vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity
grub/grub-core
History
Colin Watson 25850cfd50 Don't allow insmod when secure boot is enabled. 
Hi,

Fedora's patch to forbid insmod in UEFI Secure Boot environments is fine
as far as it goes.  However, the insmod command is not the only way that
modules can be loaded.  In particular, the 'normal' command, which
implements the usual GRUB menu and the fully-featured command prompt,
will implicitly load commands not currently loaded into memory.  This
permits trivial Secure Boot violations by writing commands implementing
whatever you want to do and pointing $prefix at the malicious code.

I'm currently test-building this patch (replacing your current
grub-2.00-no-insmod-on-sb.patch), but this should be more correct.  It
moves the check into grub_dl_load_file.
2015-04-22 12:47:49 -07:00
..
boot * grub-core/boot/sparc64/ieee1275/boot.S: Fix order of fields. 2013-12-19 01:53:56 +01:00
bus cleanup: grub_cpu_to_XXX_compile_time for constants 2014-09-22 20:47:10 +04:00
commands gpt: add search by partition label and uuid commands 2014-11-27 18:49:24 -08:00
disk cleanup: grub_cpu_to_XXX_compile_time for constants 2014-09-22 20:47:10 +04:00
efiemu fix include loop on MinGW due to libintl.h pulling stdio.h 2014-01-18 21:22:57 +04:00
font Pass font config to config.h and not by TARGET_CFLAGS as adding 2013-12-04 10:25:53 +01:00
fs cleanup: grub_cpu_to_XXX_compile_time for constants 2014-09-22 20:47:10 +04:00
gdb With Apple assembly in .macro environvemnt you have to use $$ instead 2013-11-24 07:08:18 +01:00
gettext * grub-core/gettext/gettext.c (main_context), (secondary_context): 2013-11-07 01:01:47 +01:00
gfxmenu Enable -Wformat=2 if it's supported. 2013-12-21 15:28:28 +01:00
gnulib Allow compilation with mingw64 albeit with warnings due to lack of 2013-10-15 18:03:19 +02:00
hello * grub-core/commands/gptsync.c: Fix typographic quoting. 2012-03-03 13:05:08 +01:00
hook * grub-core/hook/datehook.c (grub_read_hook_datetime): Small stylistic 2011-11-11 21:03:49 +01:00
io Make grub_zlib_decompress handle incomplete chunks. 2013-12-18 23:39:49 +01:00
kern Don't allow insmod when secure boot is enabled. 2015-04-22 12:47:49 -07:00
lib gpt: add search by partition label and uuid commands 2014-11-27 18:49:24 -08:00
loader Add support for linuxefi 2014-11-05 20:40:53 -08:00
mmap * grub-core/mmap/i386/uppermem.c (lower_hook) [COREBOOT]: Ignore low 2014-02-28 09:50:47 +01:00
net icmp6 fix no respond to neighbor solicit message 2014-11-03 20:03:04 +03:00
normal * grub-core/normal/main.c: Don't drop to rescue console in 2014-09-21 18:51:09 +02:00
osdep * grub-core/osdep/unix/config.c: Remove extraneous comma. 2014-09-21 17:49:13 +02:00
partmap cleanup: grub_cpu_to_XXX_compile_time for constants 2014-09-22 20:47:10 +04:00
parttool * grub-core/net/http.c: Add TRANSLATORS comments. 2012-03-05 16:42:26 +01:00
script Decrease stack usage in lexer. 2013-11-16 16:37:59 +01:00
term * grub-core/term/at_keyboard.c: Retry probing keyboard if 2014-08-13 23:04:01 +02:00
tests cleanup: grub_cpu_to_XXX_compile_time for constants 2014-09-22 20:47:10 +04:00
video fix include loop on MinGW due to libintl.h pulling stdio.h 2014-01-18 21:22:57 +04:00
gdb_grub.in * grub-core/gdb_grub.in: Fix overflow and wrong field. 2013-10-14 03:40:20 +02:00
genemuinit.sh use MODULE_FILES for genemuinit* instead of MOD_FILES 2014-01-18 23:15:40 +04:00
genemuinitheader.sh use MODULE_FILES for genemuinit* instead of MOD_FILES 2014-01-18 23:15:40 +04:00
genmod.sh.in * grub-core/genmod.sh.in: Strip before converting to ELF as strip 2013-12-16 13:18:48 +01:00
genmoddep.awk * grub-core/genmoddep.awk: Remove explicit getline < /dev/stdin. 2013-12-16 13:02:19 +01:00
gensyminfo.sh.in * grub-core/gensyminfo.sh.in: Handle the case of portable output 2013-11-11 23:05:53 +01:00
gensymlist.sh Make 'make check' work on emu. 2013-04-27 02:00:16 +02:00
gentrigtables.c * grub-core/gentrigtables.c: Make tables const. 2013-03-01 11:15:09 +01:00
gmodule.pl.in * grub-core/gmodule.pl.in: Accept newer binutils which output 2014-09-21 18:23:23 +02:00
gnulib-fix-null-deref.diff Import new gnulib. 2013-04-11 21:12:46 +02:00
gnulib-fix-width.diff Import new gnulib. 2013-04-11 21:12:46 +02:00
gnulib-no-abort.diff Import new gnulib. 2013-04-11 21:12:46 +02:00
gnulib-no-gets.diff Import new gnulib. 2013-04-11 21:12:46 +02:00
Makefile.am use MODULE_FILES for genemuinit* instead of MOD_FILES 2014-01-18 23:15:40 +04:00
Makefile.core.def gpt: add search by partition label and uuid commands 2014-11-27 18:49:24 -08:00
modinfo.sh.in Save TARGET_CC version in modinfo.sh. 2013-12-24 14:47:44 +01:00