Proposed patch for SESAME support

[Stephen R. van den Berg]

commit 4d9673b72e1dd05489176073ea630ec4cf5b2760
Author: Stephen R. van den Berg <address@hidden>
Date:   Wed Sep 6 01:42:29 2017 +0200

    GRUB_SESAME support.

diff --git a/docs/grub.texi b/docs/grub.texi
index 471d97c95..e13383bec 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -1317,6 +1317,13 @@ If the timeout expires before either of these happens, 
it will boot the
 default entry.  In the @samp{countdown} case, it will show a one-line
 indication of the remaining time.
 
address@hidden GRUB_SESAME
+Assigning a phrase to this option will only have effect if
address@hidden is set to either @samp{countdown} or @samp{hidden}.
+If set, it will keep the menu from appearing until the sesame-phrase
+has been typed.  Entering the phrase needs to have been completed before
address@hidden expires.
+
 @item GRUB_DEFAULT_BUTTON
 @itemx GRUB_TIMEOUT_BUTTON
 @itemx GRUB_TIMEOUT_STYLE_BUTTON
diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
index e7a83c2d6..c1f4d4571 100644
--- a/grub-core/normal/menu.c
+++ b/grub-core/normal/menu.c
@@ -580,6 +580,9 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
   int default_entry, current_entry;
   int timeout;
   enum timeout_style timeout_style;
+  const char *sesameword;
+  char *sesamebuf = 0;
+  unsigned sesamelen;
 
   default_entry = get_entry_number (menu, "default");
 
@@ -597,6 +600,17 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
     grub_env_unset ("timeout_style");
 
   timeout_style = get_timeout_style ();
+  sesameword = grub_env_get ("sesame");
+
+  if (sesameword) {
+    if (!*sesameword)
+      sesameword = 0;
+    else
+      {
+        sesamelen = grub_strlen (sesameword);
+        sesamebuf = grub_zalloc (sesamelen-- + 1);
+      }
+  }
 
   if (timeout_style == TIMEOUT_STYLE_COUNTDOWN
       || timeout_style == TIMEOUT_STYLE_HIDDEN)
@@ -620,9 +634,19 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
          key = grub_getkey_noblock ();
          if (key != GRUB_TERM_NO_KEY)
            {
-             entry = get_entry_index_by_hotkey (menu, key);
-             if (entry >= 0)
-               break;
+             if (sesameword)
+               {
+                 grub_memmove (sesamebuf, sesamebuf+1, sesamelen);
+                 sesamebuf[sesamelen] = key;
+                 key = grub_strcmp (sesamebuf, sesameword)
+                     ? GRUB_TERM_NO_KEY : GRUB_TERM_ESC;
+               }
+             else
+               {
+                 entry = get_entry_index_by_hotkey (menu, key);
+                 if (entry >= 0)
+                   break;
+               }
            }
          if (key == GRUB_TERM_ESC)
            {
@@ -642,8 +666,11 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
            break;
        }
 
+      if (sesamebuf)
+        grub_free (sesamebuf);
       grub_env_unset ("timeout");
       grub_env_unset ("timeout_style");
+      grub_env_unset ("sesame");
       if (entry >= 0)
        {
          *auto_boot = 0;
diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
index 33332360e..dc3872ce3 100644
--- a/util/grub-mkconfig.in
+++ b/util/grub-mkconfig.in
@@ -203,6 +203,7 @@ export GRUB_DEFAULT \
   GRUB_HIDDEN_TIMEOUT_QUIET \
   GRUB_TIMEOUT \
   GRUB_TIMEOUT_STYLE \
+  GRUB_SESAME \
   GRUB_DEFAULT_BUTTON \
   GRUB_HIDDEN_TIMEOUT_BUTTON \
   GRUB_TIMEOUT_BUTTON \
diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in
index 93a90233e..c20d63a27 100644
--- a/util/grub.d/00_header.in
+++ b/util/grub.d/00_header.in
@@ -282,6 +282,11 @@ fi
 
 make_timeout ()
 {
+    if [ "x${GRUB_SESAME}" != "x" ] ; then
+    cat << EOF
+set sesame="${GRUB_SESAME}"
+EOF
+    fi
     if [ "x${3}" != "x" ] ; then
        timeout="${2}"
        style="${3}"