ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-04-12 21:53:03 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1272 from tlaurion/boot_ops_under_subshell

Browse Source 
/boot: make sure operations requiring to be happening under /boot are under subshells
This commit is contained in:
tlaurion 2023-01-11 16:24:26 -05:00 committed by GitHub
commit 6f6f37ec3a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
initrd/bin/kexec-save-default
View File

@ -122,7 +122,7 @@ if [ ! -d $paramsdir ]; then
fi
rm $paramsdir/kexec_default.*.txt 2>/dev/null || true
echo "$entry" > $ENTRY_FILE
cd $bootdir && kexec-boot -b "$bootdir" -e "$entry" -f | \
kexec-boot -b "$bootdir" -e "$entry" -f | \
xargs sha256sum > $HASH_FILE \
|| die "Failed to create hashes of boot files"
if [ ! -r $ENTRY_FILE -o ! -r $HASH_FILE ]; then

4
initrd/bin/kexec-select-boot
View File

@ -52,7 +52,7 @@ verify_global_hashes()
{
echo "+++ Checking verified boot hash file "
# Check the hashes of all the files
if cd $bootdir && sha256sum -c "$TMP_HASH_FILE" > /tmp/hash_output ; then
if ( cd $bootdir && sha256sum -c "$TMP_HASH_FILE" > /tmp/hash_output ); then
echo "+++ Verified boot hashes "
valid_hash='y'
valid_global_hash='y'
@ -236,7 +236,7 @@ default_select() {
# Enforce that default option hashes are valid
echo "+++ Checking verified default boot hash file "
# Check the hashes of all the files
if cd $bootdir && sha256sum -c "$TMP_DEFAULT_HASH_FILE" > /tmp/hash_output ; then
if ( cd $bootdir && sha256sum -c "$TMP_DEFAULT_HASH_FILE" > /tmp/hash_output ); then
echo "+++ Verified default boot hashes "
valid_hash='y'
else

3
initrd/bin/oem-factory-reset
View File

@ -322,9 +322,8 @@ report_integrity_measurements()
check_config /boot force
TMP_HASH_FILE="/tmp/kexec/kexec_hashes.txt"
if cd /boot && sha256sum -c "$TMP_HASH_FILE" > /tmp/hash_output ; then
if ( cd /boot && sha256sum -c "$TMP_HASH_FILE" > /tmp/hash_output ); then
HASH="OK"
cd /
else
HASH="ALTERED"
fi