Zhang Boyang 03d18df312 kern/efi/sb: Enforce verification of font files ... As a mitigation and hardening measure enforce verification of font files. Then only trusted font files can be load. This will reduce the attack surface at cost of losing the ability of end-users to customize fonts if e.g. UEFI Secure Boot is enabled. Vendors can always customize fonts because they have ability to pack fonts into their GRUB bundles. This goal is achieved by: * Removing GRUB_FILE_TYPE_FONT from shim lock verifier's skip-verification list. * Adding GRUB_FILE_TYPE_FONT to lockdown verifier's defer-auth list, so font files must be verified by a verifier before they can be loaded. Suggested-by: Daniel Kiper <daniel.kiper@oracle.com> Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>		2022-11-12 22:51:49 +00:00
..
arm	efi: Fix use-after-free in halt/reboot path	2020-07-29 16:55:48 +02:00
arm64	i18n: Format large integers before the translation message	2021-04-13 17:16:04 +02:00
coreboot	arm-coreboot: Start new port.	2017-05-08 20:53:28 +02:00
efi	kern/efi/sb: Enforce verification of font files	2022-11-12 22:51:49 +00:00
emu	Disable use of floppy devices	2021-09-24 10:34:44 +01:00
generic	rtc_get_time_ms.c (grub_rtc_get_time_ms): Avoid division by zero.	2015-01-21 17:42:14 +01:00
i386	i386: Don't include <grub/cpu/linux.h> in coreboot and ieee1275 startup.S	2020-12-11 13:52:18 +01:00
ia64	i18n: Format large integers before the translation message	2021-04-13 17:16:04 +02:00
ieee1275	Hack prefix for OLPC	2021-09-24 10:34:44 +01:00
mips	disk: Rename grub_disk_get_size() to grub_disk_native_sectors()	2020-12-12 01:19:03 +01:00
powerpc	Disable VSX instruction	2021-09-27 20:09:38 +01:00
riscv	i18n: Format large integers before the translation message	2021-04-13 17:16:04 +02:00
sparc64	i18n: Format large integers before the translation message	2021-04-13 17:16:04 +02:00
uboot	calloc: Use calloc() at most places	2020-07-29 16:55:47 +02:00
x86_64	i18n: Format large integers before the translation message	2021-04-13 17:16:04 +02:00
xen	xen: Add basic hooks for PVH in current code	2018-12-12 12:03:27 +01:00
acpi.c	Make grub_acpi_find_fadt accessible generically	2016-02-12 11:35:48 +01:00
buffer.c	kern/buffer: Add variable sized heap buffer	2021-03-02 15:54:19 +01:00
command.c	kern: Add lockdown support	2021-03-02 15:54:15 +01:00
compiler-rt.c	mips: Enable __clzdi2()	2020-12-18 23:04:36 +01:00
corecmd.c	Change fs functions to add fs_ prefix	2019-04-09 10:03:29 +10:00
device.c	Remove nested functions from device iterators.	2013-01-20 15:52:15 +00:00
disk_common.c	disk: Move hardcoded max disk size literal to a GRUB_DISK_MAX_SECTORS in disk.h	2020-12-12 01:19:03 +01:00
disk.c	disk: Rename grub_disk_get_size() to grub_disk_native_sectors()	2020-12-12 01:19:03 +01:00
dl.c	dl: Only allow unloading modules that are not dependencies	2021-03-02 15:54:15 +01:00
elf.c	verifiers: File type for fine-grained signature-verification controlling	2018-11-09 13:25:31 +01:00
elfXX.c	kern/elf: fix unintended sign extension	2016-01-09 19:41:26 +03:00
env.c	* grub-core/kern/env.c, include/grub/env.h: Change iterator through	2013-03-03 01:34:27 +01:00
err.c	* grub-core/kern/misc.c (grub_abort): Make static	2013-10-27 14:13:39 +01:00
file.c	kern/file: Do not leak device_name on error in grub_file_open()	2022-06-08 12:41:03 +02:00
fs.c	fs: Fix block lists not being able to address to end of disk sometimes	2020-12-12 01:19:03 +01:00
list.c	Remove prio_list.	2012-02-26 22:49:24 +01:00
lockdown.c	kern/efi/sb: Enforce verification of font files	2022-11-12 22:51:49 +00:00
main.c	i386-pc: build verifiers API as module	2021-09-27 20:09:39 +01:00
misc.c	kern/misc: Add function to check printf() format against expected format	2021-03-02 15:54:20 +01:00
mm.c	kern/mm: Fix grub_debug_calloc() compilation error	2021-03-02 15:54:20 +01:00
parser.c	kern/parser: Fix a stack buffer overflow	2021-03-02 15:54:19 +01:00
partition.c	kern/partition: Check for NULL before dereferencing input string	2021-03-02 15:54:16 +01:00
rescue_parser.c	rescue_parser: restructure code to avoid Coverity false positive	2016-01-09 18:15:27 +03:00
rescue_reader.c	Add configure option to reduce visual clutter at boot time	2021-09-27 20:09:38 +01:00
term.c	kern/term: Accept ESC, F4 and holding SHIFT as user interrupt keys	2020-04-21 22:13:44 +02:00
time.c	automake commit without merge history	2010-05-06 11:34:04 +05:30
verifiers.c	Add debug to display what's going on with verifiers	2021-09-27 20:09:39 +01:00
vga_init.c	* grub-core/kern/vga_init.c: Fix compilation on qemu-mips.	2013-08-14 09:50:57 +02:00