code.delx.au - refind/blob - install.sh

   1 #!/bin/bash
   2 #
   3 # Linux/MacOS X script to install rEFInd
   4 #
   5 # Usage:
   6 #
   7 # ./install.sh [options]
   8 #
   9 # options include:
  10 #    "--esp" to install to the ESP rather than to the system's root
  11 #           filesystem. This is the default on Linux
  12 #    "--usedefault {devicefile}" to install as default
  13 #           (/EFI/BOOT/BOOTX64.EFI and similar) to the specified device
  14 #           (/dev/sdd1 or whatever) without registering with the NVRAM.
  15 #    "--root {dir}" to specify installation using the specified directory
  16 #           as the system's root
  17 #    "--alldrivers" to install all drivers along with regular files
  18 #    "--nodrivers" to suppress driver installation (default in Linux is
  19 #           driver used on /boot; --nodrivers is OS X default)
  20 #    "--shim {shimfile}" to install a shim.efi file for Secure Boot
  21 #    "--preloader" is synonymous with "--shim"
  22 #    "--localkeys" to re-sign x86-64 binaries with a locally-generated key
  23 #    "--yes" to assume a "yes" response to all prompts
  24 #
  25 # The "esp" option is valid only on Mac OS X; it causes
  26 # installation to the EFI System Partition (ESP) rather than
  27 # to the current OS X boot partition. Under Linux, this script
  28 # installs to the ESP by default.
  29 #
  30 # This program is copyright (c) 2012 by Roderick W. Smith
  31 # It is released under the terms of the GNU GPL, version 3,
  32 # a copy of which should be included in the file COPYING.txt.
  33 #
  34 # Revision history:
  35 #
  36 # 0.7.2   -- Fixed code that could be confused by use of autofs to mount the ESP
  37 # 0.7.0   -- Added support for the new Btrfs driver
  38 # 0.6.12  -- Added support for PreLoader as well as for shim
  39 # 0.6.11  -- Improvements in script's ability to handle directories with spaces
  40 #            in their names
  41 # 0.6.9   -- Install gptsync on Macs
  42 # 0.6.8   -- Bug fix: ESP scan now uses "uniq".
  43 # 0.6.6   -- Bug fix: Upgrade drivers when installed to EFI/BOOT. Also enable
  44 #            copying shim.efi and MokManager.efi over themselves.
  45 # 0.6.4   -- Copies ext2 driver rather than ext4 driver for ext2/3fs
  46 # 0.6.3   -- Support for detecting rEFInd in EFI/BOOT and EFI/Microsoft/Boot
  47 #            directories & for installing to EFI/BOOT in BIOS mode
  48 # 0.6.2-1 -- Added --yes option & tweaked key-copying for use with RPM install script
  49 # 0.6.1   -- Added --root option; minor bug fixes
  50 # 0.6.0   -- Changed --drivers to --alldrivers and added --nodrivers option;
  51 #            changed default driver installation behavior in Linux to install
  52 #            the driver needed to read /boot (if available)
  53 # 0.5.1.2 -- Fixed bug that caused failure to generate refind_linux.conf file
  54 # 0.5.1.1 -- Fixed bug that caused script failure under OS X
  55 # 0.5.1   -- Added --shim & --localkeys options & create sample refind_linux.conf
  56 #            in /boot
  57 # 0.5.0   -- Added --usedefault & --drivers options & changed "esp" option to "--esp"
  58 # 0.4.5   -- Fixed check for rEFItBlesser in OS X
  59 # 0.4.2   -- Added notice about BIOS-based OSes & made NVRAM changes in Linux smarter
  60 # 0.4.1   -- Added check for rEFItBlesser in OS X
  61 # 0.3.3.1 -- Fixed OS X 10.7 bug; also works as make target
  62 # 0.3.2.1 -- Check for presence of source files; aborts if not present
  63 # 0.3.2   -- Initial version
  64 #
  65 # Note: install.sh version numbers match those of the rEFInd package
  66 # with which they first appeared.
  67
  68 RootDir="/"
  69 TargetDir=/EFI/refind
  70 LocalKeysBase="refind_local"
  71 ShimSource="none"
  72 ShimType="none"
  73 TargetShim="default"
  74 TargetX64="refind_x64.efi"
  75 TargetIA32="refind_ia32.efi"
  76 LocalKeys=0
  77 DeleteRefindDir=0
  78 AlwaysYes=0
  79
  80 #
  81 # Functions used by both OS X and Linux....
  82 #
  83
  84 GetParams() {
  85    InstallToEspOnMac=0
  86    if [[ $OSName == "Linux" ]] ; then
  87       # Install the driver required to read /boot, if it's available
  88       InstallDrivers="boot"
  89    else
  90       InstallDrivers="none"
  91    fi
  92    while [[ $# -gt 0 ]]; do
  93       case $1 in
  94          --esp | --ESP) InstallToEspOnMac=1
  95               ;;
  96          --usedefault) TargetDir=/EFI/BOOT
  97               TargetPart="$2"
  98               TargetX64="bootx64.efi"
  99               TargetIA32="bootia32.efi"
 100               shift
 101               ;;
 102          --root) RootDir="$2"
 103               shift
 104               ;;
 105          --localkeys) LocalKeys=1
 106               ;;
 107          --shim | --preloader) ShimSource="$2"
 108               ShimType=`basename $ShimSource`
 109               shift
 110               ;;
 111          --drivers | --alldrivers) InstallDrivers="all"
 112               ;;
 113          --nodrivers) InstallDrivers="none"
 114               ;;
 115          --yes) AlwaysYes=1
 116               ;;
 117          * ) echo "Usage: $0 [--esp | --usedefault {device-file} | --root {directory} ]"
 118              echo "                  [--nodrivers | --alldrivers] [--shim {shim-filename}]"
 119              echo "                  [--localkeys] [--yes]"
 120              exit 1
 121       esac
 122       shift
 123    done
 124
 125    if [[ $InstallToEspOnMac == 1 && "$TargetDir" == '/EFI/BOOT' ]] ; then
 126       echo "You may use --esp OR --usedefault, but not both! Aborting!"
 127       exit 1
 128    fi
 129    if [[ "$RootDir" != '/' && "$TargetDir" == '/EFI/BOOT' ]] ; then
 130       echo "You may use --usedefault OR --root, but not both! Aborting!"
 131       exit 1
 132    fi
 133    if [[ "$RootDir" != '/' && $InstallToEspOnMac == 1 ]] ; then
 134       echo "You may use --root OR --esp, but not both! Aborting!"
 135       exit 1
 136    fi
 137
 138    RLConfFile="$RootDir/boot/refind_linux.conf"
 139    EtcKeysDir="$RootDir/etc/refind.d/keys"
 140 } # GetParams()
 141
 142 # Get a yes/no response from the user and place it in the YesNo variable.
 143 # If the AlwaysYes variable is set to 1, skip the user input and set "Y"
 144 # in the YesNo variable.
 145 ReadYesNo() {
 146    if [[ $AlwaysYes == 1 ]] ; then
 147       YesNo="Y"
 148       echo "Y"
 149    else
 150       read YesNo
 151    fi
 152 }
 153
 154 # Abort if the rEFInd files can't be found.
 155 # Also sets $ConfFile to point to the configuration file,
 156 # $IconsDir to point to the icons directory, and
 157 # $ShimSource to the source of the shim.efi file (if necessary).
 158 CheckForFiles() {
 159    # Note: This check is satisfied if EITHER the 32- or the 64-bit version
 160    # is found, even on the wrong platform. This is because the platform
 161    # hasn't yet been determined. This could obviously be improved, but it
 162    # would mean restructuring lots more code....
 163    if [[ ! -f "$RefindDir/refind_ia32.efi" && ! -f "$RefindDir/refind_x64.efi" ]] ; then
 164       echo "The rEFInd binary file is missing! Aborting installation!"
 165       exit 1
 166    fi
 167
 168    if [[ -f "$RefindDir/refind.conf-sample" ]] ; then
 169       ConfFile="$RefindDir/refind.conf-sample"
 170    elif [[ -f "$ThisDir/refind.conf-sample" ]] ; then
 171       ConfFile="$ThisDir/refind.conf-sample"
 172    else
 173       echo "The sample configuration file is missing! Aborting installation!"
 174       exit 1
 175    fi
 176
 177    if [[ -d "$RefindDir/icons" ]] ; then
 178       IconsDir="$RefindDir/icons"
 179    elif [[ -d "$ThisDir/icons" ]] ; then
 180       IconsDir="$ThisDir/icons"
 181    else
 182       echo "The icons directory is missing! Aborting installation!"
 183       exit 1
 184    fi
 185
 186    if [[ "$ShimSource" != "none" ]] ; then
 187       if [[ -f "$ShimSource" ]] ; then
 188          if [[ $ShimType == "shimx64.efi" || $ShimType == "shim.efi" ]] ; then
 189             TargetX64="grubx64.efi"
 190             MokManagerSource=`dirname "$ShimSource"`/MokManager.efi
 191          elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 192             TargetX64="loader.efi"
 193             MokManagerSource=`dirname "$ShimSource"`/HashTool.efi
 194          else
 195             echo "Unknown shim/PreBootloader filename: $ShimType!"
 196             echo "Known filenames are shimx64.efi, shim.efi, and PreLoader.efi. Aborting!"
 197             exit 1
 198          fi
 199       else
 200          echo "The specified shim/PreBootloader file, $ShimSource, doesn't exist!"
 201          echo "Aborting installation!"
 202          exit 1
 203       fi
 204    fi
 205 } # CheckForFiles()
 206
 207 # Helper for CopyRefindFiles; copies shim files (including MokManager, if it's
 208 # available) to target.
 209 CopyShimFiles() {
 210    cp -fb "$ShimSource" "$InstallDir/$TargetDir/$TargetShim"
 211    if [[ $? != 0 ]] ; then
 212       Problems=1
 213    fi
 214    if [[ -f "$MokManagerSource" ]] ; then
 215       cp -fb "$MokManagerSource" "$InstallDir/$TargetDir/"
 216    fi
 217    if [[ $? != 0 ]] ; then
 218       Problems=1
 219    fi
 220 } # CopyShimFiles()
 221
 222 # Copy the public keys to the installation medium
 223 CopyKeys() {
 224    if [[ $LocalKeys == 1 ]] ; then
 225       mkdir -p "$InstallDir/$TargetDir/keys/"
 226       cp "$EtcKeysDir/$LocalKeysBase.cer" "$InstallDir/$TargetDir/keys/"
 227       cp "$EtcKeysDir/$LocalKeysBase.crt" "$InstallDir/$TargetDir/keys/"
 228    fi
 229 } # CopyKeys()
 230
 231 # Copy drivers from $RefindDir/drivers_$1 to $InstallDir/$TargetDir/drivers_$1,
 232 # honoring the $InstallDrivers condition. Must be passed a suitable
 233 # architecture code (ia32 or x64).
 234 CopyDrivers() {
 235    if [[ $InstallDrivers == "all" ]] ; then
 236       mkdir -p "$InstallDir/$TargetDir/drivers_$1"
 237       cp "$ThisDir"/drivers_$1/*_$1.efi "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 238       cp "$RefindDir"/drivers_$1/*_$1.efi "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 239    elif [[ "$InstallDrivers" == "boot" && -x `which blkid` ]] ; then
 240       BootPart=`df /boot | grep dev | cut -f 1 -d " "`
 241       BootFS=`blkid -o export $BootPart 2> /dev/null | grep TYPE= | cut -f 2 -d =`
 242       DriverType=""
 243       case $BootFS in
 244          ext2 | ext3) DriverType="ext2"
 245               # Could use ext4, but that can create unwanted entries from symbolic
 246               # links in / to /boot/vmlinuz if a separate /boot partition is used.
 247               ;;
 248          ext4) DriverType="ext4"
 249               ;;
 250          reiserfs) DriverType="reiserfs"
 251               ;;
 252          btrfs) DriverType="btrfs"
 253               ;;
 254          hfsplus) DriverType="hfs"
 255               ;;
 256          *) BootFS=""
 257       esac
 258       if [[ -n $BootFS ]] ; then
 259          echo "Installing driver for $BootFS (${DriverType}_$1.efi)"
 260          mkdir -p "$InstallDir/$TargetDir/drivers_$1"
 261          cp "$ThisDir/drivers_$1/${DriverType}_$1.efi" "$InstallDir/$TargetDir/drivers_$1/" 2> /dev/null
 262          cp "$RefindDir/drivers_$1/${DriverType}_$1.efi" "$InstallDir/$TargetDir/drivers_$1"/ 2> /dev/null
 263       fi
 264    fi
 265 }
 266
 267 # Copy tools (currently only gptsync, and that only on Macs) to the EFI/tools
 268 # directory on the ESP. Must be passed a suitable architecture code (ia32
 269 # or x64).
 270 CopyTools() {
 271    mkdir -p $InstallDir/EFI/tools
 272    if [[ $OSName == 'Darwin' ]] ; then
 273       cp -f "$RefindDir/tools_$1/gptsync_$1.efi" "$InstallDir/EFI/tools/"
 274       if [[ -f "$InstallDir/EFI/tools/gptsync.efi" ]] ; then
 275          mv "$InstallDir/EFI/tools/gptsync.efi" "$InstallDir/EFI/tools/gptsync.efi-disabled"
 276          echo "Found old gptsync.efi; disabling it by renaming it to gptsync.efi-disabled"
 277       fi
 278    fi
 279 } # CopyTools()
 280
 281 # Copy the rEFInd files to the ESP or OS X root partition.
 282 # Sets Problems=1 if any critical commands fail.
 283 CopyRefindFiles() {
 284    mkdir -p "$InstallDir/$TargetDir"
 285    if [[ "$TargetDir" == '/EFI/BOOT' ]] ; then
 286       cp "$RefindDir/refind_ia32.efi" "$InstallDir/$TargetDir/$TargetIA32" 2> /dev/null
 287       if [[ $? != 0 ]] ; then
 288          echo "Note: IA32 (x86) binary not installed!"
 289       fi
 290       cp "$RefindDir/refind_x64.efi" "$InstallDir/$TargetDir/$TargetX64" 2> /dev/null
 291       if [[ $? != 0 ]] ; then
 292          Problems=1
 293       fi
 294       if [[ "$ShimSource" != "none" ]] ; then
 295          TargetShim="bootx64.efi"
 296          CopyShimFiles
 297       fi
 298       if [[ $InstallDrivers == "all" ]] ; then
 299          cp -r "$RefindDir"/drivers_* "$InstallDir/$TargetDir/" 2> /dev/null
 300          cp -r "$ThisDir"/drivers_* "$InstallDir/$TargetDir/" 2> /dev/null
 301       elif [[ $Upgrade == 1 ]] ; then
 302          if [[ $Platform == 'EFI64' ]] ; then
 303             CopyDrivers x64
 304             CopyTools x64
 305          else
 306             CopyDrivers ia32
 307             CopyTools ia32
 308          fi
 309       fi
 310       Refind=""
 311       CopyKeys
 312    elif [[ $Platform == 'EFI64' || $TargetDir == "/EFI/Microsoft/Boot" ]] ; then
 313       cp "$RefindDir/refind_x64.efi" "$InstallDir/$TargetDir/$TargetX64"
 314       if [[ $? != 0 ]] ; then
 315          Problems=1
 316       fi
 317       CopyDrivers x64
 318       CopyTools x64
 319       Refind="refind_x64.efi"
 320       CopyKeys
 321       if [[ "$ShimSource" != "none" ]] ; then
 322          if [[ "$TargetShim" == "default" ]] ; then
 323             TargetShim=`basename "$ShimSource"`
 324          fi
 325          CopyShimFiles
 326          Refind="$TargetShim"
 327          if [[ $LocalKeys == 0 ]] ; then
 328             echo "Storing copies of rEFInd Secure Boot public keys in $EtcKeysDir"
 329             mkdir -p "$EtcKeysDir"
 330             cp "$ThisDir/keys/refind.cer" "$EtcKeysDir" 2> /dev/null
 331             cp "$ThisDir/keys/refind.crt" "$EtcKeysDir" 2> /dev/null
 332          fi
 333       fi
 334    elif [[ $Platform == 'EFI32' ]] ; then
 335       cp "$RefindDir/refind_ia32.efi" "$InstallDir/$TargetDir/$TargetIA32"
 336       if [[ $? != 0 ]] ; then
 337          Problems=1
 338       fi
 339       CopyDrivers ia32
 340       CopyTools ia32
 341       Refind="refind_ia32.efi"
 342    else
 343       echo "Unknown platform! Aborting!"
 344       exit 1
 345    fi
 346    echo "Copied rEFInd binary files"
 347    echo ""
 348    if [[ -d "$InstallDir/$TargetDir/icons" ]] ; then
 349       rm -rf "$InstallDir/$TargetDir/icons-backup" &> /dev/null
 350       mv -f "$InstallDir/$TargetDir/icons" "$InstallDir/$TargetDir/icons-backup"
 351       echo "Notice: Backed up existing icons directory as icons-backup."
 352    fi
 353    cp -r "$IconsDir" "$InstallDir/$TargetDir"
 354    if [[ $? != 0 ]] ; then
 355       Problems=1
 356    fi
 357    mkdir -p "$InstallDir/$TargetDir/keys"
 358    cp -rf "$ThisDir"/keys/*.[cd]er "$InstallDir/$TargetDir/keys/" 2> /dev/null
 359    cp -rf "$EtcKeysDir"/*.[cd]er "$InstallDir/$TargetDir/keys/" 2> /dev/null
 360    if [[ -f "$InstallDir/$TargetDir/refind.conf" ]] ; then
 361       echo "Existing refind.conf file found; copying sample file as refind.conf-sample"
 362       echo "to avoid overwriting your customizations."
 363       echo ""
 364       cp -f "$ConfFile" "$InstallDir/$TargetDir"
 365       if [[ $? != 0 ]] ; then
 366          Problems=1
 367       fi
 368    else
 369       echo "Copying sample configuration file as refind.conf; edit this file to configure"
 370       echo "rEFInd."
 371       echo ""
 372       cp -f "$ConfFile" "$InstallDir/$TargetDir/refind.conf"
 373       if [[ $? != 0 ]] ; then
 374          Problems=1
 375       fi
 376    fi
 377    if [[ $DeleteRefindDir == 1 ]] ; then
 378       echo "Deleting the temporary directory $RefindDir"
 379       rm -r "$RefindDir"
 380    fi
 381 } # CopyRefindFiles()
 382
 383 # Mount the partition the user specified with the --usedefault option
 384 MountDefaultTarget() {
 385    InstallDir=/tmp/refind_install
 386    mkdir -p "$InstallDir"
 387    if [[ $OSName == 'Darwin' ]] ; then
 388       mount -t msdos "$TargetPart" "$InstallDir"
 389    elif [[ $OSName == 'Linux' ]] ; then
 390       mount -t vfat "$TargetPart" "$InstallDir"
 391    fi
 392    if [[ $? != 0 ]] ; then
 393       echo "Couldn't mount $TargetPart ! Aborting!"
 394       rmdir "$InstallDir"
 395       exit 1
 396    fi
 397    UnmountEsp=1
 398 } # MountDefaultTarget()
 399
 400 #
 401 # A series of OS X support functions....
 402 #
 403
 404 # Mount the ESP at /Volumes/ESP or determine its current mount
 405 # point.
 406 # Sets InstallDir to the ESP mount point
 407 # Sets UnmountEsp if we mounted it
 408 MountOSXESP() {
 409    # Identify the ESP. Note: This returns the FIRST ESP found;
 410    # if the system has multiple disks, this could be wrong!
 411    Temp=`diskutil list | grep " EFI "`
 412    Esp=/dev/`echo $Temp | cut -f 5 -d ' '`
 413    # If the ESP is mounted, use its current mount point....
 414    Temp=`df | grep "$Esp"`
 415    InstallDir=`echo $Temp | cut -f 6 -d ' '`
 416    if [[ "$InstallDir" == '' ]] ; then
 417       mkdir /Volumes/ESP &> /dev/null
 418       mount -t msdos "$Esp" /Volumes/ESP
 419       if [[ $? != 0 ]] ; then
 420          echo "Unable to mount ESP! Aborting!\n"
 421          exit 1
 422       fi
 423       UnmountEsp=1
 424       InstallDir="/Volumes/ESP"
 425    fi
 426 } # MountOSXESP()
 427
 428 # Control the OS X installation.
 429 # Sets Problems=1 if problems found during the installation.
 430 InstallOnOSX() {
 431    echo "Installing rEFInd on OS X...."
 432    if [[ "$TargetDir" == "/EFI/BOOT" ]] ; then
 433       MountDefaultTarget
 434    elif [[ "$InstallToEspOnMac" == "1" ]] ; then
 435       MountOSXESP
 436    else
 437       InstallDir="$RootDir/"
 438    fi
 439    echo "Installing rEFInd to the partition mounted at $InstallDir"
 440    Platform=`ioreg -l -p IODeviceTree | grep firmware-abi | cut -d "\"" -f 4`
 441    CopyRefindFiles
 442    if [[ $InstallToEspOnMac == "1" ]] ; then
 443       bless --mount "$InstallDir" --setBoot --file "$InstallDir/$TargetDir/$Refind"
 444    elif [[ "$TargetDir" != "/EFI/BOOT" ]] ; then
 445       bless --setBoot --folder "$InstallDir/$TargetDir" --file "$InstallDir/$TargetDir/$Refind"
 446    fi
 447    if [[ $? != 0 ]] ; then
 448       Problems=1
 449    fi
 450    if [[ -f /Library/StartupItems/rEFItBlesser || -d /Library/StartupItems/rEFItBlesser ]] ; then
 451       echo
 452       echo "/Library/StartupItems/rEFItBlesser found!"
 453       echo "This program is part of rEFIt, and will cause rEFInd to fail to work after"
 454       echo -n "its first boot. Do you want to remove rEFItBlesser (Y/N)? "
 455       ReadYesNo
 456       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 457          echo "Deleting /Library/StartupItems/rEFItBlesser..."
 458          rm -r /Library/StartupItems/rEFItBlesser
 459       else
 460          echo "Not deleting rEFItBlesser."
 461       fi
 462    fi
 463    echo
 464    echo "WARNING: If you have an Advanced Format disk, *DO NOT* attempt to check the"
 465    echo "bless status with 'bless --info', since this is known to cause disk corruption"
 466    echo "on some systems!!"
 467    echo
 468 } # InstallOnOSX()
 469
 470
 471 #
 472 # Now a series of Linux support functions....
 473 #
 474
 475 # Check for evidence that we're running in Secure Boot mode. If so, and if
 476 # appropriate options haven't been set, warn the user and offer to abort.
 477 # If we're NOT in Secure Boot mode but the user HAS specified the --shim
 478 # or --localkeys option, warn the user and offer to abort.
 479 #
 480 # FIXME: Although I checked the presence (and lack thereof) of the
 481 # /sys/firmware/efi/vars/SecureBoot* files on my Secure Boot test system
 482 # before releasing this script, I've since found that they are at least
 483 # sometimes present when Secure Boot is absent. This means that the first
 484 # test can produce false alarms. A better test is highly desirable.
 485 CheckSecureBoot() {
 486    VarFile=`ls -d /sys/firmware/efi/vars/SecureBoot* 2> /dev/null`
 487    if [[ -n "$VarFile" && "$TargetDir" != '/EFI/BOOT' && "$ShimSource" == "none" ]] ; then
 488       echo ""
 489       echo "CAUTION: Your computer appears to support Secure Boot, but you haven't"
 490       echo "specified a valid shim.efi file source. If you've disabled Secure Boot and"
 491       echo "intend to leave it disabled, this is fine; but if Secure Boot is active, the"
 492       echo "resulting installation won't boot. You can read more about this topic at"
 493       echo "http://www.rodsbooks.com/refind/secureboot.html."
 494       echo ""
 495       echo -n "Do you want to proceed with installation (Y/N)? "
 496       ReadYesNo
 497       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 498          echo "OK; continuing with the installation..."
 499       else
 500          exit 0
 501       fi
 502    fi
 503
 504    if [[ "$ShimSource" != "none" && ! -n "$VarFile" ]] ; then
 505       echo ""
 506       echo "You've specified installing using a shim.efi file, but your computer does not"
 507       echo "appear to be running in Secure Boot mode. Although installing in this way"
 508       echo "should work, it's unnecessarily complex. You may continue, but unless you"
 509       echo "plan to enable Secure Boot, you should consider stopping and omitting the"
 510       echo "--shim option. You can read more about this topic at"
 511       echo "http://www.rodsbooks.com/refind/secureboot.html."
 512       echo ""
 513       echo -n "Do you want to proceed with installation (Y/N)? "
 514       ReadYesNo
 515       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 516          echo "OK; continuing with the installation..."
 517       else
 518          exit 0
 519       fi
 520    fi
 521
 522    if [[ $LocalKeys != 0 && ! -n "$VarFile" ]] ; then
 523       echo ""
 524       echo "You've specified re-signing your rEFInd binaries with locally-generated keys,"
 525       echo "but your computer does not appear to be running in Secure Boot mode. The"
 526       echo "keys you generate will be useless unless you enable Secure Boot. You may"
 527       echo "proceed with this installation, but before you do so, you may want to read"
 528       echo "more about it at http://www.rodsbooks.com/refind/secureboot.html."
 529       echo ""
 530       echo -n "Do you want to proceed with installation (Y/N)? "
 531       ReadYesNo
 532       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 533          echo "OK; continuing with the installation..."
 534       else
 535          exit 0
 536       fi
 537    fi
 538
 539 } # CheckSecureBoot()
 540
 541 # Check for the presence of locally-generated keys from a previous installation in
 542 # $EtcKeysDir (/etc/refind.d/keys). If they're not present, generate them using
 543 # openssl.
 544 GenerateKeys() {
 545    PrivateKey="$EtcKeysDir/$LocalKeysBase.key"
 546    CertKey="$EtcKeysDir/$LocalKeysBase.crt"
 547    DerKey="$EtcKeysDir/$LocalKeysBase.cer"
 548    OpenSSL=`which openssl 2> /dev/null`
 549
 550    # Do the work only if one or more of the necessary keys is missing
 551    # TODO: Technically, we don't need the DerKey; but if it's missing and openssl
 552    # is also missing, this will fail. This could be improved.
 553    if [[ ! -f "$PrivateKey" || ! -f "$CertKey" || ! -f "$DerKey" ]] ; then
 554       echo "Generating a fresh set of local keys...."
 555       mkdir -p "$EtcKeysDir"
 556       chmod 0700 "$EtcKeysDir"
 557       if [[ ! -x "$OpenSSL" ]] ; then
 558          echo "Can't find openssl, which is required to create your private signing keys!"
 559          echo "Aborting!"
 560          exit 1
 561       fi
 562       if [[ -f "$PrivateKey" ]] ; then
 563          echo "Backing up existing $PrivateKey"
 564          cp -f "$PrivateKey" "$PrivateKey.backup" 2> /dev/null
 565       fi
 566       if [[ -f "$CertKey" ]] ; then
 567          echo "Backing up existing $CertKey"
 568          cp -f "$CertKey" "$CertKey.backup" 2> /dev/null
 569       fi
 570       if [[ -f "$DerKey" ]] ; then
 571          echo "Backing up existing $DerKey"
 572          cp -f "$DerKey" "$DerKey.backup" 2> /dev/null
 573       fi
 574       "$OpenSSL" req -new -x509 -newkey rsa:2048 -keyout "$PrivateKey" -out "$CertKey" \
 575                      -nodes -days 3650 -subj "/CN=Locally-generated rEFInd key/"
 576       "$OpenSSL" x509 -in "$CertKey" -out "$DerKey" -outform DER
 577       chmod 0600 "$PrivateKey"
 578    else
 579       echo "Using existing local keys...."
 580    fi
 581 }
 582
 583 # Sign a single binary. Requires parameters:
 584 #   $1 = source file
 585 #   $2 = destination file
 586 # Also assumes that the SBSign, PESign, UseSBSign, UsePESign, and various key variables are set
 587 # appropriately.
 588 # Aborts script on error
 589 SignOneBinary() {
 590    $SBSign --key "$PrivateKey" --cert "$CertKey" --output "$2" "$1"
 591    if [[ $? != 0 ]] ; then
 592       echo "Problem signing the binary $1! Aborting!"
 593       exit 1
 594    fi
 595 }
 596
 597 # Re-sign the x86-64 binaries with a locally-generated key, First look for appropriate
 598 # key files in $EtcKeysDir. If they're present, use them to re-sign the binaries. If
 599 # not, try to generate new keys and store them in $EtcKeysDir.
 600 ReSignBinaries() {
 601    SBSign=`which sbsign 2> /dev/null`
 602    echo "Found sbsign at $SBSign"
 603    TempDir="/tmp/refind_local"
 604    if [[ ! -x "$SBSign" ]] ; then
 605       echo "Can't find sbsign, which is required to sign rEFInd with your own keys!"
 606       echo "Aborting!"
 607       exit 1
 608    fi
 609    GenerateKeys
 610    mkdir -p "$TempDir/drivers_x64"
 611    cp "$RefindDir/refind.conf-sample $TempDir" 2> /dev/null
 612    cp "$ThisDir/refind.conf-sample $TempDir" 2> /dev/null
 613    cp "$RefindDir/refind_ia32.efi $TempDir" 2> /dev/null
 614    cp -a "$RefindDir/drivers_ia32 $TempDir" 2> /dev/null
 615    cp -a "$ThisDir/drivers_ia32 $TempDir" 2> /dev/null
 616    SignOneBinary "$RefindDir/refind_x64.efi" "$TempDir/refind_x64.efi"
 617    SaveIFS=$IFS
 618    IFS=$(echo -en "\n\b")
 619    for Driver in `ls "$RefindDir"/drivers_x64/*.efi "$ThisDir"/drivers_x64/*.efi 2> /dev/null` ; do
 620       TempName=`basename "$Driver"`
 621       SignOneBinary "$Driver" "$TempDir/drivers_x64/$TempName"
 622    done
 623    IFS=$SaveIFS
 624    RefindDir="$TempDir"
 625    DeleteRefindDir=1
 626 }
 627
 628 # Identifies the ESP's location (/boot or /boot/efi, or these locations under
 629 # the directory specified by --root); aborts if the ESP isn't mounted at
 630 # either location.
 631 # Sets InstallDir to the ESP mount point.
 632 FindLinuxESP() {
 633    EspLine=`df "$RootDir/boot/efi" 2> /dev/null | grep boot/efi`
 634    if [[ ! -n "$EspLine" ]] ; then
 635       EspLine=`df "$RootDir"/boot | grep boot`
 636    fi
 637    InstallDir=`echo $EspLine | cut -d " " -f 6`
 638    if [[ -n "$InstallDir" ]] ; then
 639       EspFilesystem=`grep "$InstallDir" /etc/mtab | uniq | grep -v autofs | cut -d " " -f 3`
 640    fi
 641    echo "EspFilesystem is '$EspFilesystem'"
 642    if [[ $EspFilesystem != 'vfat' ]] ; then
 643       echo "$RootDir/boot/efi doesn't seem to be on a VFAT filesystem. The ESP must be"
 644       echo "mounted at $RootDir/boot or $RootDir/boot/efi and it must be VFAT! Aborting!"
 645       exit 1
 646    fi
 647    echo "ESP was found at $InstallDir using $EspFilesystem"
 648 } # FindLinuxESP
 649
 650 # Uses efibootmgr to add an entry for rEFInd to the EFI's NVRAM.
 651 # If this fails, sets Problems=1
 652 AddBootEntry() {
 653    InstallIt="0"
 654    Efibootmgr=`which efibootmgr 2> /dev/null`
 655    if [[ "$Efibootmgr" ]] ; then
 656       InstallDisk=`grep "$InstallDir" /etc/mtab | cut -d " " -f 1 | cut -c 1-8`
 657       PartNum=`grep "$InstallDir" /etc/mtab | cut -d " " -f 1 | cut -c 9-10`
 658       EntryFilename="$TargetDir/$Refind"
 659       EfiEntryFilename=`echo ${EntryFilename//\//\\\}`
 660       EfiEntryFilename2=`echo ${EfiEntryFilename} | sed s/\\\\\\\\/\\\\\\\\\\\\\\\\/g`
 661       ExistingEntry=`"$Efibootmgr" -v | grep -i "$EfiEntryFilename2"`
 662
 663       if [[ "$ExistingEntry" ]] ; then
 664          ExistingEntryBootNum=`echo "$ExistingEntry" | cut -c 5-8`
 665          FirstBoot=`"$Efibootmgr" | grep BootOrder | cut -c 12-15`
 666          if [[ "$ExistingEntryBootNum" != "$FirstBoot" ]] ; then
 667             echo "An existing rEFInd boot entry exists, but isn't set as the default boot"
 668             echo "manager. The boot order is being adjusted to make rEFInd the default boot"
 669             echo "manager. If this is NOT what you want, you should use efibootmgr to"
 670             echo "manually adjust your EFI's boot order."
 671             "$Efibootmgr" -b $ExistingEntryBootNum -B &> /dev/null
 672             InstallIt="1"
 673          fi
 674       else
 675          InstallIt="1"
 676       fi
 677
 678       if [[ $InstallIt == "1" ]] ; then
 679          echo "Installing it!"
 680          "$Efibootmgr" -c -l "$EfiEntryFilename" -L "rEFInd Boot Manager" -d $InstallDisk -p $PartNum &> /dev/null
 681          if [[ $? != 0 ]] ; then
 682             EfibootmgrProblems=1
 683             Problems=1
 684          fi
 685       fi
 686
 687    else # efibootmgr not found
 688       EfibootmgrProblems=1
 689       Problems=1
 690    fi
 691
 692    if [[ $EfibootmgrProblems ]] ; then
 693       echo
 694       echo "ALERT: There were problems running the efibootmgr program! You may need to"
 695       echo "rename the $Refind binary to the default name (EFI/boot/bootx64.efi"
 696       echo "on x86-64 systems or EFI/boot/bootia32.efi on x86 systems) to have it run!"
 697       echo
 698    fi
 699 } # AddBootEntry()
 700
 701 # Create a minimal/sample refind_linux.conf file in /boot.
 702 GenerateRefindLinuxConf() {
 703    if [[ -f "$RLConfFile" ]] ; then
 704       echo "Existing $RLConfFile found; not overwriting."
 705    else
 706       if [[ -f "$RootDir/etc/default/grub" ]] ; then
 707          # We want the default options used by the distribution, stored here....
 708          source "$RootDir/etc/default/grub"
 709       fi
 710       RootFS=`df "$RootDir" | grep dev | cut -f 1 -d " "`
 711       StartOfDevname=`echo "$RootFS" | cut -b 1-7`
 712       if [[ "$StartOfDevname" == "/dev/sd" || "$StartOfDevName" == "/dev/hd" ]] ; then
 713          # Identify root filesystem by UUID rather than by device node, if possible
 714          Uuid=`blkid -o export "$RootFS" 2> /dev/null | grep UUID=`
 715          if [[ -n $Uuid ]] ; then
 716             RootFS="$Uuid"
 717          fi
 718       fi
 719       DefaultOptions="$GRUB_CMDLINE_LINUX $GRUB_CMDLINE_LINUX_DEFAULT"
 720       echo "\"Boot with standard options\" \"ro root=$RootFS $DefaultOptions \"" > $RLConfFile
 721       echo "\"Boot to single-user mode\"   \"ro root=$RootFS $DefaultOptions single\"" >> $RLConfFile
 722       echo "\"Boot with minimal options\"  \"ro root=$RootFS\"" >> $RLConfFile
 723    fi
 724 }
 725
 726 # Set varaibles for installation in EFI/BOOT directory
 727 SetVarsForBoot() {
 728    TargetDir="/EFI/BOOT"
 729    if [[ $ShimSource == "none" ]] ; then
 730       TargetX64="bootx64.efi"
 731       TargetIA32="bootia32.efi"
 732    else
 733       if [[ $ShimType == "shim.efi" || $ShimType == "shimx64.efi" ]] ; then
 734          TargetX64="grubx64.efi"
 735       elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 736          TargetX64="loader.efi"
 737       else
 738          echo "Unknown shim/PreBootloader type: $ShimType"
 739          echo "Aborting!"
 740          exit 1
 741       fi
 742       TargetIA32="bootia32.efi"
 743       TargetShim="bootx64.efi"
 744    fi
 745 } # SetFilenamesForBoot()
 746
 747 # Set variables for installation in EFI/Microsoft/Boot directory
 748 SetVarsForMsBoot() {
 749    TargetDir="/EFI/Microsoft/Boot"
 750    if [[ $ShimSource == "none" ]] ; then
 751       TargetX64="bootmgfw.efi"
 752    else
 753       if [[ $ShimType == "shim.efi" || $ShimType == "shimx64.efi" ]] ; then
 754          TargetX64="grubx64.efi"
 755       elif [[ $ShimType == "preloader.efi" || $ShimType == "PreLoader.efi" ]] ; then
 756          TargetX64="loader.efi"
 757       else
 758          echo "Unknown shim/PreBootloader type: $ShimType"
 759          echo "Aborting!"
 760          exit 1
 761       fi
 762       TargetShim="bootmgfw.efi"
 763    fi
 764 }
 765
 766 # TargetDir defaults to /EFI/refind; however, this function adjusts it as follows:
 767 # - If an existing refind.conf is available in /EFI/BOOT or /EFI/Microsoft/Boot,
 768 #   install to that directory under the suitable name; but DO NOT do this if
 769 #   refind.conf is also in /EFI/refind.
 770 # - If booted in BIOS mode and the ESP lacks any other EFI files, install to
 771 #   /EFI/BOOT
 772 # - If booted in BIOS mode and there's no refind.conf file and there is a
 773 #   /EFI/Microsoft/Boot/bootmgfw.efi file, move it down one level and
 774 #   install under that name, "hijacking" the Windows boot loader filename
 775 DetermineTargetDir() {
 776    Upgrade=0
 777
 778    if [[ -f $InstallDir/EFI/BOOT/refind.conf ]] ; then
 779       SetVarsForBoot
 780       Upgrade=1
 781    fi
 782    if [[ -f $InstallDir/EFI/Microsoft/Boot/refind.conf ]] ; then
 783       SetVarsForMsBoot
 784       Upgrade=1
 785    fi
 786    if [[ -f $InstallDir/EFI/refind/refind.conf ]] ; then
 787       TargetDir="/EFI/refind"
 788       Upgrade=1
 789    fi
 790    if [[ $Upgrade == 1 ]] ; then
 791       echo "Found rEFInd installation in $InstallDir$TargetDir; upgrading it."
 792    fi
 793
 794    if [[ ! -d /sys/firmware/efi && $Upgrade == 0 ]] ; then     # BIOS-mode
 795       FoundEfiFiles=`find "$InstallDir/EFI/BOOT" -name "*.efi" 2> /dev/null`
 796       FoundConfFiles=`find "$InstallDir" -name "refind\.conf" 2> /dev/null`
 797       if [[ ! -n "$FoundConfFiles" && -f "$InstallDir/EFI/Microsoft/Boot/bootmgfw.efi" ]] ; then
 798          mv -n "$InstallDir/EFI/Microsoft/Boot/bootmgfw.efi" "$InstallDir/EFI/Microsoft" &> /dev/null
 799          SetVarsForMsBoot
 800          echo "Running in BIOS mode with a suspected Windows installation; moving boot loader"
 801          echo "files so as to install to $InstallDir$TargetDir."
 802       elif [[ ! -n "$FoundEfiFiles" ]] ; then  # In BIOS mode and no default loader; install as default loader
 803          SetVarsForBoot
 804          echo "Running in BIOS mode with no existing default boot loader; installing to"
 805          echo $InstallDir$TargetDir
 806       else
 807          echo "Running in BIOS mode with an existing default boot loader; backing it up and"
 808          echo "installing rEFInd in its place."
 809          if [[ -d "$InstallDir/EFI/BOOT-rEFIndBackup" ]] ; then
 810             echo ""
 811             echo "Caution: An existing backup of a default boot loader exists! If the current"
 812             echo "default boot loader and the backup are different boot loaders, the current"
 813             echo "one will become inaccessible."
 814             echo ""
 815             echo -n "Do you want to proceed with installation (Y/N)? "
 816             ReadYesNo
 817             if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 818                echo "OK; continuing with the installation..."
 819             else
 820                exit 0
 821             fi
 822          fi
 823          mv -n "$InstallDir/EFI/BOOT" "$InstallDir/EFI/BOOT-rEFIndBackup"
 824          SetVarsForBoot
 825       fi
 826    fi # BIOS-mode
 827 } # DetermineTargetDir()
 828
 829 # Controls rEFInd installation under Linux.
 830 # Sets Problems=1 if something goes wrong.
 831 InstallOnLinux() {
 832    echo "Installing rEFInd on Linux...."
 833    modprobe efivars &> /dev/null
 834    if [[ $TargetDir == "/EFI/BOOT" ]] ; then
 835       MountDefaultTarget
 836    else
 837       FindLinuxESP
 838       DetermineTargetDir
 839    fi
 840    CpuType=`uname -m`
 841    if [[ $CpuType == 'x86_64' ]] ; then
 842       Platform="EFI64"
 843    elif [[ ($CpuType == 'i386' || $CpuType == 'i486' || $CpuType == 'i586' || $CpuType == 'i686') ]] ; then
 844       Platform="EFI32"
 845       # If we're in EFI mode, do some sanity checks, and alert the user or even
 846       # abort. Not in BIOS mode, though, since that could be used on an emergency
 847       # disc to try to recover a troubled Linux installation.
 848       if [[ -d /sys/firmware/efi ]] ; then
 849          if [[ "$ShimSource" != "none" && "$TargetDir" != "/BOOT/EFI" ]] ; then
 850             echo ""
 851             echo "CAUTION: shim does not currently supports 32-bit systems, so you should not"
 852             echo "use the --shim option to install on such systems. Aborting!"
 853             echo ""
 854             exit 1
 855          fi
 856          echo
 857          echo "CAUTION: This Linux installation uses a 32-bit kernel. 32-bit EFI-based"
 858          echo "computers are VERY RARE. If you've installed a 32-bit version of Linux"
 859          echo "on a 64-bit computer, you should manually install the 64-bit version of"
 860          echo "rEFInd. If you're installing on a Mac, you should do so from OS X. If"
 861          echo "you're positive you want to continue with this installation, answer 'Y'"
 862          echo "to the following question..."
 863          echo
 864          echo -n "Are you sure you want to continue (Y/N)? "
 865          ReadYesNo
 866          if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 867             echo "OK; continuing with the installation..."
 868          else
 869             exit 0
 870          fi
 871       fi # in EFI mode
 872    else
 873       echo "Unknown CPU type '$CpuType'; aborting!"
 874       exit 1
 875    fi
 876
 877    if [[ $LocalKeys == 1 ]] ; then
 878       ReSignBinaries
 879    fi
 880
 881    CheckSecureBoot
 882    CopyRefindFiles
 883    if [[ "$TargetDir" != "/EFI/BOOT" && "$TargetDir" != "/EFI/Microsoft/Boot" ]] ; then
 884       AddBootEntry
 885       GenerateRefindLinuxConf
 886    fi
 887 } # InstallOnLinux()
 888
 889 #
 890 # The main part of the script. Sets a few environment variables,
 891 # performs a few startup checks, and then calls functions to
 892 # install under OS X or Linux, depending on the detected platform.
 893 #
 894
 895 OSName=`uname -s`
 896 GetParams "$@"
 897 ThisDir="$( cd -P "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 898 RefindDir="$ThisDir/refind"
 899 ThisScript="$ThisDir/`basename $0`"
 900 if [[ `whoami` != "root" ]] ; then
 901    echo "Not running as root; attempting to elevate privileges via sudo...."
 902    sudo "$ThisScript" "$@"
 903    if [[ $? != 0 ]] ; then
 904       echo "This script must be run as root (or using sudo). Exiting!"
 905       exit 1
 906    else
 907       exit 0
 908    fi
 909 fi
 910 CheckForFiles
 911 if [[ $OSName == 'Darwin' ]] ; then
 912    if [[ "$ShimSource" != "none" ]] ; then
 913       echo "The --shim option is not supported on OS X! Exiting!"
 914       exit 1
 915    fi
 916    if [[ "$LocalKeys" != 0 ]] ; then
 917       echo "The --localkeys option is not supported on OS X! Exiting!"
 918       exit 1
 919    fi
 920    InstallOnOSX $1
 921 elif [[ $OSName == 'Linux' ]] ; then
 922    InstallOnLinux
 923 else
 924    echo "Running on unknown OS; aborting!"
 925 fi
 926
 927 if [[ $Problems ]] ; then
 928    echo
 929    echo "ALERT:"
 930    echo "Installation has completed, but problems were detected. Review the output for"
 931    echo "error messages and take corrective measures as necessary. You may need to"
 932    echo "re-run this script or install manually before rEFInd will work."
 933    echo
 934 else
 935    echo
 936    echo "Installation has completed successfully."
 937    echo
 938 fi
 939
 940 if [[ $UnmountEsp ]] ; then
 941    echo "Unmounting install dir"
 942    umount $InstallDir
 943 fi
 944
 945 if [[ "$InstallDir" == /tmp/refind_install ]] ; then
 946 #   sleep 5
 947    rmdir "$InstallDir"
 948 fi