Skip to content

Commit ebf8d04

Browse files
qzedqzed
committed
Check for efivarfs before running mokutil
1 parent 333ac68 commit ebf8d04

File tree

6 files changed

+317
-81
lines changed

6 files changed

+317
-81
lines changed

‎arch/PKGBUILD

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ pkgdesc='Secure-boot machine owner key for linux-surface kernels'
77
url='https://github.com/linux-surface/linux-surface'
88
license=('MIT')
99
arch=('any')
10-
depends=('mokutil')
10+
depends=('mokutil' 'grep')
1111
install="${pkgname}.install"
1212

1313
_commit="d8887bc8ce14a47d5b9d45f6697f05d53e43fe9a"

‎arch/linux-surface-secureboot-mok.install

Lines changed: 99 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,43 @@
11
post_install() {
2+
local original="/usr/share/linux-surface-secureboot/surface.cer"
3+
local hashfile
4+
25
echo ""
36
echo "The secure-boot certificate has been installed to"
47
echo ""
5-
echo " /usr/share/linux-surface-secureboot/surface.cer"
8+
echo " ${original}"
69
echo ""
10+
11+
# check if efivarfs has been mounted
12+
if ! mount -l | grep --quiet "efivarfs"; then
13+
echo "The 'efivarfs' filesystem has not been mounted. Please add the key to the"
14+
echo "UEFI key store manually."
15+
echo ""
16+
echo "You can do this by, e.g., mounting efivarfs via"
17+
echo ""
18+
echo " mount -t efivarfs none /sys/firmware/efi/efivars"
19+
echo ""
20+
echo "and running mokutil via"
21+
echo ""
22+
echo " mokutil --import ${original}"
23+
echo ""
24+
echo "To finish the enrollment process you then need to reboot, where you will be"
25+
echo "asked to enroll the certificate. During the import, you will be prompted for"
26+
echo "the (temporary) password you chose when asked in the commands above. Please"
27+
echo "make sure that you are indeed adding the right key and confirm by entering"
28+
echo "your chosen password."
29+
echo ""
30+
return
31+
fi
32+
733
echo "It will now be automatically enrolled for you and guarded with the password"
834
echo ""
935
echo " surface"
1036
echo ""
1137

12-
local hashfile=$(mktemp)
13-
mokutil --generate-hash=surface > ${hashfile}
14-
mokutil --hash-file ${hashfile} --import /usr/share/linux-surface-secureboot/surface.cer
38+
hashfile=$(mktemp)
39+
mokutil --generate-hash=surface > "${hashfile}"
40+
mokutil --hash-file "${hashfile}" --import ${original}
1541

1642
echo "To finish the enrollment process you need to reboot, where you will then be"
1743
echo "asked to enroll the certificate. During the import, you will be prompted for"
@@ -24,23 +50,56 @@ post_install() {
2450
}
2551

2652
pre_remove() {
53+
local backup="/tmp/linux-surface-secureboot.surface.cer.backup"
54+
local original="/usr/share/linux-surface-secureboot/surface.cer"
55+
local hashfile
56+
57+
# check if efivarfs has been mounted
58+
if ! mount -l | grep --quiet "efivarfs"; then
59+
cp "${original}" "${backup}"
60+
61+
echo ""
62+
echo "The 'efivarfs' filesystem has not been mounted. Please remove the key from"
63+
echo "the UEFI key store manually."
64+
echo ""
65+
echo "You can do this by, e.g., mounting efivarfs via"
66+
echo ""
67+
echo " mount -t efivarfs none /sys/firmware/efi/efivars"
68+
echo ""
69+
echo "and running mokutil via"
70+
echo ""
71+
echo " mokutil --delete ${backup}"
72+
echo ""
73+
echo "The key will be revoked on the next start of your system. You will then"
74+
echo "be asked to confirm the key and enter the (temporary) password you chose"
75+
echo "when running the command above."
76+
echo ""
77+
echo "Note: The key has been backed up to temporary storage at"
78+
echo ""
79+
echo " ${backup}"
80+
echo ""
81+
echo "It may be gone after the next reboot."
82+
echo ""
83+
return
84+
fi
85+
2786
echo ""
2887
echo "The following secure-boot certificate will be uninstalled and revoked from"
2988
echo "your system"
3089
echo ""
31-
echo " /usr/share/linux-surface-secureboot/surface.cer"
90+
echo " ${original}"
3291
echo ""
3392

34-
local hashfile=$(mktemp)
35-
mokutil --generate-hash=surface > ${hashfile}
36-
mokutil --hash-file ${hashfile} --delete /usr/share/linux-surface-secureboot/surface.cer
93+
hashfile=$(mktemp)
94+
mokutil --generate-hash=surface > "${hashfile}"
95+
mokutil --hash-file "${hashfile}" --delete "${original}"
3796

3897
echo "The key will be revoked on the next start of your system. You will then"
39-
echo "again asked for the password. Enter 'surface' to confirm."
98+
echo "be asked again for the password. Enter 'surface' to confirm."
4099
echo ""
41-
echo "Kernels signed with the corresponding private key will still not be allowed"
42-
echo "to boot after this. Note that you can always manage your secure-boot keys"
43-
echo "via the 'mokutil' tool. Please refer to 'man mokutil' for more information."
100+
echo "Kernels signed with the corresponding private key will not be allowed to"
101+
echo "boot after this. Note that you can always manage your secure-boot keys via"
102+
echo "the 'mokutil' tool. Please refer to 'man mokutil' for more information."
44103
echo ""
45104
}
46105

@@ -54,20 +113,42 @@ pre_upgrade() {
54113
post_upgrade() {
55114
local backup="/tmp/linux-surface-secureboot.surface.cer.backup"
56115
local original="/usr/share/linux-surface-secureboot/surface.cer"
116+
local hashfile
117+
118+
if ! cmp --silent "${original}" "${backup}"; then
119+
# check if efivarfs has been mounted
120+
if ! mount -l | grep --quiet "efivarfs"; then
121+
echo "The 'efivarfs' filesystem has not been mounted. Please update the key in"
122+
echo "UEFI key store manually."
123+
echo ""
124+
echo "You can do this by, e.g., mounting efivarfs via"
125+
echo ""
126+
echo " mount -t efivarfs none /sys/firmware/efi/efivars"
127+
echo ""
128+
echo "and running mokutil via"
129+
echo ""
130+
echo " mokutil --delete ${backup}"
131+
echo " mokutil --import ${original}"
132+
echo ""
133+
echo "The key will be updated on the next start of your system. You will then"
134+
echo "be asked to confirm the key and enter the (temporary) password you chose"
135+
echo "when running the commands above."
136+
echo ""
137+
return
138+
fi
57139

58-
if ! cmp --silent "${original}" "${backup}"
59-
then
140+
# certificate has changed and needs re-enrollment
60141
echo ""
61142
echo "Updating secure boot certificate. The old key will be revoked and a new key"
62143
echo "will be installed. You will need to reboot your system, where you will then"
63144
echo "be asked to delete the old and import the new key. In both cases, make sure"
64145
echo "this is the right key and confirm with the password 'surface'."
65146
echo ""
66147

67-
local hashfile=$(mktemp)
68-
mokutil --generate-hash=surface > ${hashfile}
69-
mokutil --hash-file ${hashfile} --delete ${backup}
70-
mokutil --hash-file ${hashfile} --import ${original}
148+
hashfile=$(mktemp)
149+
mokutil --generate-hash=surface > "${hashfile}"
150+
mokutil --hash-file "${hashfile}" --delete ${backup}
151+
mokutil --hash-file "${hashfile}" --import ${original}
71152
fi
72153

73154
rm -f "${backup}"

‎debian/debian/control

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,5 @@ Build-Depends: build-essential, debhelper (>= 10)
66

77
Package: linux-surface-secureboot-mok
88
Architecture: amd64
9-
Depends: mokutil
9+
Depends: mokutil, grep
1010
Description: Secure-boot machine owner key for linux-surface kernels

‎debian/debian/postinst

Lines changed: 53 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,30 @@ set -e
44
post_upgrade() {
55
local backup="/tmp/linux-surface-secureboot.surface.cer.backup"
66
local original="/usr/share/linux-surface-secureboot/surface.cer"
7+
local hashfile
78

89
if ! cmp --silent "${original}" "${backup}"; then
10+
# check if efivarfs has been mounted
11+
if ! mount -l | grep --quiet "efivarfs"; then
12+
echo "The 'efivarfs' filesystem has not been mounted. Please update the key in"
13+
echo "UEFI key store manually."
14+
echo ""
15+
echo "You can do this by, e.g., mounting efivarfs via"
16+
echo ""
17+
echo " mount -t efivarfs none /sys/firmware/efi/efivars"
18+
echo ""
19+
echo "and running mokutil via"
20+
echo ""
21+
echo " mokutil --delete ${backup}"
22+
echo " mokutil --import ${original}"
23+
echo ""
24+
echo "The key will be updated on the next start of your system. You will then"
25+
echo "be asked to confirm the key and enter the (temporary) password you chose"
26+
echo "when running the commands above."
27+
echo ""
28+
return
29+
fi
30+
931
# certificate has changed and needs re-enrollment
1032
echo ""
1133
echo "Updating secure boot certificate. The old key will be revoked and a new key"
@@ -14,31 +36,55 @@ post_upgrade() {
1436
echo "this is the right key and confirm with the password 'surface'."
1537
echo ""
1638

17-
local hashfile=$(mktemp)
18-
mokutil --generate-hash=surface > ${hashfile}
19-
mokutil --hash-file ${hashfile} --delete ${backup}
20-
mokutil --hash-file ${hashfile} --import ${original}
39+
hashfile=$(mktemp)
40+
mokutil --generate-hash=surface > "${hashfile}"
41+
mokutil --hash-file "${hashfile}" --delete ${backup}
42+
mokutil --hash-file "${hashfile}" --import ${original}
2143
fi
2244

2345
rm -f "${backup}"
2446
}
2547

2648
post_install() {
2749
local original="/usr/share/linux-surface-secureboot/surface.cer"
50+
local hashfile
2851

2952
echo ""
3053
echo "The secure-boot certificate has been installed to"
3154
echo ""
3255
echo " ${original}"
3356
echo ""
57+
58+
# check if efivarfs has been mounted
59+
if ! mount -l | grep --quiet "efivarfs"; then
60+
echo "The 'efivarfs' filesystem has not been mounted. Please add the key to the"
61+
echo "UEFI key store manually."
62+
echo ""
63+
echo "You can do this by, e.g., mounting efivarfs via"
64+
echo ""
65+
echo " mount -t efivarfs none /sys/firmware/efi/efivars"
66+
echo ""
67+
echo "and running mokutil via"
68+
echo ""
69+
echo " mokutil --import ${original}"
70+
echo ""
71+
echo "To finish the enrollment process you then need to reboot, where you will be"
72+
echo "asked to enroll the certificate. During the import, you will be prompted for"
73+
echo "the (temporary) password you chose when asked in the commands above. Please"
74+
echo "make sure that you are indeed adding the right key and confirm by entering"
75+
echo "your chosen password."
76+
echo ""
77+
return
78+
fi
79+
3480
echo "It will now be automatically enrolled for you and guarded with the password"
3581
echo ""
3682
echo " surface"
3783
echo ""
3884

39-
local hashfile=$(mktemp)
40-
mokutil --generate-hash=surface > ${hashfile}
41-
mokutil --hash-file ${hashfile} --import ${original}
85+
hashfile=$(mktemp)
86+
mokutil --generate-hash=surface > "${hashfile}"
87+
mokutil --hash-file "${hashfile}" --import ${original}
4288

4389
echo "To finish the enrollment process you need to reboot, where you will then be"
4490
echo "asked to enroll the certificate. During the import, you will be prompted for"

‎debian/debian/prerm

Lines changed: 41 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,56 @@
22
set -e
33

44
pre_remove() {
5+
local backup="/tmp/linux-surface-secureboot.surface.cer.backup"
6+
local original="/usr/share/linux-surface-secureboot/surface.cer"
7+
local hashfile
8+
9+
# check if efivarfs has been mounted
10+
if ! mount -l | grep --quiet "efivarfs"; then
11+
cp "${original}" "${backup}"
12+
13+
echo ""
14+
echo "The 'efivarfs' filesystem has not been mounted. Please remove the key from"
15+
echo "the UEFI key store manually."
16+
echo ""
17+
echo "You can do this by, e.g., mounting efivarfs via"
18+
echo ""
19+
echo " mount -t efivarfs none /sys/firmware/efi/efivars"
20+
echo ""
21+
echo "and running mokutil via"
22+
echo ""
23+
echo " mokutil --delete ${backup}"
24+
echo ""
25+
echo "The key will be revoked on the next start of your system. You will then"
26+
echo "be asked to confirm the key and enter the (temporary) password you chose"
27+
echo "when running the command above."
28+
echo ""
29+
echo "Note: The key has been backed up to temporary storage at"
30+
echo ""
31+
echo " ${backup}"
32+
echo ""
33+
echo "It may be gone after the next reboot."
34+
echo ""
35+
return
36+
fi
37+
538
echo ""
639
echo "The following secure-boot certificate will be uninstalled and revoked from"
740
echo "your system"
841
echo ""
9-
echo " /usr/share/linux-surface-secureboot/surface.cer"
42+
echo " ${original}"
1043
echo ""
1144

12-
local hashfile=$(mktemp)
13-
mokutil --generate-hash=surface > ${hashfile}
14-
mokutil --hash-file ${hashfile} --delete /usr/share/linux-surface-secureboot/surface.cer
45+
hashfile=$(mktemp)
46+
mokutil --generate-hash=surface > "${hashfile}"
47+
mokutil --hash-file "${hashfile}" --delete "${original}"
1548

1649
echo "The key will be revoked on the next start of your system. You will then"
17-
echo "again asked for the password. Enter 'surface' to confirm."
50+
echo "be asked again for the password. Enter 'surface' to confirm."
1851
echo ""
19-
echo "Kernels signed with the corresponding private key will still not be allowed"
20-
echo "to boot after this. Note that you can always manage your secure-boot keys"
21-
echo "via the 'mokutil' tool. Please refer to 'man mokutil' for more information."
52+
echo "Kernels signed with the corresponding private key will not be allowed to"
53+
echo "boot after this. Note that you can always manage your secure-boot keys via"
54+
echo "the 'mokutil' tool. Please refer to 'man mokutil' for more information."
2255
echo ""
2356
}
2457

0 commit comments

Comments
 (0)