base: initramfs: check for secure boot

[ldts]

Using efivar --print-decimal returns an integer.

[ldts]

@ricardosalveti please could we merge this. I have noticed errors on qemu with the previous validation code. thx.

[igoropaniuk]

I think you should drop quotation marks for the first operand, same in meta-lmp-base/recipes-core/initrdscripts/initramfs-module-install-efi/init-install-efi.sh

[ldts]

it doesnt really matter in this particular case - all bash variables are strings anyway. it is safer and good practice to keep the quotes in case there are spaces and so on...

[ricardosalveti]

@ricardosalveti please could we merge this. I have noticed errors on qemu with the previous validation code. thx.

Which errors? Looks like this won't change the actual functionality of the code.

[ldts]

I added some traces for you so you can see how bash works. Notice the delimiters around the variable

if [ "${efi_secure}" != "1"] || [ "${efi_mode}" != "0" ]; then
       echo "UEFI SecureBoot not enabled (required due PCR 7) ==>  ${efi_secure} ${efi_mode}"
       echo "efi_secure=[$efi_secure]"
       echo "efi_mode=[$efi_mode]"
        exit 1
fi

This generates the following error on output even though secure boot was enabled (secure = 1, mode = 0)

UEFI SecureBoot not enabled (required due PCR 7) ==>  1  0 
efi_secure=[1 ]
efi_mode=[0 ]

basically the trailing space makes the difference.

the sooner we merge, the better :)

[igoropaniuk]

@ldts

just cross-checked on my laptop, you're right, --print-decimal actually prints a value with an additional trailing space:

# testvar=`efivar --name=8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot --print-decimal` && echo "%$testvar%"
%0 %

imo, why not to trim it with xargs for example (so it looks much more obvious what kind of an issue the commit addresses + add that information in commit message):

# testvar=`efivar --name=8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot --print-decimal | xargs` && echo "%$testvar%"
%0%

[ldts]

@ldts

imo, why not to trim it with xargs for example (so it looks much more obvious what kind of an issue the commit addresses + add that information in commit message):

# testvar=`efivar --name=8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot --print-decimal | xargs` && echo "%$testvar%"
%0%

Using standard solutions to standard problems is usually the better thing.

[MrCry0]

It seems a fix for another commit. Could you please add a "Fixed:" field?