xen/tools/security/updategrub.sh

#!/bin/sh
# *
# * updategrub
# *
# * Copyright (C) 2005 IBM Corporation
# *
# * Authors:
# * Stefan Berger <stefanb@us.ibm.com>
# *
# * This program is free software; you can redistribute it and/or
# * modify it under the terms of the GNU General Public License as
# * published by the Free Software Foundation, version 2 of the
# * License.
# *
# *
#

if [ -z "$runbash" ]; then
	runbash="1"
	export runbash
	exec sh -c "bash $0 $*"
	exit
fi


# Show usage of this program
usage ()
{
	echo "Usage: $0 <policy name> <root of xen repository>"
	echo ""
	echo "<policy name>             : The name of the policy, i.e. xen_null"
	echo "<root of xen repository>  : The root of the XEN repositrory."
	echo ""
}

# This function sets the global variable 'linux'
# to the name of the linux kernel that was compiled
# For now a pattern should do the trick
getLinuxVersion ()
{
	path=$1
	linux=""
	for f in $path/linux-*-xen0 ; do
		versionfile=$f/include/linux/version.h
		if [ -r $versionfile ]; then
			lnx=`cat $versionfile | \
			     grep UTS_RELEASE | \
			     awk '{             \
			       len=length($3);  \
			       print substr($3,2,len-2) }'`
		fi
		if [ "$lnx" != "" ]; then
			linux="[./0-9a-zA-z]*$lnx"
			return;
		fi
	done

	#Last resort.
	linux="vmlinuz-2.[45678].[0-9]*[.0-9]*-xen0$"
}

#Return where the grub.conf file is.
#I only know of one place it can be.
findGrubConf()
{
	grubconf="/boot/grub/grub.conf"
	if [ -w $grubconf ]; then
		return 1
	fi
	return 0
}


#Update the grub configuration file.
#Search for existing entries and replace the current
#policy entry with the policy passed to this script
#
#Arguments passed to this function
# 1st : the grub configuration file
# 2nd : the binary policy file name
# 3rd : the name or pattern of the linux kernel name to match
#
# The algorithm here is based on pattern matching
# and is working correctly if
# - under a title a line beginning with 'kernel' is found
#   whose following item ends with "xen.gz"
#   Example:  kernel /xen.gz dom0_mem=....
# - a module line matching the 3rd parameter is found
#
updateGrub ()
{
	grubconf=$1
	policyfile=$2
	linux=$3

	tmpfile="/tmp/new_grub.conf"

	cat $grubconf |                                \
	         awk -vpolicy=$policyfile              \
	             -vlinux=$linux '{                 \
	           if ( $1 == "title" ) {              \
	             kernelfound = 0;                  \
	             if ( policymaycome == 1 ){        \
	               printf ("\tmodule %s%s\n", path, policy);      \
	             }                                 \
	             policymaycome = 0;                \
	           }                                   \
	           else if ( $1 == "kernel" ) {        \
	             if ( match($2,"xen.gz$") ) {      \
	               path=substr($2,1,RSTART-1);     \
	               kernelfound = 1;                \
	             }                                 \
	           }                                   \
	           else if ( $1 == "module" &&         \
	                     kernelfound == 1 &&       \
	                     match($2,linux) ) {       \
	              policymaycome = 1;               \
	           }                                   \
	           else if ( $1 == "module" &&         \
	                     kernelfound == 1 &&       \
	                     policymaycome == 1 &&     \
	                     match($2,"[0-9a-zA-Z]*.bin$") ) { \
	              printf ("\tmodule %s%s\n", path, policy); \
	              policymaycome = 0;               \
	              kernelfound = 0;                 \
	              dontprint = 1;                   \
	           }                                   \
	           else if ( $1 == "" &&               \
	                     kernelfound == 1 &&       \
	                     policymaycome == 1) {     \
	              dontprint = 1;                   \
	           }                                   \
	           if (dontprint == 0) {               \
	             printf ("%s\n", $0);              \
	           }                                   \
	           dontprint = 0;                      \
	         } END {                               \
	           if ( policymaycome == 1 ) {         \
	             printf ("\tmodule %s%s\n", path, policy);  \
	           }                                   \
	         }' > $tmpfile
	if [ ! -r $tmpfile ]; then
		echo "Could not create temporary file! Aborting."
		exit -1
	fi
	mv -f $tmpfile $grubconf
}

if [ "$1" == "" -o "$2" == "" ]; then
	usage
	exit -1
fi

if [ "$1" == "-?" ]; then
	usage
	exit 0
fi

policy=$1
policyfile=$policy.bin

getLinuxVersion $2

findGrubConf
ERR=$?
if [ $ERR -eq 0 ]; then
	echo "Could not find grub.conf. Aborting."
	exit -1
fi

updateGrub $grubconf $policyfile $linux