sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-01-21 01:28:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

[build] Fail Secure Boot builds unless all files are permitted

Browse Source 
Add the Secure Boot permissibility check as a dependency for targets
built with the Secure Boot flag enabled.  Attempting to build e.g.

  make bin-x86_64-efi-sb/snponly.efi

will now fail unless all files used in the final binary are marked as
being permitted for Secure Boot.

This does not affect the standard build targets (without the "-sb"
suffix on the build directory).

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2026-01-14 16:56:38 +00:00
parent 46510f36ab
commit 1d5b1d9248
2 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Makefile.efi
View File

@@ -29,11 +29,13 @@ DRIVERS_net += snp mnp
# Rules for building EFI files # Rules for building EFI files
# #
$(BIN)/%.efi : $(BIN)/%.efi.tmp $(ELF2EFI) $(BIN)/%.efi : $(BIN)/%.efi.tmp $(ELF2EFI) \
$(if $(SECUREBOOT),$(BIN)/%.efi.secboot)
$(QM)$(ECHO) " [FINISH] $@" $(QM)$(ECHO) " [FINISH] $@"
$(Q)$(ELF2EFI) --subsystem=10 $< $@ $(Q)$(ELF2EFI) --subsystem=10 $< $@
$(BIN)/%.efidrv : $(BIN)/%.efidrv.tmp $(ELF2EFI) $(BIN)/%.efidrv : $(BIN)/%.efidrv.tmp $(ELF2EFI) \
$(if $(SECUREBOOT),$(BIN)/%.efidrv.secboot)
$(QM)$(ECHO) " [FINISH] $@" $(QM)$(ECHO) " [FINISH] $@"
$(Q)$(ELF2EFI) --subsystem=11 $< $@ $(Q)$(ELF2EFI) --subsystem=11 $< $@

8
src/Makefile.housekeeping
View File

@@ -226,10 +226,10 @@ BIN_ELEMENTS := $(subst -,$(SPACE),$(BIN))
BIN_APS := $(wordlist 2,4,$(BIN_ELEMENTS)) BIN_APS := $(wordlist 2,4,$(BIN_ELEMENTS))
ifeq ($(lastword $(BIN_APS)),sb) ifeq ($(lastword $(BIN_APS)),sb)
BIN_AP := $(wordlist 2,$(words $(BIN_APS)),discard $(BIN_APS)) BIN_AP := $(wordlist 2,$(words $(BIN_APS)),discard $(BIN_APS))
BIN_SECUREBOOT := 1 BIN_SECUREBOOT := sb
else else
BIN_AP := $(BIN_APS) BIN_AP := $(BIN_APS)
BIN_SECUREBOOT := 0 BIN_SECUREBOOT :=
endif endif
ifeq ($(BIN_AP),efi) ifeq ($(BIN_AP),efi)
BIN_ARCH := i386 BIN_ARCH := i386
@@ -259,9 +259,7 @@ platform :
@$(ECHO) $(PLATFORM) @$(ECHO) $(PLATFORM)
# Determine security flag # Determine security flag
DEFAULT_SECUREBOOT := 0 SECUREBOOT := $(BIN_SECUREBOOT)
SECUREBOOT := $(firstword $(BIN_SECUREBOOT) $(DEFAULT_SECUREBOOT))
CFLAGS += -DSECUREBOOT=$(SECUREBOOT)
secureboot : secureboot :
@$(ECHO) $(SECUREBOOT) @$(ECHO) $(SECUREBOOT)