Compare commits
No commits in common. 'c9' and 'i9-beta' have entirely different histories.
@ -0,0 +1,159 @@
|
|||||||
|
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Marta Lewandowska <mlewando@redhat.com>
|
||||||
|
Date: Mon, 9 Oct 2023 08:53:18 +0200
|
||||||
|
Subject: [PATCH] search command: add flag to only search root dev
|
||||||
|
|
||||||
|
bz#2223437
|
||||||
|
Signed-off-by: Marta Lewandowska <mlewando@redhat.com>
|
||||||
|
---
|
||||||
|
grub-core/commands/search.c | 36 ++++++++++++++++++++++++++++++++++++
|
||||||
|
grub-core/commands/search_wrap.c | 5 +++++
|
||||||
|
grub-core/kern/misc.c | 30 ++++++++++++++++++++++++++++++
|
||||||
|
include/grub/misc.h | 1 +
|
||||||
|
include/grub/search.h | 3 ++-
|
||||||
|
5 files changed, 74 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
|
||||||
|
index 57d26ced8a8e..94fe8b2872a1 100644
|
||||||
|
--- a/grub-core/commands/search.c
|
||||||
|
+++ b/grub-core/commands/search.c
|
||||||
|
@@ -85,6 +85,42 @@ iterate_device (const char *name, void *data)
|
||||||
|
grub_device_close (dev);
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /* Skip it if it's not the root device when requested. */
|
||||||
|
+ if (ctx->flags & SEARCH_FLAGS_ROOTDEV_ONLY)
|
||||||
|
+ {
|
||||||
|
+ const char *root_dev;
|
||||||
|
+ root_dev = grub_env_get ("root");
|
||||||
|
+ if (root_dev != NULL && *root_dev != '\0')
|
||||||
|
+ {
|
||||||
|
+ char *root_disk = grub_malloc (grub_strlen(root_dev) + 1);
|
||||||
|
+ char *name_disk = grub_malloc (grub_strlen(name) + 1);
|
||||||
|
+ char *rem_1 = grub_malloc(grub_strlen(root_dev) + 1);
|
||||||
|
+ char *rem_2 = grub_malloc(grub_strlen(name) + 1);
|
||||||
|
+
|
||||||
|
+ if (root_disk != NULL && name_disk != NULL &&
|
||||||
|
+ rem_1 != NULL && rem_2 != NULL)
|
||||||
|
+ {
|
||||||
|
+ /* get just the disk name; partitions will be different. */
|
||||||
|
+ grub_str_sep (root_dev, root_disk, ',', rem_1);
|
||||||
|
+ grub_str_sep (name, name_disk, ',', rem_2);
|
||||||
|
+ if (root_disk != NULL && *root_disk != '\0' &&
|
||||||
|
+ name_disk != NULL && *name_disk != '\0')
|
||||||
|
+ if (grub_strcmp(root_disk, name_disk) != 0)
|
||||||
|
+ {
|
||||||
|
+ grub_free (root_disk);
|
||||||
|
+ grub_free (name_disk);
|
||||||
|
+ grub_free (rem_1);
|
||||||
|
+ grub_free (rem_2);
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ grub_free (root_disk);
|
||||||
|
+ grub_free (name_disk);
|
||||||
|
+ grub_free (rem_1);
|
||||||
|
+ grub_free (rem_2);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
#ifdef DO_SEARCH_FS_UUID
|
||||||
|
#define compare_fn grub_strcasecmp
|
||||||
|
#else
|
||||||
|
diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c
|
||||||
|
index 0b62acf85359..06b5f51eefb5 100644
|
||||||
|
--- a/grub-core/commands/search_wrap.c
|
||||||
|
+++ b/grub-core/commands/search_wrap.c
|
||||||
|
@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] =
|
||||||
|
ARG_TYPE_STRING},
|
||||||
|
{"no-floppy", 'n', 0, N_("Do not probe any floppy drive."), 0, 0},
|
||||||
|
{"efidisk-only", 0, 0, N_("Only probe EFI disks."), 0, 0},
|
||||||
|
+ {"root-dev-only", 'r', 0, N_("Only probe root device."), 0, 0},
|
||||||
|
{"hint", 'h', GRUB_ARG_OPTION_REPEATABLE,
|
||||||
|
N_("First try the device HINT. If HINT ends in comma, "
|
||||||
|
"also try subpartitions"), N_("HINT"), ARG_TYPE_STRING},
|
||||||
|
@@ -75,6 +76,7 @@ enum options
|
||||||
|
SEARCH_SET,
|
||||||
|
SEARCH_NO_FLOPPY,
|
||||||
|
SEARCH_EFIDISK_ONLY,
|
||||||
|
+ SEARCH_ROOTDEV_ONLY,
|
||||||
|
SEARCH_HINT,
|
||||||
|
SEARCH_HINT_IEEE1275,
|
||||||
|
SEARCH_HINT_BIOS,
|
||||||
|
@@ -189,6 +191,9 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args)
|
||||||
|
if (state[SEARCH_EFIDISK_ONLY].set)
|
||||||
|
flags |= SEARCH_FLAGS_EFIDISK_ONLY;
|
||||||
|
|
||||||
|
+ if (state[SEARCH_ROOTDEV_ONLY].set)
|
||||||
|
+ flags |= SEARCH_FLAGS_ROOTDEV_ONLY;
|
||||||
|
+
|
||||||
|
if (state[SEARCH_LABEL].set)
|
||||||
|
grub_search_label (id, var, flags, hints, nhints);
|
||||||
|
else if (state[SEARCH_FS_UUID].set)
|
||||||
|
diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c
|
||||||
|
index cb454614022f..50af9ee1bdd9 100644
|
||||||
|
--- a/grub-core/kern/misc.c
|
||||||
|
+++ b/grub-core/kern/misc.c
|
||||||
|
@@ -619,6 +619,36 @@ grub_reverse (char *str)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+/* Separate string into two parts, broken up by delimiter delim. */
|
||||||
|
+void
|
||||||
|
+grub_str_sep (const char *s, char *p, char delim, char *r)
|
||||||
|
+{
|
||||||
|
+ char* t = grub_strndup(s, grub_strlen(s));
|
||||||
|
+
|
||||||
|
+ if (t != NULL && *t != '\0')
|
||||||
|
+ {
|
||||||
|
+ char* tmp = t;
|
||||||
|
+
|
||||||
|
+ while (((*p = *t) != '\0') && ((*p = *t) != delim))
|
||||||
|
+ {
|
||||||
|
+ p++;
|
||||||
|
+ t++;
|
||||||
|
+ }
|
||||||
|
+ *p = '\0';
|
||||||
|
+
|
||||||
|
+ if (*t != '\0')
|
||||||
|
+ {
|
||||||
|
+ t++;
|
||||||
|
+ while ((*r++ = *t++) != '\0')
|
||||||
|
+ ;
|
||||||
|
+ *r = '\0';
|
||||||
|
+ }
|
||||||
|
+ grub_free (tmp);
|
||||||
|
+ }
|
||||||
|
+ else
|
||||||
|
+ grub_free (t);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/* Divide N by D, return the quotient, and store the remainder in *R. */
|
||||||
|
grub_uint64_t
|
||||||
|
grub_divmod64 (grub_uint64_t n, grub_uint64_t d, grub_uint64_t *r)
|
||||||
|
diff --git a/include/grub/misc.h b/include/grub/misc.h
|
||||||
|
index faae0ae8606c..981526644d29 100644
|
||||||
|
--- a/include/grub/misc.h
|
||||||
|
+++ b/include/grub/misc.h
|
||||||
|
@@ -314,6 +314,7 @@ void *EXPORT_FUNC(grub_memset) (void *s, int c, grub_size_t n);
|
||||||
|
grub_size_t EXPORT_FUNC(grub_strlen) (const char *s) WARN_UNUSED_RESULT;
|
||||||
|
int EXPORT_FUNC(grub_printf) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2)));
|
||||||
|
int EXPORT_FUNC(grub_printf_) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2)));
|
||||||
|
+void EXPORT_FUNC(grub_str_sep) (const char *s, char *p, char delim, char *r);
|
||||||
|
|
||||||
|
/* Replace all `ch' characters of `input' with `with' and copy the
|
||||||
|
result into `output'; return EOS address of `output'. */
|
||||||
|
diff --git a/include/grub/search.h b/include/grub/search.h
|
||||||
|
index 4190aeb2cbf5..321d1400e451 100644
|
||||||
|
--- a/include/grub/search.h
|
||||||
|
+++ b/include/grub/search.h
|
||||||
|
@@ -22,7 +22,8 @@
|
||||||
|
enum search_flags
|
||||||
|
{
|
||||||
|
SEARCH_FLAGS_NO_FLOPPY = 1,
|
||||||
|
- SEARCH_FLAGS_EFIDISK_ONLY = 2
|
||||||
|
+ SEARCH_FLAGS_EFIDISK_ONLY = 2,
|
||||||
|
+ SEARCH_FLAGS_ROOTDEV_ONLY = 4
|
||||||
|
};
|
||||||
|
|
||||||
|
void grub_search_fs_file (const char *key, const char *var,
|
||||||
@ -1,77 +0,0 @@
|
|||||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Marta Lewandowska <mlewando@redhat.com>
|
|
||||||
Date: Fri, 13 Oct 2023 09:13:41 +0200
|
|
||||||
Subject: [PATCH] grub-install on EFI if forced
|
|
||||||
|
|
||||||
UEFI Secure Boot requires signed grub binaries to work, so grub-
|
|
||||||
install should not be used. However, users who have Secure Boot
|
|
||||||
disabled and wish to use the command should not be prevented from
|
|
||||||
doing so if they invoke --force.
|
|
||||||
|
|
||||||
fixes bz#1917213 / bz#2240994
|
|
||||||
|
|
||||||
Signed-off-by: Marta Lewandowska <mlewando@redhat.com>
|
|
||||||
---
|
|
||||||
util/grub-install.c | 42 ++++++++++++++++++++++++++----------------
|
|
||||||
1 file changed, 26 insertions(+), 16 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/util/grub-install.c b/util/grub-install.c
|
|
||||||
index 5babc7af5518..162162bec6e2 100644
|
|
||||||
--- a/util/grub-install.c
|
|
||||||
+++ b/util/grub-install.c
|
|
||||||
@@ -899,22 +899,6 @@ main (int argc, char *argv[])
|
|
||||||
|
|
||||||
platform = grub_install_get_target (grub_install_source_directory);
|
|
||||||
|
|
||||||
- switch (platform)
|
|
||||||
- {
|
|
||||||
- case GRUB_INSTALL_PLATFORM_ARM_EFI:
|
|
||||||
- case GRUB_INSTALL_PLATFORM_ARM64_EFI:
|
|
||||||
- case GRUB_INSTALL_PLATFORM_I386_EFI:
|
|
||||||
- case GRUB_INSTALL_PLATFORM_IA64_EFI:
|
|
||||||
- case GRUB_INSTALL_PLATFORM_X86_64_EFI:
|
|
||||||
- is_efi = 1;
|
|
||||||
- grub_util_error (_("this utility cannot be used for EFI platforms"
|
|
||||||
- " because it does not support UEFI Secure Boot"));
|
|
||||||
- break;
|
|
||||||
- default:
|
|
||||||
- is_efi = 0;
|
|
||||||
- break;
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
{
|
|
||||||
char *platname = grub_install_get_platform_name (platform);
|
|
||||||
fprintf (stderr, _("Installing for %s platform.\n"), platname);
|
|
||||||
@@ -1027,6 +1011,32 @@ main (int argc, char *argv[])
|
|
||||||
grub_hostfs_init ();
|
|
||||||
grub_host_init ();
|
|
||||||
|
|
||||||
+ switch (platform)
|
|
||||||
+ {
|
|
||||||
+ case GRUB_INSTALL_PLATFORM_I386_EFI:
|
|
||||||
+ case GRUB_INSTALL_PLATFORM_X86_64_EFI:
|
|
||||||
+ case GRUB_INSTALL_PLATFORM_ARM_EFI:
|
|
||||||
+ case GRUB_INSTALL_PLATFORM_ARM64_EFI:
|
|
||||||
+ case GRUB_INSTALL_PLATFORM_RISCV32_EFI:
|
|
||||||
+ case GRUB_INSTALL_PLATFORM_RISCV64_EFI:
|
|
||||||
+ case GRUB_INSTALL_PLATFORM_IA64_EFI:
|
|
||||||
+ is_efi = 1;
|
|
||||||
+ if (!force)
|
|
||||||
+ grub_util_error (_("This utility should not be used for EFI platforms"
|
|
||||||
+ " because it does not support UEFI Secure Boot."
|
|
||||||
+ " If you really wish to proceed, invoke the --force"
|
|
||||||
+ " option.\nMake sure Secure Boot is disabled before"
|
|
||||||
+ " proceeding"));
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ is_efi = 0;
|
|
||||||
+ break;
|
|
||||||
+
|
|
||||||
+ /* pacify warning. */
|
|
||||||
+ case GRUB_INSTALL_PLATFORM_MAX:
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
/* Find the EFI System Partition. */
|
|
||||||
if (is_efi)
|
|
||||||
{
|
|
||||||
@ -1,182 +0,0 @@
|
|||||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Nicolas Frayer <nfrayer@redhat.com>
|
|
||||||
Date: Thu, 16 May 2024 10:58:32 +0200
|
|
||||||
Subject: [PATCH] cmd/search: Rework of CVE-2023-4001 fix
|
|
||||||
|
|
||||||
The initial fix implemented a new flag that forces the grub cfg
|
|
||||||
stub to be located on the same disk as grub. This created several
|
|
||||||
issues such as RAID machines not being able to boot as their
|
|
||||||
partition names under grub were different from the partition where
|
|
||||||
grub is located. It also simply means that any machines with the
|
|
||||||
/boot partition located on a disk other than the one containing grub
|
|
||||||
won't boot.
|
|
||||||
This commit denies booting if the grub cfg stub is located on a USB
|
|
||||||
drive with a duplicated UUID (UUID being the same as the partition
|
|
||||||
containing the actual grub cfg stub)
|
|
||||||
|
|
||||||
Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
|
|
||||||
---
|
|
||||||
grub-core/commands/search.c | 136 +++++++++++++++++++++++++++++++++++++++++---
|
|
||||||
1 file changed, 127 insertions(+), 9 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
|
|
||||||
index 94fe8b2872a1..c052cb098c36 100644
|
|
||||||
--- a/grub-core/commands/search.c
|
|
||||||
+++ b/grub-core/commands/search.c
|
|
||||||
@@ -30,6 +30,8 @@
|
|
||||||
#include <grub/i18n.h>
|
|
||||||
#include <grub/disk.h>
|
|
||||||
#include <grub/partition.h>
|
|
||||||
+#include <grub/efi/api.h>
|
|
||||||
+#include <grub/time.h>
|
|
||||||
|
|
||||||
GRUB_MOD_LICENSE ("GPLv3+");
|
|
||||||
|
|
||||||
@@ -54,6 +56,100 @@ struct search_ctx
|
|
||||||
int is_cache;
|
|
||||||
};
|
|
||||||
|
|
||||||
+static int
|
|
||||||
+is_device_usb (const char *name)
|
|
||||||
+{
|
|
||||||
+ int ret = 0;
|
|
||||||
+
|
|
||||||
+ grub_device_t dev = grub_device_open(name);
|
|
||||||
+
|
|
||||||
+ if (dev)
|
|
||||||
+ {
|
|
||||||
+ struct grub_efidisk_data
|
|
||||||
+ {
|
|
||||||
+ grub_efi_handle_t handle;
|
|
||||||
+ grub_efi_device_path_t *device_path;
|
|
||||||
+ grub_efi_device_path_t *last_device_path;
|
|
||||||
+ grub_efi_block_io_t *block_io;
|
|
||||||
+ struct grub_efidisk_data *next;
|
|
||||||
+ };
|
|
||||||
+
|
|
||||||
+ if (dev->disk && dev->disk->data)
|
|
||||||
+ {
|
|
||||||
+ struct grub_efidisk_data *dp = dev->disk->data;
|
|
||||||
+
|
|
||||||
+ if ( GRUB_EFI_DEVICE_PATH_TYPE (dp->last_device_path) == GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE &&
|
|
||||||
+ GRUB_EFI_DEVICE_PATH_SUBTYPE (dp->last_device_path) == GRUB_EFI_USB_DEVICE_PATH_SUBTYPE)
|
|
||||||
+ {
|
|
||||||
+ ret = 1;
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ grub_device_close(dev);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return ret;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static int
|
|
||||||
+get_device_uuid(const char *name, char** quid)
|
|
||||||
+{
|
|
||||||
+ int ret = 0;
|
|
||||||
+
|
|
||||||
+ grub_device_t dev_part = grub_device_open(name);
|
|
||||||
+
|
|
||||||
+ if (dev_part)
|
|
||||||
+ {
|
|
||||||
+ grub_fs_t fs;
|
|
||||||
+
|
|
||||||
+ fs = grub_fs_probe (dev_part);
|
|
||||||
+
|
|
||||||
+#ifdef DO_SEARCH_FS_UUID
|
|
||||||
+#define read_fn fs_uuid
|
|
||||||
+#else
|
|
||||||
+#define read_fn fs_label
|
|
||||||
+#endif
|
|
||||||
+ if (fs && fs->read_fn)
|
|
||||||
+ {
|
|
||||||
+ fs->read_fn (dev_part, quid);
|
|
||||||
+
|
|
||||||
+ if (grub_errno == GRUB_ERR_NONE && *quid)
|
|
||||||
+ {
|
|
||||||
+ ret = 1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ }
|
|
||||||
+ grub_device_close (dev_part);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return ret;
|
|
||||||
+}
|
|
||||||
+struct uuid_context {
|
|
||||||
+ char* name;
|
|
||||||
+ char* uuid;
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
+static int
|
|
||||||
+check_for_duplicate (const char *name, void *data)
|
|
||||||
+{
|
|
||||||
+ int ret = 0;
|
|
||||||
+ struct uuid_context * uuid_ctx = (struct uuid_context *)data;
|
|
||||||
+ char *quid = 0;
|
|
||||||
+
|
|
||||||
+ get_device_uuid(name, &quid);
|
|
||||||
+
|
|
||||||
+ if (quid == NULL)
|
|
||||||
+ return 0;
|
|
||||||
+
|
|
||||||
+ if (!grub_strcasecmp(quid, uuid_ctx->uuid) && grub_strcasecmp(name, uuid_ctx->name))
|
|
||||||
+ {
|
|
||||||
+ ret = 1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ grub_free(quid);
|
|
||||||
+
|
|
||||||
+ return ret;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/* Helper for FUNC_NAME. */
|
|
||||||
static int
|
|
||||||
iterate_device (const char *name, void *data)
|
|
||||||
@@ -104,15 +200,37 @@ iterate_device (const char *name, void *data)
|
|
||||||
grub_str_sep (root_dev, root_disk, ',', rem_1);
|
|
||||||
grub_str_sep (name, name_disk, ',', rem_2);
|
|
||||||
if (root_disk != NULL && *root_disk != '\0' &&
|
|
||||||
- name_disk != NULL && *name_disk != '\0')
|
|
||||||
- if (grub_strcmp(root_disk, name_disk) != 0)
|
|
||||||
- {
|
|
||||||
- grub_free (root_disk);
|
|
||||||
- grub_free (name_disk);
|
|
||||||
- grub_free (rem_1);
|
|
||||||
- grub_free (rem_2);
|
|
||||||
- return 0;
|
|
||||||
- }
|
|
||||||
+ name_disk != NULL && *name_disk != '\0')
|
|
||||||
+ {
|
|
||||||
+ grub_device_t dev, dev_part;
|
|
||||||
+
|
|
||||||
+ if (is_device_usb(name) && !is_device_usb(root_dev))
|
|
||||||
+ {
|
|
||||||
+ char *quid_name = NULL;
|
|
||||||
+ int longlist = 0;
|
|
||||||
+ struct uuid_context uuid_ctx;
|
|
||||||
+ int ret = 0;
|
|
||||||
+
|
|
||||||
+ get_device_uuid(name, &quid_name);
|
|
||||||
+ if (!grub_strcmp(quid_name, ctx->key))
|
|
||||||
+ {
|
|
||||||
+ uuid_ctx.name = name;
|
|
||||||
+ uuid_ctx.uuid = quid_name;
|
|
||||||
+
|
|
||||||
+ ret = grub_device_iterate (check_for_duplicate, &uuid_ctx);
|
|
||||||
+
|
|
||||||
+ if (ret)
|
|
||||||
+ {
|
|
||||||
+ grub_printf("Duplicated media UUID found, rebooting ...\n");
|
|
||||||
+ grub_sleep(10);
|
|
||||||
+ grub_reboot();
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (quid_name) grub_free (quid_name);
|
|
||||||
+
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
grub_free (root_disk);
|
|
||||||
grub_free (name_disk);
|
|
||||||
@ -1,3 +1,4 @@
|
|||||||
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
|
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
|
||||||
grub,3,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/
|
grub,3,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/
|
||||||
grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com
|
grub.rh,2,Red Hat,grub2,@@RHEL_VERSION_RELEASE@@,mailto:secalert@redhat.com
|
||||||
|
grub.msvsphere,2,MSVSphere,grub2,@@VERSION_RELEASE@@,mailto:security@msvsphere-os.ru
|
||||||
|
|||||||
Loading…
Reference in new issue