openstack/ironic
Code Issues Proposed changes

Use packaged grub efi for network boot

Browse Source 
Instead of using the efi written by grub-mknetdir, use the packaged
signed binary. The core.efi generated by grub-mknetdir is not signed
so it does not help with end-to-end secure-boot.

Also, the successful run of
ironic-tempest-ipa-partition-uefi-pxe-grub2[1] demonstrates that grub
continues to boot even when the grub-mknetdir generated
grub/x86_64-efi/*.lst are missing. Avoiding using grub-mknetdir makes
for a much simpler setup of /tftpboot for grub network boot.

[1] https://zuul.opendev.org/t/openstack/build/bab62f6bf032474cb80af3cb5a999117/log/tftpd-journal.txt

Change-Id: Ide0aa416391c20371bbb8d1a18288b262872e313
This commit is contained in:
Steve Baker 2021-09-01 09:13:06 +12:00
parent 183325d464
commit fc8601cd02
1 changed files with 12 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
devstack/lib/ironic
View File

@ -618,6 +618,7 @@ IRONIC_SECURE_BOOT=${IRONIC_SECURE_BOOT:-False}
IRONIC_UEFI_BOOT_LOADER=${IRONIC_UEFI_BOOT_LOADER:-grub2}
IRONIC_GRUB2_SHIM_FILE=${IRONIC_GRUB2_SHIM_FILE:-}
IRONIC_GRUB2_FILE=${IRONIC_GRUB2_FILE:-}
IRONIC_GRUB2_NETWORK_FILE=${IRONIC_GRUB2_NETWORK_FILE:-}
IRONIC_UEFI_FILES_DIR=${IRONIC_UEFI_FILES_DIR:-/var/lib/libvirt/images}
UEFI_LOADER_PATH=$IRONIC_UEFI_FILES_DIR/OVMF_CODE.fd
UEFI_NVRAM_PATH=$IRONIC_UEFI_FILES_DIR/OVMF_VARS.fd
@ -628,7 +629,7 @@ if [[ $IRONIC_HW_ARCH == "x86_64" ]]; then
if is_ubuntu; then
install_package grub-efi-amd64-signed shim-signed
elif is_fedora; then
install_package grub2-efi
install_package grub2 grub2-efi
fi
fi
@ -642,21 +643,14 @@ if [[ "$IRONIC_BOOT_MODE" == "uefi" ]]; then
die $LINENO "Boot mode UEFI only works in Ubuntu or Fedora for now."
fi
if is_arch "x86_64"; then
if is_ubuntu; then
install_package grub-efi
elif is_fedora; then
install_package grub2 grub2-efi
fi
fi
if is_ubuntu && [[ -z $IRONIC_GRUB2_FILE ]]; then
if [[ -f /usr/lib/shim/shimx64.efi.signed ]]; then
IRONIC_GRUB2_SHIM_FILE=/usr/lib/shim/shimx64.efi.signed
else
IRONIC_GRUB2_SHIM_FILE=/usr/lib/shim/shimx64.efi
fi
IRONIC_GRUB2_SHIM_FILE=/usr/lib/shim/shimx64.efi.signed
IRONIC_GRUB2_FILE=/usr/lib/grub/x86_64-efi-signed/grubx64.efi.signed
IRONIC_GRUB2_NETWORK_FILE=/usr/lib/grub/x86_64-efi-signed/grubnetx64.efi.signed
elif is_fedora && [[ -z $IRONIC_GRUB2_FILE ]]; then
IRONIC_GRUB2_SHIM_FILE=/boot/efi/EFI/fedora/shimx64.efi
IRONIC_GRUB2_FILE=/boot/efi/EFI/fedora/grubx64.efi
IRONIC_GRUB2_NETWORK_FILE=/boot/efi/EFI/fedora/grubx64.efi
fi
if [[ "$IRONIC_IPXE_ENABLED" == "False" ]]; then
@ -2697,7 +2691,6 @@ function configure_tftpd {
if [[ "$IRONIC_IPXE_ENABLED" == "False" && \
( "$IRONIC_BOOT_MODE" == "uefi" || "$IRONIC_SECURE_BOOT" == "True" ) && \
"$IRONIC_UEFI_BOOT_LOADER" == "grub2" ]]; then
local grub_dir
echo "re ^($IRONIC_TFTPBOOT_DIR/) $IRONIC_TFTPBOOT_DIR/\2" >$IRONIC_TFTPBOOT_DIR/map-file
echo "re ^$IRONIC_TFTPBOOT_DIR/ $IRONIC_TFTPBOOT_DIR/" >>$IRONIC_TFTPBOOT_DIR/map-file
@ -2705,20 +2698,12 @@ function configure_tftpd {
echo "re ^([^/]) $IRONIC_TFTPBOOT_DIR/\1" >>$IRONIC_TFTPBOOT_DIR/map-file
sudo cp $IRONIC_GRUB2_SHIM_FILE $IRONIC_TFTPBOOT_DIR/bootx64.efi
sudo cp $IRONIC_GRUB2_NETWORK_FILE $IRONIC_TFTPBOOT_DIR/grubx64.efi
if is_fedora; then
grub_subdir="EFI/fedora"
elif is_ubuntu; then
grub_subdir="boot/grub"
fi
grub_dir=$IRONIC_TFTPBOOT_DIR/$grub_subdir
# Write a grub.cfg redirect for the ubuntu grub. The fedora grub
# will fetch the generated grub.cfg-01-<mac> directly
grub_dir=$IRONIC_TFTPBOOT_DIR/grub
mkdir -p $grub_dir
# Grub looks for numerous files when the grubnetx.efi binary is used :\
# specifically .lst files which define module lists which we can't seem
# to find on disk. That being said, the grub-mknetdir utility generates
# these files for us.
grub-mknetdir --net-directory="$IRONIC_TFTPBOOT_DIR" --subdir="$grub_subdir"
sudo cp $grub_dir/x86_64-efi/core.efi $IRONIC_TFTPBOOT_DIR/grubx64.efi
cat << EOF > $grub_dir/grub.cfg
set default=master
set timeout=1
@ -2729,8 +2714,6 @@ configfile $IRONIC_TFTPBOOT_DIR/\$net_default_mac.conf
}
EOF
chmod 644 $grub_dir/grub.cfg
iniset $IRONIC_CONF_FILE pxe uefi_pxe_config_template '$pybasedir/drivers/modules/pxe_grub_config.template'
iniset $IRONIC_CONF_FILE pxe uefi_pxe_bootfile_name "bootx64.efi"
else
echo "r ^([^/]) $IRONIC_TFTPBOOT_DIR/\1" >$IRONIC_TFTPBOOT_DIR/map-file
echo "r ^(/tftpboot/) $IRONIC_TFTPBOOT_DIR/\2" >>$IRONIC_TFTPBOOT_DIR/map-file