Current File : //var/lib/dpkg/info/shim-signed.postinst
#! /bin/sh
set -e
# Must load the confmodule for our template to be installed correctly.
. /usr/share/debconf/confmodule
config_item ()
{
if [ -f /etc/default/grub ]; then
. /etc/default/grub || return
for x in /etc/default/grub.d/*.cfg; do
if [ -e "$x" ]; then
. "$x"
fi
done
fi
eval echo "\$$1"
}
sign_dkms_modules()
{
for kern in `dpkg -l linux-image-[0-9]\* | awk '/^ii/ { sub("linux-image-","",$2); print $2 }'`;
do
for dkms in `dkms status -k $(uname -r) | grep 'installed' | awk -F,\ '{print $1"/"$2}'`;
do
dkms uninstall -k "$kern" "$dkms" || :
if ! dkms status -k "$kern" "$dkms" | grep -q 'built$'
then
cat <<EOF
shim-signed: failed to prepare dkms module for signing; ignoring.
module: $dkms
kernel: $kern
EOF
continue
fi
mods=$(find /var/lib/dkms/${dkms}/${kern}/$(uname -m)/module/ -name "*.ko")
for mod in $mods; do
kmodsign sha512 \
/var/lib/shim-signed/mok/MOK.priv \
/var/lib/shim-signed/mok/MOK.der \
$mod
done
dkms install -k "$kern" "${dkms}"
done
done
}
case $(dpkg --print-architecture) in
amd64)
grubarch=x86_64-efi
;;
arm64)
grubarch=arm64-efi
;;
esac
case $1 in
triggered)
if [ -e /var/lib/shim-signed/mok/MOK.priv ]; then
SHIM_NOTRIGGER=y update-secureboot-policy --enroll-key
fi
;;
configure)
bootloader_id="$(config_item GRUB_DISTRIBUTOR | tr A-Z a-z | \
cut -d' ' -f1)"
case $bootloader_id in
kubuntu) bootloader_id=ubuntu ;;
esac
# Check /boot/grub to see if we previously installed to an ESP. We don't
# want to trigger the install code just by installing the package,
# normally the installer installs grub itself first.
if [ -e /boot/grub/${grubarch}/core.efi ]; then
/usr/lib/grub/grub-multi-install --target=${grubarch} --auto-nvram
if dpkg --compare-versions "$2" lt-nl "1.22~"; then
rm -f /boot/efi/EFI/ubuntu/MokManager.efi
fi
fi
# Upgrade case, capture pre-existing DKMS packages.
if dpkg --compare-versions "$2" lt-nl "1.30" \
&& [ -d /var/lib/dkms ]
then
find /var/lib/dkms -maxdepth 1 -type d -print \
| LC_ALL=C sort > /var/lib/shim-signed/dkms-list
fi
# Upgrade case, migrate all existing kernels/dkms module combinations
# to self-signed modules.
if dpkg --compare-versions "$2" lt "1.34.7" \
&& [ -d /var/lib/dkms ]
then
SHIM_NOTRIGGER=y update-secureboot-policy --new-key
sign_dkms_modules
SHIM_NOTRIGGER=y update-secureboot-policy --enroll-key
fi
;;
esac
exit 0
Mini Shell