stub: Support global sysext/confext

Systemd-stub support loading addons, credentials, system and configuration
extensions from ESP and while addons and credentials can be both global and
per-UKI, sysext/confext are only per-UKI.

Add support for loading ESP/loader/credentials/*.{sysext,confext}.raw to
systemd-stub.

Note: for backwards compatibility reasons, per-UKI sysexts can also be
*.raw (not only *.sysext.raw) but as global extensions are new, there's
no need to bring this legacy there.

diff --git a/man/systemd-stub.xml b/man/systemd-stub.xml
index abba8834fba34ac9b05bfb2a226f5990336a0afb..dd709c2949e1661859762e3a3686c6e111697616 100644 (file)
--- a/man/systemd-stub.xml
+++ b/man/systemd-stub.xml
@@ -36,6 +36,8 @@
       <member><filename><replaceable>ESP</replaceable>/.../<replaceable>foo</replaceable>.efi.extra.d/*.confext.raw</filename></member>
       <member><filename><replaceable>ESP</replaceable>/loader/addons/*.addon.efi</filename></member>
       <member><filename><replaceable>ESP</replaceable>/loader/credentials/*.cred</filename></member>
+      <member><filename><replaceable>ESP</replaceable>/loader/extensions/*.sysext.raw</filename></member>
+      <member><filename><replaceable>ESP</replaceable>/loader/extensions/*.confext.raw</filename></member>
     </simplelist></para>
   </refsynopsisdiv>
 
@@ -202,8 +204,8 @@
       <listitem><para>Similarly, files
       <filename><replaceable>foo</replaceable>.efi.extra.d/*.sysext.raw</filename> are packed up in a
       <command>cpio</command> archive and placed in the <filename>/.extra/sysext/</filename> directory in the
-      initrd file hierarchy. This is supposed to be used to pass additional system extension images to the
-      initrd. See
+      initrd file hierarchy. This is supposed to be used to pass additional UKI-specific system extension
+      images to the initrd. See
       <citerefentry><refentrytitle>systemd-sysext</refentrytitle><manvolnum>8</manvolnum></citerefentry> for
       details on system extension images. The generated <command>cpio</command> archive containing these
       system extension images is measured into TPM PCR 13 (if a TPM is present).</para></listitem>
@@ -212,11 +214,27 @@
            compatibility reasons with old versions. But we want people to name their system extensions
            properly, hence we document the *.sysext.raw suffix only. -->
 
+      <listitem><para>Similarly, files <filename>/loader/extensions/*.sysext.raw</filename>
+      are packed up in a <command>cpio</command> archive and placed in the <filename>/.extra/global_sysext/</filename>
+      directory in the initrd file hierarchy. This is supposed to be used to pass additional global system
+      extension images to the initrd. See
+      <citerefentry><refentrytitle>systemd-sysext</refentrytitle><manvolnum>8</manvolnum></citerefentry> for
+      details on system extension images. The generated <command>cpio</command> archive containing these
+      system extension images is measured into TPM PCR 13 (if a TPM is present).</para></listitem>
+
       <listitem><para>Similarly, files
       <filename><replaceable>foo</replaceable>.efi.extra.d/*.confext.raw</filename> are packed up in a
       <command>cpio</command> archive and placed in the <filename>/.extra/confext/</filename> directory in
-      the initrd file hierarchy. This is supposed to be used to pass additional configuration extension
-      images to the initrd. See
+      the initrd file hierarchy. This is supposed to be used to pass additional UKI-specific configuration
+      extension images to the initrd. See
+      <citerefentry><refentrytitle>systemd-confext</refentrytitle><manvolnum>8</manvolnum></citerefentry> for
+      details on configuration extension images. The generated <command>cpio</command> archive containing
+      these configuration extension images is measured into TPM PCR 12 (if a TPM is present).</para></listitem>
+
+      <listitem><para>Similarly, files <filename>/loader/extensions/*.confext.raw</filename>
+      are packed up in a <command>cpio</command> archive and placed in the <filename>/.extra/global_confext/</filename>
+      directory in the initrd file hierarchy. This is supposed to be used to pass additional global configuration
+      extension images to the initrd. See
       <citerefentry><refentrytitle>systemd-confext</refentrytitle><manvolnum>8</manvolnum></citerefentry> for
       details on configuration extension images. The generated <command>cpio</command> archive containing
       these configuration extension images is measured into TPM PCR 12 (if a TPM is present).</para></listitem>
@@ -676,6 +694,16 @@
         <xi:include href="version-info.xml" xpointer="v252"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><filename>/.extra/global_sysext/*.sysext.raw</filename></term>
+        <listitem><para>Similarly, system extension image files (suffix <literal>.sysext.raw</literal>) that
+        are placed in the <filename>/loader/extensions/</filename> directory in the file system the unified
+        kernel image is placed in are copied into the <filename>/.extra/global_sysext/</filename>
+        directory in the initrd execution environment.</para>
+
+        <xi:include href="version-info.xml" xpointer="v258"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><filename>/.extra/confext/*.confext.raw</filename></term>
         <listitem><para>Configuration extension image files (suffix <literal>.confext.raw</literal>) that are
@@ -685,6 +713,16 @@
         <xi:include href="version-info.xml" xpointer="v255"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><filename>/.extra/global_confext/*.confext.raw</filename></term>
+        <listitem><para>Similarly, configuration extension image files (suffix <literal>.confext.raw</literal>)
+        that are placed in the <filename>/loader/extensions/</filename> directory in the file system the unified
+        kernel image is placed in are copied into the <filename>/.extra/global_confext/</filename>
+        directory in the initrd execution environment.</para>
+
+        <xi:include href="version-info.xml" xpointer="v258"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><filename>/.extra/tpm2-pcr-signature.json</filename></term>
         <listitem><para>The TPM2 PCR signature JSON object included in the <literal>.pcrsig</literal> PE

diff --git a/src/boot/stub.c b/src/boot/stub.c
index 301d7a1cc9f999ca6f5f106f4abb985341307ace..8354be3583f8e75066b66ab6733ebe26bd592cb1 100644 (file)
--- a/src/boot/stub.c
+++ b/src/boot/stub.c
@@ -38,7 +38,9 @@ enum {
         INITRD_CREDENTIAL = _INITRD_DYNAMIC_FIRST,
         INITRD_GLOBAL_CREDENTIAL,
         INITRD_SYSEXT,
+        INITRD_GLOBAL_SYSEXT,
         INITRD_CONFEXT,
+        INITRD_GLOBAL_CONFEXT,
         INITRD_PCRSIG,
         INITRD_PCRPKEY,
         INITRD_OSREL,
@@ -869,6 +871,19 @@ static void generate_sidecar_initrds(
                       &m) == EFI_SUCCESS)
                 combine_measured_flag(sysext_measured, m);
 
+        if (pack_cpio(loaded_image,
+                      u"\\loader\\extensions",
+                      u".sysext.raw",
+                      /* exclude_suffix= */ NULL,
+                      ".extra/global_sysext",
+                      /* dir_mode= */ 0555,
+                      /* access_mode= */ 0444,
+                      /* tpm_pcr= */ TPM2_PCR_SYSEXTS,
+                      u"Global system extension initrd",
+                      initrds + INITRD_GLOBAL_SYSEXT,
+                      &m) == EFI_SUCCESS)
+                combine_measured_flag(sysext_measured, m);
+
         if (pack_cpio(loaded_image,
                       /* dropin_dir= */ NULL,
                       u".confext.raw",
@@ -881,6 +896,19 @@ static void generate_sidecar_initrds(
                       initrds + INITRD_CONFEXT,
                       &m) == EFI_SUCCESS)
                 combine_measured_flag(confext_measured, m);
+
+        if (pack_cpio(loaded_image,
+                      u"\\loader\\extensions",
+                      u".confext.raw",
+                      /* exclude_suffix= */ NULL,
+                      ".extra/global_confext",
+                      /* dir_mode= */ 0555,
+                      /* access_mode= */ 0444,
+                      /* tpm_pcr= */ TPM2_PCR_KERNEL_CONFIG,
+                      u"Global configuration extension initrd",
+                      initrds + INITRD_GLOBAL_CONFEXT,
+                      &m) == EFI_SUCCESS)
+                combine_measured_flag(confext_measured, m);
 }
 
 static void generate_embedded_initrds(