Add support for GPG signature enforcement on booted

[petitboot] / discover / grub2 / builtins.c

diff --git a/discover/grub2/builtins.c b/discover/grub2/builtins.c
index c218bc7d07155bd6426d630f26bf623f0bcb4bb6..c16b6390225aa403820d65d6dd26841282f51407 100644 (file)
--- a/discover/grub2/builtins.c
+++ b/discover/grub2/builtins.c
@@ -5,8 +5,11 @@
 #include <log/log.h>
 #include <types/types.h>
 #include <talloc/talloc.h>
-#include <array-size/array-size.h>
+#include <util/util.h>
+#include <url/url.h>
 
+#include "discover/resource.h"
+#include "discover/parser.h"
 #include "grub2.h"
 
 
@@ -68,6 +71,12 @@ static int builtin_linux(struct grub2_script *script,
                opt->option->boot_args = talloc_asprintf_append(
                                                opt->option->boot_args,
                                                " %s", argv[i]);
+
+       char* args_sigfile_default = talloc_asprintf(opt,
+               "%s.cmdline.sig", argv[1]);
+       opt->args_sig_file = create_grub2_resource(opt, script->ctx->device,
+                                               root, args_sigfile_default);
+       talloc_free(args_sigfile_default);
        return 0;
 }
 
@@ -123,7 +132,62 @@ static int builtin_search(struct grub2_script *script,
        return 0;
 }
 
-static bool builtin_test_op(int argc, char **argv, int *consumed)
+/* Note that GRUB does not follow symlinks in evaluating all file
+ * tests but -s, unlike below. However, it seems like a bad idea to
+ * emulate GRUB's behavior (e.g., it would take extra work), so we
+ * implement the behavior that coreutils' test binary has. */
+static bool builtin_test_op_file(struct grub2_script *script, char op,
+               const char *file)
+{
+       bool result;
+       int rc;
+       struct stat statbuf;
+
+       rc = parser_stat_path(script->ctx, script->ctx->device,
+                       file, &statbuf);
+       if (rc)
+               return false;
+
+       switch (op) {
+       case 's':
+               /* -s: return true if file exists and has non-zero size */
+               result = statbuf.st_size > 0;
+               break;
+       case 'f':
+               /* -f: return true if file exists and is not a directory. This is
+                * different than the behavior of "test", but is what GRUB does
+                * (though note as above that we follow symlinks unlike GRUB). */
+               result = !S_ISDIR(statbuf.st_mode);
+               break;
+       default:
+               result = false;
+
+       }
+
+       return result;
+}
+
+/* See comment at builtin_test_op_file for differences between how
+ * GRUB implements file tests versus Petitboot's GRUB parser. */
+static bool builtin_test_op_dir(struct grub2_script *script, char op,
+               const char *dir)
+{
+       int rc;
+       struct stat statbuf;
+
+       if (op != 'd')
+               return false;
+
+       rc = parser_stat_path(script->ctx, script->ctx->device, dir, &statbuf);
+       if (rc) {
+               return false;
+       }
+
+       return S_ISDIR(statbuf.st_mode);
+}
+
+static bool builtin_test_op(struct grub2_script *script,
+               int argc, char **argv, int *consumed)
 {
        char *op;
 
@@ -171,10 +235,14 @@ static bool builtin_test_op(int argc, char **argv, int *consumed)
                        return strlen(a1) != 0;
                }
 
-               /* todo: implement file checks */
                if (!strcmp(op, "-s") || !strcmp(op, "-f")) {
                        *consumed = 2;
-                       return false;
+                       return builtin_test_op_file(script, op[1], a1);
+               }
+
+               if (!strcmp(op, "-d")) {
+                       *consumed = 2;
+                       return builtin_test_op_dir(script, op[1], a1);
                }
        }
 
@@ -183,7 +251,7 @@ static bool builtin_test_op(int argc, char **argv, int *consumed)
        return strlen(op) > 0;
 }
 
-static int builtin_test(struct grub2_script *script __attribute__((unused)),
+static int builtin_test(struct grub2_script *script,
                void *data __attribute__((unused)),
                int argc, char *argv[])
 {
@@ -222,7 +290,7 @@ static int builtin_test(struct grub2_script *script __attribute__((unused)),
                        continue;
                }
 
-               rc = builtin_test_op(argc, argv, &consumed);
+               rc = builtin_test_op(script, argc, argv, &consumed);
                if (not) {
                        rc = !rc;
                        not = false;