Fix setup on Secure Boot systems where cryptodisk is in use

On full-encrypted systems, including /boot, the current code omits
cryptodisk commands needed to open the drives if Secure Boot is enabled.
This prevents grub2 from reading any further configuration residing on
the encrypted disk.
This patch fixes this issue by adding the needed "cryptomount" commands in
the load.cfg file that is then copied in the EFI partition.

Bug-Debian: https://bugs.debian.org/917117
Last-Update: 2019-02-10

Patch-Name: uefi-secure-boot-cryptomount.patch

Gbp-Pq: Name uefi-secure-boot-cryptomount.patch

diff --git a/util/grub-install.c b/util/grub-install.c
index 5132d49873944a7f2fe7864be46f5facd6e7f44d..e15611cb80b277fb80c42c8feeacfb70f32a5950 100644 (file)
--- a/util/grub-install.c
+++ b/util/grub-install.c
@@ -1442,6 +1442,23 @@ main (int argc, char *argv[])
          || !have_bootdev (platform))
        {
          char *uuid = NULL;
+
+         if (uefi_secure_boot && config.is_cryptodisk_enabled)
+           {
+             if (grub_dev->disk)
+               probe_cryptodisk_uuid (grub_dev->disk);
+
+             for (curdrive = grub_drives + 1; *curdrive; curdrive++)
+               {
+                 grub_device_t dev = grub_device_open (*curdrive);
+                 if (!dev)
+                   continue;
+                 if (dev->disk)
+                   probe_cryptodisk_uuid (dev->disk);
+                 grub_device_close (dev);
+               }
+           }
+
          /*  generic method (used on coreboot and ata mod).  */
          if (!force_file_id
              && grub_fs->fs_uuid && grub_fs->fs_uuid (grub_dev, &uuid))