0037-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch 1.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849
  1. From 98b00a403cbf2ba6833d1ac0499871b27a08eb77 Mon Sep 17 00:00:00 2001
  2. From: Javier Martinez Canillas <javierm@redhat.com>
  3. Date: Mon, 28 Sep 2020 20:08:29 +0200
  4. Subject: [PATCH] efi: Lockdown the GRUB when the UEFI Secure Boot is enabled
  5. If the UEFI Secure Boot is enabled then the GRUB must be locked down
  6. to prevent executing code that can potentially be used to subvert its
  7. verification mechanisms.
  8. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
  9. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  10. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  11. ---
  12. grub-core/kern/efi/init.c | 12 ++++++++++--
  13. 1 file changed, 10 insertions(+), 2 deletions(-)
  14. diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c
  15. index b683bec..1333465 100644
  16. --- a/grub-core/kern/efi/init.c
  17. +++ b/grub-core/kern/efi/init.c
  18. @@ -21,6 +21,7 @@
  19. #include <grub/efi/console.h>
  20. #include <grub/efi/disk.h>
  21. #include <grub/efi/sb.h>
  22. +#include <grub/lockdown.h>
  23. #include <grub/term.h>
  24. #include <grub/misc.h>
  25. #include <grub/env.h>
  26. @@ -40,8 +41,15 @@ grub_efi_init (void)
  27. /* Initialize the memory management system. */
  28. grub_efi_mm_init ();
  29. - /* Register the shim_lock verifier if UEFI Secure Boot is enabled. */
  30. - grub_shim_lock_verifier_setup ();
  31. + /*
  32. + * Lockdown the GRUB and register the shim_lock verifier
  33. + * if the UEFI Secure Boot is enabled.
  34. + */
  35. + if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
  36. + {
  37. + grub_lockdown ();
  38. + grub_shim_lock_verifier_setup ();
  39. + }
  40. efi_call_4 (grub_efi_system_table->boot_services->set_watchdog_timer,
  41. 0, 0, 0, NULL);
  42. --
  43. 2.14.2