nixos trustedGRUB: add support for HP laptops

This commit is contained in:
Thomas Strobel 2015-12-21 20:20:29 +01:00
parent d76c26e876
commit d856841ba4
3 changed files with 56 additions and 31 deletions

View file

@ -10,8 +10,11 @@ let
realGrub = if cfg.version == 1 then pkgs.grub realGrub = if cfg.version == 1 then pkgs.grub
else if cfg.zfsSupport then pkgs.grub2.override { zfsSupport = true; } else if cfg.zfsSupport then pkgs.grub2.override { zfsSupport = true; }
else if cfg.enableTrustedBoot then pkgs.trustedGrub else if cfg.trustedBoot.enable
else pkgs.grub2; then if cfg.trustedBoot.isHPLaptop
then pkgs.trustedGrub-for-HP
else pkgs.trustedGrub
else pkgs.grub2;
grub = grub =
# Don't include GRUB if we're only generating a GRUB menu (e.g., # Don't include GRUB if we're only generating a GRUB menu (e.g.,
@ -369,24 +372,37 @@ in
''; '';
}; };
enableTrustedBoot = mkOption { trustedBoot = {
default = false;
type = types.bool; enable = mkOption {
description = '' default = false;
Enable trusted boot. GRUB will measure all critical components during type = types.bool;
the boot process to offer TCG (TPM) support. description = ''
''; Enable trusted boot. GRUB will measure all critical components during
}; the boot process to offer TCG (TPM) support.
'';
};
systemHasTPM = mkOption {
default = "";
example = "YES_TPM_is_activated";
type = types.string;
description = ''
Assertion that the target system has an activated TPM. It is a safety
check before allowing the activation of 'trustedBoot.enable'. TrustedBoot
WILL FAIL TO BOOT YOUR SYSTEM if no TPM is available.
'';
};
isHPLaptop = mkOption {
default = false;
type = types.bool;
description = ''
Use a special version of TrustedGRUB that is needed by some HP laptops
and works only for the HP laptops.
'';
};
systemHasTPM = mkOption {
default = "";
example = "YES_TPM_is_activated";
type = types.string;
description = ''
Assertion that the target system has an activated TPM. It is a safety
check before allowing the activation of 'enableTrustedBoot'. TrustedBoot
WILL FAIL TO BOOT YOUR SYSTEM if no TPM is available.
'';
}; };
}; };
@ -452,19 +468,19 @@ in
message = "You cannot have duplicated devices in mirroredBoots"; message = "You cannot have duplicated devices in mirroredBoots";
} }
{ {
assertion = !cfg.enableTrustedBoot || cfg.version == 2; assertion = !cfg.trustedBoot.enable || cfg.version == 2;
message = "Trusted GRUB is only available for GRUB 2"; message = "Trusted GRUB is only available for GRUB 2";
} }
{ {
assertion = !cfg.efiSupport || !cfg.enableTrustedBoot; assertion = !cfg.efiSupport || !cfg.trustedBoot.enable;
message = "Trusted GRUB does not have EFI support"; message = "Trusted GRUB does not have EFI support";
} }
{ {
assertion = !cfg.zfsSupport || !cfg.enableTrustedBoot; assertion = !cfg.zfsSupport || !cfg.trustedBoot.enable;
message = "Trusted GRUB does not have ZFS support"; message = "Trusted GRUB does not have ZFS support";
} }
{ {
assertion = !cfg.enableTrustedBoot || cfg.systemHasTPM == "YES_TPM_is_activated"; assertion = !cfg.trustedBoot.enable || cfg.trustedBoot.systemHasTPM == "YES_TPM_is_activated";
message = "Trusted GRUB can break the system! Confirm that the system has an activated TPM by setting 'systemHasTPM'."; message = "Trusted GRUB can break the system! Confirm that the system has an activated TPM by setting 'systemHasTPM'.";
} }
] ++ flip concatMap cfg.mirroredBoots (args: [ ] ++ flip concatMap cfg.mirroredBoots (args: [

View file

@ -1,5 +1,6 @@
{ stdenv, fetchurl, fetchgit, autogen, flex, bison, python, autoconf, automake { stdenv, fetchurl, fetchgit, autogen, flex, bison, python, autoconf, automake
, gettext, ncurses, libusb, freetype, qemu, devicemapper , gettext, ncurses, libusb, freetype, qemu, devicemapper
, for_HP_laptop ? false
}: }:
with stdenv.lib; with stdenv.lib;
@ -11,7 +12,7 @@ let
inPCSystems = any (system: stdenv.system == system) (mapAttrsToList (name: _: name) pcSystems); inPCSystems = any (system: stdenv.system == system) (mapAttrsToList (name: _: name) pcSystems);
version = "1.2.1"; version = if for_HP_laptop then "1.2.1" else "1.2.0";
unifont_bdf = fetchurl { unifont_bdf = fetchurl {
url = "http://unifoundry.com/unifont-5.1.20080820.bdf.gz"; url = "http://unifoundry.com/unifont-5.1.20080820.bdf.gz";
@ -25,16 +26,22 @@ let
}; };
in ( in
stdenv.mkDerivation rec { stdenv.mkDerivation rec {
name = "trustedGRUB2-${version}"; name = "trustedGRUB2-${version}";
src = fetchgit { src = if for_HP_laptop
url = "https://github.com/Sirrix-AG/TrustedGRUB2"; then fetchgit {
rev = "ab483d389bda3115ca0ae4202fd71f2e4a31ad41"; url = "https://github.com/Sirrix-AG/TrustedGRUB2";
sha256 = "4b715837f8632278720d8b29aec06332f5302c6ba78183ced5f48d3c376d89c0"; rev = "ab483d389bda3115ca0ae4202fd71f2e4a31ad41";
}; sha256 = "4b715837f8632278720d8b29aec06332f5302c6ba78183ced5f48d3c376d89c0";
}
else fetchgit {
url = "https://github.com/Sirrix-AG/TrustedGRUB2";
rev = "1ff54a5fbe02ea01df5a7de59b1e0201e08d4f76";
sha256 = "8c17bd7e14dd96ae9c4e98723f4e18ec6b21d45ac486ecf771447649829d0b34";
};
nativeBuildInputs = [ autogen flex bison python autoconf automake ]; nativeBuildInputs = [ autogen flex bison python autoconf automake ];
buildInputs = [ ncurses libusb freetype gettext devicemapper ] buildInputs = [ ncurses libusb freetype gettext devicemapper ]
@ -89,4 +96,4 @@ stdenv.mkDerivation rec {
license = licenses.gpl3Plus; license = licenses.gpl3Plus;
platforms = platforms.gnu; platforms = platforms.gnu;
}; };
}) }

View file

@ -1741,6 +1741,8 @@ let
trustedGrub = callPackage_i686 ../tools/misc/grub/trusted.nix { }; trustedGrub = callPackage_i686 ../tools/misc/grub/trusted.nix { };
trustedGrub-for-HP = callPackage_i686 ../tools/misc/grub/trusted.nix { for_HP_laptop = true; };
grub2 = grub2_full; grub2 = grub2_full;
grub2_full = callPackage ../tools/misc/grub/2.0x.nix { }; grub2_full = callPackage ../tools/misc/grub/2.0x.nix { };