kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zipl: allow stand alone secure option on command line

Browse Source 
Allow that --secure or -S is specified on command line without the need to
allow all options on the command line.
Also ensure that the command line option overrules the config option and
correctly ensure that secure boot is only set for SCSI devices.

Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Stefan Haberland
2019-09-13 13:42:16 +02:00
committed by Jan Höppner
parent 0652c687e3
commit 27f6c0a167
2 changed files with 31 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
zipl/src/bootmap.c
View File

@@ -1134,6 +1134,12 @@ bootmap_create(struct job_data *job, disk_blockptr_t *program_table,
disk_get_type_name(info->type));
goto out_disk_free_info;
}
/* Check if secure boot was enabled only for SCSI */
if (job->is_secure == SECURE_BOOT_ENABLED &&
info->type != disk_type_scsi) {
error_reason("Secure boot forced for non-SCSI disk type");
goto out_disk_free_info;
}
if (verbose) {
printf("Target device information\n");
disk_print_info(info);

52
zipl/src/job.c
View File

@@ -81,6 +81,7 @@ struct command_line {
int add_files;
int dry_run;
int force;
int is_secure;
enum scan_section_type type;
};
@@ -98,6 +99,22 @@ store_option(struct command_line* cmdline, enum scan_keyword_id keyword,
return 0;
}
static int
set_secure_ipl(char *keyword, int *is_secure)
{
if (strcmp(keyword, "auto") == 0) {
*is_secure = SECURE_BOOT_AUTO;
} else if (strcmp(keyword, "0") == 0) {
*is_secure = SECURE_BOOT_DISABLED;
} else if (strcmp(keyword, "1") == 0) {
*is_secure = SECURE_BOOT_ENABLED;
} else {
error_reason("Invalid secure boot setting '%s'",
keyword);
return -1;
}
return 0;
}
static int
get_command_line(int argc, char* argv[], struct command_line* line)
@@ -226,9 +243,7 @@ get_command_line(int argc, char* argv[], struct command_line* line)
cmdline.menu = optarg;
break;
case 'S':
is_keyword = 1;
rc = store_option(&cmdline, scan_keyword_secure,
optarg);
rc = set_secure_ipl(optarg, &cmdline.is_secure);
break;
case 'h':
cmdline.help = 1;
@@ -1278,27 +1293,6 @@ type_from_target(char *target, disk_type_t *type)
}
}
static int
set_secure_ipl(char *keyword, struct job_data *job)
{
if (strcmp(keyword, "auto") == 0) {
job->is_secure = SECURE_BOOT_AUTO;
} else if (strcmp(keyword, "0") == 0) {
job->is_secure = SECURE_BOOT_DISABLED;
} else if (strcmp(keyword, "1") == 0) {
if (job->target.targettype != disk_type_scsi) {
error_reason("Secure boot forced for non-SCSI disk type");
return -1;
}
job->is_secure = SECURE_BOOT_ENABLED;
} else {
error_reason("Invalid secure boot setting '%s'",
keyword);
return -1;
}
return 0;
}
static int
get_job_from_section_data(char* data[], struct job_data* job, char* section)
{
@@ -1383,7 +1377,7 @@ get_job_from_section_data(char* data[], struct job_data* job, char* section)
/* Fill in secure boot */
if (data[(int) scan_keyword_secure] != NULL) {
rc = set_secure_ipl(data[(int) scan_keyword_secure],
job);
&job->is_secure);
if (rc)
return rc;
}
@@ -1547,7 +1541,7 @@ get_menu_job(struct scan_token* scan, char* menu, struct job_data* job)
case scan_keyword_secure:
rc = set_secure_ipl(
scan[i].content.keyword.value,
job);
&job->is_secure);
if (rc)
return rc;
break;
@@ -1904,7 +1898,6 @@ job_get(int argc, char* argv[], struct job_data** data)
job->add_files = cmdline.add_files;
job->data.mvdump.force = cmdline.force;
job->dry_run = cmdline.dry_run;
job->is_secure = SECURE_BOOT_AUTO;
/* Get job data from user input */
if (cmdline.help) {
job->command_line = 1;
@@ -1923,6 +1916,11 @@ job_get(int argc, char* argv[], struct job_data** data)
job_free(job);
return rc;
}
if (cmdline.is_secure)
job->is_secure = cmdline.is_secure;
else
job->is_secure = job->is_secure ? : SECURE_BOOT_AUTO;
/* Check job data for validity */
rc = check_job_data(job);
if (rc) {