proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2026-01-27 16:36:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

commands: Restrict commands that can load BIOS or DT blobs when locked down

Browse Source 
There are some more commands that should be restricted when the GRUB is
locked down. Following is the list of commands and reasons to restrict:

  * fakebios:   creates BIOS-like structures for backward compatibility with
                existing OSes. This should not be allowed when locked down.

  * loadbios:   reads a BIOS dump from storage and loads it. This action
                should not be allowed when locked down.

  * devicetree: loads a Device Tree blob and passes it to the OS. It replaces
                any Device Tree provided by the firmware. This also should
                not be allowed when locked down.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

Patch-Name: 2021-02-security/008-commands-Restrict-commands-that-can-load-BIOS-or-DT-blobs-when-locked-down.patch
This commit is contained in:
Javier Martinez Canillas 2021-02-24 09:00:05 +01:00 committed by Colin Watson
parent 5d58cce5c0
commit 22f08600d2
4 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/grub.texi
View File

@ -4255,6 +4255,9 @@ Load a device tree blob (.dtb) from a filesystem, for later use by a Linux
kernel. Does not perform merging with any device tree supplied by firmware,
but rather replaces it completely.
@ref{GNU/Linux}.
Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
This is done to prevent subverting various security mechanisms.
@end deffn
@node distrust

14
grub-core/commands/efi/loadbios.c
View File

@ -205,14 +205,14 @@ static grub_command_t cmd_fakebios, cmd_loadbios;
GRUB_MOD_INIT(loadbios)
{
cmd_fakebios = grub_register_command ("fakebios", grub_cmd_fakebios,
0, N_("Create BIOS-like structures for"
" backward compatibility with"
" existing OS."));
cmd_fakebios = grub_register_command_lockdown ("fakebios", grub_cmd_fakebios,
0, N_("Create BIOS-like structures for"
" backward compatibility with"
" existing OS."));
cmd_loadbios = grub_register_command ("loadbios", grub_cmd_loadbios,
N_("BIOS_DUMP [INT10_DUMP]"),
N_("Load BIOS dump."));
cmd_loadbios = grub_register_command_lockdown ("loadbios", grub_cmd_loadbios,
N_("BIOS_DUMP [INT10_DUMP]"),
N_("Load BIOS dump."));
}
GRUB_MOD_FINI(loadbios)

6
grub-core/loader/arm/linux.c
View File

@ -505,9 +505,9 @@ GRUB_MOD_INIT (linux)
0, N_("Load Linux."));
cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd,
0, N_("Load initrd."));
cmd_devicetree = grub_register_command ("devicetree", grub_cmd_devicetree,
/* TRANSLATORS: DTB stands for device tree blob. */
0, N_("Load DTB file."));
cmd_devicetree = grub_register_command_lockdown ("devicetree", grub_cmd_devicetree,
/* TRANSLATORS: DTB stands for device tree blob. */
0, N_("Load DTB file."));
my_mod = mod;
current_fdt = (const void *) grub_arm_firmware_get_boot_data ();
machine_type = grub_arm_firmware_get_machine_type ();

4
grub-core/loader/efi/fdt.c
View File

@ -173,8 +173,8 @@ static grub_command_t cmd_devicetree;
GRUB_MOD_INIT (fdt)
{
cmd_devicetree =
grub_register_command ("devicetree", grub_cmd_devicetree, 0,
N_("Load DTB file."));
grub_register_command_lockdown ("devicetree", grub_cmd_devicetree, 0,
N_("Load DTB file."));
}
GRUB_MOD_FINI (fdt)