mirror of
https://git.savannah.gnu.org/git/grub.git
synced 2026-10-21 23:02:40 +00:00
Maxim Suhanov
ed691c0e0e
This allows users to restrict the "search" command's scope to encrypted disks only. Typically, this command is used to "rebase" $root and $prefix before loading additional configuration files via "source" or "configfile". Unfortunately, this leads to security problems, like CVE-2023-4001, when an unexpected, attacker-controlled device is chosen by the "search" command. The --cryptodisk-only argument allows users to ensure that the file system picked is encrypted. This feature supports the CLI authentication, blocking bypass attempts. Signed-off-by: Maxim Suhanov <dfirblog@gmail.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>