0045-loader-xnu-Don-t-allow-loading-extension-and-package.patch 2.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. From 9c5565135f12400a925ee901b25984e7af4442f5 Mon Sep 17 00:00:00 2001
  2. From: Javier Martinez Canillas <javierm@redhat.com>
  3. Date: Wed, 24 Feb 2021 14:44:38 +0100
  4. Subject: [PATCH] loader/xnu: Don't allow loading extension and packages when
  5. locked down
  6. The shim_lock verifier validates the XNU kernels but no its extensions
  7. and packages. Prevent these to be loaded when the GRUB is locked down.
  8. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
  9. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  10. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  11. ---
  12. grub-core/loader/xnu.c | 31 +++++++++++++++++--------------
  13. 1 file changed, 17 insertions(+), 14 deletions(-)
  14. diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
  15. index 9ae4ceb..44fd5a9 100644
  16. --- a/grub-core/loader/xnu.c
  17. +++ b/grub-core/loader/xnu.c
  18. @@ -1485,20 +1485,23 @@ GRUB_MOD_INIT(xnu)
  19. N_("Load XNU image."));
  20. cmd_kernel64 = grub_register_command ("xnu_kernel64", grub_cmd_xnu_kernel64,
  21. 0, N_("Load 64-bit XNU image."));
  22. - cmd_mkext = grub_register_command ("xnu_mkext", grub_cmd_xnu_mkext, 0,
  23. - N_("Load XNU extension package."));
  24. - cmd_kext = grub_register_command ("xnu_kext", grub_cmd_xnu_kext, 0,
  25. - N_("Load XNU extension."));
  26. - cmd_kextdir = grub_register_command ("xnu_kextdir", grub_cmd_xnu_kextdir,
  27. - /* TRANSLATORS: OSBundleRequired is a
  28. - variable name in xnu extensions
  29. - manifests. It behaves mostly like
  30. - GNU/Linux runlevels.
  31. - */
  32. - N_("DIRECTORY [OSBundleRequired]"),
  33. - /* TRANSLATORS: There are many extensions
  34. - in extension directory. */
  35. - N_("Load XNU extension directory."));
  36. + cmd_mkext = grub_register_command_lockdown ("xnu_mkext", grub_cmd_xnu_mkext, 0,
  37. + N_("Load XNU extension package."));
  38. + cmd_kext = grub_register_command_lockdown ("xnu_kext", grub_cmd_xnu_kext, 0,
  39. + N_("Load XNU extension."));
  40. + cmd_kextdir = grub_register_command_lockdown ("xnu_kextdir", grub_cmd_xnu_kextdir,
  41. + /*
  42. + * TRANSLATORS: OSBundleRequired is
  43. + * a variable name in xnu extensions
  44. + * manifests. It behaves mostly like
  45. + * GNU/Linux runlevels.
  46. + */
  47. + N_("DIRECTORY [OSBundleRequired]"),
  48. + /*
  49. + * TRANSLATORS: There are many extensions
  50. + * in extension directory.
  51. + */
  52. + N_("Load XNU extension directory."));
  53. cmd_ramdisk = grub_register_command ("xnu_ramdisk", grub_cmd_xnu_ramdisk, 0,
  54. /* TRANSLATORS: ramdisk here isn't identifier. It can be translated. */
  55. N_("Load XNU ramdisk. "
  56. --
  57. 2.14.2