8ee92f5194
- Implement NV index mode for TPM 2.0 key protector
0001-protectors-Implement-NV-index.patch
- Fall back to passphrase mode when the key protector fails to
unlock the disk
0002-cryptodisk-Fallback-to-passphrase.patch
- Wipe out the cached key cleanly
0003-cryptodisk-wipe-out-the-cached-keys-from-protectors.patch
- Make diskfiler to look up cryptodisk devices first
0004-diskfilter-look-up-cryptodisk-devices-first.patch
- Version bump to 2.12~rc1
* Added:
- grub-2.12~rc1.tar.xz
* Removed:
- grub-2.06.tar.xz
* Patch dropped merged by new version:
- grub2-GRUB_CMDLINE_LINUX_RECOVERY-for-recovery-mode.patch
- grub2-s390x-02-kexec-module-added-to-emu.patch
- grub2-efi-chainloader-root.patch
- grub2-Fix-incorrect-netmask-on-ppc64.patch
- 0001-osdep-Introduce-include-grub-osdep-major.h-and-use-i.patch
- 0002-osdep-linux-hostdisk-Use-stat-instead-of-udevadm-for.patch
- 0002-net-read-bracketed-ipv6-addrs-and-port-numbers.patch
- grub2-s390x-10-keep-network-at-kexec.patch
- 0001-Fix-build-error-in-binutils-2.36.patch
- 0001-emu-fix-executable-stack-marking.patch
- 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- 0001-30_uefi-firmware-fix-printf-format-with-null-byte.patch
- 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- 0001-Filter-out-POSIX-locale-for-translation.patch
OBS-URL: https://build.opensuse.org/request/show/1105405
OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=458
89 lines
2.1 KiB
Diff
89 lines
2.1 KiB
Diff
From 2271da7522d8406c528d2a9079d810e140f8041a Mon Sep 17 00:00:00 2001
|
|
From: Michael Chang <mchang@suse.com>
|
|
Date: Fri, 3 Feb 2023 19:40:31 +0800
|
|
Subject: [PATCH 2/2] discard cached key before entering grub shell and editor
|
|
mode
|
|
|
|
The cached key is cleared in case of anyone poking around it by means of
|
|
the interactive shell offerings.
|
|
|
|
Signed-off-by: Michael Chang <mchang@suse.com>
|
|
---
|
|
grub-core/commands/crypttab.c | 16 ++++++++++++++++
|
|
grub-core/normal/main.c | 2 ++
|
|
grub-core/normal/menu_entry.c | 3 +++
|
|
include/grub/crypttab.h | 2 ++
|
|
4 files changed, 23 insertions(+)
|
|
|
|
--- a/grub-core/commands/crypttab.c
|
|
+++ b/grub-core/commands/crypttab.c
|
|
@@ -53,6 +53,22 @@
|
|
return GRUB_ERR_NONE;
|
|
}
|
|
|
|
+void
|
|
+grub_initrd_discard_key (void)
|
|
+{
|
|
+ struct grub_key_publisher *cur, *nxt;
|
|
+
|
|
+ FOR_LIST_ELEMENTS_SAFE (cur, nxt, kpuber)
|
|
+ {
|
|
+ grub_list_remove (GRUB_AS_LIST (cur));
|
|
+ grub_memset (cur->key, 0, cur->key_len);
|
|
+ grub_free (cur->name);
|
|
+ grub_free (cur->path);
|
|
+ grub_free (cur->key);
|
|
+ grub_free (cur);
|
|
+ }
|
|
+}
|
|
+
|
|
static grub_err_t
|
|
grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)),
|
|
int argc, char **argv)
|
|
--- a/grub-core/normal/main.c
|
|
+++ b/grub-core/normal/main.c
|
|
@@ -37,6 +37,7 @@
|
|
#ifdef GRUB_MACHINE_IEEE1275
|
|
#include <grub/ieee1275/ieee1275.h>
|
|
#endif
|
|
+#include <grub/crypttab.h>
|
|
|
|
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
|
@@ -478,6 +479,7 @@
|
|
return;
|
|
}
|
|
|
|
+ grub_initrd_discard_key ();
|
|
grub_normal_reader_init (nested);
|
|
|
|
while (1)
|
|
--- a/grub-core/normal/menu_entry.c
|
|
+++ b/grub-core/normal/menu_entry.c
|
|
@@ -28,6 +28,7 @@
|
|
#include <grub/i18n.h>
|
|
#include <grub/charset.h>
|
|
#include <grub/safemath.h>
|
|
+#include <grub/crypttab.h>
|
|
|
|
enum update_mode
|
|
{
|
|
@@ -1262,6 +1263,8 @@
|
|
return;
|
|
}
|
|
|
|
+ grub_initrd_discard_key();
|
|
+
|
|
screen = make_screen (entry);
|
|
if (! screen)
|
|
return;
|
|
--- a/include/grub/crypttab.h
|
|
+++ b/include/grub/crypttab.h
|
|
@@ -19,4 +19,6 @@
|
|
grub_err_t
|
|
grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path);
|
|
|
|
+void
|
|
+grub_initrd_discard_key (void);
|
|
#endif /* ! GRUB_CRYPTTAB_HEADER */
|