main/vaseboot
main
/
vaseboot
1
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity
vaseboot/grub-core
History
Colin Watson dec8c6a8ac Don't allow insmod when secure boot is enabled. 
Hi,

Fedora's patch to forbid insmod in UEFI Secure Boot environments is fine
as far as it goes.  However, the insmod command is not the only way that
modules can be loaded.  In particular, the 'normal' command, which
implements the usual GRUB menu and the fully-featured command prompt,
will implicitly load commands not currently loaded into memory.  This
permits trivial Secure Boot violations by writing commands implementing
whatever you want to do and pointing $prefix at the malicious code.

I'm currently test-building this patch (replacing your current
grub-2.00-no-insmod-on-sb.patch), but this should be more correct.  It
moves the check into grub_dl_load_file.
 		2018-03-29 22:18:52 -04:00
..
boot mips: Make the assembly-code N32-compatible. 2015-10-11 13:20:26 +02:00
bus usbtrans: Fix memory coherence and use-after-free. 2016-02-27 13:40:52 +01:00
commands i386, x86_64, ppc: fix switch fallthrough cases with GCC7 2017-04-04 19:23:55 +03:00
disk i386, x86_64, ppc: fix switch fallthrough cases with GCC7 2017-04-04 19:23:55 +03:00
efiemu i386, x86_64, ppc: fix switch fallthrough cases with GCC7 2017-04-04 19:23:55 +03:00
font Document intentional fallthroughs. 2015-01-27 17:17:58 +01:00
fs btrfs: avoid "used uninitialized" error with GCC7 2017-04-04 19:22:32 +03:00
gdb i386, x86_64, ppc: fix switch fallthrough cases with GCC7 2017-04-04 19:23:55 +03:00
gettext * grub-core/gettext/gettext.c (main_context), (secondary_context): 2013-11-07 01:01:47 +01:00
gfxmenu gfxmenu: fix memory leak 2016-01-12 21:52:50 +03:00
gnulib i386, x86_64, ppc: fix switch fallthrough cases with GCC7 2017-04-04 19:23:55 +03:00
hello * grub-core/commands/gptsync.c: Fix typographic quoting. 2012-03-03 13:05:08 +01:00
hook * grub-core/hook/datehook.c (grub_read_hook_datetime): Small stylistic 2011-11-11 21:03:49 +01:00
io gzio: Optimize by removing division. 2015-02-26 22:10:09 +01:00
kern Don't allow insmod when secure boot is enabled. 2018-03-29 22:18:52 -04:00
lib i386, x86_64, ppc: fix switch fallthrough cases with GCC7 2017-04-04 19:23:55 +03:00
loader Add support for linuxefi 2018-03-29 22:18:52 -04:00
mmap Translate UEFI persistent memory type 2015-12-15 10:25:34 +03:00
net ofnet: implement the receive buffer 2016-12-14 14:13:34 +01:00
normal charset: Trim away RLM and LRM. 2017-01-31 19:29:31 +01:00
osdep osdep/linux: handle autofs entries in /proc/self/mountinfo 2017-01-24 20:05:19 +03:00
partmap disk/ldm, partmap/msdos.c: fix spelling error 2015-08-22 21:22:41 +02:00
parttool * grub-core/net/http.c: Add TRANSLATORS comments. 2012-03-05 16:42:26 +01:00
script script: fix double free in lexer 2017-02-12 09:23:34 +03:00
term gfxterm: Fix clearing of cursor. 2017-01-31 18:49:37 +01:00
tests Increase version to 2.02. 2017-04-25 16:23:16 +02:00
video i386, x86_64, ppc: fix switch fallthrough cases with GCC7 2017-04-04 19:23:55 +03:00
Makefile.am Split pmtimer wait and tsc measurement from pmtimer tsc calibration. 2016-02-12 11:40:51 +01:00
Makefile.core.def Add support for linuxefi 2018-03-29 22:18:52 -04:00
gdb_grub.in * grub-core/gdb_grub.in: Fix overflow and wrong field. 2013-10-14 03:40:20 +02:00
genemuinit.sh use MODULE_FILES for genemuinit* instead of MOD_FILES 2014-01-18 23:15:40 +04:00
genemuinitheader.sh use MODULE_FILES for genemuinit* instead of MOD_FILES 2014-01-18 23:15:40 +04:00
genmod.sh.in grub-module-verifier: Ignore all_video emptiness on xen. 2017-01-30 00:13:41 +00:00
genmoddep.awk genmoddep.awk: Add a test that we have no circular dependencies 2015-11-08 20:00:27 +01:00
gensyminfo.sh.in * grub-core/gensyminfo.sh.in: Handle the case of portable output 2013-11-11 23:05:53 +01:00
gensymlist.sh Make 'make check' work on emu. 2013-04-27 02:00:16 +02:00
gentrigtables.c * grub-core/gentrigtables.c: Make tables const. 2013-03-01 11:15:09 +01:00
gmodule.pl.in * grub-core/gmodule.pl.in: Accept newer binutils which output 2014-09-21 18:23:23 +02:00
gnulib-fix-gcc7-fallthrough.diff Add gnulib-fix-gcc7-fallthrough.diff 2017-04-04 19:37:47 +03:00
gnulib-fix-null-deref.diff Import new gnulib. 2013-04-11 21:12:46 +02:00
gnulib-fix-width.diff Import new gnulib. 2013-04-11 21:12:46 +02:00
gnulib-no-abort.diff Import new gnulib. 2013-04-11 21:12:46 +02:00
gnulib-no-gets.diff Import new gnulib. 2013-04-11 21:12:46 +02:00
modinfo.sh.in modinfo.sh.in: Add missing config variables. 2015-03-27 12:18:25 +01:00