Check that we can boot on the current system

If SecureBoot is enabled, check that our shim binary is signed by at
least one of the certificates enrolled in firmware.

2 files changed, 56 insertions, 1 deletions

diff --git a/debian/control b/debian/control
index 07f4685..dbf5481 100644
--- a/debian/control
+++ b/debian/control
@@ -21,6 +21,7 @@ Package: shim-signed
 Architecture: amd64 arm64
 Multi-Arch: same
 Depends: ${misc:Depends},
+ mokutil,
  shim-signed-common (>= ${source:Version}),
  grub-efi-amd64-bin [amd64] | systemd-boot [amd64],
  shim-helpers-amd64-signed (>= ${helpers:Version}) [amd64],
diff --git a/debian/shim-signed.postinst b/debian/shim-signed.postinst
index d459f3a..1e5e683 100755
--- a/debian/shim-signed.postinst
+++ b/debian/shim-signed.postinst
@@ -14,7 +14,7 @@ fi
 # Select the right target architecture for grub-install
 ARCH=$(dpkg --print-architecture)
 case ${ARCH} in
-    i386|amd64)
+    amd64)
 	FW_SIZE=$(cat /sys/firmware/efi/fw_platform_size)
 	if [ "$FW_SIZE"x = "32"x ]; then
 	    GRUB_EFI_TARGET="i386-efi"
@@ -24,9 +24,23 @@ case ${ARCH} in
 	    echo "Unable to read a valid value from fw_platform_size, ABORT"
 	    exit 1
 	fi
+	EFI_ARCH="x64"
+	;;
+    i386)
+	FW_SIZE=$(cat /sys/firmware/efi/fw_platform_size)
+	if [ "$FW_SIZE"x = "32"x ]; then
+	    GRUB_EFI_TARGET="i386-efi"
+	elif [ "$FW_SIZE"x = "64"x ]; then
+	    GRUB_EFI_TARGET="x86_64-efi"
+	else
+	    echo "Unable to read a valid value from fw_platform_size, ABORT"
+	    exit 1
+	fi
+	EFI_ARCH="ia32"
 	;;
     arm64)
 	GRUB_EFI_TARGET="arm64-efi"
+	EFI_ARCH="aa64"
 	;;
     *)
 	echo "Unsupported dpkg architecture ${ARCH} in $0. ABORT"
@@ -34,6 +48,13 @@ case ${ARCH} in
 	;;
 esac
 
+SHIM="/usr/lib/shim/shim${EFI_ARCH}.efi.signed"
+SHIM_SIGS="/usr/lib/shim/shim${EFI_ARCH}.efi.signed-signatures"
+if [ ! -f "$SHIM" ]; then
+    echo "No signed shim ($SHIM) included for arch $ARCH. Exit."
+    exit 0
+fi
+
 # Pull out a config value from /etc/default/grub
 config_item ()
 {
@@ -67,6 +88,39 @@ case $1 in
 	    kubuntu) bootloader_id=ubuntu ;;
 	esac
 
+	# Check that we can safely boot this shim.
+	SAFE=n
+	SB_STATE=$(mokutil --sb-state)
+
+	# If SB is not enabled (etc.) then this shim is fine
+	case $SB_STATE in
+	    "SecureBoot disabled")
+		SAFE=y;;
+	    "EFI variables are not supported on this system")
+		SAFE=y;;
+	    "This system doesn't support Secure Boot")
+		SAFE=y;;
+	esac
+
+	if [ $SAFE = n ]; then
+	    echo "Checking shim signatures on $SHIM"
+	    # SB is enabled - we need to check that it is signed by a
+	    # key in the DB list
+	    for dbkey in $(mokutil --db | awk '/^SHA1 Fingerprint:/ {print $3}'); do
+		if grep -q "$dbkey" $SHIM_SIGS; then
+		    echo "- signed by DB key $dbkey, should boot OK"
+		    SAFE=y
+		fi
+	    done
+	fi
+
+	if [ $SAFE = n ]; then
+	    # SB is enabled but we don't have a signature that will work
+	    echo "SecureBoot is enabled and we don't have a valid signature on $SHIM"
+	    echo "ABORT - this system will not boot with this shim installed."
+	    exit 1
+	fi
+
 	# Call grub-install to make sure we're added to the ESP as
 	# needed
 	if [ "$bootloader_id" ] && \