File 0008-efi-Lockdown-the-GRUB-when-the-UEFI-Secure... of Package grub2.19065

Overview Repositories Revisions Requests Users Attributes Meta

File 0008-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch of Package grub2.19065

From 7d6e8143d6ad8fcfdb8b98ff4973a4d15f8c113b Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm@redhat.com>
Date: Mon, 28 Sep 2020 20:08:29 +0200
Subject: [PATCH 08/41] efi: Lockdown the GRUB when the UEFI Secure Boot is
 enabled

If the UEFI Secure Boot is enabled then the GRUB must be locked down
to prevent executing code that can potentially be used to subvert its
verification mechanisms.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/kern/efi/init.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c
index e35341ca6..06252bd39 100644
--- a/grub-core/kern/efi/init.c
+++ b/grub-core/kern/efi/init.c
@@ -20,6 +20,8 @@
 #include <grub/efi/efi.h>
 #include <grub/efi/console.h>
 #include <grub/efi/disk.h>
+#include <grub/efi/sb.h>
+#include <grub/lockdown.h>
 #include <grub/term.h>
 #include <grub/misc.h>
 #include <grub/env.h>
@@ -40,6 +42,12 @@ grub_efi_init (void)
   /* Initialize the memory management system.  */
   grub_efi_mm_init ();
 
+  /*
+   * Lockdown the GRUB if the UEFI Secure Boot is enabled.
+   */
+  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
+    grub_lockdown ();
+
   efi_call_4 (grub_efi_system_table->boot_services->set_watchdog_timer,
 	      0, 0, 0, NULL);
 
-- 
2.26.2

Places

File 0008-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch of Package grub2.19065

Places