proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-10-04 11:42:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
03d18df312
grub2/grub-core
History
Zhang Boyang 03d18df312 kern/efi/sb: Enforce verification of font files 
As a mitigation and hardening measure enforce verification of font
files. Then only trusted font files can be load. This will reduce the
attack surface at cost of losing the ability of end-users to customize
fonts if e.g. UEFI Secure Boot is enabled. Vendors can always customize
fonts because they have ability to pack fonts into their GRUB bundles.

This goal is achieved by:

  * Removing GRUB_FILE_TYPE_FONT from shim lock verifier's
    skip-verification list.

  * Adding GRUB_FILE_TYPE_FONT to lockdown verifier's defer-auth list,
    so font files must be verified by a verifier before they can be loaded.

Suggested-by: Daniel Kiper <daniel.kiper@oracle.com>
Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
2022-11-12 22:51:49 +00:00
..
boot Add configure option to reduce visual clutter at boot time 2021-09-27 20:09:38 +01:00
bus usb/usbhub: Use GRUB_USB_MAX_CONF macro instead of literal in hub for maximum configs 2021-04-12 16:26:49 +02:00
commands commands/boot: Add API to pass context to loader 2022-06-08 12:41:03 +02:00
disk i18n: Format large integers before the translation message 2021-04-13 17:16:04 +02:00
efiemu i18n: Format large integers before the translation message 2021-04-13 17:16:04 +02:00
font font: Fix integer underflow in binary search of char index 2022-11-12 22:51:49 +00:00
fs fs/btrfs: Fix more fuzz issues related to chunks 2022-06-08 12:41:03 +02:00
gdb gdb: Restrict GDB access when locked down 2021-03-02 15:54:15 +01:00
gettext Silence error messages when translations are unavailable 2021-09-24 22:18:50 +01:00
gfxmenu gfxmenu/gui: Check printf() format in the gui_progress_bar and gui_label 2021-03-02 15:54:20 +01:00
hello * grub-core/commands/gptsync.c: Fix typographic quoting. 2012-03-03 13:05:08 +01:00
hook * grub-core/hook/datehook.c (grub_read_hook_datetime): Small stylistic 2011-11-11 21:03:49 +01:00
io io/gzio: Zero gzio->tl/td in init_dynamic_block() if huft_build() fails 2021-03-02 15:54:18 +01:00
kern kern/efi/sb: Enforce verification of font files 2022-11-12 22:51:49 +00:00
lib minilzo: Update to minilzo-2.10 2021-11-29 00:07:08 +00:00
loader loader/efi/chainloader: Use grub_loader_set_ex() 2022-06-08 12:41:03 +02:00
mmap mmap: Fix memory leak when iterating over mapped memory 2021-03-02 15:54:15 +01:00
net net/http: Error out on headers with LF without CR 2022-06-08 12:41:03 +02:00
normal normal/charset: Fix array out-of-bounds formatting unicode for display 2022-06-08 12:41:03 +02:00
osdep Minimise writes to EFI variable storage 2021-09-27 20:09:39 +01:00
partmap mbr: Warn if MBR gap is small and user uses advanced modules 2020-12-12 01:19:03 +01:00
parttool parttool/msdospart: grub_error() missing format string argument 2021-03-10 14:50:44 +01:00
script misc: Format string for grub_error() should be a literal 2021-03-10 14:50:44 +01:00
term at_keyboard: initialize keyboard in module init if keyboard is ready 2021-09-27 20:09:39 +01:00
tests fs: Use 64-bit type for filesystem timestamp 2021-06-01 17:19:13 +02:00
video video/readers: Add artificial limit to image dimensions 2022-11-12 22:51:49 +00:00
gdb_grub.in * grub-core/gdb_grub.in: Fix overflow and wrong field. 2013-10-14 03:40:20 +02:00
genemuinit.sh use MODULE_FILES for genemuinit* instead of MOD_FILES 2014-01-18 23:15:40 +04:00
genemuinitheader.sh use MODULE_FILES for genemuinit* instead of MOD_FILES 2014-01-18 23:15:40 +04:00
genmod.sh.in .mod files: Strip annobin annotations and .eh_frame, and their relocations 2018-03-05 14:08:22 +01:00
genmoddep.awk enforcing fixup 2017-08-14 16:27:10 +02:00
gensyminfo.sh.in Fix shebang for termux. 2017-05-03 12:49:31 +02:00
gensymlist.sh Make 'make check' work on emu. 2013-04-27 02:00:16 +02:00
gentrigtables.c * grub-core/gentrigtables.c: Make tables const. 2013-03-01 11:15:09 +01:00
gmodule.pl.in * grub-core/gmodule.pl.in: Accept newer binutils which output 2014-09-21 18:23:23 +02:00
Makefile.am i386-pc: build verifiers API as module 2021-09-27 20:09:39 +01:00
Makefile.core.am Import grub2_2.06.orig.tar.xz 2021-09-24 10:34:42 +01:00
Makefile.core.def i386-pc: build verifiers API as module 2021-09-27 20:09:39 +01:00
Makefile.gcry.def Import grub2_2.02~beta3.orig.tar.xz 2016-09-18 17:40:00 +01:00
Makefile.in Import grub2_2.06.orig.tar.xz 2021-09-24 10:34:42 +01:00
modinfo.sh.in Fix shebang for termux. 2017-05-03 12:49:31 +02:00
unidata.c Import grub2_2.02~beta3.orig.tar.xz 2016-09-18 17:40:00 +01:00