From 27f6c0a167da8d08f7f3343360528528f85d661f Mon Sep 17 00:00:00 2001
From: Stefan Haberland <sth@linux.ibm.com>
Date: Fri, 13 Sep 2019 13:42:16 +0200
Subject: [PATCH] zipl: allow stand alone secure option on command line
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow that --secure or -S is specified on command line without the need to
allow all options on the command line.
Also ensure that the command line option overrules the config option and
correctly ensure that secure boot is only set for SCSI devices.

Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 zipl/src/bootmap.c |  6 ++++++
 zipl/src/job.c     | 52 ++++++++++++++++++++++------------------------
 2 files changed, 31 insertions(+), 27 deletions(-)

diff --git a/zipl/src/bootmap.c b/zipl/src/bootmap.c
index 06c2c58a..efce0d00 100644
--- a/zipl/src/bootmap.c
+++ b/zipl/src/bootmap.c
@@ -1134,6 +1134,12 @@ bootmap_create(struct job_data *job, disk_blockptr_t *program_table,
 			     disk_get_type_name(info->type));
 		goto out_disk_free_info;
 	}
+	/* Check if secure boot was enabled only for SCSI */
+	if (job->is_secure == SECURE_BOOT_ENABLED &&
+	    info->type != disk_type_scsi) {
+		error_reason("Secure boot forced for non-SCSI disk type");
+		goto out_disk_free_info;
+	}
 	if (verbose) {
 		printf("Target device information\n");
 		disk_print_info(info);
diff --git a/zipl/src/job.c b/zipl/src/job.c
index 2d3cf39b..db4315fa 100644
--- a/zipl/src/job.c
+++ b/zipl/src/job.c
@@ -81,6 +81,7 @@ struct command_line {
 	int add_files;
 	int dry_run;
 	int force;
+	int is_secure;
 	enum scan_section_type type;
 };
 
@@ -98,6 +99,22 @@ store_option(struct command_line* cmdline, enum scan_keyword_id keyword,
 	return 0;
 }
 
+static int
+set_secure_ipl(char *keyword, int *is_secure)
+{
+	if (strcmp(keyword, "auto") == 0) {
+		*is_secure = SECURE_BOOT_AUTO;
+	} else if (strcmp(keyword, "0") == 0) {
+		*is_secure = SECURE_BOOT_DISABLED;
+	} else if (strcmp(keyword, "1") == 0) {
+		*is_secure = SECURE_BOOT_ENABLED;
+	} else {
+		error_reason("Invalid secure boot setting '%s'",
+			     keyword);
+		return -1;
+	}
+	return 0;
+}
 
 static int
 get_command_line(int argc, char* argv[], struct command_line* line)
@@ -226,9 +243,7 @@ get_command_line(int argc, char* argv[], struct command_line* line)
 				cmdline.menu = optarg;
 			break;
 		case 'S':
-			is_keyword = 1;
-			rc = store_option(&cmdline, scan_keyword_secure,
-					  optarg);
+			rc = set_secure_ipl(optarg, &cmdline.is_secure);
 			break;
 		case 'h':
 			cmdline.help = 1;
@@ -1278,27 +1293,6 @@ type_from_target(char *target, disk_type_t *type)
 	}
 }
 
-static int
-set_secure_ipl(char *keyword, struct job_data *job)
-{
-	if (strcmp(keyword, "auto") == 0) {
-		job->is_secure = SECURE_BOOT_AUTO;
-	} else if (strcmp(keyword, "0") == 0) {
-		job->is_secure = SECURE_BOOT_DISABLED;
-	} else if (strcmp(keyword, "1") == 0) {
-		if (job->target.targettype != disk_type_scsi) {
-			error_reason("Secure boot forced for non-SCSI disk type");
-			return -1;
-		}
-		job->is_secure = SECURE_BOOT_ENABLED;
-	} else {
-		error_reason("Invalid secure boot setting '%s'",
-			     keyword);
-		return -1;
-	}
-	return 0;
-}
-
 static int
 get_job_from_section_data(char* data[], struct job_data* job, char* section)
 {
@@ -1383,7 +1377,7 @@ get_job_from_section_data(char* data[], struct job_data* job, char* section)
 		/* Fill in secure boot */
 		if (data[(int) scan_keyword_secure] != NULL) {
 			rc = set_secure_ipl(data[(int) scan_keyword_secure],
-					    job);
+					    &job->is_secure);
 			if (rc)
 				return rc;
 		}
@@ -1547,7 +1541,7 @@ get_menu_job(struct scan_token* scan, char* menu, struct job_data* job)
 				case scan_keyword_secure:
 					rc = set_secure_ipl(
 						scan[i].content.keyword.value,
-						job);
+						&job->is_secure);
 					if (rc)
 						return rc;
 					break;
@@ -1904,7 +1898,6 @@ job_get(int argc, char* argv[], struct job_data** data)
 	job->add_files = cmdline.add_files;
 	job->data.mvdump.force = cmdline.force;
 	job->dry_run = cmdline.dry_run;
-	job->is_secure = SECURE_BOOT_AUTO;
 	/* Get job data from user input */
 	if (cmdline.help) {
 		job->command_line = 1;
@@ -1923,6 +1916,11 @@ job_get(int argc, char* argv[], struct job_data** data)
 		job_free(job);
 		return rc;
 	}
+	if (cmdline.is_secure)
+		job->is_secure = cmdline.is_secure;
+	else
+		job->is_secure = job->is_secure ? : SECURE_BOOT_AUTO;
+
 	/* Check job data for validity */
 	rc = check_job_data(job);
 	if (rc) {