Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-20 22:48:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

commands: Restrict commands that can load BIOS or DT blobs when locked down

Browse Source 
There are some more commands that should be restricted when the GRUB is
locked down. Following is the list of commands and reasons to restrict:

  * fakebios:   creates BIOS-like structures for backward compatibility with
                existing OSes. This should not be allowed when locked down.

  * loadbios:   reads a BIOS dump from storage and loads it. This action
                should not be allowed when locked down.

  * devicetree: loads a Device Tree blob and passes it to the OS. It replaces
                any Device Tree provided by the firmware. This also should
                not be allowed when locked down.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Javier Martinez Canillas authored and Daniel Kiper committed 2021-03-02 15:54:15 +01:00
1 parent d298b41f90
commit 468a5699b2
4 files changed
+15 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/commands/efi/loadbios.c
+7 -7
View File
@@ -205,14 +205,14 @@ static grub_command_t cmd_fakebios, cmd_loadbios;
GRUB_MOD_INIT(loadbios)
{
cmd_fakebios = grub_register_command ("fakebios", grub_cmd_fakebios,
0, N_("Create BIOS-like structures for"
" backward compatibility with"
" existing OS."));
cmd_fakebios = grub_register_command_lockdown ("fakebios", grub_cmd_fakebios,
0, N_("Create BIOS-like structures for"
" backward compatibility with"
" existing OS."));
cmd_loadbios = grub_register_command ("loadbios", grub_cmd_loadbios,
N_("BIOS_DUMP [INT10_DUMP]"),
N_("Load BIOS dump."));
cmd_loadbios = grub_register_command_lockdown ("loadbios", grub_cmd_loadbios,
N_("BIOS_DUMP [INT10_DUMP]"),
N_("Load BIOS dump."));
}
GRUB_MOD_FINI(loadbios)