[pve-devel] [PATCH installer] ZFS: detect and handle secure boot

[Fabian Grünbichler]

and switch the ESP to grub if it is enabled.

Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---
 Proxmox/Install.pm | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/Proxmox/Install.pm b/Proxmox/Install.pm
index 1a4ee93..a2f35ae 100644
--- a/Proxmox/Install.pm
+++ b/Proxmox/Install.pm
@@ -15,7 +15,7 @@ use Proxmox::Install::StorageConfig;
 
 use Proxmox::Sys::Block qw(get_cached_disks wipe_disk partition_bootable_disk);
 use Proxmox::Sys::Command qw(run_command syscmd);
-use Proxmox::Sys::File qw(file_read_firstline file_write_all);
+use Proxmox::Sys::File qw(file_read_all file_read_firstline file_write_all);
 use Proxmox::UI;
 
 # TODO: move somewhere better?
@@ -570,7 +570,20 @@ my sub chroot_chmod {
 sub prepare_proxmox_boot_esp {
     my ($espdev, $targetdir) = @_;
 
-    syscmd("chroot $targetdir proxmox-boot-tool init $espdev") == 0 ||
+    my $mode = '';
+
+    # detect secure boot being enabled and switch to grub-on-ESP if it is
+    if (-d "/sys/firmware/efi") {
+	my $content = eval { file_read_all("/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c") };
+	if ($@) {
+	    warn "Failed to read secure boot state: $@\n";
+	} else {
+	    my @secureboot = unpack("CCCCC", $content);
+	    $mode = 'grub' if $secureboot[4] == 1;
+	}
+    }
+
+    syscmd("chroot $targetdir proxmox-boot-tool init $espdev $mode") == 0 ||
 	die "unable to init ESP and install proxmox-boot loader on '$espdev'\n";
 }
 
-- 
2.39.2