code.delx.au - refind/blob - install.sh

   1 #!/bin/bash
   2 #
   3 # Linux/MacOS X script to install rEFInd
   4 #
   5 # Usage:
   6 #
   7 # ./install.sh [options]
   8 #
   9 # options include:
  10 #    "--esp" to install to the ESP rather than to the system's root
  11 #           filesystem. This is the default on Linux
  12 #    "--usedefault {devicefile}" to install as default
  13 #           (/EFI/BOOT/BOOTX64.EFI and similar) to the specified device
  14 #           (/dev/sdd1 or whatever) without registering with the NVRAM.
  15 #    "--root {dir}" to specify installation using the specified directory
  16 #           as the system's root
  17 #    "--alldrivers" to install all drivers along with regular files
  18 #    "--nodrivers" to suppress driver installation (default in Linux is
  19 #           driver used on /boot; --nodrivers is OS X default)
  20 #    "--shim {shimfile}" to install a shim.efi file for Secure Boot
  21 #    "--preloader" is synonymous with "--shim"
  22 #    "--localkeys" to re-sign x86-64 binaries with a locally-generated key
  23 #    "--yes" to assume a "yes" response to all prompts
  24 #
  25 # The "esp" option is valid only on Mac OS X; it causes
  26 # installation to the EFI System Partition (ESP) rather than
  27 # to the current OS X boot partition. Under Linux, this script
  28 # installs to the ESP by default.
  29 #
  30 # This program is copyright (c) 2012 by Roderick W. Smith
  31 # It is released under the terms of the GNU GPL, version 3,
  32 # a copy of which should be included in the file COPYING.txt.
  33 #
  34 # Revision history:
  35 #
  36 # 0.7.2   -- Fixed code that could be confused by use of autofs to mount the ESP
  37 # 0.7.0   -- Added support for the new Btrfs driver
  38 # 0.6.12  -- Added support for PreLoader as well as for shim
  39 # 0.6.11  -- Improvements in script's ability to handle directories with spaces
  40 #            in their names
  41 # 0.6.9   -- Install gptsync on Macs
  42 # 0.6.8   -- Bug fix: ESP scan now uses "uniq".
  43 # 0.6.6   -- Bug fix: Upgrade drivers when installed to EFI/BOOT. Also enable
  44 #            copying shim.efi and MokManager.efi over themselves.
  45 # 0.6.4   -- Copies ext2 driver rather than ext4 driver for ext2/3fs
  46 # 0.6.3   -- Support for detecting rEFInd in EFI/BOOT and EFI/Microsoft/Boot
  47 #            directories & for installing to EFI/BOOT in BIOS mode
  48 # 0.6.2-1 -- Added --yes option & tweaked key-copying for use with RPM install script
  49 # 0.6.1   -- Added --root option; minor bug fixes
  50 # 0.6.0   -- Changed --drivers to --alldrivers and added --nodrivers option;
  51 #            changed default driver installation behavior in Linux to install
  52 #            the driver needed to read /boot (if available)
  53 # 0.5.1.2 -- Fixed bug that caused failure to generate refind_linux.conf file
  54 # 0.5.1.1 -- Fixed bug that caused script failure under OS X
  55 # 0.5.1   -- Added --shim & --localkeys options & create sample refind_linux.conf
  56 #            in /boot
  57 # 0.5.0   -- Added --usedefault & --drivers options & changed "esp" option to "--esp"
  58 # 0.4.5   -- Fixed check for rEFItBlesser in OS X
  59 # 0.4.2   -- Added notice about BIOS-based OSes & made NVRAM changes in Linux smarter
  60 # 0.4.1   -- Added check for rEFItBlesser in OS X
  61 # 0.3.3.1 -- Fixed OS X 10.7 bug; also works as make target
  62 # 0.3.2.1 -- Check for presence of source files; aborts if not present
  63 # 0.3.2   -- Initial version
  64 #
  65 # Note: install.sh version numbers match those of the rEFInd package
  66 # with which they first appeared.
  67
  68 RootDir="/"
  69 TargetDir=/EFI/refind
  70 LocalKeysBase="refind_local"
  71 ShimSource="none"
  72 ShimType="none"
  73 TargetShim="default"
  74 TargetX64="refind_x64.efi"
  75 TargetIA32="refind_ia32.efi"
  76 LocalKeys=0
  77 DeleteRefindDir=0
  78 AlwaysYes=0
  79
  80 #
  81 # Functions used by both OS X and Linux....
  82 #
  83
  84 GetParams() {
  85    InstallToEspOnMac=0
  86    if [[ $OSName == "Linux" ]] ; then
  87       # Install the driver required to read /boot, if it's available
  88       InstallDrivers="boot"
  89    else
  90       InstallDrivers="none"
  91    fi
  92    while [[ $# -gt 0 ]]; do
  93       case $1 in
  94          --esp | --ESP) InstallToEspOnMac=1
  95               ;;
  96          --usedefault) TargetDir=/EFI/BOOT
  97               TargetPart="$2"
  98               TargetX64="bootx64.efi"
  99               TargetIA32="bootia32.efi"
 100               shift
 101               ;;
 102          --root) RootDir="$2"
 103               shift
 104               ;;
 105          --localkeys) LocalKeys=1
 106               ;;
 107          --shim | --preloader) ShimSource="$2"
 108               ShimType=`basename $ShimSource`
 109               shift
 110               ;;
 111          --drivers | --alldrivers) InstallDrivers="all"
 112               ;;
 113          --nodrivers) InstallDrivers="none"
 114               ;;
 115          --yes) AlwaysYes=1
 116               ;;
 117          * ) echo "Usage: $0 [--esp | --usedefault {device-file} | --root {directory} ]"
 118              echo "                  [--nodrivers | --alldrivers] [--shim {shim-filename}]"
 119              echo "                  [--localkeys] [--yes]"
 120              exit 1
 121       esac
 122       shift
 123    done
 124
 125    if [[ $InstallToEspOnMac == 1 && "$TargetDir" == '/EFI/BOOT' ]] ; then
 126       echo "You may use --esp OR --usedefault, but not both! Aborting!"
 127       exit 1
 128    fi
 129    if [[ "$RootDir" != '/' && "$TargetDir" == '/EFI/BOOT' ]] ; then
 130       echo "You may use --usedefault OR --root, but not both! Aborting!"
 131       exit 1
 132    fi
 133    if [[ "$RootDir" != '/' && $InstallToEspOnMac == 1 ]] ; then
 134       echo "You may use --root OR --esp, but not both! Aborting!"
 135       exit 1
 136    fi
 137
 138    RLConfFile="$RootDir/boot/refind_linux.conf"
 139    EtcKeysDir="$RootDir/etc/refind.d/keys"
 140 } # GetParams()
 141
 142 # Get a yes/no response from the user and place it in the YesNo variable.
 143 # If the AlwaysYes variable is set to 1, skip the user input and set "Y"
 144 # in the YesNo variable.
 145 ReadYesNo() {
 146    if [[ $AlwaysYes == 1 ]] ; then
 147       YesNo="Y"
 148       echo "Y"
 149    else
 150       read YesNo
 151    fi
 152 }
 153
 154 # Abort if the rEFInd files can't be found.
 155 # Also sets $ConfFile to point to the configuration file,
 156 # $IconsDir to point to the icons directory, and
 157 # $ShimSource to the source of the shim.efi file (if necessary).
 158 CheckForFiles() {
 159    # Note: This check is satisfied if EITHER the 32- or the 64-bit version
 160    # is found, even on the wrong platform. This is because the platform
 161    # hasn't yet been determined. This could obviously be improved, but it
 162    # would mean restructuring lots more code....
 163    if [[ ! -f "$RefindDir/refind_ia32.efi" && ! -f "$RefindDir/refind_x64.efi" ]] ; then
 164       echo "The rEFInd binary file is missing! Aborting installation!"
 165       exit 1
 166    fi
 167
 168    if [[ -f "$RefindDir/refind.conf-sample" ]] ; then
 169       ConfFile="$RefindDir/refind.conf-sample"
 170    elif [[ -f "$ThisDir/refind.conf-sample" ]] ; then
 171       ConfFile="$ThisDir/refind.conf-sample"
 172    else
 173       echo "The sample configuration file is missing! Aborting installation!"
 174       exit 1
 175    fi
 176
 177    if [[ -d "$RefindDir/icons" ]] ; then
 178       IconsDir="$RefindDir/icons"
 179    elif [[ -d "$ThisDir/icons" ]] ; then
 180       IconsDir="$ThisDir/icons"
 181    else
 182       echo "The icons directory is missing! Aborting installation!"
 183       exit 1
 184    fi
 185
 186    if [[ "$ShimSource" != "none" ]] ; then
 187       if [[ -f "$ShimSource" ]] ; then
 188          if [[ $ShimType == "shimx64.efi" || $ShimType == "shim.efi" ]] ; then
 189             TargetX64="grubx64.efi"
 190             MokManagerSource=`dirname "$ShimSource"`/MokManager.efi
 191          elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 192             TargetX64="loader.efi"
 193             MokManagerSource=`dirname "$ShimSource"`/HashTool.efi
 194          else
 195             echo "Unknown shim/PreBootloader filename: $ShimType!"
 196             echo "Known filenames are shimx64.efi, shim.efi, and PreLoader.efi. Aborting!"
 197             exit 1
 198          fi
 199       else
 200          echo "The specified shim/PreBootloader file, $ShimSource, doesn't exist!"
 201          echo "Aborting installation!"
 202          exit 1
 203       fi
 204    fi
 205 } # CheckForFiles()
 206
 207 # Helper for CopyRefindFiles; copies shim files (including MokManager, if it's
 208 # available) to target.
 209 CopyShimFiles() {
 210    cp -fb "$ShimSource" "$InstallDir/$TargetDir/$TargetShim"
 211    if [[ $? != 0 ]] ; then
 212       Problems=1
 213    fi
 214    if [[ -f "$MokManagerSource" ]] ; then
 215       cp -fb "$MokManagerSource" "$InstallDir/$TargetDir/"
 216    fi
 217    if [[ $? != 0 ]] ; then
 218       Problems=1
 219    fi
 220 } # CopyShimFiles()
 221
 222 # Copy the public keys to the installation medium
 223 CopyKeys() {
 224    if [[ $LocalKeys == 1 ]] ; then
 225       mkdir -p "$InstallDir/$TargetDir/keys/"
 226       cp "$EtcKeysDir/$LocalKeysBase.cer" "$InstallDir/$TargetDir/keys/"
 227       cp "$EtcKeysDir/$LocalKeysBase.crt" "$InstallDir/$TargetDir/keys/"
 228    fi
 229 } # CopyKeys()
 230
 231 # Copy drivers from $RefindDir/drivers_$1 to $InstallDir/$TargetDir/drivers_$1,
 232 # honoring the $InstallDrivers condition. Must be passed a suitable
 233 # architecture code (ia32 or x64).
 234 CopyDrivers() {
 235    if [[ $InstallDrivers == "all" ]] ; then
 236       mkdir -p "$InstallDir/$TargetDir/drivers_$1"
 237       cp "$ThisDir"/drivers_$1/*_$1.efi "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 238       cp "$RefindDir"/drivers_$1/*_$1.efi "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 239    elif [[ "$InstallDrivers" == "boot" && -x `which blkid` ]] ; then
 240       BootPart=`df /boot | grep dev | cut -f 1 -d " "`
 241       BootFS=`blkid -o export $BootPart 2> /dev/null | grep TYPE= | cut -f 2 -d =`
 242       DriverType=""
 243       case $BootFS in
 244          ext2 | ext3) DriverType="ext2"
 245               # Could use ext4, but that can create unwanted entries from symbolic
 246               # links in / to /boot/vmlinuz if a separate /boot partition is used.
 247               ;;
 248          ext4) DriverType="ext4"
 249               ;;
 250          reiserfs) DriverType="reiserfs"
 251               ;;
 252          btrfs) DriverType="btrfs"
 253               ;;
 254          hfsplus) DriverType="hfs"
 255               ;;
 256          *) BootFS=""
 257       esac
 258       if [[ -n $BootFS ]] ; then
 259          echo "Installing driver for $BootFS (${DriverType}_$1.efi)"
 260          mkdir -p "$InstallDir/$TargetDir/drivers_$1"
 261          cp "$ThisDir/drivers_$1/${DriverType}_$1.efi" "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 262          cp "$RefindDir/drivers_$1/${DriverType}_$1.efi" "$InstallDir/$TargetDir/drivers_$1"/ 2> /dev/null
 263       fi
 264    fi
 265 }
 266
 267 # Copy tools (currently only gptsync, and that only on Macs) to the EFI/tools
 268 # directory on the ESP. Must be passed a suitable architecture code (ia32
 269 # or x64).
 270 CopyTools() {
 271    mkdir -p $InstallDir/EFI/tools
 272    if [[ $OSName == 'Darwin' ]] ; then
 273       cp -f "$RefindDir/tools_$1/gptsync_$1.efi" "$InstallDir/EFI/tools/"
 274       if [[ -f "$InstallDir/EFI/tools/gptsync.efi" ]] ; then
 275          mv "$InstallDir/EFI/tools/gptsync.efi" "$InstallDir/EFI/tools/gptsync.efi-disabled"
 276          echo "Found old gptsync.efi; disabling it by renaming it to gptsync.efi-disabled"
 277       fi
 278    fi
 279 } # CopyTools()
 280
 281 # Copy the rEFInd files to the ESP or OS X root partition.
 282 # Sets Problems=1 if any critical commands fail.
 283 CopyRefindFiles() {
 284    mkdir -p "$InstallDir/$TargetDir"
 285    if [[ "$TargetDir" == '/EFI/BOOT' ]] ; then
 286       cp "$RefindDir/refind_ia32.efi" "$InstallDir/$TargetDir/$TargetIA32" 2> /dev/null
 287       if [[ $? != 0 ]] ; then
 288          echo "Note: IA32 (x86) binary not installed!"
 289       fi
 290       cp "$RefindDir/refind_x64.efi" "$InstallDir/$TargetDir/$TargetX64" 2> /dev/null
 291       if [[ $? != 0 ]] ; then
 292          Problems=1
 293       fi
 294       if [[ "$ShimSource" != "none" ]] ; then
 295          TargetShim="bootx64.efi"
 296          CopyShimFiles
 297       fi
 298       if [[ $InstallDrivers == "all" ]] ; then
 299          cp -r "$RefindDir"/drivers_* "$InstallDir/$TargetDir/" 2> /dev/null
 300          cp -r "$ThisDir"/drivers_* "$InstallDir/$TargetDir/" 2> /dev/null
 301       elif [[ $Upgrade == 1 ]] ; then
 302          if [[ $Platform == 'EFI64' ]] ; then
 303             CopyDrivers x64
 304             CopyTools x64
 305          else
 306             CopyDrivers ia32
 307             CopyTools ia32
 308          fi
 309       fi
 310       Refind=""
 311       CopyKeys
 312    elif [[ $Platform == 'EFI64' || $TargetDir == "/EFI/Microsoft/Boot" ]] ; then
 313       cp "$RefindDir/refind_x64.efi" "$InstallDir/$TargetDir/$TargetX64"
 314       if [[ $? != 0 ]] ; then
 315          Problems=1
 316       fi
 317       CopyDrivers x64
 318       CopyTools x64
 319       Refind="refind_x64.efi"
 320       CopyKeys
 321       if [[ "$ShimSource" != "none" ]] ; then
 322          if [[ "$TargetShim" == "default" ]] ; then
 323             TargetShim=`basename "$ShimSource"`
 324          fi
 325          CopyShimFiles
 326          Refind="$TargetShim"
 327          if [[ $LocalKeys == 0 ]] ; then
 328             echo "Storing copies of rEFInd Secure Boot public keys in $EtcKeysDir"
 329             mkdir -p "$EtcKeysDir"
 330             cp "$ThisDir/keys/refind.cer" "$EtcKeysDir" 2> /dev/null
 331             cp "$ThisDir/keys/refind.crt" "$EtcKeysDir" 2> /dev/null
 332          fi
 333       fi
 334    elif [[ $Platform == 'EFI32' ]] ; then
 335       cp "$RefindDir/refind_ia32.efi" "$InstallDir/$TargetDir/$TargetIA32"
 336       if [[ $? != 0 ]] ; then
 337          Problems=1
 338       fi
 339       CopyDrivers ia32
 340       CopyTools ia32
 341       Refind="refind_ia32.efi"
 342    else
 343       echo "Unknown platform! Aborting!"
 344       exit 1
 345    fi
 346    echo "Copied rEFInd binary files"
 347    echo ""
 348    if [[ -d "$InstallDir/$TargetDir/icons" ]] ; then
 349       rm -rf "$InstallDir/$TargetDir/icons-backup" &> /dev/null
 350       mv -f "$InstallDir/$TargetDir/icons" "$InstallDir/$TargetDir/icons-backup"
 351       echo "Notice: Backed up existing icons directory as icons-backup."
 352    fi
 353    cp -r "$IconsDir" "$InstallDir/$TargetDir"
 354    if [[ $? != 0 ]] ; then
 355       Problems=1
 356    fi
 357    mkdir -p "$InstallDir/$TargetDir/keys"
 358    cp -rf "$ThisDir"/keys/*.[cd]er "$InstallDir/$TargetDir/keys/" 2> /dev/null
 359    cp -rf "$EtcKeysDir"/*.[cd]er "$InstallDir/$TargetDir/keys/" 2> /dev/null
 360    if [[ -f "$InstallDir/$TargetDir/refind.conf" ]] ; then
 361       echo "Existing refind.conf file found; copying sample file as refind.conf-sample"
 362       echo "to avoid overwriting your customizations."
 363       echo ""
 364       cp -f "$ConfFile" "$InstallDir/$TargetDir"
 365       if [[ $? != 0 ]] ; then
 366          Problems=1
 367       fi
 368    else
 369       echo "Copying sample configuration file as refind.conf; edit this file to configure"
 370       echo "rEFInd."
 371       echo ""
 372       cp -f "$ConfFile" "$InstallDir/$TargetDir/refind.conf"
 373       if [[ $? != 0 ]] ; then
 374          Problems=1
 375       fi
 376    fi
 377    if [[ $DeleteRefindDir == 1 ]] ; then
 378       echo "Deleting the temporary directory $RefindDir"
 379       rm -r "$RefindDir"
 380    fi
 381 } # CopyRefindFiles()
 382
 383 # Mount the partition the user specified with the --usedefault option
 384 MountDefaultTarget() {
 385    InstallDir=/tmp/refind_install
 386    mkdir -p "$InstallDir"
 387    if [[ $OSName == 'Darwin' ]] ; then
 388       mount -t msdos "$TargetPart" "$InstallDir"
 389    elif [[ $OSName == 'Linux' ]] ; then
 390       mount -t vfat "$TargetPart" "$InstallDir"
 391    fi
 392    if [[ $? != 0 ]] ; then
 393       echo "Couldn't mount $TargetPart ! Aborting!"
 394       rmdir "$InstallDir"
 395       exit 1
 396    fi
 397    UnmountEsp=1
 398 } # MountDefaultTarget()
 399
 400 #
 401 # A series of OS X support functions....
 402 #
 403
 404 # Mount the ESP at /Volumes/ESP or determine its current mount
 405 # point.
 406 # Sets InstallDir to the ESP mount point
 407 # Sets UnmountEsp if we mounted it
 408 MountOSXESP() {
 409    # Identify the ESP. Note: This returns the FIRST ESP found;
 410    # if the system has multiple disks, this could be wrong!
 411    Temp=`diskutil list | grep " EFI "`
 412    Esp=/dev/`echo $Temp | cut -f 5 -d ' '`
 413    # If the ESP is mounted, use its current mount point....
 414    Temp=`df | grep "$Esp"`
 415    InstallDir=`echo $Temp | cut -f 6 -d ' '`
 416    if [[ "$InstallDir" == '' ]] ; then
 417       mkdir /Volumes/ESP &> /dev/null
 418       mount -t msdos "$Esp" /Volumes/ESP
 419       if [[ $? != 0 ]] ; then
 420          echo "Unable to mount ESP! Aborting!\n"
 421          exit 1
 422       fi
 423       UnmountEsp=1
 424       InstallDir="/Volumes/ESP"
 425    fi
 426 } # MountOSXESP()
 427
 428 # Control the OS X installation.
 429 # Sets Problems=1 if problems found during the installation.
 430 InstallOnOSX() {
 431    echo "Installing rEFInd on OS X...."
 432    if [[ "$TargetDir" == "/EFI/BOOT" ]] ; then
 433       MountDefaultTarget
 434    elif [[ "$InstallToEspOnMac" == "1" ]] ; then
 435       MountOSXESP
 436    else
 437       InstallDir="$RootDir/"
 438    fi
 439    echo "Installing rEFInd to the partition mounted at $InstallDir"
 440    Platform=`ioreg -l -p IODeviceTree | grep firmware-abi | cut -d "\"" -f 4`
 441    CopyRefindFiles
 442    if [[ $InstallToEspOnMac == "1" ]] ; then
 443       bless --mount "$InstallDir" --setBoot --file "$InstallDir/$TargetDir/$Refind"
 444    elif [[ "$TargetDir" != "/EFI/BOOT" ]] ; then
 445       bless --setBoot --folder "$InstallDir/$TargetDir" --file "$InstallDir/$TargetDir/$Refind"
 446    fi
 447    if [[ $? != 0 ]] ; then
 448       Problems=1
 449    fi
 450    if [[ -f /Library/StartupItems/rEFItBlesser || -d /Library/StartupItems/rEFItBlesser ]] ; then
 451       echo
 452       echo "/Library/StartupItems/rEFItBlesser found!"
 453       echo "This program is part of rEFIt, and will cause rEFInd to fail to work after"
 454       echo -n "its first boot. Do you want to remove rEFItBlesser (Y/N)? "
 455       ReadYesNo
 456       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 457          echo "Deleting /Library/StartupItems/rEFItBlesser..."
 458          rm -r /Library/StartupItems/rEFItBlesser
 459       else
 460          echo "Not deleting rEFItBlesser."
 461       fi
 462    fi
 463    echo
 464    echo "WARNING: If you have an Advanced Format disk, *DO NOT* attempt to check the"
 465    echo "bless status with 'bless --info', since this is known to cause disk corruption"
 466    echo "on some systems!!"
 467    echo
 468 } # InstallOnOSX()
 469
 470
 471 #
 472 # Now a series of Linux support functions....
 473 #
 474
 475 # Check for evidence that we're running in Secure Boot mode. If so, and if
 476 # appropriate options haven't been set, warn the user and offer to abort.
 477 # If we're NOT in Secure Boot mode but the user HAS specified the --shim
 478 # or --localkeys option, warn the user and offer to abort.
 479 #
 480 # FIXME: Although I checked the presence (and lack thereof) of the
 481 # /sys/firmware/efi/vars/SecureBoot* files on my Secure Boot test system
 482 # before releasing this script, I've since found that they are at least
 483 # sometimes present when Secure Boot is absent. This means that the first
 484 # test can produce false alarms. A better test is highly desirable.
 485 CheckSecureBoot() {
 486    VarFile=`ls -d /sys/firmware/efi/vars/SecureBoot* 2> /dev/null`
 487    if [[ -n "$VarFile" && "$TargetDir" != '/EFI/BOOT' && "$ShimSource" == "none" ]] ; then
 488       echo ""
 489       echo "CAUTION: Your computer appears to support Secure Boot, but you haven't"
 490       echo "specified a valid shim.efi file source. If you've disabled Secure Boot and"
 491       echo "intend to leave it disabled, this is fine; but if Secure Boot is active, the"
 492       echo "resulting installation won't boot. You can read more about this topic at"
 493       echo "http://www.rodsbooks.com/refind/secureboot.html."
 494       echo ""
 495       echo -n "Do you want to proceed with installation (Y/N)? "
 496       ReadYesNo
 497       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 498          echo "OK; continuing with the installation..."
 499       else
 500          exit 0
 501       fi
 502    fi
 503
 504    if [[ "$ShimSource" != "none" && ! -n "$VarFile" ]] ; then
 505       echo ""
 506       echo "You've specified installing using a shim.efi file, but your computer does not"
 507       echo "appear to be running in Secure Boot mode. Although installing in this way"
 508       echo "should work, it's unnecessarily complex. You may continue, but unless you"
 509       echo "plan to enable Secure Boot, you should consider stopping and omitting the"
 510       echo "--shim option. You can read more about this topic at"
 511       echo "http://www.rodsbooks.com/refind/secureboot.html."
 512       echo ""
 513       echo -n "Do you want to proceed with installation (Y/N)? "
 514       ReadYesNo
 515       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 516          echo "OK; continuing with the installation..."
 517       else
 518          exit 0
 519       fi
 520    fi
 521
 522    if [[ $LocalKeys != 0 && ! -n "$VarFile" ]] ; then
 523       echo ""
 524       echo "You've specified re-signing your rEFInd binaries with locally-generated keys,"
 525       echo "but your computer does not appear to be running in Secure Boot mode. The"
 526       echo "keys you generate will be useless unless you enable Secure Boot. You may"
 527       echo "proceed with this installation, but before you do so, you may want to read"
 528       echo "more about it at http://www.rodsbooks.com/refind/secureboot.html."
 529       echo ""
 530       echo -n "Do you want to proceed with installation (Y/N)? "
 531       ReadYesNo
 532       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 533          echo "OK; continuing with the installation..."
 534       else
 535          exit 0
 536       fi
 537    fi
 538
 539 } # CheckSecureBoot()
 540
 541 # Check for the presence of locally-generated keys from a previous installation in
 542 # $EtcKeysDir (/etc/refind.d/keys). If they're not present, generate them using
 543 # openssl.
 544 GenerateKeys() {
 545    PrivateKey="$EtcKeysDir/$LocalKeysBase.key"
 546    CertKey="$EtcKeysDir/$LocalKeysBase.crt"
 547    DerKey="$EtcKeysDir/$LocalKeysBase.cer"
 548    OpenSSL=`which openssl 2> /dev/null`
 549
 550    # Do the work only if one or more of the necessary keys is missing
 551    # TODO: Technically, we don't need the DerKey; but if it's missing and openssl
 552    # is also missing, this will fail. This could be improved.
 553    if [[ ! -f "$PrivateKey" || ! -f "$CertKey" || ! -f "$DerKey" ]] ; then
 554       echo "Generating a fresh set of local keys...."
 555       mkdir -p "$EtcKeysDir"
 556       chmod 0700 "$EtcKeysDir"
 557       if [[ ! -x "$OpenSSL" ]] ; then
 558          echo "Can't find openssl, which is required to create your private signing keys!"
 559          echo "Aborting!"
 560          exit 1
 561       fi
 562       if [[ -f "$PrivateKey" ]] ; then
 563          echo "Backing up existing $PrivateKey"
 564          cp -f "$PrivateKey" "$PrivateKey.backup" 2> /dev/null
 565       fi
 566       if [[ -f "$CertKey" ]] ; then
 567          echo "Backing up existing $CertKey"
 568          cp -f "$CertKey" "$CertKey.backup" 2> /dev/null
 569       fi
 570       if [[ -f "$DerKey" ]] ; then
 571          echo "Backing up existing $DerKey"
 572          cp -f "$DerKey" "$DerKey.backup" 2> /dev/null
 573       fi
 574       "$OpenSSL" req -new -x509 -newkey rsa:2048 -keyout "$PrivateKey" -out "$CertKey" \
 575                      -nodes -days 3650 -subj "/CN=Locally-generated rEFInd key/"
 576       "$OpenSSL" x509 -in "$CertKey" -out "$DerKey" -outform DER
 577       chmod 0600 "$PrivateKey"
 578    else
 579       echo "Using existing local keys...."
 580    fi
 581 }
 582
 583 # Sign a single binary. Requires parameters:
 584 #   $1 = source file
 585 #   $2 = destination file
 586 # Also assumes that the SBSign, PESign, UseSBSign, UsePESign, and various key variables are set
 587 # appropriately.
 588 # Aborts script on error
 589 SignOneBinary() {
 590    $SBSign --key "$PrivateKey" --cert "$CertKey" --output "$2" "$1"
 591    if [[ $? != 0 ]] ; then
 592       echo "Problem signing the binary $1! Aborting!"
 593       exit 1
 594    fi
 595 }
 596
 597 # Re-sign the x86-64 binaries with a locally-generated key, First look for appropriate
 598 # key files in $EtcKeysDir. If they're present, use them to re-sign the binaries. If
 599 # not, try to generate new keys and store them in $EtcKeysDir.
 600 ReSignBinaries() {
 601    SBSign=`which sbsign 2> /dev/null`
 602    echo "Found sbsign at $SBSign"
 603    TempDir="/tmp/refind_local"
 604    if [[ ! -x "$SBSign" ]] ; then
 605       echo "Can't find sbsign, which is required to sign rEFInd with your own keys!"
 606       echo "Aborting!"
 607       exit 1
 608    fi
 609    GenerateKeys
 610    mkdir -p "$TempDir/drivers_x64"
 611    cp "$RefindDir/refind.conf-sample $TempDir" 2> /dev/null
 612    cp "$ThisDir/refind.conf-sample $TempDir" 2> /dev/null
 613    cp "$RefindDir/refind_ia32.efi $TempDir" 2> /dev/null
 614    cp -a "$RefindDir/drivers_ia32 $TempDir" 2> /dev/null
 615    cp -a "$ThisDir/drivers_ia32 $TempDir" 2> /dev/null
 616    SignOneBinary "$RefindDir/refind_x64.efi" "$TempDir/refind_x64.efi"
 617    SaveIFS=$IFS
 618    IFS=$(echo -en "\n\b")
 619    for Driver in `ls "$RefindDir"/drivers_x64/*.efi "$ThisDir"/drivers_x64/*.efi 2> /dev/null` ; do
 620       TempName=`basename "$Driver"`
 621       SignOneBinary "$Driver" "$TempDir/drivers_x64/$TempName"
 622    done
 623    IFS=$SaveIFS
 624    RefindDir="$TempDir"
 625    DeleteRefindDir=1
 626 }
 627
 628 # Identifies the ESP's location (/boot or /boot/efi, or these locations under
 629 # the directory specified by --root); aborts if the ESP isn't mounted at
 630 # either location.
 631 # Sets InstallDir to the ESP mount point.
 632 FindLinuxESP() {
 633    EspLine=`df "$RootDir/boot/efi" 2> /dev/null | grep boot/efi`
 634    if [[ ! -n "$EspLine" ]] ; then
 635       EspLine=`df "$RootDir"/boot | grep boot`
 636    fi
 637    InstallDir=`echo $EspLine | cut -d " " -f 6`
 638    if [[ -n "$InstallDir" ]] ; then
 639       EspFilesystem=`grep "$InstallDir" /etc/mtab | uniq | grep -v autofs | cut -d " " -f 3`
 640    fi
 641    if [[ $EspFilesystem != 'vfat' ]] ; then
 642       echo "$RootDir/boot/efi doesn't seem to be on a VFAT filesystem. The ESP must be"
 643       echo "mounted at $RootDir/boot or $RootDir/boot/efi and it must be VFAT! Aborting!"
 644       exit 1
 645    fi
 646    echo "ESP was found at $InstallDir using $EspFilesystem"
 647 } # FindLinuxESP
 648
 649 # Uses efibootmgr to add an entry for rEFInd to the EFI's NVRAM.
 650 # If this fails, sets Problems=1
 651 AddBootEntry() {
 652    InstallIt="0"
 653    Efibootmgr=`which efibootmgr 2> /dev/null`
 654    if [[ "$Efibootmgr" ]] ; then
 655       InstallDisk=`grep "$InstallDir" /etc/mtab | cut -d " " -f 1 | cut -c 1-8`
 656       PartNum=`grep "$InstallDir" /etc/mtab | cut -d " " -f 1 | cut -c 9-10`
 657       EntryFilename="$TargetDir/$Refind"
 658       EfiEntryFilename=`echo ${EntryFilename//\//\\\}`
 659       EfiEntryFilename2=`echo ${EfiEntryFilename} | sed s/\\\\\\\\/\\\\\\\\\\\\\\\\/g`
 660       ExistingEntry=`"$Efibootmgr" -v | grep -i "$EfiEntryFilename2"`
 661
 662       if [[ "$ExistingEntry" ]] ; then
 663          ExistingEntryBootNum=`echo "$ExistingEntry" | cut -c 5-8`
 664          FirstBoot=`"$Efibootmgr" | grep BootOrder | cut -c 12-15`
 665          if [[ "$ExistingEntryBootNum" != "$FirstBoot" ]] ; then
 666             echo "An existing rEFInd boot entry exists, but isn't set as the default boot"
 667             echo "manager. The boot order is being adjusted to make rEFInd the default boot"
 668             echo "manager. If this is NOT what you want, you should use efibootmgr to"
 669             echo "manually adjust your EFI's boot order."
 670             "$Efibootmgr" -b $ExistingEntryBootNum -B &> /dev/null
 671             InstallIt="1"
 672          fi
 673       else
 674          InstallIt="1"
 675       fi
 676
 677       if [[ $InstallIt == "1" ]] ; then
 678          echo "Installing it!"
 679          "$Efibootmgr" -c -l "$EfiEntryFilename" -L "rEFInd Boot Manager" -d $InstallDisk -p $PartNum &> /dev/null
 680          if [[ $? != 0 ]] ; then
 681             EfibootmgrProblems=1
 682             Problems=1
 683          fi
 684       fi
 685
 686    else # efibootmgr not found
 687       EfibootmgrProblems=1
 688       Problems=1
 689    fi
 690
 691    if [[ $EfibootmgrProblems ]] ; then
 692       echo
 693       echo "ALERT: There were problems running the efibootmgr program! You may need to"
 694       echo "rename the $Refind binary to the default name (EFI/boot/bootx64.efi"
 695       echo "on x86-64 systems or EFI/boot/bootia32.efi on x86 systems) to have it run!"
 696       echo
 697    else
 698       echo "rEFInd has been set as the default boot manager."
 699    fi
 700 } # AddBootEntry()
 701
 702 # Create a minimal/sample refind_linux.conf file in /boot.
 703 GenerateRefindLinuxConf() {
 704    if [[ -f "$RLConfFile" ]] ; then
 705       echo "Existing $RLConfFile found; not overwriting."
 706    else
 707       echo "Creating $RLConfFile; edit it to adjust kernel options."
 708       if [[ -f "$RootDir/etc/default/grub" ]] ; then
 709          # We want the default options used by the distribution, stored here....
 710          source "$RootDir/etc/default/grub"
 711          echo "Setting default boot options based on $RootDir/etc/default/grub"
 712       fi
 713       RootFS=`df "$RootDir" | grep dev | cut -f 1 -d " "`
 714       StartOfDevname=`echo "$RootFS" | cut -b 1-7`
 715       if [[ "$StartOfDevname" == "/dev/sd" || "$StartOfDevName" == "/dev/hd" ]] ; then
 716          # Identify root filesystem by UUID rather than by device node, if possible
 717          Uuid=`blkid -o export "$RootFS" 2> /dev/null | grep UUID=`
 718          if [[ -n $Uuid ]] ; then
 719             RootFS="$Uuid"
 720          fi
 721       fi
 722       DefaultOptions="$GRUB_CMDLINE_LINUX $GRUB_CMDLINE_LINUX_DEFAULT"
 723       echo "\"Boot with standard options\" \"ro root=$RootFS $DefaultOptions \"" > $RLConfFile
 724       echo "\"Boot to single-user mode\"   \"ro root=$RootFS $DefaultOptions single\"" >> $RLConfFile
 725       echo "\"Boot with minimal options\"  \"ro root=$RootFS\"" >> $RLConfFile
 726    fi
 727 }
 728
 729 # Set varaibles for installation in EFI/BOOT directory
 730 SetVarsForBoot() {
 731    TargetDir="/EFI/BOOT"
 732    if [[ $ShimSource == "none" ]] ; then
 733       TargetX64="bootx64.efi"
 734       TargetIA32="bootia32.efi"
 735    else
 736       if [[ $ShimType == "shim.efi" || $ShimType == "shimx64.efi" ]] ; then
 737          TargetX64="grubx64.efi"
 738       elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 739          TargetX64="loader.efi"
 740       else
 741          echo "Unknown shim/PreBootloader type: $ShimType"
 742          echo "Aborting!"
 743          exit 1
 744       fi
 745       TargetIA32="bootia32.efi"
 746       TargetShim="bootx64.efi"
 747    fi
 748 } # SetFilenamesForBoot()
 749
 750 # Set variables for installation in EFI/Microsoft/Boot directory
 751 SetVarsForMsBoot() {
 752    TargetDir="/EFI/Microsoft/Boot"
 753    if [[ $ShimSource == "none" ]] ; then
 754       TargetX64="bootmgfw.efi"
 755    else
 756       if [[ $ShimType == "shim.efi" || $ShimType == "shimx64.efi" ]] ; then
 757          TargetX64="grubx64.efi"
 758       elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 759          TargetX64="loader.efi"
 760       else
 761          echo "Unknown shim/PreBootloader type: $ShimType"
 762          echo "Aborting!"
 763          exit 1
 764       fi
 765       TargetShim="bootmgfw.efi"
 766    fi
 767 }
 768
 769 # TargetDir defaults to /EFI/refind; however, this function adjusts it as follows:
 770 # - If an existing refind.conf is available in /EFI/BOOT or /EFI/Microsoft/Boot,
 771 #   install to that directory under the suitable name; but DO NOT do this if
 772 #   refind.conf is also in /EFI/refind.
 773 # - If booted in BIOS mode and the ESP lacks any other EFI files, install to
 774 #   /EFI/BOOT
 775 # - If booted in BIOS mode and there's no refind.conf file and there is a
 776 #   /EFI/Microsoft/Boot/bootmgfw.efi file, move it down one level and
 777 #   install under that name, "hijacking" the Windows boot loader filename
 778 DetermineTargetDir() {
 779    Upgrade=0
 780
 781    if [[ -f $InstallDir/EFI/BOOT/refind.conf ]] ; then
 782       SetVarsForBoot
 783       Upgrade=1
 784    fi
 785    if [[ -f $InstallDir/EFI/Microsoft/Boot/refind.conf ]] ; then
 786       SetVarsForMsBoot
 787       Upgrade=1
 788    fi
 789    if [[ -f $InstallDir/EFI/refind/refind.conf ]] ; then
 790       TargetDir="/EFI/refind"
 791       Upgrade=1
 792    fi
 793    if [[ $Upgrade == 1 ]] ; then
 794       echo "Found rEFInd installation in $InstallDir$TargetDir; upgrading it."
 795    fi
 796
 797    if [[ ! -d /sys/firmware/efi && $Upgrade == 0 ]] ; then     # BIOS-mode
 798       FoundEfiFiles=`find "$InstallDir/EFI/BOOT" -name "*.efi" 2> /dev/null`
 799       FoundConfFiles=`find "$InstallDir" -name "refind\.conf" 2> /dev/null`
 800       if [[ ! -n "$FoundConfFiles" && -f "$InstallDir/EFI/Microsoft/Boot/bootmgfw.efi" ]] ; then
 801          mv -n "$InstallDir/EFI/Microsoft/Boot/bootmgfw.efi" "$InstallDir/EFI/Microsoft" &> /dev/null
 802          SetVarsForMsBoot
 803          echo "Running in BIOS mode with a suspected Windows installation; moving boot loader"
 804          echo "files so as to install to $InstallDir$TargetDir."
 805       elif [[ ! -n "$FoundEfiFiles" ]] ; then  # In BIOS mode and no default loader; install as default loader
 806          SetVarsForBoot
 807          echo "Running in BIOS mode with no existing default boot loader; installing to"
 808          echo $InstallDir$TargetDir
 809       else
 810          echo "Running in BIOS mode with an existing default boot loader; backing it up and"
 811          echo "installing rEFInd in its place."
 812          if [[ -d "$InstallDir/EFI/BOOT-rEFIndBackup" ]] ; then
 813             echo ""
 814             echo "Caution: An existing backup of a default boot loader exists! If the current"
 815             echo "default boot loader and the backup are different boot loaders, the current"
 816             echo "one will become inaccessible."
 817             echo ""
 818             echo -n "Do you want to proceed with installation (Y/N)? "
 819             ReadYesNo
 820             if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 821                echo "OK; continuing with the installation..."
 822             else
 823                exit 0
 824             fi
 825          fi
 826          mv -n "$InstallDir/EFI/BOOT" "$InstallDir/EFI/BOOT-rEFIndBackup"
 827          SetVarsForBoot
 828       fi
 829    fi # BIOS-mode
 830 } # DetermineTargetDir()
 831
 832 # Controls rEFInd installation under Linux.
 833 # Sets Problems=1 if something goes wrong.
 834 InstallOnLinux() {
 835    echo "Installing rEFInd on Linux...."
 836    modprobe efivars &> /dev/null
 837    if [[ $TargetDir == "/EFI/BOOT" ]] ; then
 838       MountDefaultTarget
 839    else
 840       FindLinuxESP
 841       DetermineTargetDir
 842    fi
 843    CpuType=`uname -m`
 844    if [[ $CpuType == 'x86_64' ]] ; then
 845       Platform="EFI64"
 846    elif [[ ($CpuType == 'i386' || $CpuType == 'i486' || $CpuType == 'i586' || $CpuType == 'i686') ]] ; then
 847       Platform="EFI32"
 848       # If we're in EFI mode, do some sanity checks, and alert the user or even
 849       # abort. Not in BIOS mode, though, since that could be used on an emergency
 850       # disc to try to recover a troubled Linux installation.
 851       if [[ -d /sys/firmware/efi ]] ; then
 852          if [[ "$ShimSource" != "none" && "$TargetDir" != "/BOOT/EFI" ]] ; then
 853             echo ""
 854             echo "CAUTION: shim does not currently supports 32-bit systems, so you should not"
 855             echo "use the --shim option to install on such systems. Aborting!"
 856             echo ""
 857             exit 1
 858          fi
 859          echo
 860          echo "CAUTION: This Linux installation uses a 32-bit kernel. 32-bit EFI-based"
 861          echo "computers are VERY RARE. If you've installed a 32-bit version of Linux"
 862          echo "on a 64-bit computer, you should manually install the 64-bit version of"
 863          echo "rEFInd. If you're installing on a Mac, you should do so from OS X. If"
 864          echo "you're positive you want to continue with this installation, answer 'Y'"
 865          echo "to the following question..."
 866          echo
 867          echo -n "Are you sure you want to continue (Y/N)? "
 868          ReadYesNo
 869          if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 870             echo "OK; continuing with the installation..."
 871          else
 872             exit 0
 873          fi
 874       fi # in EFI mode
 875    else
 876       echo "Unknown CPU type '$CpuType'; aborting!"
 877       exit 1
 878    fi
 879
 880    if [[ $LocalKeys == 1 ]] ; then
 881       ReSignBinaries
 882    fi
 883
 884    CheckSecureBoot
 885    CopyRefindFiles
 886    if [[ "$TargetDir" != "/EFI/BOOT" && "$TargetDir" != "/EFI/Microsoft/Boot" ]] ; then
 887       AddBootEntry
 888       GenerateRefindLinuxConf
 889    fi
 890 } # InstallOnLinux()
 891
 892 #
 893 # The main part of the script. Sets a few environment variables,
 894 # performs a few startup checks, and then calls functions to
 895 # install under OS X or Linux, depending on the detected platform.
 896 #
 897
 898 OSName=`uname -s`
 899 GetParams "$@"
 900 ThisDir="$( cd -P "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 901 RefindDir="$ThisDir/refind"
 902 ThisScript="$ThisDir/`basename $0`"
 903 if [[ `whoami` != "root" ]] ; then
 904    echo "Not running as root; attempting to elevate privileges via sudo...."
 905    sudo "$ThisScript" "$@"
 906    if [[ $? != 0 ]] ; then
 907       echo "This script must be run as root (or using sudo). Exiting!"
 908       exit 1
 909    else
 910       exit 0
 911    fi
 912 fi
 913 CheckForFiles
 914 if [[ $OSName == 'Darwin' ]] ; then
 915    if [[ "$ShimSource" != "none" ]] ; then
 916       echo "The --shim option is not supported on OS X! Exiting!"
 917       exit 1
 918    fi
 919    if [[ "$LocalKeys" != 0 ]] ; then
 920       echo "The --localkeys option is not supported on OS X! Exiting!"
 921       exit 1
 922    fi
 923    InstallOnOSX $1
 924 elif [[ $OSName == 'Linux' ]] ; then
 925    InstallOnLinux
 926 else
 927    echo "Running on unknown OS; aborting!"
 928 fi
 929
 930 if [[ $Problems ]] ; then
 931    echo
 932    echo "ALERT:"
 933    echo "Installation has completed, but problems were detected. Review the output for"
 934    echo "error messages and take corrective measures as necessary. You may need to"
 935    echo "re-run this script or install manually before rEFInd will work."
 936    echo
 937 else
 938    echo
 939    echo "Installation has completed successfully."
 940    echo
 941 fi
 942
 943 if [[ $UnmountEsp ]] ; then
 944    echo "Unmounting install dir"
 945    umount $InstallDir
 946 fi
 947
 948 if [[ "$InstallDir" == /tmp/refind_install ]] ; then
 949 #   sleep 5
 950    rmdir "$InstallDir"
 951 fi