code.delx.au - refind/blob - install.sh

   1 #!/bin/bash
   2 #
   3 # Linux/MacOS X script to install rEFInd
   4 #
   5 # Usage:
   6 #
   7 # ./install.sh [options]
   8 #
   9 # options include:
  10 #    "--esp" to install to the ESP rather than to the system's root
  11 #           filesystem. This is the default on Linux
  12 #    "--usedefault {devicefile}" to install as default
  13 #           (/EFI/BOOT/BOOTX64.EFI and similar) to the specified device
  14 #           (/dev/sdd1 or whatever) without registering with the NVRAM.
  15 #    "--root {dir}" to specify installation using the specified directory
  16 #           as the system's root
  17 #    "--alldrivers" to install all drivers along with regular files
  18 #    "--nodrivers" to suppress driver installation (default in Linux is
  19 #           driver used on /boot; --nodrivers is OS X default)
  20 #    "--shim {shimfile}" to install a shim.efi file for Secure Boot
  21 #    "--preloader" is synonymous with "--shim"
  22 #    "--localkeys" to re-sign x86-64 binaries with a locally-generated key
  23 #    "--yes" to assume a "yes" response to all prompts
  24 #
  25 # The "esp" option is valid only on Mac OS X; it causes
  26 # installation to the EFI System Partition (ESP) rather than
  27 # to the current OS X boot partition. Under Linux, this script
  28 # installs to the ESP by default.
  29 #
  30 # This program is copyright (c) 2012 by Roderick W. Smith
  31 # It is released under the terms of the GNU GPL, version 3,
  32 # a copy of which should be included in the file COPYING.txt.
  33 #
  34 # Revision history:
  35 #
  36 # 0.7.5   -- Fixed bug when installing to ESP on recent versions of OS X
  37 # 0.7.2   -- Fixed code that could be confused by use of autofs to mount the ESP
  38 # 0.7.0   -- Added support for the new Btrfs driver
  39 # 0.6.12  -- Added support for PreLoader as well as for shim
  40 # 0.6.11  -- Improvements in script's ability to handle directories with spaces
  41 #            in their names
  42 # 0.6.9   -- Install gptsync on Macs
  43 # 0.6.8   -- Bug fix: ESP scan now uses "uniq".
  44 # 0.6.6   -- Bug fix: Upgrade drivers when installed to EFI/BOOT. Also enable
  45 #            copying shim.efi and MokManager.efi over themselves.
  46 # 0.6.4   -- Copies ext2 driver rather than ext4 driver for ext2/3fs
  47 # 0.6.3   -- Support for detecting rEFInd in EFI/BOOT and EFI/Microsoft/Boot
  48 #            directories & for installing to EFI/BOOT in BIOS mode
  49 # 0.6.2-1 -- Added --yes option & tweaked key-copying for use with RPM install script
  50 # 0.6.1   -- Added --root option; minor bug fixes
  51 # 0.6.0   -- Changed --drivers to --alldrivers and added --nodrivers option;
  52 #            changed default driver installation behavior in Linux to install
  53 #            the driver needed to read /boot (if available)
  54 # 0.5.1.2 -- Fixed bug that caused failure to generate refind_linux.conf file
  55 # 0.5.1.1 -- Fixed bug that caused script failure under OS X
  56 # 0.5.1   -- Added --shim & --localkeys options & create sample refind_linux.conf
  57 #            in /boot
  58 # 0.5.0   -- Added --usedefault & --drivers options & changed "esp" option to "--esp"
  59 # 0.4.5   -- Fixed check for rEFItBlesser in OS X
  60 # 0.4.2   -- Added notice about BIOS-based OSes & made NVRAM changes in Linux smarter
  61 # 0.4.1   -- Added check for rEFItBlesser in OS X
  62 # 0.3.3.1 -- Fixed OS X 10.7 bug; also works as make target
  63 # 0.3.2.1 -- Check for presence of source files; aborts if not present
  64 # 0.3.2   -- Initial version
  65 #
  66 # Note: install.sh version numbers match those of the rEFInd package
  67 # with which they first appeared.
  68
  69 RootDir="/"
  70 TargetDir=/EFI/refind
  71 LocalKeysBase="refind_local"
  72 ShimSource="none"
  73 ShimType="none"
  74 TargetShim="default"
  75 TargetX64="refind_x64.efi"
  76 TargetIA32="refind_ia32.efi"
  77 LocalKeys=0
  78 DeleteRefindDir=0
  79 AlwaysYes=0
  80
  81 #
  82 # Functions used by both OS X and Linux....
  83 #
  84
  85 GetParams() {
  86    InstallToEspOnMac=0
  87    if [[ $OSName == "Linux" ]] ; then
  88       # Install the driver required to read /boot, if it's available
  89       InstallDrivers="boot"
  90    else
  91       InstallDrivers="none"
  92    fi
  93    while [[ $# -gt 0 ]]; do
  94       case $1 in
  95          --esp | --ESP) InstallToEspOnMac=1
  96               ;;
  97          --usedefault) TargetDir=/EFI/BOOT
  98               TargetPart="$2"
  99               TargetX64="bootx64.efi"
 100               TargetIA32="bootia32.efi"
 101               shift
 102               ;;
 103          --root) RootDir="$2"
 104               shift
 105               ;;
 106          --localkeys) LocalKeys=1
 107               ;;
 108          --shim | --preloader) ShimSource="$2"
 109               ShimType=`basename $ShimSource`
 110               shift
 111               ;;
 112          --drivers | --alldrivers) InstallDrivers="all"
 113               ;;
 114          --nodrivers) InstallDrivers="none"
 115               ;;
 116          --yes) AlwaysYes=1
 117               ;;
 118          * ) echo "Usage: $0 [--esp | --usedefault {device-file} | --root {directory} ]"
 119              echo "                  [--nodrivers | --alldrivers] [--shim {shim-filename}]"
 120              echo "                  [--localkeys] [--yes]"
 121              exit 1
 122       esac
 123       shift
 124    done
 125
 126    if [[ $InstallToEspOnMac == 1 && "$TargetDir" == '/EFI/BOOT' ]] ; then
 127       echo "You may use --esp OR --usedefault, but not both! Aborting!"
 128       exit 1
 129    fi
 130    if [[ "$RootDir" != '/' && "$TargetDir" == '/EFI/BOOT' ]] ; then
 131       echo "You may use --usedefault OR --root, but not both! Aborting!"
 132       exit 1
 133    fi
 134    if [[ "$RootDir" != '/' && $InstallToEspOnMac == 1 ]] ; then
 135       echo "You may use --root OR --esp, but not both! Aborting!"
 136       exit 1
 137    fi
 138
 139    RLConfFile="$RootDir/boot/refind_linux.conf"
 140    EtcKeysDir="$RootDir/etc/refind.d/keys"
 141 } # GetParams()
 142
 143 # Get a yes/no response from the user and place it in the YesNo variable.
 144 # If the AlwaysYes variable is set to 1, skip the user input and set "Y"
 145 # in the YesNo variable.
 146 ReadYesNo() {
 147    if [[ $AlwaysYes == 1 ]] ; then
 148       YesNo="Y"
 149       echo "Y"
 150    else
 151       read YesNo
 152    fi
 153 }
 154
 155 # Abort if the rEFInd files can't be found.
 156 # Also sets $ConfFile to point to the configuration file,
 157 # $IconsDir to point to the icons directory, and
 158 # $ShimSource to the source of the shim.efi file (if necessary).
 159 CheckForFiles() {
 160    # Note: This check is satisfied if EITHER the 32- or the 64-bit version
 161    # is found, even on the wrong platform. This is because the platform
 162    # hasn't yet been determined. This could obviously be improved, but it
 163    # would mean restructuring lots more code....
 164    if [[ ! -f "$RefindDir/refind_ia32.efi" && ! -f "$RefindDir/refind_x64.efi" ]] ; then
 165       echo "The rEFInd binary file is missing! Aborting installation!"
 166       exit 1
 167    fi
 168
 169    if [[ -f "$RefindDir/refind.conf-sample" ]] ; then
 170       ConfFile="$RefindDir/refind.conf-sample"
 171    elif [[ -f "$ThisDir/refind.conf-sample" ]] ; then
 172       ConfFile="$ThisDir/refind.conf-sample"
 173    else
 174       echo "The sample configuration file is missing! Aborting installation!"
 175       exit 1
 176    fi
 177
 178    if [[ -d "$RefindDir/icons" ]] ; then
 179       IconsDir="$RefindDir/icons"
 180    elif [[ -d "$ThisDir/icons" ]] ; then
 181       IconsDir="$ThisDir/icons"
 182    else
 183       echo "The icons directory is missing! Aborting installation!"
 184       exit 1
 185    fi
 186
 187    if [[ "$ShimSource" != "none" ]] ; then
 188       if [[ -f "$ShimSource" ]] ; then
 189          if [[ $ShimType == "shimx64.efi" || $ShimType == "shim.efi" ]] ; then
 190             TargetX64="grubx64.efi"
 191             MokManagerSource=`dirname "$ShimSource"`/MokManager.efi
 192          elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 193             TargetX64="loader.efi"
 194             MokManagerSource=`dirname "$ShimSource"`/HashTool.efi
 195          else
 196             echo "Unknown shim/PreBootloader filename: $ShimType!"
 197             echo "Known filenames are shimx64.efi, shim.efi, and PreLoader.efi. Aborting!"
 198             exit 1
 199          fi
 200       else
 201          echo "The specified shim/PreBootloader file, $ShimSource, doesn't exist!"
 202          echo "Aborting installation!"
 203          exit 1
 204       fi
 205    fi
 206 } # CheckForFiles()
 207
 208 # Helper for CopyRefindFiles; copies shim files (including MokManager, if it's
 209 # available) to target.
 210 CopyShimFiles() {
 211    cp -fb "$ShimSource" "$InstallDir/$TargetDir/$TargetShim"
 212    if [[ $? != 0 ]] ; then
 213       Problems=1
 214    fi
 215    if [[ -f "$MokManagerSource" ]] ; then
 216       cp -fb "$MokManagerSource" "$InstallDir/$TargetDir/"
 217    fi
 218    if [[ $? != 0 ]] ; then
 219       Problems=1
 220    fi
 221 } # CopyShimFiles()
 222
 223 # Copy the public keys to the installation medium
 224 CopyKeys() {
 225    if [[ $LocalKeys == 1 ]] ; then
 226       mkdir -p "$InstallDir/$TargetDir/keys/"
 227       cp "$EtcKeysDir/$LocalKeysBase.cer" "$InstallDir/$TargetDir/keys/"
 228       cp "$EtcKeysDir/$LocalKeysBase.crt" "$InstallDir/$TargetDir/keys/"
 229    fi
 230 } # CopyKeys()
 231
 232 # Copy drivers from $RefindDir/drivers_$1 to $InstallDir/$TargetDir/drivers_$1,
 233 # honoring the $InstallDrivers condition. Must be passed a suitable
 234 # architecture code (ia32 or x64).
 235 CopyDrivers() {
 236    if [[ $InstallDrivers == "all" ]] ; then
 237       mkdir -p "$InstallDir/$TargetDir/drivers_$1"
 238       cp "$ThisDir"/drivers_$1/*_$1.efi "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 239       cp "$RefindDir"/drivers_$1/*_$1.efi "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 240    elif [[ "$InstallDrivers" == "boot" && -x `which blkid` ]] ; then
 241       BootPart=`df /boot | grep dev | cut -f 1 -d " "`
 242       BootFS=`blkid -o export $BootPart 2> /dev/null | grep TYPE= | cut -f 2 -d =`
 243       DriverType=""
 244       case $BootFS in
 245          ext2 | ext3) DriverType="ext2"
 246               # Could use ext4, but that can create unwanted entries from symbolic
 247               # links in / to /boot/vmlinuz if a separate /boot partition is used.
 248               ;;
 249          ext4) DriverType="ext4"
 250               ;;
 251          reiserfs) DriverType="reiserfs"
 252               ;;
 253          btrfs) DriverType="btrfs"
 254               ;;
 255          hfsplus) DriverType="hfs"
 256               ;;
 257          *) BootFS=""
 258       esac
 259       if [[ -n $BootFS ]] ; then
 260          echo "Installing driver for $BootFS (${DriverType}_$1.efi)"
 261          mkdir -p "$InstallDir/$TargetDir/drivers_$1"
 262          cp "$ThisDir/drivers_$1/${DriverType}_$1.efi" "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 263          cp "$RefindDir/drivers_$1/${DriverType}_$1.efi" "$InstallDir/$TargetDir/drivers_$1"/ 2> /dev/null
 264       fi
 265    fi
 266 }
 267
 268 # Copy tools (currently only gptsync, and that only on Macs) to the EFI/tools
 269 # directory on the ESP. Must be passed a suitable architecture code (ia32
 270 # or x64).
 271 CopyTools() {
 272    mkdir -p $InstallDir/EFI/tools
 273    if [[ $OSName == 'Darwin' ]] ; then
 274       cp -f "$RefindDir/tools_$1/gptsync_$1.efi" "$InstallDir/EFI/tools/"
 275       if [[ -f "$InstallDir/EFI/tools/gptsync.efi" ]] ; then
 276          mv "$InstallDir/EFI/tools/gptsync.efi" "$InstallDir/EFI/tools/gptsync.efi-disabled"
 277          echo "Found old gptsync.efi; disabling it by renaming it to gptsync.efi-disabled"
 278       fi
 279    fi
 280 } # CopyTools()
 281
 282 # Copy the rEFInd files to the ESP or OS X root partition.
 283 # Sets Problems=1 if any critical commands fail.
 284 CopyRefindFiles() {
 285    mkdir -p "$InstallDir/$TargetDir"
 286    if [[ "$TargetDir" == '/EFI/BOOT' ]] ; then
 287       cp "$RefindDir/refind_ia32.efi" "$InstallDir/$TargetDir/$TargetIA32" 2> /dev/null
 288       if [[ $? != 0 ]] ; then
 289          echo "Note: IA32 (x86) binary not installed!"
 290       fi
 291       cp "$RefindDir/refind_x64.efi" "$InstallDir/$TargetDir/$TargetX64" 2> /dev/null
 292       if [[ $? != 0 ]] ; then
 293          Problems=1
 294       fi
 295       if [[ "$ShimSource" != "none" ]] ; then
 296          TargetShim="bootx64.efi"
 297          CopyShimFiles
 298       fi
 299       if [[ $InstallDrivers == "all" ]] ; then
 300          cp -r "$RefindDir"/drivers_* "$InstallDir/$TargetDir/" 2> /dev/null
 301          cp -r "$ThisDir"/drivers_* "$InstallDir/$TargetDir/" 2> /dev/null
 302       elif [[ $Upgrade == 1 ]] ; then
 303          if [[ $Platform == 'EFI64' ]] ; then
 304             CopyDrivers x64
 305             CopyTools x64
 306          else
 307             CopyDrivers ia32
 308             CopyTools ia32
 309          fi
 310       fi
 311       Refind=""
 312       CopyKeys
 313    elif [[ $Platform == 'EFI64' || $TargetDir == "/EFI/Microsoft/Boot" ]] ; then
 314       cp "$RefindDir/refind_x64.efi" "$InstallDir/$TargetDir/$TargetX64"
 315       if [[ $? != 0 ]] ; then
 316          Problems=1
 317       fi
 318       CopyDrivers x64
 319       CopyTools x64
 320       Refind="refind_x64.efi"
 321       CopyKeys
 322       if [[ "$ShimSource" != "none" ]] ; then
 323          if [[ "$TargetShim" == "default" ]] ; then
 324             TargetShim=`basename "$ShimSource"`
 325          fi
 326          CopyShimFiles
 327          Refind="$TargetShim"
 328          if [[ $LocalKeys == 0 ]] ; then
 329             echo "Storing copies of rEFInd Secure Boot public keys in $EtcKeysDir"
 330             mkdir -p "$EtcKeysDir"
 331             cp "$ThisDir/keys/refind.cer" "$EtcKeysDir" 2> /dev/null
 332             cp "$ThisDir/keys/refind.crt" "$EtcKeysDir" 2> /dev/null
 333          fi
 334       fi
 335    elif [[ $Platform == 'EFI32' ]] ; then
 336       cp "$RefindDir/refind_ia32.efi" "$InstallDir/$TargetDir/$TargetIA32"
 337       if [[ $? != 0 ]] ; then
 338          Problems=1
 339       fi
 340       CopyDrivers ia32
 341       CopyTools ia32
 342       Refind="refind_ia32.efi"
 343    else
 344       echo "Unknown platform! Aborting!"
 345       exit 1
 346    fi
 347    echo "Copied rEFInd binary files"
 348    echo ""
 349    if [[ -d "$InstallDir/$TargetDir/icons" ]] ; then
 350       rm -rf "$InstallDir/$TargetDir/icons-backup" &> /dev/null
 351       mv -f "$InstallDir/$TargetDir/icons" "$InstallDir/$TargetDir/icons-backup"
 352       echo "Notice: Backed up existing icons directory as icons-backup."
 353    fi
 354    cp -r "$IconsDir" "$InstallDir/$TargetDir"
 355    if [[ $? != 0 ]] ; then
 356       Problems=1
 357    fi
 358    mkdir -p "$InstallDir/$TargetDir/keys"
 359    cp -rf "$ThisDir"/keys/*.[cd]er "$InstallDir/$TargetDir/keys/" 2> /dev/null
 360    cp -rf "$EtcKeysDir"/*.[cd]er "$InstallDir/$TargetDir/keys/" 2> /dev/null
 361    if [[ -f "$InstallDir/$TargetDir/refind.conf" ]] ; then
 362       echo "Existing refind.conf file found; copying sample file as refind.conf-sample"
 363       echo "to avoid overwriting your customizations."
 364       echo ""
 365       cp -f "$ConfFile" "$InstallDir/$TargetDir"
 366       if [[ $? != 0 ]] ; then
 367          Problems=1
 368       fi
 369    else
 370       echo "Copying sample configuration file as refind.conf; edit this file to configure"
 371       echo "rEFInd."
 372       echo ""
 373       cp -f "$ConfFile" "$InstallDir/$TargetDir/refind.conf"
 374       if [[ $? != 0 ]] ; then
 375          Problems=1
 376       fi
 377    fi
 378    if [[ $DeleteRefindDir == 1 ]] ; then
 379       echo "Deleting the temporary directory $RefindDir"
 380       rm -r "$RefindDir"
 381    fi
 382 } # CopyRefindFiles()
 383
 384 # Mount the partition the user specified with the --usedefault option
 385 MountDefaultTarget() {
 386    InstallDir=/tmp/refind_install
 387    mkdir -p "$InstallDir"
 388    if [[ $OSName == 'Darwin' ]] ; then
 389       mount -t msdos "$TargetPart" "$InstallDir"
 390    elif [[ $OSName == 'Linux' ]] ; then
 391       mount -t vfat "$TargetPart" "$InstallDir"
 392    fi
 393    if [[ $? != 0 ]] ; then
 394       echo "Couldn't mount $TargetPart ! Aborting!"
 395       rmdir "$InstallDir"
 396       exit 1
 397    fi
 398    UnmountEsp=1
 399 } # MountDefaultTarget()
 400
 401 #
 402 # A series of OS X support functions....
 403 #
 404
 405 # Mount the ESP at /Volumes/ESP or determine its current mount
 406 # point.
 407 # Sets InstallDir to the ESP mount point
 408 # Sets UnmountEsp if we mounted it
 409 MountOSXESP() {
 410    # Identify the ESP. Note: This returns the FIRST ESP found;
 411    # if the system has multiple disks, this could be wrong!
 412    Temp=`diskutil list | grep " EFI "`
 413    Esp=/dev/`echo $Temp | cut -f 5 -d ' '`
 414    # If the ESP is mounted, use its current mount point....
 415    Temp=`df -P | grep "$Esp"`
 416    InstallDir=`echo $Temp | cut -f 6 -d ' '`
 417    if [[ "$InstallDir" == '' ]] ; then
 418       mkdir /Volumes/ESP &> /dev/null
 419       mount -t msdos "$Esp" /Volumes/ESP
 420       if [[ $? != 0 ]] ; then
 421          echo "Unable to mount ESP! Aborting!\n"
 422          exit 1
 423       fi
 424       UnmountEsp=1
 425       InstallDir="/Volumes/ESP"
 426    fi
 427 } # MountOSXESP()
 428
 429 # Control the OS X installation.
 430 # Sets Problems=1 if problems found during the installation.
 431 InstallOnOSX() {
 432    echo "Installing rEFInd on OS X...."
 433    if [[ "$TargetDir" == "/EFI/BOOT" ]] ; then
 434       MountDefaultTarget
 435    elif [[ "$InstallToEspOnMac" == "1" ]] ; then
 436       MountOSXESP
 437    else
 438       InstallDir="$RootDir/"
 439    fi
 440    echo "Installing rEFInd to the partition mounted at $InstallDir"
 441    Platform=`ioreg -l -p IODeviceTree | grep firmware-abi | cut -d "\"" -f 4`
 442    CopyRefindFiles
 443    if [[ $InstallToEspOnMac == "1" ]] ; then
 444       bless --mount "$InstallDir" --setBoot --file "$InstallDir/$TargetDir/$Refind"
 445    elif [[ "$TargetDir" != "/EFI/BOOT" ]] ; then
 446       bless --setBoot --folder "$InstallDir/$TargetDir" --file "$InstallDir/$TargetDir/$Refind"
 447    fi
 448    if [[ $? != 0 ]] ; then
 449       Problems=1
 450    fi
 451    if [[ -f /Library/StartupItems/rEFItBlesser || -d /Library/StartupItems/rEFItBlesser ]] ; then
 452       echo
 453       echo "/Library/StartupItems/rEFItBlesser found!"
 454       echo "This program is part of rEFIt, and will cause rEFInd to fail to work after"
 455       echo -n "its first boot. Do you want to remove rEFItBlesser (Y/N)? "
 456       ReadYesNo
 457       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 458          echo "Deleting /Library/StartupItems/rEFItBlesser..."
 459          rm -r /Library/StartupItems/rEFItBlesser
 460       else
 461          echo "Not deleting rEFItBlesser."
 462       fi
 463    fi
 464    echo
 465    echo "WARNING: If you have an Advanced Format disk, *DO NOT* attempt to check the"
 466    echo "bless status with 'bless --info', since this is known to cause disk corruption"
 467    echo "on some systems!!"
 468    echo
 469 } # InstallOnOSX()
 470
 471
 472 #
 473 # Now a series of Linux support functions....
 474 #
 475
 476 # Check for evidence that we're running in Secure Boot mode. If so, and if
 477 # appropriate options haven't been set, warn the user and offer to abort.
 478 # If we're NOT in Secure Boot mode but the user HAS specified the --shim
 479 # or --localkeys option, warn the user and offer to abort.
 480 #
 481 # FIXME: Although I checked the presence (and lack thereof) of the
 482 # /sys/firmware/efi/vars/SecureBoot* files on my Secure Boot test system
 483 # before releasing this script, I've since found that they are at least
 484 # sometimes present when Secure Boot is absent. This means that the first
 485 # test can produce false alarms. A better test is highly desirable.
 486 CheckSecureBoot() {
 487    VarFile=`ls -d /sys/firmware/efi/vars/SecureBoot* 2> /dev/null`
 488    if [[ -n "$VarFile" && "$TargetDir" != '/EFI/BOOT' && "$ShimSource" == "none" ]] ; then
 489       echo ""
 490       echo "CAUTION: Your computer appears to support Secure Boot, but you haven't"
 491       echo "specified a valid shim.efi file source. If you've disabled Secure Boot and"
 492       echo "intend to leave it disabled, this is fine; but if Secure Boot is active, the"
 493       echo "resulting installation won't boot. You can read more about this topic at"
 494       echo "http://www.rodsbooks.com/refind/secureboot.html."
 495       echo ""
 496       echo -n "Do you want to proceed with installation (Y/N)? "
 497       ReadYesNo
 498       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 499          echo "OK; continuing with the installation..."
 500       else
 501          exit 0
 502       fi
 503    fi
 504
 505    if [[ "$ShimSource" != "none" && ! -n "$VarFile" ]] ; then
 506       echo ""
 507       echo "You've specified installing using a shim.efi file, but your computer does not"
 508       echo "appear to be running in Secure Boot mode. Although installing in this way"
 509       echo "should work, it's unnecessarily complex. You may continue, but unless you"
 510       echo "plan to enable Secure Boot, you should consider stopping and omitting the"
 511       echo "--shim option. You can read more about this topic at"
 512       echo "http://www.rodsbooks.com/refind/secureboot.html."
 513       echo ""
 514       echo -n "Do you want to proceed with installation (Y/N)? "
 515       ReadYesNo
 516       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 517          echo "OK; continuing with the installation..."
 518       else
 519          exit 0
 520       fi
 521    fi
 522
 523    if [[ $LocalKeys != 0 && ! -n "$VarFile" ]] ; then
 524       echo ""
 525       echo "You've specified re-signing your rEFInd binaries with locally-generated keys,"
 526       echo "but your computer does not appear to be running in Secure Boot mode. The"
 527       echo "keys you generate will be useless unless you enable Secure Boot. You may"
 528       echo "proceed with this installation, but before you do so, you may want to read"
 529       echo "more about it at http://www.rodsbooks.com/refind/secureboot.html."
 530       echo ""
 531       echo -n "Do you want to proceed with installation (Y/N)? "
 532       ReadYesNo
 533       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 534          echo "OK; continuing with the installation..."
 535       else
 536          exit 0
 537       fi
 538    fi
 539
 540 } # CheckSecureBoot()
 541
 542 # Check for the presence of locally-generated keys from a previous installation in
 543 # $EtcKeysDir (/etc/refind.d/keys). If they're not present, generate them using
 544 # openssl.
 545 GenerateKeys() {
 546    PrivateKey="$EtcKeysDir/$LocalKeysBase.key"
 547    CertKey="$EtcKeysDir/$LocalKeysBase.crt"
 548    DerKey="$EtcKeysDir/$LocalKeysBase.cer"
 549    OpenSSL=`which openssl 2> /dev/null`
 550
 551    # Do the work only if one or more of the necessary keys is missing
 552    # TODO: Technically, we don't need the DerKey; but if it's missing and openssl
 553    # is also missing, this will fail. This could be improved.
 554    if [[ ! -f "$PrivateKey" || ! -f "$CertKey" || ! -f "$DerKey" ]] ; then
 555       echo "Generating a fresh set of local keys...."
 556       mkdir -p "$EtcKeysDir"
 557       chmod 0700 "$EtcKeysDir"
 558       if [[ ! -x "$OpenSSL" ]] ; then
 559          echo "Can't find openssl, which is required to create your private signing keys!"
 560          echo "Aborting!"
 561          exit 1
 562       fi
 563       if [[ -f "$PrivateKey" ]] ; then
 564          echo "Backing up existing $PrivateKey"
 565          cp -f "$PrivateKey" "$PrivateKey.backup" 2> /dev/null
 566       fi
 567       if [[ -f "$CertKey" ]] ; then
 568          echo "Backing up existing $CertKey"
 569          cp -f "$CertKey" "$CertKey.backup" 2> /dev/null
 570       fi
 571       if [[ -f "$DerKey" ]] ; then
 572          echo "Backing up existing $DerKey"
 573          cp -f "$DerKey" "$DerKey.backup" 2> /dev/null
 574       fi
 575       "$OpenSSL" req -new -x509 -newkey rsa:2048 -keyout "$PrivateKey" -out "$CertKey" \
 576                      -nodes -days 3650 -subj "/CN=Locally-generated rEFInd key/"
 577       "$OpenSSL" x509 -in "$CertKey" -out "$DerKey" -outform DER
 578       chmod 0600 "$PrivateKey"
 579    else
 580       echo "Using existing local keys...."
 581    fi
 582 }
 583
 584 # Sign a single binary. Requires parameters:
 585 #   $1 = source file
 586 #   $2 = destination file
 587 # Also assumes that the SBSign, PESign, UseSBSign, UsePESign, and various key variables are set
 588 # appropriately.
 589 # Aborts script on error
 590 SignOneBinary() {
 591    $SBSign --key "$PrivateKey" --cert "$CertKey" --output "$2" "$1"
 592    if [[ $? != 0 ]] ; then
 593       echo "Problem signing the binary $1! Aborting!"
 594       exit 1
 595    fi
 596 }
 597
 598 # Re-sign the x86-64 binaries with a locally-generated key, First look for appropriate
 599 # key files in $EtcKeysDir. If they're present, use them to re-sign the binaries. If
 600 # not, try to generate new keys and store them in $EtcKeysDir.
 601 ReSignBinaries() {
 602    SBSign=`which sbsign 2> /dev/null`
 603    echo "Found sbsign at $SBSign"
 604    TempDir="/tmp/refind_local"
 605    if [[ ! -x "$SBSign" ]] ; then
 606       echo "Can't find sbsign, which is required to sign rEFInd with your own keys!"
 607       echo "Aborting!"
 608       exit 1
 609    fi
 610    GenerateKeys
 611    mkdir -p "$TempDir/drivers_x64"
 612    cp "$RefindDir/refind.conf-sample $TempDir" 2> /dev/null
 613    cp "$ThisDir/refind.conf-sample $TempDir" 2> /dev/null
 614    cp "$RefindDir/refind_ia32.efi $TempDir" 2> /dev/null
 615    cp -a "$RefindDir/drivers_ia32 $TempDir" 2> /dev/null
 616    cp -a "$ThisDir/drivers_ia32 $TempDir" 2> /dev/null
 617    SignOneBinary "$RefindDir/refind_x64.efi" "$TempDir/refind_x64.efi"
 618    SaveIFS=$IFS
 619    IFS=$(echo -en "\n\b")
 620    for Driver in `ls "$RefindDir"/drivers_x64/*.efi "$ThisDir"/drivers_x64/*.efi 2> /dev/null` ; do
 621       TempName=`basename "$Driver"`
 622       SignOneBinary "$Driver" "$TempDir/drivers_x64/$TempName"
 623    done
 624    IFS=$SaveIFS
 625    RefindDir="$TempDir"
 626    DeleteRefindDir=1
 627 }
 628
 629 # Identifies the ESP's location (/boot or /boot/efi, or these locations under
 630 # the directory specified by --root); aborts if the ESP isn't mounted at
 631 # either location.
 632 # Sets InstallDir to the ESP mount point.
 633 FindLinuxESP() {
 634    EspLine=`df "$RootDir/boot/efi" 2> /dev/null | grep boot/efi`
 635    if [[ ! -n "$EspLine" ]] ; then
 636       EspLine=`df "$RootDir"/boot | grep boot`
 637    fi
 638    InstallDir=`echo $EspLine | cut -d " " -f 6`
 639    if [[ -n "$InstallDir" ]] ; then
 640       EspFilesystem=`grep "$InstallDir" /etc/mtab | uniq | grep -v autofs | cut -d " " -f 3`
 641    fi
 642    if [[ $EspFilesystem != 'vfat' ]] ; then
 643       echo "$RootDir/boot/efi doesn't seem to be on a VFAT filesystem. The ESP must be"
 644       echo "mounted at $RootDir/boot or $RootDir/boot/efi and it must be VFAT! Aborting!"
 645       exit 1
 646    fi
 647    echo "ESP was found at $InstallDir using $EspFilesystem"
 648 } # FindLinuxESP
 649
 650 # Uses efibootmgr to add an entry for rEFInd to the EFI's NVRAM.
 651 # If this fails, sets Problems=1
 652 AddBootEntry() {
 653    InstallIt="0"
 654    Efibootmgr=`which efibootmgr 2> /dev/null`
 655    if [[ "$Efibootmgr" ]] ; then
 656       InstallDisk=`grep "$InstallDir" /etc/mtab | cut -d " " -f 1 | cut -c 1-8`
 657       PartNum=`grep "$InstallDir" /etc/mtab | cut -d " " -f 1 | cut -c 9-10`
 658       EntryFilename="$TargetDir/$Refind"
 659       EfiEntryFilename=`echo ${EntryFilename//\//\\\}`
 660       EfiEntryFilename2=`echo ${EfiEntryFilename} | sed s/\\\\\\\\/\\\\\\\\\\\\\\\\/g`
 661       ExistingEntry=`"$Efibootmgr" -v | grep -i "$EfiEntryFilename2"`
 662
 663       if [[ "$ExistingEntry" ]] ; then
 664          ExistingEntryBootNum=`echo "$ExistingEntry" | cut -c 5-8`
 665          FirstBoot=`"$Efibootmgr" | grep BootOrder | cut -c 12-15`
 666          if [[ "$ExistingEntryBootNum" != "$FirstBoot" ]] ; then
 667             echo "An existing rEFInd boot entry exists, but isn't set as the default boot"
 668             echo "manager. The boot order is being adjusted to make rEFInd the default boot"
 669             echo "manager. If this is NOT what you want, you should use efibootmgr to"
 670             echo "manually adjust your EFI's boot order."
 671             "$Efibootmgr" -b $ExistingEntryBootNum -B &> /dev/null
 672             InstallIt="1"
 673          fi
 674       else
 675          InstallIt="1"
 676       fi
 677
 678       if [[ $InstallIt == "1" ]] ; then
 679          echo "Installing it!"
 680          "$Efibootmgr" -c -l "$EfiEntryFilename" -L "rEFInd Boot Manager" -d $InstallDisk -p $PartNum &> /dev/null
 681          if [[ $? != 0 ]] ; then
 682             EfibootmgrProblems=1
 683             Problems=1
 684          fi
 685       fi
 686
 687    else # efibootmgr not found
 688       EfibootmgrProblems=1
 689       Problems=1
 690    fi
 691
 692    if [[ $EfibootmgrProblems ]] ; then
 693       echo
 694       echo "ALERT: There were problems running the efibootmgr program! You may need to"
 695       echo "rename the $Refind binary to the default name (EFI/boot/bootx64.efi"
 696       echo "on x86-64 systems or EFI/boot/bootia32.efi on x86 systems) to have it run!"
 697       echo
 698    else
 699       echo "rEFInd has been set as the default boot manager."
 700    fi
 701 } # AddBootEntry()
 702
 703 # Create a minimal/sample refind_linux.conf file in /boot.
 704 GenerateRefindLinuxConf() {
 705    if [[ -f "$RLConfFile" ]] ; then
 706       echo "Existing $RLConfFile found; not overwriting."
 707    else
 708       echo "Creating $RLConfFile; edit it to adjust kernel options."
 709       if [[ -f "$RootDir/etc/default/grub" ]] ; then
 710          # We want the default options used by the distribution, stored here....
 711          source "$RootDir/etc/default/grub"
 712          echo "Setting default boot options based on $RootDir/etc/default/grub"
 713       fi
 714       RootFS=`df "$RootDir" | grep dev | cut -f 1 -d " "`
 715       StartOfDevname=`echo "$RootFS" | cut -b 1-7`
 716       if [[ "$StartOfDevname" == "/dev/sd" || "$StartOfDevName" == "/dev/hd" ]] ; then
 717          # Identify root filesystem by UUID rather than by device node, if possible
 718          Uuid=`blkid -o export "$RootFS" 2> /dev/null | grep UUID=`
 719          if [[ -n $Uuid ]] ; then
 720             RootFS="$Uuid"
 721          fi
 722       fi
 723       DefaultOptions="$GRUB_CMDLINE_LINUX $GRUB_CMDLINE_LINUX_DEFAULT"
 724       echo "\"Boot with standard options\" \"ro root=$RootFS $DefaultOptions \"" > $RLConfFile
 725       echo "\"Boot to single-user mode\"   \"ro root=$RootFS $DefaultOptions single\"" >> $RLConfFile
 726       echo "\"Boot with minimal options\"  \"ro root=$RootFS\"" >> $RLConfFile
 727    fi
 728 }
 729
 730 # Set varaibles for installation in EFI/BOOT directory
 731 SetVarsForBoot() {
 732    TargetDir="/EFI/BOOT"
 733    if [[ $ShimSource == "none" ]] ; then
 734       TargetX64="bootx64.efi"
 735       TargetIA32="bootia32.efi"
 736    else
 737       if [[ $ShimType == "shim.efi" || $ShimType == "shimx64.efi" ]] ; then
 738          TargetX64="grubx64.efi"
 739       elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 740          TargetX64="loader.efi"
 741       else
 742          echo "Unknown shim/PreBootloader type: $ShimType"
 743          echo "Aborting!"
 744          exit 1
 745       fi
 746       TargetIA32="bootia32.efi"
 747       TargetShim="bootx64.efi"
 748    fi
 749 } # SetFilenamesForBoot()
 750
 751 # Set variables for installation in EFI/Microsoft/Boot directory
 752 SetVarsForMsBoot() {
 753    TargetDir="/EFI/Microsoft/Boot"
 754    if [[ $ShimSource == "none" ]] ; then
 755       TargetX64="bootmgfw.efi"
 756    else
 757       if [[ $ShimType == "shim.efi" || $ShimType == "shimx64.efi" ]] ; then
 758          TargetX64="grubx64.efi"
 759       elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 760          TargetX64="loader.efi"
 761       else
 762          echo "Unknown shim/PreBootloader type: $ShimType"
 763          echo "Aborting!"
 764          exit 1
 765       fi
 766       TargetShim="bootmgfw.efi"
 767    fi
 768 }
 769
 770 # TargetDir defaults to /EFI/refind; however, this function adjusts it as follows:
 771 # - If an existing refind.conf is available in /EFI/BOOT or /EFI/Microsoft/Boot,
 772 #   install to that directory under the suitable name; but DO NOT do this if
 773 #   refind.conf is also in /EFI/refind.
 774 # - If booted in BIOS mode and the ESP lacks any other EFI files, install to
 775 #   /EFI/BOOT
 776 # - If booted in BIOS mode and there's no refind.conf file and there is a
 777 #   /EFI/Microsoft/Boot/bootmgfw.efi file, move it down one level and
 778 #   install under that name, "hijacking" the Windows boot loader filename
 779 DetermineTargetDir() {
 780    Upgrade=0
 781
 782    if [[ -f $InstallDir/EFI/BOOT/refind.conf ]] ; then
 783       SetVarsForBoot
 784       Upgrade=1
 785    fi
 786    if [[ -f $InstallDir/EFI/Microsoft/Boot/refind.conf ]] ; then
 787       SetVarsForMsBoot
 788       Upgrade=1
 789    fi
 790    if [[ -f $InstallDir/EFI/refind/refind.conf ]] ; then
 791       TargetDir="/EFI/refind"
 792       Upgrade=1
 793    fi
 794    if [[ $Upgrade == 1 ]] ; then
 795       echo "Found rEFInd installation in $InstallDir$TargetDir; upgrading it."
 796    fi
 797
 798    if [[ ! -d /sys/firmware/efi && $Upgrade == 0 ]] ; then     # BIOS-mode
 799       FoundEfiFiles=`find "$InstallDir/EFI/BOOT" -name "*.efi" 2> /dev/null`
 800       FoundConfFiles=`find "$InstallDir" -name "refind\.conf" 2> /dev/null`
 801       if [[ ! -n "$FoundConfFiles" && -f "$InstallDir/EFI/Microsoft/Boot/bootmgfw.efi" ]] ; then
 802          mv -n "$InstallDir/EFI/Microsoft/Boot/bootmgfw.efi" "$InstallDir/EFI/Microsoft" &> /dev/null
 803          SetVarsForMsBoot
 804          echo "Running in BIOS mode with a suspected Windows installation; moving boot loader"
 805          echo "files so as to install to $InstallDir$TargetDir."
 806       elif [[ ! -n "$FoundEfiFiles" ]] ; then  # In BIOS mode and no default loader; install as default loader
 807          SetVarsForBoot
 808          echo "Running in BIOS mode with no existing default boot loader; installing to"
 809          echo $InstallDir$TargetDir
 810       else
 811          echo "Running in BIOS mode with an existing default boot loader; backing it up and"
 812          echo "installing rEFInd in its place."
 813          if [[ -d "$InstallDir/EFI/BOOT-rEFIndBackup" ]] ; then
 814             echo ""
 815             echo "Caution: An existing backup of a default boot loader exists! If the current"
 816             echo "default boot loader and the backup are different boot loaders, the current"
 817             echo "one will become inaccessible."
 818             echo ""
 819             echo -n "Do you want to proceed with installation (Y/N)? "
 820             ReadYesNo
 821             if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 822                echo "OK; continuing with the installation..."
 823             else
 824                exit 0
 825             fi
 826          fi
 827          mv -n "$InstallDir/EFI/BOOT" "$InstallDir/EFI/BOOT-rEFIndBackup"
 828          SetVarsForBoot
 829       fi
 830    fi # BIOS-mode
 831 } # DetermineTargetDir()
 832
 833 # Controls rEFInd installation under Linux.
 834 # Sets Problems=1 if something goes wrong.
 835 InstallOnLinux() {
 836    echo "Installing rEFInd on Linux...."
 837    modprobe efivars &> /dev/null
 838    if [[ $TargetDir == "/EFI/BOOT" ]] ; then
 839       MountDefaultTarget
 840    else
 841       FindLinuxESP
 842       DetermineTargetDir
 843    fi
 844    CpuType=`uname -m`
 845    if [[ $CpuType == 'x86_64' ]] ; then
 846       Platform="EFI64"
 847    elif [[ ($CpuType == 'i386' || $CpuType == 'i486' || $CpuType == 'i586' || $CpuType == 'i686') ]] ; then
 848       Platform="EFI32"
 849       # If we're in EFI mode, do some sanity checks, and alert the user or even
 850       # abort. Not in BIOS mode, though, since that could be used on an emergency
 851       # disc to try to recover a troubled Linux installation.
 852       if [[ -d /sys/firmware/efi ]] ; then
 853          if [[ "$ShimSource" != "none" && "$TargetDir" != "/BOOT/EFI" ]] ; then
 854             echo ""
 855             echo "CAUTION: shim does not currently supports 32-bit systems, so you should not"
 856             echo "use the --shim option to install on such systems. Aborting!"
 857             echo ""
 858             exit 1
 859          fi
 860          echo
 861          echo "CAUTION: This Linux installation uses a 32-bit kernel. 32-bit EFI-based"
 862          echo "computers are VERY RARE. If you've installed a 32-bit version of Linux"
 863          echo "on a 64-bit computer, you should manually install the 64-bit version of"
 864          echo "rEFInd. If you're installing on a Mac, you should do so from OS X. If"
 865          echo "you're positive you want to continue with this installation, answer 'Y'"
 866          echo "to the following question..."
 867          echo
 868          echo -n "Are you sure you want to continue (Y/N)? "
 869          ReadYesNo
 870          if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 871             echo "OK; continuing with the installation..."
 872          else
 873             exit 0
 874          fi
 875       fi # in EFI mode
 876    else
 877       echo "Unknown CPU type '$CpuType'; aborting!"
 878       exit 1
 879    fi
 880
 881    if [[ $LocalKeys == 1 ]] ; then
 882       ReSignBinaries
 883    fi
 884
 885    CheckSecureBoot
 886    CopyRefindFiles
 887    if [[ "$TargetDir" != "/EFI/BOOT" && "$TargetDir" != "/EFI/Microsoft/Boot" ]] ; then
 888       AddBootEntry
 889       GenerateRefindLinuxConf
 890    fi
 891 } # InstallOnLinux()
 892
 893 #
 894 # The main part of the script. Sets a few environment variables,
 895 # performs a few startup checks, and then calls functions to
 896 # install under OS X or Linux, depending on the detected platform.
 897 #
 898
 899 OSName=`uname -s`
 900 GetParams "$@"
 901 ThisDir="$( cd -P "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 902 RefindDir="$ThisDir/refind"
 903 ThisScript="$ThisDir/`basename $0`"
 904 if [[ `whoami` != "root" ]] ; then
 905    echo "Not running as root; attempting to elevate privileges via sudo...."
 906    sudo "$ThisScript" "$@"
 907    if [[ $? != 0 ]] ; then
 908       echo "This script must be run as root (or using sudo). Exiting!"
 909       exit 1
 910    else
 911       exit 0
 912    fi
 913 fi
 914 CheckForFiles
 915 if [[ $OSName == 'Darwin' ]] ; then
 916    if [[ "$ShimSource" != "none" ]] ; then
 917       echo "The --shim option is not supported on OS X! Exiting!"
 918       exit 1
 919    fi
 920    if [[ "$LocalKeys" != 0 ]] ; then
 921       echo "The --localkeys option is not supported on OS X! Exiting!"
 922       exit 1
 923    fi
 924    InstallOnOSX $1
 925 elif [[ $OSName == 'Linux' ]] ; then
 926    InstallOnLinux
 927 else
 928    echo "Running on unknown OS; aborting!"
 929 fi
 930
 931 if [[ $Problems ]] ; then
 932    echo
 933    echo "ALERT:"
 934    echo "Installation has completed, but problems were detected. Review the output for"
 935    echo "error messages and take corrective measures as necessary. You may need to"
 936    echo "re-run this script or install manually before rEFInd will work."
 937    echo
 938 else
 939    echo
 940    echo "Installation has completed successfully."
 941    echo
 942 fi
 943
 944 if [[ $UnmountEsp ]] ; then
 945    echo "Unmounting install dir"
 946    umount $InstallDir
 947 fi
 948
 949 if [[ "$InstallDir" == /tmp/refind_install ]] ; then
 950 #   sleep 5
 951    rmdir "$InstallDir"
 952 fi