Javier Martinez Canillas 8f73052885 efi: Use grub_is_lockdown() instead of hardcoding a disabled modules list ... Now the GRUB can check if it has been locked down and this can be used to prevent executing commands that can be utilized to circumvent the UEFI Secure Boot mechanisms. So, instead of hardcoding a list of modules that have to be disabled, prevent the usage of commands that can be dangerous. This not only allows the commands to be disabled on other platforms, but also properly separate the concerns. Since the shim_lock verifier logic should be only about preventing to run untrusted binaries and not about defining these kind of policies. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>		2021-03-02 15:54:15 +01:00
..
acpi.c	tsc: Use alternative delay sources whenever appropriate.	2015-11-27 11:39:55 +01:00
efi.c	efi: Add a function to read EFI variables with attributes	2020-12-11 13:55:31 +01:00
fdt.c	efi: Move fdt helper into own file	2016-11-24 10:09:24 +01:00
init.c	efi: Lockdown the GRUB when the UEFI Secure Boot is enabled	2021-03-02 15:54:15 +01:00
mm.c	efi: Print error messages to grub_efi_allocate_pages_real()	2020-03-10 21:41:16 +01:00
sb.c	efi: Use grub_is_lockdown() instead of hardcoding a disabled modules list	2021-03-02 15:54:15 +01:00