mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-30 04:33:00 +02:00
Joachim Wiberg
937d4c38c7
Use kernel cmdline option 'usbcore.authorized_default=2' to lock all
external/user-visible USB ports by default.
The kernel distinguishes internal vs external USB ports using ACPI
methods (_UPC and _PLD) on x86/x86_64 systems. On ACPI systems, ports
marked as non-visible but connectable are considered internal (e.g.,
hard-wired USB-to-Ethernet adapters) and are automatically authorized,
while user-visible external ports require manual authorization.
However, on device tree systems the kernel lacks a standard mechanism
for identifying internal ports. The 'authorized_default=2' setting falls
back to requiring authorization for all devices on these platforms,
We list user-accessible USB ports in the device tree ('usb-ports' and
'usb-port-names'), with unlisted ports being implicitly internal and
managed separately.
Fixes #1065
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
81 lines
2.0 KiB
INI
81 lines
2.0 KiB
INI
set timeout="1"
|
|
|
|
load_env ORDER DEBUG
|
|
|
|
if [ -z "$ORDER" ]; then
|
|
set ORDER="primary secondary"
|
|
fi
|
|
|
|
set ORDER="$ORDER reboot"
|
|
|
|
for slot in $ORDER; do
|
|
if [ -z "$default" ]; then
|
|
set default="$slot"
|
|
else
|
|
# Contrary to what the documentation says, GRUB (2.06) does
|
|
# not support using titles or IDs in the fallback variable, so
|
|
# we translate to indices.
|
|
if [ "$slot" = "primary" ]; then
|
|
set fallback="$fallback 0"
|
|
elif [ "$slot" = "secondary" ]; then
|
|
set fallback="$fallback 1"
|
|
elif [ "$slot" = "net" ]; then
|
|
set fallback="$fallback 2"
|
|
elif [ "$slot" = "reboot" ]; then
|
|
set fallback="$fallback 3"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
if [ "$DEBUG" ]; then
|
|
set log="debug"
|
|
else
|
|
set log="loglevel=4"
|
|
fi
|
|
|
|
# From board/common/rootfs/etc/partition-uuid
|
|
search -p 107ae911-a97b-4380-975c-7ce1a2dde1e0 --set primary
|
|
search -p 352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02 --set secondary
|
|
|
|
export primary
|
|
export secondary
|
|
|
|
submenu "primary" "$log" {
|
|
set slot="$1"
|
|
set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
|
|
set root="($primary)"
|
|
source /boot/grub/grub.cfg
|
|
}
|
|
|
|
submenu "secondary" "$log" {
|
|
set slot="$1"
|
|
set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2"
|
|
set root="($secondary)"
|
|
source /boot/grub/grub.cfg
|
|
}
|
|
|
|
submenu "net" "$log" {
|
|
net_dhcp
|
|
|
|
if [ "$net_efinet0_dhcp_next_server" -a "$net_efinet0_dhcp_boot_file" ]; then
|
|
set initrd=(tftp,$net_efinet0_dhcp_next_server)/$net_efinet0_dhcp_boot_file
|
|
loopback initrd $initrd
|
|
set root=(initrd)
|
|
|
|
set slot="$1"
|
|
set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 qroot=/dev/ram0 ramdisk_size=65536 $2"
|
|
source /boot/grub/grub.cfg
|
|
else
|
|
if [ -z "$net_efinet0_dhcp_next_server" ]; then
|
|
echo "No TFTP server supplied in DHCP response"
|
|
fi
|
|
if [ -z "$net_efinet0_dhcp_boot_file" ]; then
|
|
echo "No bootfile supplied in DHCP response"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
submenu "reboot" {
|
|
reboot
|
|
}
|