Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-28 01:59:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

efi: Use grub_is_lockdown() instead of hardcoding a disabled modules list

Browse Source 
Now the GRUB can check if it has been locked down and this can be used to
prevent executing commands that can be utilized to circumvent the UEFI
Secure Boot mechanisms. So, instead of hardcoding a list of modules that
have to be disabled, prevent the usage of commands that can be dangerous.

This not only allows the commands to be disabled on other platforms, but
also properly separate the concerns. Since the shim_lock verifier logic
should be only about preventing to run untrusted binaries and not about
defining these kind of policies.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Javier Martinez Canillas authored and Daniel Kiper committed 2021-03-02 15:54:15 +01:00
1 parent 98b00a403c
commit 8f73052885
5 files changed
+32 -67
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/commands/iorw.c
+10 -9
View File
@@ -23,6 +23,7 @@
#include <grub/env.h>
#include <grub/cpu/io.h>
#include <grub/i18n.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@@ -131,17 +132,17 @@ GRUB_MOD_INIT(memrw)
N_("PORT"), N_("Read 32-bit value from PORT."),
options);
cmd_write_byte =
grub_register_command ("outb", grub_cmd_write,
N_("PORT VALUE [MASK]"),
N_("Write 8-bit VALUE to PORT."));
grub_register_command_lockdown ("outb", grub_cmd_write,
N_("PORT VALUE [MASK]"),
N_("Write 8-bit VALUE to PORT."));
cmd_write_word =
grub_register_command ("outw", grub_cmd_write,
N_("PORT VALUE [MASK]"),
N_("Write 16-bit VALUE to PORT."));
grub_register_command_lockdown ("outw", grub_cmd_write,
N_("PORT VALUE [MASK]"),
N_("Write 16-bit VALUE to PORT."));
cmd_write_dword =
grub_register_command ("outl", grub_cmd_write,
N_("ADDR VALUE [MASK]"),
N_("Write 32-bit VALUE to PORT."));
grub_register_command_lockdown ("outl", grub_cmd_write,
N_("ADDR VALUE [MASK]"),
N_("Write 32-bit VALUE to PORT."));
}
GRUB_MOD_FINI(memrw)