mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 13:27:45 +00:00
Daan De Meyer
74d392ed1b
Drop the -fundamental suffix from src/fundamental/ headers in favor of names
that match their src/basic/ or src/shared/ counterparts (e.g.
macro-fundamental.h -> macro.h, assert-fundamental.h -> assert-util.h,
cleanup-fundamental.h -> cleanup-util.h). Rename src/basic/{btrfs,label}.{c,h}
to use the -util suffix to match the existing shared/btrfs-util and
shared/label-util siblings. Rename src/shared/mkdir-label.{c,h} to mkdir.{c,h}
and src/shared/tmpfile-util-label.{c,h} to tmpfile-util.{c,h} to match the
corresponding src/basic names.
This saves us from having to come up with separate names for files that do
the same thing across tiers, and it makes it easier to move stuff between
src/fundamental, src/basic and src/shared: consumers just #include "foo.h"
and pick up whichever tier their -I path resolves to first, so call sites
don't need to be updated when an API moves between layers.
Where a higher-tier wrapper exists (e.g. src/basic/macro.h wrapping
src/fundamental/macro.h), the wrapper uses an explicit "../fundamental/foo.h"
or "../basic/foo.h" relative include for the lower-tier header. We can't use
GCC's #include_next directive for this — when the wrapper is reachable both
via same-dir-as-source lookup and via -I (e.g. -Isrc/shared) for the
directory it lives in, #include_next advances by exactly one slot in libcpp's
internal directory chain and lands on the same physical directory it was
already in, never reaching the lower-tier sibling (see make_cpp_dir() in
gcc/libcpp/files.cc:1986).
To make sure the right headers are always picked up, the include directories
are reordered so that e.g. src/shared always takes priority over src/basic and
similar for the other directories.
Co-developed-by: Claude Opus 4.7 <noreply@anthropic.com>
46 lines
1.8 KiB
C
46 lines
1.8 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
#pragma once
|
|
|
|
#include "efi.h"
|
|
#include "efivars.h"
|
|
|
|
typedef enum {
|
|
ENROLL_OFF, /* no Secure Boot key enrollment whatsoever, even manual entries are not generated */
|
|
ENROLL_MANUAL, /* Secure Boot key enrollment is strictly manual: manual entries are generated and need to be selected by the user */
|
|
ENROLL_IF_SAFE, /* Automatically enroll if it is safe (if we are running inside a VM, for example). */
|
|
ENROLL_FORCE, /* Secure Boot key enrollment may be automatic if it is available but might not be safe */
|
|
_SECURE_BOOT_ENROLL_MAX,
|
|
} secure_boot_enroll;
|
|
|
|
typedef enum {
|
|
ENROLL_ACTION_REBOOT, /* Reboot the system after enrollment */
|
|
ENROLL_ACTION_SHUTDOWN, /* Shutdown the system after enrollment */
|
|
_SECURE_BOOT_ENROLL_ACTION_MAX,
|
|
} secure_boot_enroll_action;
|
|
|
|
enum {
|
|
ENROLL_TIMEOUT_HIDDEN = 0,
|
|
ENROLL_TIMEOUT_MIN = 1,
|
|
ENROLL_TIMEOUT_DEFAULT = 15,
|
|
ENROLL_TIMEOUT_MAX = UINT32_MAX,
|
|
};
|
|
|
|
bool secure_boot_enabled(void);
|
|
SecureBootMode secure_boot_mode(void);
|
|
|
|
EFI_STATUS secure_boot_enroll_at(EFI_FILE *root_dir, const char16_t *path, bool force,
|
|
secure_boot_enroll_action action, uint64_t timeout_sec);
|
|
|
|
typedef bool (*security_validator_t)(
|
|
const void *ctx,
|
|
const EFI_DEVICE_PATH *device_path,
|
|
const void *file_buffer,
|
|
size_t file_size);
|
|
|
|
void install_security_override(security_validator_t validator, const void *validator_ctx);
|
|
void uninstall_security_override(void);
|
|
bool security_override_available(void);
|
|
|
|
DECLARE_STRING_TABLE_LOOKUP_TO_STRING(secure_boot_enroll, secure_boot_enroll);
|
|
DECLARE_STRING_TABLE_LOOKUP_TO_STRING(secure_boot_enroll_action, secure_boot_enroll_action);
|