code.delx.au - refind/blob - install.sh

   1 #!/bin/bash
   2 #
   3 # Linux/MacOS X script to install rEFInd
   4 #
   5 # Usage:
   6 #
   7 # ./install.sh [options]
   8 #
   9 # options include:
  10 #    "--esp" to install to the ESP rather than to the system's root
  11 #           filesystem. This is the default on Linux
  12 #    "--usedefault {devicefile}" to install as default
  13 #           (/EFI/BOOT/BOOTX64.EFI and similar) to the specified device
  14 #           (/dev/sdd1 or whatever) without registering with the NVRAM.
  15 #    "--root {dir}" to specify installation using the specified directory
  16 #           as the system's root
  17 #    "--alldrivers" to install all drivers along with regular files
  18 #    "--nodrivers" to suppress driver installation (default in Linux is
  19 #           driver used on /boot; --nodrivers is OS X default)
  20 #    "--shim {shimfile}" to install a shim.efi file for Secure Boot
  21 #    "--preloader" is synonymous with "--shim"
  22 #    "--localkeys" to re-sign x86-64 binaries with a locally-generated key
  23 #    "--yes" to assume a "yes" response to all prompts
  24 #
  25 # The "esp" option is valid only on Mac OS X; it causes
  26 # installation to the EFI System Partition (ESP) rather than
  27 # to the current OS X boot partition. Under Linux, this script
  28 # installs to the ESP by default.
  29 #
  30 # This program is copyright (c) 2012 by Roderick W. Smith
  31 # It is released under the terms of the GNU GPL, version 3,
  32 # a copy of which should be included in the file COPYING.txt.
  33 #
  34 # Revision history:
  35 #
  36 # 0.7.2   -- Fixed code that could be confused by use of autofs to mount the ESP
  37 # 0.7.0   -- Added support for the new Btrfs driver
  38 # 0.6.12  -- Added support for PreLoader as well as for shim
  39 # 0.6.11  -- Improvements in script's ability to handle directories with spaces
  40 #            in their names
  41 # 0.6.9   -- Install gptsync on Macs
  42 # 0.6.8   -- Bug fix: ESP scan now uses "uniq".
  43 # 0.6.6   -- Bug fix: Upgrade drivers when installed to EFI/BOOT. Also enable
  44 #            copying shim.efi and MokManager.efi over themselves.
  45 # 0.6.4   -- Copies ext2 driver rather than ext4 driver for ext2/3fs
  46 # 0.6.3   -- Support for detecting rEFInd in EFI/BOOT and EFI/Microsoft/Boot
  47 #            directories & for installing to EFI/BOOT in BIOS mode
  48 # 0.6.2-1 -- Added --yes option & tweaked key-copying for use with RPM install script
  49 # 0.6.1   -- Added --root option; minor bug fixes
  50 # 0.6.0   -- Changed --drivers to --alldrivers and added --nodrivers option;
  51 #            changed default driver installation behavior in Linux to install
  52 #            the driver needed to read /boot (if available)
  53 # 0.5.1.2 -- Fixed bug that caused failure to generate refind_linux.conf file
  54 # 0.5.1.1 -- Fixed bug that caused script failure under OS X
  55 # 0.5.1   -- Added --shim & --localkeys options & create sample refind_linux.conf
  56 #            in /boot
  57 # 0.5.0   -- Added --usedefault & --drivers options & changed "esp" option to "--esp"
  58 # 0.4.5   -- Fixed check for rEFItBlesser in OS X
  59 # 0.4.2   -- Added notice about BIOS-based OSes & made NVRAM changes in Linux smarter
  60 # 0.4.1   -- Added check for rEFItBlesser in OS X
  61 # 0.3.3.1 -- Fixed OS X 10.7 bug; also works as make target
  62 # 0.3.2.1 -- Check for presence of source files; aborts if not present
  63 # 0.3.2   -- Initial version
  64 #
  65 # Note: install.sh version numbers match those of the rEFInd package
  66 # with which they first appeared.
  67
  68 RootDir="/"
  69 TargetDir=/EFI/refind
  70 LocalKeysBase="refind_local"
  71 ShimSource="none"
  72 ShimType="none"
  73 TargetShim="default"
  74 TargetX64="refind_x64.efi"
  75 TargetIA32="refind_ia32.efi"
  76 LocalKeys=0
  77 DeleteRefindDir=0
  78 AlwaysYes=0
  79
  80 #
  81 # Functions used by both OS X and Linux....
  82 #
  83
  84 GetParams() {
  85    InstallToEspOnMac=0
  86    if [[ $OSName == "Linux" ]] ; then
  87       # Install the driver required to read /boot, if it's available
  88       InstallDrivers="boot"
  89    else
  90       InstallDrivers="none"
  91    fi
  92    while [[ $# -gt 0 ]]; do
  93       case $1 in
  94          --esp | --ESP) InstallToEspOnMac=1
  95               ;;
  96          --usedefault) TargetDir=/EFI/BOOT
  97               TargetPart="$2"
  98               TargetX64="bootx64.efi"
  99               TargetIA32="bootia32.efi"
 100               shift
 101               ;;
 102          --root) RootDir="$2"
 103               shift
 104               ;;
 105          --localkeys) LocalKeys=1
 106               ;;
 107          --shim | --preloader) ShimSource="$2"
 108               ShimType=`basename $ShimSource`
 109               shift
 110               ;;
 111          --drivers | --alldrivers) InstallDrivers="all"
 112               ;;
 113          --nodrivers) InstallDrivers="none"
 114               ;;
 115          --yes) AlwaysYes=1
 116               ;;
 117          * ) echo "Usage: $0 [--esp | --usedefault {device-file} | --root {directory} ]"
 118              echo "                  [--nodrivers | --alldrivers] [--shim {shim-filename}]"
 119              echo "                  [--localkeys] [--yes]"
 120              exit 1
 121       esac
 122       shift
 123    done
 124
 125    if [[ $InstallToEspOnMac == 1 && "$TargetDir" == '/EFI/BOOT' ]] ; then
 126       echo "You may use --esp OR --usedefault, but not both! Aborting!"
 127       exit 1
 128    fi
 129    if [[ "$RootDir" != '/' && "$TargetDir" == '/EFI/BOOT' ]] ; then
 130       echo "You may use --usedefault OR --root, but not both! Aborting!"
 131       exit 1
 132    fi
 133    if [[ "$RootDir" != '/' && $InstallToEspOnMac == 1 ]] ; then
 134       echo "You may use --root OR --esp, but not both! Aborting!"
 135       exit 1
 136    fi
 137
 138    RLConfFile="$RootDir/boot/refind_linux.conf"
 139    EtcKeysDir="$RootDir/etc/refind.d/keys"
 140 } # GetParams()
 141
 142 # Get a yes/no response from the user and place it in the YesNo variable.
 143 # If the AlwaysYes variable is set to 1, skip the user input and set "Y"
 144 # in the YesNo variable.
 145 ReadYesNo() {
 146    if [[ $AlwaysYes == 1 ]] ; then
 147       YesNo="Y"
 148       echo "Y"
 149    else
 150       read YesNo
 151    fi
 152 }
 153
 154 # Abort if the rEFInd files can't be found.
 155 # Also sets $ConfFile to point to the configuration file,
 156 # $IconsDir to point to the icons directory, and
 157 # $ShimSource to the source of the shim.efi file (if necessary).
 158 CheckForFiles() {
 159    # Note: This check is satisfied if EITHER the 32- or the 64-bit version
 160    # is found, even on the wrong platform. This is because the platform
 161    # hasn't yet been determined. This could obviously be improved, but it
 162    # would mean restructuring lots more code....
 163    if [[ ! -f "$RefindDir/refind_ia32.efi" && ! -f "$RefindDir/refind_x64.efi" ]] ; then
 164       echo "The rEFInd binary file is missing! Aborting installation!"
 165       exit 1
 166    fi
 167
 168    if [[ -f "$RefindDir/refind.conf-sample" ]] ; then
 169       ConfFile="$RefindDir/refind.conf-sample"
 170    elif [[ -f "$ThisDir/refind.conf-sample" ]] ; then
 171       ConfFile="$ThisDir/refind.conf-sample"
 172    else
 173       echo "The sample configuration file is missing! Aborting installation!"
 174       exit 1
 175    fi
 176
 177    if [[ -d "$RefindDir/icons" ]] ; then
 178       IconsDir="$RefindDir/icons"
 179    elif [[ -d "$ThisDir/icons" ]] ; then
 180       IconsDir="$ThisDir/icons"
 181    else
 182       echo "The icons directory is missing! Aborting installation!"
 183       exit 1
 184    fi
 185
 186    if [[ "$ShimSource" != "none" ]] ; then
 187       if [[ -f "$ShimSource" ]] ; then
 188          if [[ $ShimType == "shimx64.efi" || $ShimType == "shim.efi" ]] ; then
 189             TargetX64="grubx64.efi"
 190             MokManagerSource=`dirname "$ShimSource"`/MokManager.efi
 191          elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 192             TargetX64="loader.efi"
 193             MokManagerSource=`dirname "$ShimSource"`/HashTool.efi
 194          else
 195             echo "Unknown shim/PreBootloader filename: $ShimType!"
 196             echo "Known filenames are shimx64.efi, shim.efi, and PreLoader.efi. Aborting!"
 197             exit 1
 198          fi
 199       else
 200          echo "The specified shim/PreBootloader file, $ShimSource, doesn't exist!"
 201          echo "Aborting installation!"
 202          exit 1
 203       fi
 204    fi
 205 } # CheckForFiles()
 206
 207 # Helper for CopyRefindFiles; copies shim files (including MokManager, if it's
 208 # available) to target.
 209 CopyShimFiles() {
 210    cp -fb "$ShimSource" "$InstallDir/$TargetDir/$TargetShim"
 211    if [[ $? != 0 ]] ; then
 212       Problems=1
 213    fi
 214    if [[ -f "$MokManagerSource" ]] ; then
 215       cp -fb "$MokManagerSource" "$InstallDir/$TargetDir/"
 216    fi
 217    if [[ $? != 0 ]] ; then
 218       Problems=1
 219    fi
 220 } # CopyShimFiles()
 221
 222 # Copy the public keys to the installation medium
 223 CopyKeys() {
 224    if [[ $LocalKeys == 1 ]] ; then
 225       mkdir -p "$InstallDir/$TargetDir/keys/"
 226       cp "$EtcKeysDir/$LocalKeysBase.cer" "$InstallDir/$TargetDir/keys/"
 227       cp "$EtcKeysDir/$LocalKeysBase.crt" "$InstallDir/$TargetDir/keys/"
 228    fi
 229 } # CopyKeys()
 230
 231 # Copy drivers from $RefindDir/drivers_$1 to $InstallDir/$TargetDir/drivers_$1,
 232 # honoring the $InstallDrivers condition. Must be passed a suitable
 233 # architecture code (ia32 or x64).
 234 CopyDrivers() {
 235    if [[ $InstallDrivers == "all" ]] ; then
 236       mkdir -p "$InstallDir/$TargetDir/drivers_$1"
 237       cp "$ThisDir"/drivers_$1/*_$1.efi "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 238       cp "$RefindDir"/drivers_$1/*_$1.efi "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 239    elif [[ "$InstallDrivers" == "boot" && -x `which blkid` ]] ; then
 240       BootPart=`df /boot | grep dev | cut -f 1 -d " "`
 241       BootFS=`blkid -o export $BootPart 2> /dev/null | grep TYPE= | cut -f 2 -d =`
 242       DriverType=""
 243       case $BootFS in
 244          ext2 | ext3) DriverType="ext2"
 245               # Could use ext4, but that can create unwanted entries from symbolic
 246               # links in / to /boot/vmlinuz if a separate /boot partition is used.
 247               ;;
 248          ext4) DriverType="ext4"
 249               ;;
 250          reiserfs) DriverType="reiserfs"
 251               ;;
 252          btrfs) DriverType="btrfs"
 253               ;;
 254          hfsplus) DriverType="hfs"
 255               ;;
 256          *) BootFS=""
 257       esac
 258       if [[ -n $BootFS ]] ; then
 259          echo "Installing driver for $BootFS (${DriverType}_$1.efi)"
 260          mkdir -p "$InstallDir/$TargetDir/drivers_$1"
 261          cp "$ThisDir/drivers_$1/${DriverType}_$1.efi" "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 262          cp "$RefindDir/drivers_$1/${DriverType}_$1.efi" "$InstallDir/$TargetDir/drivers_$1"/ 2> /dev/null
 263       fi
 264    fi
 265 }
 266
 267 # Copy tools (currently only gptsync, and that only on Macs) to the EFI/tools
 268 # directory on the ESP. Must be passed a suitable architecture code (ia32
 269 # or x64).
 270 CopyTools() {
 271    mkdir -p $InstallDir/EFI/tools
 272    if [[ $OSName == 'Darwin' ]] ; then
 273       cp -f "$RefindDir/tools_$1/gptsync_$1.efi" "$InstallDir/EFI/tools/"
 274       if [[ -f "$InstallDir/EFI/tools/gptsync.efi" ]] ; then
 275          mv "$InstallDir/EFI/tools/gptsync.efi" "$InstallDir/EFI/tools/gptsync.efi-disabled"
 276          echo "Found old gptsync.efi; disabling it by renaming it to gptsync.efi-disabled"
 277       fi
 278    fi
 279 } # CopyTools()
 280
 281 # Copy the rEFInd files to the ESP or OS X root partition.
 282 # Sets Problems=1 if any critical commands fail.
 283 CopyRefindFiles() {
 284    mkdir -p "$InstallDir/$TargetDir"
 285    if [[ "$TargetDir" == '/EFI/BOOT' ]] ; then
 286       cp "$RefindDir/refind_ia32.efi" "$InstallDir/$TargetDir/$TargetIA32" 2> /dev/null
 287       if [[ $? != 0 ]] ; then
 288          echo "Note: IA32 (x86) binary not installed!"
 289       fi
 290       cp "$RefindDir/refind_x64.efi" "$InstallDir/$TargetDir/$TargetX64" 2> /dev/null
 291       if [[ $? != 0 ]] ; then
 292          Problems=1
 293       fi
 294       if [[ "$ShimSource" != "none" ]] ; then
 295          TargetShim="bootx64.efi"
 296          CopyShimFiles
 297       fi
 298       if [[ $InstallDrivers == "all" ]] ; then
 299          cp -r "$RefindDir"/drivers_* "$InstallDir/$TargetDir/" 2> /dev/null
 300          cp -r "$ThisDir"/drivers_* "$InstallDir/$TargetDir/" 2> /dev/null
 301       elif [[ $Upgrade == 1 ]] ; then
 302          if [[ $Platform == 'EFI64' ]] ; then
 303             CopyDrivers x64
 304             CopyTools x64
 305          else
 306             CopyDrivers ia32
 307             CopyTools ia32
 308          fi
 309       fi
 310       Refind=""
 311       CopyKeys
 312    elif [[ $Platform == 'EFI64' || $TargetDir == "/EFI/Microsoft/Boot" ]] ; then
 313       cp "$RefindDir/refind_x64.efi" "$InstallDir/$TargetDir/$TargetX64"
 314       if [[ $? != 0 ]] ; then
 315          Problems=1
 316       fi
 317       CopyDrivers x64
 318       CopyTools x64
 319       Refind="refind_x64.efi"
 320       CopyKeys
 321       if [[ "$ShimSource" != "none" ]] ; then
 322          if [[ "$TargetShim" == "default" ]] ; then
 323             TargetShim=`basename "$ShimSource"`
 324          fi
 325          CopyShimFiles
 326          Refind="$TargetShim"
 327          if [[ $LocalKeys == 0 ]] ; then
 328             echo "Storing copies of rEFInd Secure Boot public keys in $EtcKeysDir"
 329             mkdir -p "$EtcKeysDir"
 330             cp "$ThisDir/keys/refind.cer" "$EtcKeysDir" 2> /dev/null
 331             cp "$ThisDir/keys/refind.crt" "$EtcKeysDir" 2> /dev/null
 332          fi
 333       fi
 334    elif [[ $Platform == 'EFI32' ]] ; then
 335       cp "$RefindDir/refind_ia32.efi" "$InstallDir/$TargetDir/$TargetIA32"
 336       if [[ $? != 0 ]] ; then
 337          Problems=1
 338       fi
 339       CopyDrivers ia32
 340       CopyTools ia32
 341       Refind="refind_ia32.efi"
 342    else
 343       echo "Unknown platform! Aborting!"
 344       exit 1
 345    fi
 346    echo "Copied rEFInd binary files"
 347    echo ""
 348    if [[ -d "$InstallDir/$TargetDir/icons" ]] ; then
 349       rm -rf "$InstallDir/$TargetDir/icons-backup" &> /dev/null
 350       mv -f "$InstallDir/$TargetDir/icons" "$InstallDir/$TargetDir/icons-backup"
 351       echo "Notice: Backed up existing icons directory as icons-backup."
 352    fi
 353    cp -r "$IconsDir" "$InstallDir/$TargetDir"
 354    if [[ $? != 0 ]] ; then
 355       Problems=1
 356    fi
 357    mkdir -p "$InstallDir/$TargetDir/keys"
 358    cp -rf "$ThisDir"/keys/*.[cd]er "$InstallDir/$TargetDir/keys/" 2> /dev/null
 359    cp -rf "$EtcKeysDir"/*.[cd]er "$InstallDir/$TargetDir/keys/" 2> /dev/null
 360    if [[ -f "$InstallDir/$TargetDir/refind.conf" ]] ; then
 361       echo "Existing refind.conf file found; copying sample file as refind.conf-sample"
 362       echo "to avoid overwriting your customizations."
 363       echo ""
 364       cp -f "$ConfFile" "$InstallDir/$TargetDir"
 365       if [[ $? != 0 ]] ; then
 366          Problems=1
 367       fi
 368    else
 369       echo "Copying sample configuration file as refind.conf; edit this file to configure"
 370       echo "rEFInd."
 371       echo ""
 372       cp -f "$ConfFile" "$InstallDir/$TargetDir/refind.conf"
 373       if [[ $? != 0 ]] ; then
 374          Problems=1
 375       fi
 376    fi
 377    if [[ $DeleteRefindDir == 1 ]] ; then
 378       echo "Deleting the temporary directory $RefindDir"
 379       rm -r "$RefindDir"
 380    fi
 381 } # CopyRefindFiles()
 382
 383 # Mount the partition the user specified with the --usedefault option
 384 MountDefaultTarget() {
 385    InstallDir=/tmp/refind_install
 386    mkdir -p "$InstallDir"
 387    if [[ $OSName == 'Darwin' ]] ; then
 388       mount -t msdos "$TargetPart" "$InstallDir"
 389    elif [[ $OSName == 'Linux' ]] ; then
 390       mount -t vfat "$TargetPart" "$InstallDir"
 391    fi
 392    if [[ $? != 0 ]] ; then
 393       echo "Couldn't mount $TargetPart ! Aborting!"
 394       rmdir "$InstallDir"
 395       exit 1
 396    fi
 397    UnmountEsp=1
 398 } # MountDefaultTarget()
 399
 400 #
 401 # A series of OS X support functions....
 402 #
 403
 404 # Mount the ESP at /Volumes/ESP or determine its current mount
 405 # point.
 406 # Sets InstallDir to the ESP mount point
 407 # Sets UnmountEsp if we mounted it
 408 MountOSXESP() {
 409    # Identify the ESP. Note: This returns the FIRST ESP found;
 410    # if the system has multiple disks, this could be wrong!
 411    Temp=`diskutil list | grep " EFI "`
 412    Esp=/dev/`echo $Temp | cut -f 5 -d ' '`
 413    # If the ESP is mounted, use its current mount point....
 414    Temp=`df | grep "$Esp"`
 415    InstallDir=`echo $Temp | cut -f 6 -d ' '`
 416    if [[ "$InstallDir" == '' ]] ; then
 417       mkdir /Volumes/ESP &> /dev/null
 418       mount -t msdos "$Esp" /Volumes/ESP
 419       if [[ $? != 0 ]] ; then
 420          echo "Unable to mount ESP! Aborting!\n"
 421          exit 1
 422       fi
 423       UnmountEsp=1
 424       InstallDir="/Volumes/ESP"
 425    fi
 426 } # MountOSXESP()
 427
 428 # Control the OS X installation.
 429 # Sets Problems=1 if problems found during the installation.
 430 InstallOnOSX() {
 431    echo "Installing rEFInd on OS X...."
 432    if [[ "$TargetDir" == "/EFI/BOOT" ]] ; then
 433       MountDefaultTarget
 434    elif [[ "$InstallToEspOnMac" == "1" ]] ; then
 435       MountOSXESP
 436    else
 437       InstallDir="$RootDir/"
 438    fi
 439    echo "Installing rEFInd to the partition mounted at $InstallDir"
 440    Platform=`ioreg -l -p IODeviceTree | grep firmware-abi | cut -d "\"" -f 4`
 441    CopyRefindFiles
 442    if [[ $InstallToEspOnMac == "1" ]] ; then
 443       bless --mount "$InstallDir" --setBoot --file "$InstallDir/$TargetDir/$Refind"
 444    elif [[ "$TargetDir" != "/EFI/BOOT" ]] ; then
 445       bless --setBoot --folder "$InstallDir/$TargetDir" --file "$InstallDir/$TargetDir/$Refind"
 446    fi
 447    if [[ $? != 0 ]] ; then
 448       Problems=1
 449    fi
 450    if [[ -f /Library/StartupItems/rEFItBlesser || -d /Library/StartupItems/rEFItBlesser ]] ; then
 451       echo
 452       echo "/Library/StartupItems/rEFItBlesser found!"
 453       echo "This program is part of rEFIt, and will cause rEFInd to fail to work after"
 454       echo -n "its first boot. Do you want to remove rEFItBlesser (Y/N)? "
 455       ReadYesNo
 456       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 457          echo "Deleting /Library/StartupItems/rEFItBlesser..."
 458          rm -r /Library/StartupItems/rEFItBlesser
 459       else
 460          echo "Not deleting rEFItBlesser."
 461       fi
 462    fi
 463    echo
 464    echo "WARNING: If you have an Advanced Format disk, *DO NOT* attempt to check the"
 465    echo "bless status with 'bless --info', since this is known to cause disk corruption"
 466    echo "on some systems!!"
 467    echo
 468 } # InstallOnOSX()
 469
 470
 471 #
 472 # Now a series of Linux support functions....
 473 #
 474
 475 # Check for evidence that we're running in Secure Boot mode. If so, and if
 476 # appropriate options haven't been set, warn the user and offer to abort.
 477 # If we're NOT in Secure Boot mode but the user HAS specified the --shim
 478 # or --localkeys option, warn the user and offer to abort.
 479 #
 480 # FIXME: Although I checked the presence (and lack thereof) of the
 481 # /sys/firmware/efi/vars/SecureBoot* files on my Secure Boot test system
 482 # before releasing this script, I've since found that they are at least
 483 # sometimes present when Secure Boot is absent. This means that the first
 484 # test can produce false alarms. A better test is highly desirable.
 485 CheckSecureBoot() {
 486    VarFile=`ls -d /sys/firmware/efi/vars/SecureBoot* 2> /dev/null`
 487    if [[ -n "$VarFile" && "$TargetDir" != '/EFI/BOOT' && "$ShimSource" == "none" ]] ; then
 488       echo ""
 489       echo "CAUTION: Your computer appears to support Secure Boot, but you haven't"
 490       echo "specified a valid shim.efi file source. If you've disabled Secure Boot and"
 491       echo "intend to leave it disabled, this is fine; but if Secure Boot is active, the"
 492       echo "resulting installation won't boot. You can read more about this topic at"
 493       echo "http://www.rodsbooks.com/refind/secureboot.html."
 494       echo ""
 495       echo -n "Do you want to proceed with installation (Y/N)? "
 496       ReadYesNo
 497       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 498          echo "OK; continuing with the installation..."
 499       else
 500          exit 0
 501       fi
 502    fi
 503
 504    if [[ "$ShimSource" != "none" && ! -n "$VarFile" ]] ; then
 505       echo ""
 506       echo "You've specified installing using a shim.efi file, but your computer does not"
 507       echo "appear to be running in Secure Boot mode. Although installing in this way"
 508       echo "should work, it's unnecessarily complex. You may continue, but unless you"
 509       echo "plan to enable Secure Boot, you should consider stopping and omitting the"
 510       echo "--shim option. You can read more about this topic at"
 511       echo "http://www.rodsbooks.com/refind/secureboot.html."
 512       echo ""
 513       echo -n "Do you want to proceed with installation (Y/N)? "
 514       ReadYesNo
 515       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 516          echo "OK; continuing with the installation..."
 517       else
 518          exit 0
 519       fi
 520    fi
 521
 522    if [[ $LocalKeys != 0 && ! -n "$VarFile" ]] ; then
 523       echo ""
 524       echo "You've specified re-signing your rEFInd binaries with locally-generated keys,"
 525       echo "but your computer does not appear to be running in Secure Boot mode. The"
 526       echo "keys you generate will be useless unless you enable Secure Boot. You may"
 527       echo "proceed with this installation, but before you do so, you may want to read"
 528       echo "more about it at http://www.rodsbooks.com/refind/secureboot.html."
 529       echo ""
 530       echo -n "Do you want to proceed with installation (Y/N)? "
 531       ReadYesNo
 532       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 533          echo "OK; continuing with the installation..."
 534       else
 535          exit 0
 536       fi
 537    fi
 538
 539 } # CheckSecureBoot()
 540
 541 # Check for the presence of locally-generated keys from a previous installation in
 542 # $EtcKeysDir (/etc/refind.d/keys). If they're not present, generate them using
 543 # openssl.
 544 GenerateKeys() {
 545    PrivateKey="$EtcKeysDir/$LocalKeysBase.key"
 546    CertKey="$EtcKeysDir/$LocalKeysBase.crt"
 547    DerKey="$EtcKeysDir/$LocalKeysBase.cer"
 548    OpenSSL=`which openssl 2> /dev/null`
 549
 550    # Do the work only if one or more of the necessary keys is missing
 551    # TODO: Technically, we don't need the DerKey; but if it's missing and openssl
 552    # is also missing, this will fail. This could be improved.
 553    if [[ ! -f "$PrivateKey" || ! -f "$CertKey" || ! -f "$DerKey" ]] ; then
 554       echo "Generating a fresh set of local keys...."
 555       mkdir -p "$EtcKeysDir"
 556       chmod 0700 "$EtcKeysDir"
 557       if [[ ! -x "$OpenSSL" ]] ; then
 558          echo "Can't find openssl, which is required to create your private signing keys!"
 559          echo "Aborting!"
 560          exit 1
 561       fi
 562       if [[ -f "$PrivateKey" ]] ; then
 563          echo "Backing up existing $PrivateKey"
 564          cp -f "$PrivateKey" "$PrivateKey.backup" 2> /dev/null
 565       fi
 566       if [[ -f "$CertKey" ]] ; then
 567          echo "Backing up existing $CertKey"
 568          cp -f "$CertKey" "$CertKey.backup" 2> /dev/null
 569       fi
 570       if [[ -f "$DerKey" ]] ; then
 571          echo "Backing up existing $DerKey"
 572          cp -f "$DerKey" "$DerKey.backup" 2> /dev/null
 573       fi
 574       "$OpenSSL" req -new -x509 -newkey rsa:2048 -keyout "$PrivateKey" -out "$CertKey" \
 575                      -nodes -days 3650 -subj "/CN=Locally-generated rEFInd key/"
 576       "$OpenSSL" x509 -in "$CertKey" -out "$DerKey" -outform DER
 577       chmod 0600 "$PrivateKey"
 578    else
 579       echo "Using existing local keys...."
 580    fi
 581 }
 582
 583 # Sign a single binary. Requires parameters:
 584 #   $1 = source file
 585 #   $2 = destination file
 586 # Also assumes that the SBSign, PESign, UseSBSign, UsePESign, and various key variables are set
 587 # appropriately.
 588 # Aborts script on error
 589 SignOneBinary() {
 590    $SBSign --key "$PrivateKey" --cert "$CertKey" --output "$2" "$1"
 591    if [[ $? != 0 ]] ; then
 592       echo "Problem signing the binary $1! Aborting!"
 593       exit 1
 594    fi
 595 }
 596
 597 # Re-sign the x86-64 binaries with a locally-generated key, First look for appropriate
 598 # key files in $EtcKeysDir. If they're present, use them to re-sign the binaries. If
 599 # not, try to generate new keys and store them in $EtcKeysDir.
 600 ReSignBinaries() {
 601    SBSign=`which sbsign 2> /dev/null`
 602    echo "Found sbsign at $SBSign"
 603    TempDir="/tmp/refind_local"
 604    if [[ ! -x "$SBSign" ]] ; then
 605       echo "Can't find sbsign, which is required to sign rEFInd with your own keys!"
 606       echo "Aborting!"
 607       exit 1
 608    fi
 609    GenerateKeys
 610    mkdir -p "$TempDir/drivers_x64"
 611    cp "$RefindDir/refind.conf-sample $TempDir" 2> /dev/null
 612    cp "$ThisDir/refind.conf-sample $TempDir" 2> /dev/null
 613    cp "$RefindDir/refind_ia32.efi $TempDir" 2> /dev/null
 614    cp -a "$RefindDir/drivers_ia32 $TempDir" 2> /dev/null
 615    cp -a "$ThisDir/drivers_ia32 $TempDir" 2> /dev/null
 616    SignOneBinary "$RefindDir/refind_x64.efi" "$TempDir/refind_x64.efi"
 617    SaveIFS=$IFS
 618    IFS=$(echo -en "\n\b")
 619    for Driver in `ls "$RefindDir"/drivers_x64/*.efi "$ThisDir"/drivers_x64/*.efi 2> /dev/null` ; do
 620       TempName=`basename "$Driver"`
 621       SignOneBinary "$Driver" "$TempDir/drivers_x64/$TempName"
 622    done
 623    IFS=$SaveIFS
 624    RefindDir="$TempDir"
 625    DeleteRefindDir=1
 626 }
 627
 628 # Identifies the ESP's location (/boot or /boot/efi, or these locations under
 629 # the directory specified by --root); aborts if the ESP isn't mounted at
 630 # either location.
 631 # Sets InstallDir to the ESP mount point.
 632 FindLinuxESP() {
 633    EspLine=`df "$RootDir/boot/efi" 2> /dev/null | grep boot/efi`
 634    if [[ ! -n "$EspLine" ]] ; then
 635       EspLine=`df "$RootDir"/boot | grep boot`
 636    fi
 637    InstallDir=`echo $EspLine | cut -d " " -f 6`
 638    if [[ -n "$InstallDir" ]] ; then
 639       EspFilesystem=`grep "$InstallDir" /etc/mtab | uniq | grep -v autofs | cut -d " " -f 3`
 640    fi
 641    echo "EspFilesystem is '$EspFilesystem'"
 642    if [[ $EspFilesystem != 'vfat' ]] ; then
 643       echo "$RootDir/boot/efi doesn't seem to be on a VFAT filesystem. The ESP must be"
 644       echo "mounted at $RootDir/boot or $RootDir/boot/efi and it must be VFAT! Aborting!"
 645       exit 1
 646    fi
 647    echo "ESP was found at $InstallDir using $EspFilesystem"
 648 } # FindLinuxESP
 649
 650 # Uses efibootmgr to add an entry for rEFInd to the EFI's NVRAM.
 651 # If this fails, sets Problems=1
 652 AddBootEntry() {
 653    InstallIt="0"
 654    Efibootmgr=`which efibootmgr 2> /dev/null`
 655    if [[ "$Efibootmgr" ]] ; then
 656       InstallDisk=`grep "$InstallDir" /etc/mtab | cut -d " " -f 1 | cut -c 1-8`
 657       PartNum=`grep "$InstallDir" /etc/mtab | cut -d " " -f 1 | cut -c 9-10`
 658       EntryFilename="$TargetDir/$Refind"
 659       EfiEntryFilename=`echo ${EntryFilename//\//\\\}`
 660       EfiEntryFilename2=`echo ${EfiEntryFilename} | sed s/\\\\\\\\/\\\\\\\\\\\\\\\\/g`
 661       ExistingEntry=`"$Efibootmgr" -v | grep -i "$EfiEntryFilename2"`
 662
 663       if [[ "$ExistingEntry" ]] ; then
 664          ExistingEntryBootNum=`echo "$ExistingEntry" | cut -c 5-8`
 665          FirstBoot=`"$Efibootmgr" | grep BootOrder | cut -c 12-15`
 666          if [[ "$ExistingEntryBootNum" != "$FirstBoot" ]] ; then
 667             echo "An existing rEFInd boot entry exists, but isn't set as the default boot"
 668             echo "manager. The boot order is being adjusted to make rEFInd the default boot"
 669             echo "manager. If this is NOT what you want, you should use efibootmgr to"
 670             echo "manually adjust your EFI's boot order."
 671             "$Efibootmgr" -b $ExistingEntryBootNum -B &> /dev/null
 672             InstallIt="1"
 673          fi
 674       else
 675          InstallIt="1"
 676       fi
 677
 678       if [[ $InstallIt == "1" ]] ; then
 679          echo "Installing it!"
 680          "$Efibootmgr" -c -l "$EfiEntryFilename" -L "rEFInd Boot Manager" -d $InstallDisk -p $PartNum &> /dev/null
 681          if [[ $? != 0 ]] ; then
 682             EfibootmgrProblems=1
 683             Problems=1
 684          fi
 685       fi
 686
 687    else # efibootmgr not found
 688       EfibootmgrProblems=1
 689       Problems=1
 690    fi
 691
 692    if [[ $EfibootmgrProblems ]] ; then
 693       echo
 694       echo "ALERT: There were problems running the efibootmgr program! You may need to"
 695       echo "rename the $Refind binary to the default name (EFI/boot/bootx64.efi"
 696       echo "on x86-64 systems or EFI/boot/bootia32.efi on x86 systems) to have it run!"
 697       echo
 698    fi
 699 } # AddBootEntry()
 700
 701 # Create a minimal/sample refind_linux.conf file in /boot.
 702 GenerateRefindLinuxConf() {
 703    if [[ -f "$RLConfFile" ]] ; then
 704       echo "Existing $RLConfFile found; not overwriting."
 705    else
 706       if [[ -f "$RootDir/etc/default/grub" ]] ; then
 707          # We want the default options used by the distribution, stored here....
 708          source "$RootDir/etc/default/grub"
 709          echo "Setting default boot options based on $RootDir/etc/default/grub"
 710       fi
 711       RootFS=`df "$RootDir" | grep dev | cut -f 1 -d " "`
 712       StartOfDevname=`echo "$RootFS" | cut -b 1-7`
 713       if [[ "$StartOfDevname" == "/dev/sd" || "$StartOfDevName" == "/dev/hd" ]] ; then
 714          # Identify root filesystem by UUID rather than by device node, if possible
 715          Uuid=`blkid -o export "$RootFS" 2> /dev/null | grep UUID=`
 716          if [[ -n $Uuid ]] ; then
 717             RootFS="$Uuid"
 718          fi
 719       fi
 720       DefaultOptions="$GRUB_CMDLINE_LINUX $GRUB_CMDLINE_LINUX_DEFAULT"
 721       echo "\"Boot with standard options\" \"ro root=$RootFS $DefaultOptions \"" > $RLConfFile
 722       echo "\"Boot to single-user mode\"   \"ro root=$RootFS $DefaultOptions single\"" >> $RLConfFile
 723       echo "\"Boot with minimal options\"  \"ro root=$RootFS\"" >> $RLConfFile
 724    fi
 725 }
 726
 727 # Set varaibles for installation in EFI/BOOT directory
 728 SetVarsForBoot() {
 729    TargetDir="/EFI/BOOT"
 730    if [[ $ShimSource == "none" ]] ; then
 731       TargetX64="bootx64.efi"
 732       TargetIA32="bootia32.efi"
 733    else
 734       if [[ $ShimType == "shim.efi" || $ShimType == "shimx64.efi" ]] ; then
 735          TargetX64="grubx64.efi"
 736       elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 737          TargetX64="loader.efi"
 738       else
 739          echo "Unknown shim/PreBootloader type: $ShimType"
 740          echo "Aborting!"
 741          exit 1
 742       fi
 743       TargetIA32="bootia32.efi"
 744       TargetShim="bootx64.efi"
 745    fi
 746 } # SetFilenamesForBoot()
 747
 748 # Set variables for installation in EFI/Microsoft/Boot directory
 749 SetVarsForMsBoot() {
 750    TargetDir="/EFI/Microsoft/Boot"
 751    if [[ $ShimSource == "none" ]] ; then
 752       TargetX64="bootmgfw.efi"
 753    else
 754       if [[ $ShimType == "shim.efi" || $ShimType == "shimx64.efi" ]] ; then
 755          TargetX64="grubx64.efi"
 756       elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 757          TargetX64="loader.efi"
 758       else
 759          echo "Unknown shim/PreBootloader type: $ShimType"
 760          echo "Aborting!"
 761          exit 1
 762       fi
 763       TargetShim="bootmgfw.efi"
 764    fi
 765 }
 766
 767 # TargetDir defaults to /EFI/refind; however, this function adjusts it as follows:
 768 # - If an existing refind.conf is available in /EFI/BOOT or /EFI/Microsoft/Boot,
 769 #   install to that directory under the suitable name; but DO NOT do this if
 770 #   refind.conf is also in /EFI/refind.
 771 # - If booted in BIOS mode and the ESP lacks any other EFI files, install to
 772 #   /EFI/BOOT
 773 # - If booted in BIOS mode and there's no refind.conf file and there is a
 774 #   /EFI/Microsoft/Boot/bootmgfw.efi file, move it down one level and
 775 #   install under that name, "hijacking" the Windows boot loader filename
 776 DetermineTargetDir() {
 777    Upgrade=0
 778
 779    if [[ -f $InstallDir/EFI/BOOT/refind.conf ]] ; then
 780       SetVarsForBoot
 781       Upgrade=1
 782    fi
 783    if [[ -f $InstallDir/EFI/Microsoft/Boot/refind.conf ]] ; then
 784       SetVarsForMsBoot
 785       Upgrade=1
 786    fi
 787    if [[ -f $InstallDir/EFI/refind/refind.conf ]] ; then
 788       TargetDir="/EFI/refind"
 789       Upgrade=1
 790    fi
 791    if [[ $Upgrade == 1 ]] ; then
 792       echo "Found rEFInd installation in $InstallDir$TargetDir; upgrading it."
 793    fi
 794
 795    if [[ ! -d /sys/firmware/efi && $Upgrade == 0 ]] ; then     # BIOS-mode
 796       FoundEfiFiles=`find "$InstallDir/EFI/BOOT" -name "*.efi" 2> /dev/null`
 797       FoundConfFiles=`find "$InstallDir" -name "refind\.conf" 2> /dev/null`
 798       if [[ ! -n "$FoundConfFiles" && -f "$InstallDir/EFI/Microsoft/Boot/bootmgfw.efi" ]] ; then
 799          mv -n "$InstallDir/EFI/Microsoft/Boot/bootmgfw.efi" "$InstallDir/EFI/Microsoft" &> /dev/null
 800          SetVarsForMsBoot
 801          echo "Running in BIOS mode with a suspected Windows installation; moving boot loader"
 802          echo "files so as to install to $InstallDir$TargetDir."
 803       elif [[ ! -n "$FoundEfiFiles" ]] ; then  # In BIOS mode and no default loader; install as default loader
 804          SetVarsForBoot
 805          echo "Running in BIOS mode with no existing default boot loader; installing to"
 806          echo $InstallDir$TargetDir
 807       else
 808          echo "Running in BIOS mode with an existing default boot loader; backing it up and"
 809          echo "installing rEFInd in its place."
 810          if [[ -d "$InstallDir/EFI/BOOT-rEFIndBackup" ]] ; then
 811             echo ""
 812             echo "Caution: An existing backup of a default boot loader exists! If the current"
 813             echo "default boot loader and the backup are different boot loaders, the current"
 814             echo "one will become inaccessible."
 815             echo ""
 816             echo -n "Do you want to proceed with installation (Y/N)? "
 817             ReadYesNo
 818             if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 819                echo "OK; continuing with the installation..."
 820             else
 821                exit 0
 822             fi
 823          fi
 824          mv -n "$InstallDir/EFI/BOOT" "$InstallDir/EFI/BOOT-rEFIndBackup"
 825          SetVarsForBoot
 826       fi
 827    fi # BIOS-mode
 828 } # DetermineTargetDir()
 829
 830 # Controls rEFInd installation under Linux.
 831 # Sets Problems=1 if something goes wrong.
 832 InstallOnLinux() {
 833    echo "Installing rEFInd on Linux...."
 834    modprobe efivars &> /dev/null
 835    if [[ $TargetDir == "/EFI/BOOT" ]] ; then
 836       MountDefaultTarget
 837    else
 838       FindLinuxESP
 839       DetermineTargetDir
 840    fi
 841    CpuType=`uname -m`
 842    if [[ $CpuType == 'x86_64' ]] ; then
 843       Platform="EFI64"
 844    elif [[ ($CpuType == 'i386' || $CpuType == 'i486' || $CpuType == 'i586' || $CpuType == 'i686') ]] ; then
 845       Platform="EFI32"
 846       # If we're in EFI mode, do some sanity checks, and alert the user or even
 847       # abort. Not in BIOS mode, though, since that could be used on an emergency
 848       # disc to try to recover a troubled Linux installation.
 849       if [[ -d /sys/firmware/efi ]] ; then
 850          if [[ "$ShimSource" != "none" && "$TargetDir" != "/BOOT/EFI" ]] ; then
 851             echo ""
 852             echo "CAUTION: shim does not currently supports 32-bit systems, so you should not"
 853             echo "use the --shim option to install on such systems. Aborting!"
 854             echo ""
 855             exit 1
 856          fi
 857          echo
 858          echo "CAUTION: This Linux installation uses a 32-bit kernel. 32-bit EFI-based"
 859          echo "computers are VERY RARE. If you've installed a 32-bit version of Linux"
 860          echo "on a 64-bit computer, you should manually install the 64-bit version of"
 861          echo "rEFInd. If you're installing on a Mac, you should do so from OS X. If"
 862          echo "you're positive you want to continue with this installation, answer 'Y'"
 863          echo "to the following question..."
 864          echo
 865          echo -n "Are you sure you want to continue (Y/N)? "
 866          ReadYesNo
 867          if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 868             echo "OK; continuing with the installation..."
 869          else
 870             exit 0
 871          fi
 872       fi # in EFI mode
 873    else
 874       echo "Unknown CPU type '$CpuType'; aborting!"
 875       exit 1
 876    fi
 877
 878    if [[ $LocalKeys == 1 ]] ; then
 879       ReSignBinaries
 880    fi
 881
 882    CheckSecureBoot
 883    CopyRefindFiles
 884    if [[ "$TargetDir" != "/EFI/BOOT" && "$TargetDir" != "/EFI/Microsoft/Boot" ]] ; then
 885       AddBootEntry
 886       GenerateRefindLinuxConf
 887    fi
 888 } # InstallOnLinux()
 889
 890 #
 891 # The main part of the script. Sets a few environment variables,
 892 # performs a few startup checks, and then calls functions to
 893 # install under OS X or Linux, depending on the detected platform.
 894 #
 895
 896 OSName=`uname -s`
 897 GetParams "$@"
 898 ThisDir="$( cd -P "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 899 RefindDir="$ThisDir/refind"
 900 ThisScript="$ThisDir/`basename $0`"
 901 if [[ `whoami` != "root" ]] ; then
 902    echo "Not running as root; attempting to elevate privileges via sudo...."
 903    sudo "$ThisScript" "$@"
 904    if [[ $? != 0 ]] ; then
 905       echo "This script must be run as root (or using sudo). Exiting!"
 906       exit 1
 907    else
 908       exit 0
 909    fi
 910 fi
 911 CheckForFiles
 912 if [[ $OSName == 'Darwin' ]] ; then
 913    if [[ "$ShimSource" != "none" ]] ; then
 914       echo "The --shim option is not supported on OS X! Exiting!"
 915       exit 1
 916    fi
 917    if [[ "$LocalKeys" != 0 ]] ; then
 918       echo "The --localkeys option is not supported on OS X! Exiting!"
 919       exit 1
 920    fi
 921    InstallOnOSX $1
 922 elif [[ $OSName == 'Linux' ]] ; then
 923    InstallOnLinux
 924 else
 925    echo "Running on unknown OS; aborting!"
 926 fi
 927
 928 if [[ $Problems ]] ; then
 929    echo
 930    echo "ALERT:"
 931    echo "Installation has completed, but problems were detected. Review the output for"
 932    echo "error messages and take corrective measures as necessary. You may need to"
 933    echo "re-run this script or install manually before rEFInd will work."
 934    echo
 935 else
 936    echo
 937    echo "Installation has completed successfully."
 938    echo
 939 fi
 940
 941 if [[ $UnmountEsp ]] ; then
 942    echo "Unmounting install dir"
 943    umount $InstallDir
 944 fi
 945
 946 if [[ "$InstallDir" == /tmp/refind_install ]] ; then
 947 #   sleep 5
 948    rmdir "$InstallDir"
 949 fi