Allow modifying the default kernel cmdline allowlist.

BUG=b/538980164
TEST=presubmit
RELEASE_NOTE=None

Change-Id: Ida5918bae2df6e3e5a2c3a6563e68ae31fa7aa9a
Reviewed-on: https://cos-review.googlesource.com/c/third_party/platform/crosutils/+/173026
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Kevin Berry <kpberry@google.com>

build_library/create_legacy_bootloader_templates.sh

diff --git a/build_library/create_legacy_bootloader_templates.sh b/build_library/create_legacy_bootloader_templates.sh
index ab22b5c..875be30 100755
--- a/build_library/create_legacy_bootloader_templates.sh
+++ b/build_library/create_legacy_bootloader_templates.sh
@@ -58,8 +58,10 @@
 # similar to the one in build_kernel_image.sh. This could be refactored into a
 # common place. Until then it needs to be kept consistent.
 config_file="$(mktemp --tmpdir legacy_config_XXXXXXXXXX.txt)"
+allowlist_file="$(mktemp --tmpdir legacy_command_line_allowlist_XXXXXXXXXX.txt)"
 cleanup() {
   rm -f "${config_file}"
+  rm -f "${allowlist_file}"
 }
 trap cleanup EXIT
 
@@ -83,15 +85,27 @@
   :
 }
 
+# Support optional, board-specific command line allowlists.
+#
+# Intended to be overridden by boards that wish to allow command line
+# values to be toggled on or off without disabling secure boot.
+# The allowlist should be formatted as "arg1=v1 arg2=v2", etc.
+# $1 - output file containing the allowlist string
+modify_kernel_command_line_allowlist() {
+  :
+}
+
 # shellcheck source=board_options.sh
 . "${BUILD_LIBRARY_DIR}/board_options.sh" || exit 1
 (
   # Run in a subshell so we know build_kernel_image.sh can't set env vars.
   load_board_specific_script "build_kernel_image.sh"
   modify_kernel_command_line "${config_file}"
+  modify_kernel_command_line_allowlist "${allowlist_file}"
 )
 # Read back the config_file; translate newlines to space
 common_args="$(tr "\n" " " < "${config_file}")"
+allowlist="$(tr "\n" " " < "${allowlist_file}")"
 cleanup
 trap - EXIT
 
@@ -159,7 +173,7 @@
 
 # NOTE: These magic grub variables are a Chrome OS hack. They are not portable.
 
-KERNEL_CMDLINE_ALLOWLIST=""
+KERNEL_CMDLINE_ALLOWLIST="${allowlist}"
 cmdline_extra=""
 pickargs --infile (\$grubdisk,gpt12)/efi/boot/cmdline_extra.bin --allowlistvar KERNEL_CMDLINE_ALLOWLIST --outvar cmdline_extra
 
@@ -320,7 +334,7 @@
 
 # NOTE: These magic grub variables are a Chrome OS hack. They are not portable.
 
-KERNEL_CMDLINE_ALLOWLIST=""
+KERNEL_CMDLINE_ALLOWLIST="${allowlist}"
 cmdline_extra=""
 pickargs --infile (\$grubdisk,gpt12)/efi/boot/cmdline_extra.bin --allowlistvar KERNEL_CMDLINE_ALLOWLIST --outvar cmdline_extra