Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-21 06:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

efi: Lockdown the GRUB when the UEFI Secure Boot is enabled

Browse Source 
If the UEFI Secure Boot is enabled then the GRUB must be locked down
to prevent executing code that can potentially be used to subvert its
verification mechanisms.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Javier Martinez Canillas authored and Daniel Kiper committed 2021-03-02 15:54:15 +01:00
1 parent d903674717
commit 98b00a403c
1 file changed
+9 -1
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/kern/efi/init.c
+9 -1
View File
@@ -21,6 +21,7 @@
#include <grub/efi/console.h>
#include <grub/efi/disk.h>
#include <grub/efi/sb.h>
#include <grub/lockdown.h>
#include <grub/term.h>
#include <grub/misc.h>
#include <grub/env.h>
@@ -40,8 +41,15 @@ grub_efi_init (void)
/* Initialize the memory management system. */
grub_efi_mm_init ();
/* Register the shim_lock verifier if UEFI Secure Boot is enabled. */
/*
* Lockdown the GRUB and register the shim_lock verifier
* if the UEFI Secure Boot is enabled.
*/
if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
{
grub_lockdown ();
grub_shim_lock_verifier_setup ();
}
efi_call_4 (grub_efi_system_table->boot_services->set_watchdog_timer,
0, 0, 0, NULL);