cli_lock: Add build option to block command line interface

Add functionality to disable command line interface access and editing of GRUB
menu entries if GRUB image is built with --disable-cli.

Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Reviewed-by: Vladimir Serbinenko <phcoder@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

grub-core/kern/main.c

@@ -31,11 +31,14 @@
 #include <grub/reader.h>
 #include <grub/parser.h>
 #include <grub/verify.h>
+#include <grub/types.h>
 
 #ifdef GRUB_MACHINE_PCBIOS
 #include <grub/machine/memory.h>
 #endif
 
+static bool cli_disabled = false;
+
 grub_addr_t
 grub_modules_get_end (void)
 {
@@ -238,6 +241,28 @@ grub_load_normal_mode (void)
   grub_command_execute ("normal", 0, 0);
 }
 
+bool
+grub_is_cli_disabled (void)
+{
+  return cli_disabled;
+}
+
+static void
+check_is_cli_disabled (void)
+{
+  struct grub_module_header *header;
+  header = 0;
+
+  FOR_MODULES (header)
+    {
+      if (header->type == OBJ_TYPE_DISABLE_CLI)
+	{
+	  cli_disabled = true;
+	  return;
+	}
+    }
+}
+
 static void
 reclaim_module_space (void)
 {
@@ -305,6 +330,9 @@ grub_main (void)
 
   grub_boot_time ("After loading embedded modules.");
 
+  /* Check if the CLI should be disabled */
+  check_is_cli_disabled ();
+
   /* It is better to set the root device as soon as possible,
      for convenience.  */
   grub_set_prefix_and_root ();

grub-core/kern/rescue_reader.c

@@ -78,6 +78,19 @@ grub_rescue_read_line (char **line, int cont,
 void __attribute__ ((noreturn))
 grub_rescue_run (void)
 {
+  /* Stall if the CLI has been disabled */
+  if (grub_is_cli_disabled ())
+    {
+      grub_printf ("Rescue mode has been disabled...\n");
+
+      do
+	{
+	  /* Do not optimize out the loop. */
+	  asm volatile ("");
+	}
+      while (1);
+    }
+
   grub_printf ("Entering rescue mode...\n");
 
   while (1)

grub-core/normal/auth.c

@@ -209,6 +209,9 @@ grub_auth_check_authentication (const char *userlist)
   char entered[GRUB_AUTH_MAX_PASSLEN];
   struct grub_auth_user *user;
 
+  if (grub_is_cli_disabled ())
+    return GRUB_ACCESS_DENIED;
+
   grub_memset (login, 0, sizeof (login));
 
   if (is_authenticated (userlist))

grub-core/normal/menu_text.c

@@ -178,21 +178,24 @@ command-line or ESC to discard edits and return to the GRUB menu."),
 
       grub_free (msg_translated);
 
-      if (nested)
+      if (!grub_is_cli_disabled ())
 	{
-	  ret += grub_print_message_indented_real
-	    (_("Press enter to boot the selected OS, "
-	       "`e' to edit the commands before booting "
-	       "or `c' for a command-line. ESC to return previous menu."),
-	     STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run);
-	}
-      else
-	{
-	  ret += grub_print_message_indented_real
-	    (_("Press enter to boot the selected OS, "
-	       "`e' to edit the commands before booting "
-	       "or `c' for a command-line."),
-	     STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run);
+	  if (nested)
+	    {
+	      ret += grub_print_message_indented_real
+		(_("Press enter to boot the selected OS, "
+		   "`e' to edit the commands before booting "
+		   "or `c' for a command-line. ESC to return previous menu."),
+		 STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run);
+	    }
+	  else
+	    {
+	      ret += grub_print_message_indented_real
+		(_("Press enter to boot the selected OS, "
+		   "`e' to edit the commands before booting "
+		   "or `c' for a command-line."),
+		 STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run);
+	    }
 	}
     }
   return ret;