forked from pool/grub2
be3181b1eb
- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057) * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch * 0036-util-mkimage-Improve-data_size-value-calculation.patch * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch * 0039-grub-install-common-Add-sbat-option.patch - Fix CVE-2021-20225 (bsc#1182262) * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch - Fix CVE-2020-27749 (bsc#1179264) * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch * 0025-kern-parser-Fix-a-memory-leak.patch * 0026-kern-parser-Introduce-process_char-helper.patch * 0027-kern-parser-Introduce-terminate_arg-helper.patch * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch - Fix CVE-2021-20233 (bsc#1182263) * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch - Fix CVE-2020-25647 (bsc#1177883) * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch - Fix CVE-2020-25632 (bsc#1176711) * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch - Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970) * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch OBS-URL: https://build.opensuse.org/request/show/876326 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=374
89 lines
2.6 KiB
Diff
89 lines
2.6 KiB
Diff
From 768ab190a7c0a412bbec6142d12000655324daa0 Mon Sep 17 00:00:00 2001
|
||
From: Michael Chang <mchang@suse.com>
|
||
Date: Fri, 11 Dec 2020 23:01:59 +0800
|
||
Subject: [PATCH 43/46] squash! Don't allow insmod when secure boot is enabled.
|
||
|
||
Use grub_efi_get_secureboot to get secure boot status
|
||
---
|
||
grub-core/kern/dl.c | 4 ++--
|
||
grub-core/kern/efi/efi.c | 28 ----------------------------
|
||
include/grub/efi/efi.h | 1 -
|
||
3 files changed, 2 insertions(+), 31 deletions(-)
|
||
|
||
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
|
||
index e02f2afc5..93f08dfce 100644
|
||
--- a/grub-core/kern/dl.c
|
||
+++ b/grub-core/kern/dl.c
|
||
@@ -39,7 +39,7 @@
|
||
#endif
|
||
|
||
#ifdef GRUB_MACHINE_EFI
|
||
-#include <grub/efi/efi.h>
|
||
+#include <grub/efi/sb.h>
|
||
#endif
|
||
|
||
|
||
@@ -702,7 +702,7 @@ grub_dl_load_file (const char *filename)
|
||
grub_boot_time ("Loading module %s", filename);
|
||
|
||
#ifdef GRUB_MACHINE_EFI
|
||
- if (grub_efi_secure_boot ())
|
||
+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
|
||
{
|
||
#if 0
|
||
/* This is an error, but grub2-mkconfig still generates a pile of
|
||
diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
|
||
index 92e99b441..32f1b2ec7 100644
|
||
--- a/grub-core/kern/efi/efi.c
|
||
+++ b/grub-core/kern/efi/efi.c
|
||
@@ -278,34 +278,6 @@ grub_efi_get_variable_with_attributes (const char *var,
|
||
return status;
|
||
}
|
||
|
||
-grub_efi_boolean_t
|
||
-grub_efi_secure_boot (void)
|
||
-{
|
||
- grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
|
||
- grub_size_t datasize;
|
||
- char *secure_boot = NULL;
|
||
- char *setup_mode = NULL;
|
||
- grub_efi_boolean_t ret = 0;
|
||
-
|
||
- secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);
|
||
-
|
||
- if (datasize != 1 || !secure_boot)
|
||
- goto out;
|
||
-
|
||
- setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize);
|
||
-
|
||
- if (datasize != 1 || !setup_mode)
|
||
- goto out;
|
||
-
|
||
- if (*secure_boot && !*setup_mode)
|
||
- ret = 1;
|
||
-
|
||
- out:
|
||
- grub_free (secure_boot);
|
||
- grub_free (setup_mode);
|
||
- return ret;
|
||
-}
|
||
-
|
||
grub_efi_status_t
|
||
grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
|
||
grub_size_t *datasize_out, void **data_out)
|
||
diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
|
||
index 568d80030..08f6ee00a 100644
|
||
--- a/include/grub/efi/efi.h
|
||
+++ b/include/grub/efi/efi.h
|
||
@@ -91,7 +91,6 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
|
||
const grub_efi_guid_t *guid,
|
||
void *data,
|
||
grub_size_t datasize);
|
||
-grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void);
|
||
int
|
||
EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,
|
||
const grub_efi_device_path_t *dp2);
|
||
--
|
||
2.26.2
|
||
|