summaryrefslogtreecommitdiff
path: root/debian/source_shim-signed.py
blob: d03504f31d17d005153cb13d8c2eb977a3152e45 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
'''apport package hook for shim and shim-signed

(c) 2015 Canonical Ltd.
Author: Brian Murray <brian@ubuntu.com>
'''

import errno
import os

from apport.hookutils import (
    command_available,
    command_output,
    attach_file,
    attach_root_command_outputs)

efiarch = {'amd64': 'x64',
           'i386': 'ia32',
           'arm64': 'aarch64'
          }
grubarch = {'amd64': 'x86_64',
            'i386': 'i386',
            'arm64': 'arm64'
           }

def add_info(report, ui):
    efiboot = '/boot/efi/EFI/ubuntu'
    if command_available('efibootmgr'):
        report['EFIBootMgr'] = command_output(['efibootmgr', '-v'])
    else:
        report['EFIBootMgr'] = 'efibootmgr not available'
    commands = {}
    try:
        directory = os.stat(efiboot)
    except OSError as e:
        if e.errno == errno.ENOENT:
            report['Missing'] = '/boot/efi/EFI/ubuntu directory is missing'
            return
        if e.errno == errno.EACCES:
            directory= True
    if directory:
        arch = report['Architecture']
        commands['BootEFIContents'] = 'ls %s' % efiboot
        commands['ShimDiff'] = 'diff %s/shim%s.efi /usr/lib/shim/shim%s.efi.signed' % (efiboot, efiarch[arch], efiarch[arch])
        commands['GrubDiff'] = 'diff %s/grub%s.efi /usr/lib/grub/%s-efi-signed/grub%s.efi.signed' %(efiboot, efiarch[arch], grubarch[arch], efiarch[arch])
        attach_root_command_outputs(report, commands)

    efivars_dir = '/sys/firmware/efi/efivars'
    sb_var = os.path.join(efivars_dir,
                          'SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c')
    mok_var = os.path.join(efivars_dir,
                           'MokSBStateRT-605dab50-e046-4300-abb6-3dd810dd8b23')

    attach_file(report, '/proc/sys/kernel/moksbstate_disabled')
    attach_file(report, sb_var)
    attach_file(report, mok_var)