode update initrd, so we can early-load it, by
comparing the resolved file names to the ending "-ucode.cpio". In the
case that a user has explicitly masked an initrd by symlinking a name in
/etc/kernel/initrd.d/ to /dev/null, we store NULL in the resolved
filename pointer.
Before we do the actual comparison, we do a strlen to make sure the
filename is longer than the desired match. For a NULL pointer, that
results in a segfault, so for that case, explicitly code the length to 0
instead of calling strlen on it.
Signature:
[277506.631610] clr-boot-manage[2369580]: segfault at 0 ip 0000558974796218 sp 00007ffca90d9658 error 4 cpu 18 in libc-2.40.so[196218,558974628000+184000] likely on CPU 18 (core 8, socket 0)
[277506.631627] Code: 0f 84 5e fd ff ff 48 89 f8 0f bc c9 f3 a4 c3 0f 1f 00 89 f8 62 a1 fd 00 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 28 01 00 00 <62> f1 7d 20 74 07 c5 fb 93 c0 85 c0 74 1a 0f bc c0 c3 66 0f 1f 44
$ sudo CBM_DEBUG=1 clr-boot-manager update
[DEBUG] cbm (../src/cli/cli.c:L142): No such file: //etc/kernel/update_efi_vars
[INFO] cbm (../src/bootman/bootman.c:L788): Current running kernel: 6.10.12-1467.native
[INFO] cbm (../src/bootman/sysconfig.c:L179): Discovered UEFI ESP: /dev/disk/by-partuuid/cb7f514a-2dd7-445d-9dec-2d5d105c6eee
[INFO] cbm (../src/bootman/sysconfig.c:L256): Fully resolved boot device: /dev/sda1
[DEBUG] cbm (../src/bootman/bootman.c:L141): shim-systemd caps: 0x26, wanted: 0x26
[DEBUG] cbm (../src/bootman/bootman.c:L156): UEFI boot now selected (shim-systemd)
[DEBUG] cbm (../src/bootman/bootman.c:L829): Non regular file: ///etc/kernel/initrd.d/.., skipping.
Segmentation fault
(gdb) bt
#0 0x0000555555396218 in __strlen_evex () from /usr/lib64/libc.so.6
#1 0x000055555555b9cc in _boot_manager_enumerate_initrds_freestanding () at ../src/bootman/bootman.c:889
#2 0x000055555555d570 in boot_manager_enumerate_initrds_freestanding () at ../src/bootman/bootman.c:918
#3 0x000055555555b170 in cbm_command_update_do () at ../src/cli/ops/update.c:82
#4 0x000055555555b2ac in cbm_command_update () at ../src/cli/ops/update.c:44
#5 0x000055555555990b in main () at ../src/cli/main.c:296
In some cases users will want to remove kernels from their systems
outside an update workflow. This is fairly painful to do manually so
add a command to handle the operation which removes both the /boot
data and configuration files as well as the /usr data.
The default symlink for a kernel type will remain as this is something
that the update mechanism should be in control of and figuring out
what would be the fallback is out of cbm's scope.
Signed-off-by: William Douglas <william.douglas@intel.com>
When checking whether we're trying to print an initrd directive for the
early microcode initrd again, use the streq macro instead, as it handles
the edge cases for us.
Make sure we only attempt to match at the end of the string, so we
don't accidentally fail if we also match earlier in the string, e.g.
foo-ucode.cpio-ucode.cpio
We still have to print the initrd entry first, but need to leave it in
the hashmap because it hasn't been copied to the ESP yet. Instead, just
skip printing it again when we print the rest.
Now that we identify microcode initrds for early loading, write the
entry for the one we've picked prior to all other initrds, then remove
it from the bootmanager's hashmap so we don't write it again with the
rest.
Check the user- and system-owned initrd.d directories for potential
microcode initrds (*-ucode.cpio). Save the first one found.
Later, we'll make sure that's the first entry we emit when writing the
loader config files.
In some cases (legacy in particular) /proc/self/mounts contains
/dev/root as the device the root path ('/') resolves to. This isn't
a valid device and so fall back to using stat in cases where
cbm_system_get_device_for_mountpoint doesn't return a device path.
Signed-off-by: William Douglas <william.r.douglas@gmail.com>
When using autofree, pointers must be initialized to NULL otherwise
use of uninitialized data might occur in the handler.
Signed-off-by: William Douglas <william.r.douglas@gmail.com>
Calling stat() on some filesystems, like Btrfs,
results in a dev_t with no relation to the backing device(s),
and subsequent failure to detect the root fs.
Add support such filesystems by retrieving the block device from
`/proc/self/mounts` and working on from there.
Resolves#61, #182 and #193.
Make sure we honor users timeout configuration propagating it to config file when
running update command.
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
With recent systemd changes cbm use cases will break if we don't add ".conf" to the
loader.conf default entry configuration.
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
Currently we can't set default kernel with extlinux/syslinux because we basically
the current implementation doesn't load the installed kernel data and when comparing
the detected ones to check with the selected kernel we'll use a data the set-kernel
command doesn't provide us. Long story short this patch brings to life the
set-kernel command for legacy bios mode bootloaders.
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
This will affact the list-kernels command that for now with legacy bios mode will
not list the actual default kernel(the one starting with *).
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
The biggest difference between extlinux and syslinux from cbm point of view is the
bootloaders install/update command. Having said that, This patch unifies the
syslinux and extlinux implementation reducing much of duplication on that side.
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
Make sure extlinux is consistent with syslinux and mark the boot partition as legacy
bios bootable.
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
Make our life easier, put together all the required steps before cutting a new
release instead of having to remember it all.
Change the VERSION file, create the release commit and tag. Bonus point added a
--help flag so we can easily remember how this script works.
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
For some reason (may be a user manual intervention or some issue on previous
updates) the syslinux/extlinux config file may be empty and in that case cbm will
segfault when reading the content's buffer.
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
By using syslinux-nomtools we don't depend on mtools and reduce the footprint for
smaller images.
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
Robert Dower