From: Javier Martinez Canillas <javi...@redhat.com> It may be useful for scripts to determine whether the GRUB is locked down or not. Add the lockdown variable which is set to "y" when the GRUB is locked down.
Suggested-by: Dimitri John Ledkov <x...@ubuntu.com> Signed-off-by: Javier Martinez Canillas <javi...@redhat.com> Reviewed-by: Daniel Kiper <daniel.ki...@oracle.com> --- docs/grub.texi | 3 +++ grub-core/kern/lockdown.c | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/docs/grub.texi b/docs/grub.texi index fd3c78054..4c980d356 100644 --- a/docs/grub.texi +++ b/docs/grub.texi @@ -5966,6 +5966,9 @@ The GRUB can be locked down when booted on a secure boot environment, for exampl if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will be restricted and some operations/commands cannot be executed. +The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down. +Otherwise it does not exit. + @node Platform limitations @chapter Platform limitations diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c index 1e56c0b80..0bc70fd42 100644 --- a/grub-core/kern/lockdown.c +++ b/grub-core/kern/lockdown.c @@ -18,6 +18,7 @@ */ #include <grub/dl.h> +#include <grub/env.h> #include <grub/file.h> #include <grub/lockdown.h> #include <grub/verify.h> @@ -71,6 +72,9 @@ grub_lockdown (void) lockdown = GRUB_LOCKDOWN_ENABLED; grub_verifier_register (&lockdown_verifier); + + grub_env_set ("lockdown", "y"); + grub_env_export ("lockdown"); } int -- 2.11.0 _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel