osresearch / safeboot

Scripts to slightly improve the security of the Linux boot process with UEFI Secure Boot and TPM support
https://safeboot.dev/
GNU General Public License v2.0
268 stars 28 forks source link

Don't die if files already in initramfs #157

Open umbernhard opened 2 years ago

umbernhard commented 2 years ago

Attempting to build safeboot-hooks into the initramfs doesn't work right now with kernels 5.10 and 5.11. It appears that this is because safeboot-hooks runs set -e, while hook-functions returns a 1 if the file already exists in the initramfs (i.e. this is probably not an error?) and error codes >1 for other errors.

Proposed solution: add a wrapper to safeboot-hooks to make idempotent copies to the initramfs and replace all calls to copy_file with it:

idempotent_copy() {
        copy_file "$1" "$2" "$3" || [ $? -eq 1 ]
}