Skip to content

Add facts to note EFI status - #232

Merged
trevor-vaughan merged 6 commits into
simp:masterfrom
jcpunk:efivars
Sep 17, 2020
Merged

trevor-vaughan merged 6 commits into
simp:masterfrom
jcpunk:efivars

Conversation

@jcpunk

@jcpunk jcpunk commented Sep 15, 2020

Copy link
Copy Markdown
Contributor

It can be handy to see which hosts are booted into EFI and which are running secure-boot.

@trevor-vaughan trevor-vaughan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jcpunk Thanks for this! It definitely looks useful. Have a few items that it would be great to get cleaned up if possible.

If you're up for adding tests, you can find examples in spec/unit/facter. If not, that's fine, we can pick it up from there.

If you're OK with me editing this PR a bit, let me know and I would be happy to make the updates and you can re-review before submission.

Comment thread lib/facter/efi.rb Outdated
Comment thread lib/facter/secure_boot_enabled.rb Outdated
Comment thread lib/facter/secure_boot_enabled.rb Outdated
Comment thread lib/facter/secure_boot_enabled.rb Outdated
File.open(file, 'r') do | hexcode |
hexcode.read(4)
code = hexcode.read(16).unpack('H*').first.to_i
if code == 1

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can just leave this as code == 1 and remove the if/else block since that will have the same result.

If you want to make this a bit cleaner, you could use a retval-style block where you set it to false by default and then set it to code == 1 like in your #233 and #234 submissions.

@jcpunk

jcpunk commented Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

I'm perfectly happy to have you make any edits you see fit.

As you can probably tell, ruby is not my forte....

@trevor-vaughan

Copy link
Copy Markdown
Member

OK I'll do a quick hack-around and you can see if it works for you

I'm perfectly happy to have you make any edits you see fit.

As you can probably tell, ruby is not my forte....

* Namespaced under `simplib__` to match other new facts
* Changed `efi` to `simplib__efi_enabled` to match the intent of the fact
* Simplified the `secure_boot_enabled` code and added a touch of error handling
@trevor-vaughan

Copy link
Copy Markdown
Member

@jcpunk See if this does what you expect.

@jcpunk

jcpunk commented Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

That looks good to me. With the alternate names, it is probably worth getting README.md to match ;)

@jcpunk

jcpunk commented Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

I'd say this looks perfect :)

@trevor-vaughan

Copy link
Copy Markdown
Member

Great, going to throw in a quick test and we should be ready to roll

@trevor-vaughan

Copy link
Copy Markdown
Member

It looks like there are some edge cases with reading the files in /sys/firmware/efi/efivars/SecureBoot-*.

@jcpunk Do you have a reference site for the format of these files? Also, this is a loop, is stopping at the first valid match sufficient?

@jcpunk

jcpunk commented Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

I believe the first match of /sys/firmware/efi/efivars/SecureBoot-* should be sufficient. At least, all my test systems only had one that matched.

My initial attempt to read the file was based in part on:
https://github.com/lcp/mokutil/blob/master/src/mokutil.c#L1273
and some local testing.

but it looks like these[1] are probably the right place to look. I think my provided reads look to be a bit too large...

[1]
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/testing/selftests/kexec/kexec_common_lib.sh?h=v5.4.65
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/firmware/efi/libstub/secureboot.c?h=v5.4.65
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/ima_arch.c?h=v5.4.65

@trevor-vaughan

Copy link
Copy Markdown
Member

@jcpunk Ah, spot on with those refs. It looks like we need to actually check two files (for whatever reason) and I do think your reads are a bit aggressive.

Would you mind giving it a refactor based on the self-test script? Matching what the devs do should always be right (probably :-D)

See: tools/testing/selftests/kexec/kexec_common_lib.sh
@jcpunk

jcpunk commented Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

I've reworked it with a note for where the upstream tests are located.

The kernel test seems to assume there is just one /sys/firmware/efi/efivars/SecureBoot-* and /sys/firmware/efi/efivars/SetupMode-* based on the if -f tests...

@trevor-vaughan

Copy link
Copy Markdown
Member

@jcpunk Thanks! I've got a case where the SecureBoot file exists but reading from it, even as root, is hit with an 'Access Denied' error. I'll wrap the fact to make sure that it doesn't explode on read errors. I'll leave it defaulting to false because an unknown status is false-ish.

Also ensure that both files have the correct value as part of the end
result
@trevor-vaughan

Copy link
Copy Markdown
Member

@jcpunk Can you see if the latest push works for you?

@jcpunk

jcpunk commented Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

It returns the right results on my test systems.

@trevor-vaughan

Copy link
Copy Markdown
Member

Awesome! No way to stuff this through beaker that I know of so I just need to get some spec tests added and we'll be ready to roll!

* Corrected identified code issues
@trevor-vaughan

Copy link
Copy Markdown
Member

@jcpunk Just waiting for tests to finish before pushing. Thought you might want to take a look at the spec tests that were added for future reference.

@jcpunk

jcpunk commented Sep 17, 2020

Copy link
Copy Markdown
Contributor Author

:) awesome thanks!

@trevor-vaughan
trevor-vaughan merged commit 6710c51 into simp:master Sep 17, 2020
@jcpunk
jcpunk deleted the efivars branch September 17, 2020 16:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants