X-Git-Url: http://git.grml.org/?p=grml2usb.git;a=blobdiff_plain;f=grml2usb;h=5108b9ffd852d9ae1dcb7a609b0cecbc28ed77d7;hp=e465ebe2528a12fd1a9781b21d07274877289261;hb=70c9de3d7a635e4aa12507490a77284313b2aab6;hpb=9cbb2312cb49156f1daa60e1a9f91d0516dc68e3

diff --git a/grml2usb b/grml2usb
index e465ebe..5108b9f 100755
--- a/grml2usb
+++ b/grml2usb
@@ -513,14 +513,15 @@ def install_grub(device):
             mount(device, device_mountpoint, "")
 
             logging.info("Installing grub as bootloader")
-            for opt in ["", "--force"]:
+            for opt in ["--", "--force"]:
                 set_rw(device)
                 set_rw(grub_device)
-                logging.debug("grub-install --recheck %s --no-floppy --root-directory=%s %s",
-                              opt, device_mountpoint, grub_device)
-                proc = subprocess.Popen([GRUB_INSTALL, "--recheck", opt,
+                logging.debug("%s --recheck --no-floppy --target=i386-pc --root-directory=%s %s %s",
+                              GRUB_INSTALL, device_mountpoint, opt, grub_device)
+                proc = subprocess.Popen([GRUB_INSTALL, "--recheck",
                                          "--no-floppy", "--target=i386-pc",
-                                         "--root-directory=%s" % device_mountpoint, grub_device],
+                                         "--root-directory=%s" % device_mountpoint,
+                                         opt, grub_device],
                                         stdout=file(os.devnull, "r+"))
                 proc.wait()
                 if proc.returncode == 0:
@@ -1118,6 +1119,7 @@ def copy_bootloader_files(iso_mount, target, grml_flavour):
     if efi_img:
         mkdir(target + '/boot/')
         exec_rsync(efi_img, target + '/boot/efi.img')
+        handle_secure_boot(target, efi_img)
 
     for ffile in ['f%d' % number for number in range(1, 11)]:
         search_and_copy(ffile, iso_mount, syslinux_target + ffile)
@@ -1274,6 +1276,7 @@ def handle_grub_config(grml_flavour, device, target):
     logging.debug("Updating grub configuration")
 
     grub_target = target + '/boot/grub/'
+    secureboot_target = target + '/EFI/ubuntu/'
 
     bootid_re = re.compile("bootid=[\w_-]+")
     live_media_path_re = re.compile("live-media-path=[\w_/-]+")
@@ -1288,7 +1291,7 @@ def handle_grub_config(grml_flavour, device, target):
             remove_regexes.append(re.compile(regex))
 
     shortname = get_shortname(grml_flavour)
-    for filename in glob.glob(grub_target + '*.cfg'):
+    for filename in glob.glob(grub_target + '*.cfg') + glob.glob(secureboot_target + '*.cfg'):
         for line in fileinput.input(filename, inplace=1):
             line = line.rstrip("\r\n")
             if option_re.search(line):
@@ -1508,6 +1511,51 @@ def handle_syslinux_config(grml_flavour, target):
     add_syslinux_entry("%s/additional.cfg" % syslinux_target, flavour_filename)
 
 
+def handle_secure_boot(target, efi_img):
+    """Provide secure boot support by extracting files from /boot/efi.img
+
+    @target: path where grml's main files should be copied to
+    @efi_img: path to the efi.img file that includes the files for secure boot
+    """
+
+    mkdir(target + '/efi/boot/')
+    efi_mountpoint = tempfile.mkdtemp(prefix="grml2usb", dir=os.path.abspath(options.tmpdir))
+    logging.debug("efi_mountpoint = %s" % efi_mountpoint)
+    register_tmpfile(efi_mountpoint)
+
+    try:
+        logging.debug("mount(%s, %s, ['-o', 'ro', '-t', 'vfat']" % (efi_img, efi_mountpoint))
+        mount(efi_img, efi_mountpoint, ['-o', 'ro', '-t', 'vfat'])
+    except CriticalException as error:
+        logging.critical("Fatal: %s", error)
+        sys.exit(1)
+
+    ubuntu_cfg = search_file('grub.cfg', efi_mountpoint + '/EFI/ubuntu')
+    logging.debug("ubuntu_cfg = %s" % ubuntu_cfg)
+    if not ubuntu_cfg:
+        logging.info("No /EFI/ubuntu/grub.cfg found inside EFI image, looks like Secure Boot support is missing.")
+    else:
+        mkdir(target + '/efi/ubuntu')
+        logging.debug("exec_rsync(%s, %s + '/efi/ubuntu/grub.cfg')" % (ubuntu_cfg, target))
+        exec_rsync(ubuntu_cfg, target + '/efi/ubuntu/grub.cfg')
+
+        logging.debug("exec_rsync(%s + '/EFI/BOOT/grubx64.efi', %s + '/efi/boot/grubx64.efi')'" % (efi_mountpoint, target))
+        exec_rsync(efi_mountpoint + '/EFI/BOOT/grubx64.efi', target + '/efi/boot/grubx64.efi')
+
+        # NOTE - we're overwriting /efi/boot/bootx64.efi from copy_bootloader_files here
+        logging.debug("exec_rsync(%s + '/EFI/BOOT/bootx64.efi', %s + '/efi/boot/bootx64.efi')'" % (efi_mountpoint, target))
+        exec_rsync(efi_mountpoint + '/EFI/BOOT/bootx64.efi', target + '/efi/boot/bootx64.efi')
+
+    try:
+        unmount(efi_mountpoint, "")
+        logging.debug('Unmounted %s' % efi_mountpoint)
+        os.rmdir(efi_mountpoint)
+        logging.debug('Removed directory %s' % efi_mountpoint)
+    except StandardError:
+        logging.critical('RuntimeError while umount %s' % efi_mountpoint)
+        sys.exit(1)
+
+
 def handle_bootloader_config(grml_flavour, device, target):
     """Main handler for generating bootloader's configuration