Skip to content

Commit 6710c51

Browse files
jcpunktrevor-vaughan
jcpunk
and
trevor-vaughan
authored
Add facts to note EFI status (#232)
See: tools/testing/selftests/kexec/kexec_common_lib.sh Co-authored-by: Trevor Vaughan <[email protected]>
1 parent 77628f6 commit 6710c51

File tree

4 files changed

+202
-39
lines changed

4 files changed

+202
-39
lines changed

‎README.md

Lines changed: 41 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -65,45 +65,47 @@ See [REFERENCE.md](./REFERENCE.md) for all other reference documentation.
6565

6666
### Facts
6767

68-
* **acpid_enabled** - Return true if ACPI is available on the system
69-
* **boot_dir_uuid** - Return the UUID of the partition holding the
70-
boot directory
71-
* **cmdline** - Returns the contents of `/proc/cmdline` as a
72-
hash
73-
* **cpuinfo** - Returns the contents of `/proc/cpuinfo` as a
74-
hash
75-
* **defaultgateway** - Return the default gateway of the system
76-
* **defaultgatewayiface** - Return the default gw interface of the system
77-
* **fips_ciphers** - Returns a list of available OpenSSL ciphers
78-
* **fips_enabled** - Determine whether FIPS is enabled on this system
79-
* **fullrun** - Determine whether to do an intensive run
80-
* **gdm_version** - Return the version of GDM that is installed
81-
* **grub_version** - Return the grub version installed on the system
82-
* **init_systems** - Return a list of all init systems present on
83-
the system
84-
* **ipa** - Return a hash containing the IPA domain and
85-
server to which a host is connected
86-
* **ipv6_enabled** - Return true if IPv6 is enabled and false if not
87-
* **login_defs** - Return the contents of `/etc/login.defs` as a
88-
hash with downcased keys
89-
* **prelink** - Returns a hash containing prelink status
90-
* **reboot_required** - Returns a hash of 'name' => 'reason' entries
91-
* **root_dir_uuid** - Return the UUID of the partition holding the
92-
`/` directory
93-
* **runlevel** - Return the current system runlevel
94-
* **shmall** - Return the value of shmall from sysctl
95-
* **simplib__firewalls** - Return an array of known firewall commands that
96-
are present on the system.
97-
* **simplib__mountpoints** - Return a hash of mountpoints of particular
98-
interest to SIMP modules.
99-
* **simplib_sysctl** - Return hash of sysctl values that are relevant
100-
to SIMP
101-
* **simp_puppet_settings** - Returns a hash of all Puppet settings on a node
102-
* **tmp_mounts** - DEPRECATED - use `simplib__mountpoints`
103-
This fact provides information about `/tmp`,
104-
`/var/tmp`, and `/dev/shm` should they be present
105-
on the system
106-
* **uid_min** - Return the minimum uid allowed
68+
* **acpid_enabled** - Return true if ACPI is available on the system
69+
* **boot_dir_uuid** - Return the UUID of the partition holding the
70+
boot directory
71+
* **cmdline** - Returns the contents of `/proc/cmdline` as a
72+
hash
73+
* **cpuinfo** - Returns the contents of `/proc/cpuinfo` as a
74+
hash
75+
* **defaultgateway** - Return the default gateway of the system
76+
* **defaultgatewayiface** - Return the default gw interface of the system
77+
* **fips_ciphers** - Returns a list of available OpenSSL ciphers
78+
* **fips_enabled** - Determine whether FIPS is enabled on this system
79+
* **fullrun** - Determine whether to do an intensive run
80+
* **gdm_version** - Return the version of GDM that is installed
81+
* **grub_version** - Return the grub version installed on the system
82+
* **init_systems** - Return a list of all init systems present on
83+
the system
84+
* **ipa** - Return a hash containing the IPA domain and
85+
server to which a host is connected
86+
* **ipv6_enabled** - Return true if IPv6 is enabled and false if not
87+
* **login_defs** - Return the contents of `/etc/login.defs` as a
88+
hash with downcased keys
89+
* **prelink** - Returns a hash containing prelink status
90+
* **reboot_required** - Returns a hash of 'name' => 'reason' entries
91+
* **root_dir_uuid** - Return the UUID of the partition holding the
92+
`/` directory
93+
* **runlevel** - Return the current system runlevel
94+
* **shmall** - Return the value of shmall from sysctl
95+
* **simplib__efi_enabled** - Returns true if the system is using EFI
96+
* **simplib__secure_boot_enabled** - Returns true if the host is using uEFI Secure Boot
97+
* **simplib__firewalls** - Return an array of known firewall commands that
98+
are present on the system.
99+
* **simplib__mountpoints** - Return a hash of mountpoints of particular
100+
interest to SIMP modules.
101+
* **simplib_sysctl** - Return hash of sysctl values that are relevant
102+
to SIMP
103+
* **simp_puppet_settings** - Returns a hash of all Puppet settings on a node
104+
* **tmp_mounts** - DEPRECATED - use `simplib__mountpoints`
105+
This fact provides information about `/tmp`,
106+
`/var/tmp`, and `/dev/shm` should they be present
107+
on the system
108+
* **uid_min** - Return the minimum uid allowed
107109

108110
### Run stages
109111

‎lib/facter/simplib__efi_enabled.rb

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# _Description_
2+
#
3+
# Return true if system booted via EFI
4+
#
5+
Facter.add("simplib__efi_enabled") do
6+
confine :kernel => 'Linux'
7+
8+
setcode do
9+
File.exist?('/sys/firmware/efi')
10+
end
11+
end

‎lib/facter/simplib__secure_boot_enabled.rb

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# _Description_
2+
#
3+
# Return true if system booted via UEFI Secure Boot
4+
#
5+
Facter.add("simplib__secure_boot_enabled") do
6+
confine :kernel => 'Linux'
7+
8+
setcode do
9+
secure_boot_status = false
10+
Dir.glob('/sys/firmware/efi/efivars/SecureBoot-*').each do | file |
11+
begin
12+
File.open(file, 'r') do | hexcode |
13+
# skip leading status codes
14+
hexcode.read(4)
15+
code = hexcode.read()
16+
# If we didn't get any data, unpacking will fail
17+
secure_boot_status = (1 == code.unpack('H*').first.to_i) if code
18+
end
19+
rescue Errno::EPERM, Errno::EACCES
20+
next
21+
end
22+
23+
break if secure_boot_status
24+
end
25+
26+
setup_mode_status = false
27+
if secure_boot_status
28+
Dir.glob('/sys/firmware/efi/efivars/SetupMode-*').each do | file |
29+
begin
30+
File.open(file, 'r') do | hexcode |
31+
# skip leading status codes
32+
hexcode.read(4)
33+
code = hexcode.read()
34+
# If we didn't get any data, unpacking will fail
35+
setup_mode_status = (0 == code.unpack('H*').first.to_i) if code
36+
end
37+
rescue Errno::EPERM, Errno::EACCES
38+
next
39+
end
40+
41+
break if setup_mode_status
42+
end
43+
end
44+
45+
secure_boot_status & setup_mode_status
46+
end
47+
end

‎spec/unit/facter/simplib__secure_boot_enabled.rb

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
describe 'simplib__secure_boot_enabled' do
6+
before :each do
7+
Facter.clear
8+
Facter.stubs(:value).with(:kernel).returns('Linux')
9+
end
10+
11+
context 'without SecureBoot files in /sys/firmware/efi/efivars' do
12+
it do
13+
Dir.stubs(:glob).with('/sys/firmware/efi/efivars/SecureBoot-*').returns([])
14+
15+
expect(Facter.fact('simplib__secure_boot_enabled').value).to match(false)
16+
end
17+
end
18+
19+
context 'with a SecureBoot file in /sys/firmware/efi/efivars' do
20+
before :each do
21+
@sb_tempfile = Tempfile.new('simplib__secure_boot_enabled')
22+
@sm_tempfile = Tempfile.new('simplib__secure_boot_enabled')
23+
24+
Dir.stubs(:glob).with('/sys/firmware/efi/efivars/SecureBoot-*').returns([@sb_tempfile.path])
25+
Dir.stubs(:glob).with('/sys/firmware/efi/efivars/SetupMode-*').returns([@sm_tempfile.path])
26+
end
27+
28+
after :each do
29+
File.unlink(@sb_tempfile) if File.exist?(@sb_tempfile)
30+
File.unlink(@sm_tempfile) if File.exist?(@sm_tempfile)
31+
end
32+
33+
context 'with SecureBoot enabled' do
34+
before :each do
35+
File.open(@sb_tempfile, 'wb') do |fh|
36+
fh.write('1234')
37+
fh.write([1].pack('C'))
38+
end
39+
end
40+
41+
context 'with SetupMode disabled' do
42+
before :each do
43+
File.open(@sm_tempfile, 'w') do |fh|
44+
fh.write('1234')
45+
fh.write([0].pack('C'))
46+
end
47+
end
48+
49+
it do
50+
expect(Facter.fact('simplib__secure_boot_enabled').value).to match(true)
51+
end
52+
end
53+
54+
context 'with SetupMode enabled' do
55+
before :each do
56+
File.open(@sm_tempfile, 'w') do |fh|
57+
fh.write('1234')
58+
fh.write([1].pack('C'))
59+
end
60+
end
61+
62+
it do
63+
expect(Facter.fact('simplib__secure_boot_enabled').value).to match(false)
64+
end
65+
end
66+
end
67+
68+
context 'with SecureBoot disabled' do
69+
before :each do
70+
File.open(@sb_tempfile, 'w') do |fh|
71+
fh.write('1234')
72+
fh.write([0].pack('C'))
73+
end
74+
end
75+
76+
context 'with SetupMode disabled' do
77+
before :each do
78+
File.open(@sm_tempfile, 'w') do |fh|
79+
fh.write('1234')
80+
fh.write([0].pack('C'))
81+
end
82+
end
83+
84+
it do
85+
expect(Facter.fact('simplib__secure_boot_enabled').value).to match(false)
86+
end
87+
end
88+
89+
context 'with SetupMode enabled' do
90+
before :each do
91+
File.open(@sm_tempfile, 'w') do |fh|
92+
fh.write('1234')
93+
fh.write([1].pack('C'))
94+
end
95+
end
96+
97+
it do
98+
expect(Facter.fact('simplib__secure_boot_enabled').value).to match(false)
99+
end
100+
end
101+
end
102+
end
103+
end

0 commit comments

Comments
 (0)