Javier Martinez Canillas 8f73052885 efi: Use grub_is_lockdown() instead of hardcoding a disabled modules list ... Now the GRUB can check if it has been locked down and this can be used to prevent executing commands that can be utilized to circumvent the UEFI Secure Boot mechanisms. So, instead of hardcoding a list of modules that have to be disabled, prevent the usage of commands that can be dangerous. This not only allows the commands to be disabled on other platforms, but also properly separate the concerns. Since the shim_lock verifier logic should be only about preventing to run untrusted binaries and not about defining these kind of policies. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>		2021-03-02 15:54:15 +01:00
..
coreboot	coreboot: Split parts that are platform-independent.	2017-05-08 19:10:24 +02:00
pc	misc: Make grub_strtol() "end" pointers have safer const qualifiers	2020-02-28 12:41:29 +01:00
cmosdump.c	Clarify several translatable messages.	2013-12-21 01:41:16 +01:00
cmostest.c	misc: Make grub_strtol() "end" pointers have safer const qualifiers	2020-02-28 12:41:29 +01:00
cpuid.c	Support cpuid --pae.	2013-12-17 23:40:49 +01:00
rdmsr.c	misc: Make grub_strtol() "end" pointers have safer const qualifiers	2020-02-28 12:41:29 +01:00
wrmsr.c	efi: Use grub_is_lockdown() instead of hardcoding a disabled modules list	2021-03-02 15:54:15 +01:00