16 Lockdown framework

The GRUB can be locked down, which is a restricted mode where some operations are not allowed. For instance, some commands cannot be used when the GRUB is locked down.

The function grub_lockdown() is used to lockdown GRUB and the function grub_is_lockdown() function can be used to check whether lockdown is enabled or not. When enabled, the function returns ‘GRUB_LOCKDOWN_ENABLED’ and ‘GRUB_LOCKDOWN_DISABLED’ when is not enabled.

The following functions can be used to register the commands that can only be used when lockdown is disabled:

• grub_cmd_lockdown() registers command which should not run when the GRUB is in lockdown mode.
• grub_cmd_lockdown() registers extended command which should not run when the GRUB is in lockdown mode.