rpms/grub2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import grub2-2.06-23.el9

Browse Source
This commit is contained in:
CentOS Sources 2022-03-01 07:59:15 -05:00 committed by Stepan Oksanichenko
parent c36e7cc679
commit dcbd1694a5
11 changed files with 108 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
SOURCES/0224-grub-mkconfig-restore-umask-for-grub.cfg.patch Normal file
View File

@ -0,0 +1,41 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Michael Chang via Grub-devel <grub-devel@gnu.org>
Date: Fri, 3 Dec 2021 16:13:28 +0800
Subject: [PATCH] grub-mkconfig: restore umask for grub.cfg
Since commit:
ab2e53c8a grub-mkconfig: Honor a symlink when generating configuration
by grub-mkconfig
has inadvertently discarded umask for creating grub.cfg in the process
of grub-mkconfig. The resulting wrong permission (0644) would allow
unprivileged users to read grub's configuration file content. This
presents a low confidentiality risk as grub.cfg may contain non-secured
plain-text passwords.
This patch restores the missing umask and set the file mode of creation
to 0600 preventing unprivileged access.
Fixes: CVE-2021-3981
Signed-off-by: Michael Chang <mchang@suse.com>
(cherry picked from commit 2acad06610da1488bfa387f56a847119ab758766)
---
util/grub-mkconfig.in | 2 ++
1 file changed, 2 insertions(+)
diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
index f55339a3f64..520a672cd2c 100644
--- a/util/grub-mkconfig.in
+++ b/util/grub-mkconfig.in
@@ -311,7 +311,9 @@ and /etc/grub.d/* files or please file a bug report with
exit 1
else
# none of the children aborted with error, install the new grub.cfg
+ oldumask=$(umask); umask 077
cat ${grub_cfg}.new > ${grub_cfg}
+ umask $oldumask
rm -f ${grub_cfg}.new
fi
fi

7
SOURCES/99-grub-mkconfig.install
View File

@ -40,14 +40,17 @@ if [[ $DISABLE_BLS = "true" ]]; then
fi
fi
[ -f /etc/default/grub ] && . /etc/default/grub
if [ x$GRUB_ENABLE_BLSCFG = xfalse ]; then
RUN_MKCONFIG=true
fi
# A traditional grub configuration file needs to be generated only in the case when
# the bootloaders are not capable of populating a menu entry from the BLS fragments.
if [[ $RUN_MKCONFIG != "true" ]]; then
exit 0
fi
[[ -f /etc/default/grub ]] && . /etc/default/grub
COMMAND="$1"
case "$COMMAND" in

78
SOURCES/grub.macros Normal file → Executable file
View File

@ -68,7 +68,6 @@
%global efi_target_ldflags %{expand:%%(echo %{target_ldflags})}
%global with_efi_arch 0
%global with_alt_efi_arch 0
%global with_legacy_arch 0
%global with_emu_arch 1
%global emuarch %{_arch}
@ -154,19 +153,6 @@
%global legacy_target_cpu_name i386
%global legacy_package_arch pc
%global platform pc
%global alt_efi_arch ia32
%global alt_target_cpu_name i386
%global alt_grub_target_name i386-efi
%global alt_platform efi
%global alt_package_arch efi-ia32
%global alt_efi_host_cflags %{expand:%%(echo %{efi_host_cflags})}
%global alt_efi_target_cflags \\\
%{expand:%%(echo %{target_cflags} | \\\
%{cflags_sed} \\\
-e 's/-m64//g' \\\
)}
%endif
%ifarch aarch64
@ -200,7 +186,6 @@
%endif
%global _target_platform %{target_cpu_name}-%{_vendor}-%{_target_os}%{?_gnu}
%global _alt_target_platform %{alt_target_cpu_name}-%{_vendor}-%{_target_os}%{?_gnu}
%ifarch %{efi_arch}
%global with_efi_arch 1
@ -216,13 +201,6 @@
%endif
%endif
%if 0%{?alt_efi_arch:1}
%global with_alt_efi_arch 1
%global grubaltefiname grub%{alt_efi_arch}.efi
%global grubalteficdname gcd%{alt_efi_arch}.efi
%global grubaltefiarch %{alt_target_cpu_name}-efi
%endif
%ifnarch %{efi_only}
%global with_legacy_arch 1
%global grublegacyarch %{legacy_target_cpu_name}-%{platform}
@ -416,11 +394,8 @@ rm -f %{1}.conf \
${GRUB_MODULES} \
%{expand:%%define ___pesign_client_cert %{?___pesign_client_cert}%{!?___pesign_client_cert:%{__pesign_client_cert}}} \
%{?__pesign_client_cert:%{expand:%%define __pesign_client_cert %{___pesign_client_cert}}} \
%{expand:%%{pesign -s -i %%{2}.orig -o %%{2}.onesig -a %%{5} -c %%{6} -n %%{7}}} \
%{expand:%%{pesign -s -i %%{3}.orig -o %%{3}.onesig -a %%{5} -c %%{6} -n %%{7}}} \
%{expand:%%define __pesign_client_cert %{name}-signer} \
%{expand:%%{pesign -s -i %%{2}.onesig -o %%{2} -a %%{8} -c %%{9} -n %%{10}}} \
%{expand:%%{pesign -s -i %%{3}.onesig -o %%{3} -a %%{8} -c %%{9} -n %%{10}}} \
%{expand:%%{pesign -s -i %%{2}.orig -o %%{2} -a %%{5} -c %%{6} -n %%{7}}} \
%{expand:%%{pesign -s -i %%{3}.orig -o %%{3} -a %%{5} -c %%{6} -n %%{7}}} \
%{nil}
%else
%define efi_mkimage() \
@ -438,7 +413,7 @@ rm -f %{1}.conf \
APPENDED_SIG_SIZE=0 \
if [ -x /usr/bin/rpm-sign ]; then \
touch empty.unsigned \
rpm-sign --key %{5} \\\
rpm-sign --key %{4} \\\
--lkmsign empty.unsigned \\\
--output empty.signed \
APPENDED_SIG_SIZE="$(stat -c '%s' empty.signed)" \
@ -447,12 +422,12 @@ fi \
# FIXME: using this prefix is fragile, must be done properly \
./grub-mkimage -O %{1} -o %{2}.orig \\\
-p '/grub2' -d grub-core \\\
-x %{3} -x %{4} \\\
-x %{3} \\\
--appended-signature-size ${APPENDED_SIG_SIZE} \\\
${GRUB_MODULES} \
if [ -x /usr/bin/rpm-sign ]; then \
truncate -s -${APPENDED_SIG_SIZE} %{2}.orig \
rpm-sign --key %{5} \\\
rpm-sign --key %{4} \\\
--lkmsign %{2}.orig \\\
--output %{2} \
else \
@ -468,12 +443,12 @@ GRUB_MODULES+=%{platform_modules} \
%{expand:%%{efi_mkimage %{1} %{2} %{3} %{4} %{5} %{6} %{7} %{8} %{9} %{10}}} \
%{nil}
%define do_ieee1275_build_images() \
GRUB_MODULES+=%{grub_modules} \
GRUB_MODULES+=%{platform_modules} \
cd grub-%{1}-%{tarversion} \
%{expand:%%ieee1275_mkimage %%{1} %%{2} %%{3} %%{4} %%{5}} \
cd .. \
%define do_ieee1275_build_images() \
GRUB_MODULES+=%{grub_modules} \
GRUB_MODULES+=%{platform_modules} \
cd grub-%{1}-%{tarversion} \
%{expand:%%ieee1275_mkimage %%{1} %%{2} %%{3} %%{4}} \
cd .. \
%{nil}
%define do_primary_efi_build() \
@ -484,15 +459,6 @@ cd grub-%{1}-%{tarversion} \
cd .. \
%{nil}
%define do_alt_efi_build() \
cd grub-%{1}-%{tarversion} \
%{expand:%%do_efi_configure %%{4} %%{5} %%{6}} \
%do_efi_build_modules \
%{expand:%%do_efi_link_utils %{grubefiarch}} \
%{expand:%%do_efi_build_images %{alt_grub_target_name} %{2} %{3} ../grub-%{grubefiarch}-%{tarversion}/ %{7} %{8} %{9} %{10} %{11} %{12}} \
cd .. \
%{nil}
%define do_legacy_build() \
cd grub-%{1}-%{tarversion} \
%configure \\\
@ -534,26 +500,6 @@ make %{?_smp_mflags} -C grub-core \
cd .. \
%{nil}
%define do_alt_efi_install() \
cd grub-%{1}-%{tarversion} \
install -d -m 755 $RPM_BUILD_ROOT/usr/lib/grub/%{grubaltefiarch}/ \
find . '(' -iname gdb_grub \\\
-o -iname kernel.exec \\\
-o -iname kernel.img \\\
-o -iname config.h \\\
-o -iname gmodule.pl \\\
-o -iname modinfo.sh \\\
-o -iname '*.lst' \\\
-o -iname '*.mod' \\\
')' \\\
-exec cp {} $RPM_BUILD_ROOT/usr/lib/grub/%{grubaltefiarch}/ \\\; \
find $RPM_BUILD_ROOT -type f -iname "*.mod*" -exec chmod a-x {} '\;' \
install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \
install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \
%{expand:%%do_install_protected_file %{name}-%{alt_package_arch}} \
cd .. \
%{nil}
%define do_efi_install() \
cd grub-%{1}-%{tarversion} \
make DESTDIR=$RPM_BUILD_ROOT install \
@ -595,7 +541,7 @@ if [ -f $RPM_BUILD_ROOT/%{_libdir}/grub/%{1}/%{name}.chrp ]; then \
mv $RPM_BUILD_ROOT/%{_libdir}/grub/%{1}/%{name}.chrp \\\
$RPM_BUILD_ROOT/%{_libdir}/grub/%{1}/%{name}.chrp \
fi \
if [ %{3} -eq 0 ]; then \
if [ %{2} -eq 0 ]; then \
${RPM_BUILD_ROOT}/%{_bindir}/%{name}-editenv \\\
${RPM_BUILD_ROOT}/boot/%{name}/grubenv create \
fi \

1
SOURCES/grub.patches
View File

@ -221,3 +221,4 @@ Patch0220: 0220-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch
Patch0221: 0221-fs-xfs-Fix-unreadable-filesystem-with-v4-superblock.patch
Patch0222: 0222-Print-module-name-on-license-check-failure.patch
Patch0223: 0223-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch
Patch0224: 0224-grub-mkconfig-restore-umask-for-grub.cfg.patch

BIN
SOURCES/redhatsecureboot301.cer
View File

Binary file not shown.

BIN
SOURCES/redhatsecureboot303.cer
View File

Binary file not shown.

BIN
SOURCES/redhatsecureboot502.cer
View File

Binary file not shown.

BIN
SOURCES/redhatsecureboot601.cer
View File

Binary file not shown.

BIN
SOURCES/redhatsecurebootca3.cer
View File

Binary file not shown.

BIN
SOURCES/redhatsecurebootca5.cer
View File

Binary file not shown.

87
SPECS/grub2.spec
View File

@ -14,7 +14,7 @@
Name: grub2
Epoch: 1
Version: 2.06
Release: 16%{?dist}
Release: 23%{?dist}
Summary: Bootloader with support for Linux, Multiboot and more
License: GPLv3+
URL: http://www.gnu.org/software/grub/
@ -32,29 +32,27 @@ Source9: strtoull_test.c
Source10: 20-grub.install
Source11: grub.patches
Source12: sbat.csv.in
Source13: redhatsecurebootca3.cer
Source14: redhatsecureboot301.cer
Source15: redhatsecurebootca5.cer
Source16: redhatsecureboot502.cer
Source17: redhatsecureboot303.cer
Source18: redhatsecureboot601.cer
%include %{SOURCE1}
%if 0%{with_efi_arch}
%define old_sb_ca %{SOURCE13}
%define old_sb_cer %{SOURCE14}
%define old_sb_key redhatsecureboot301
%define sb_ca %{SOURCE15}
%define sb_cer %{SOURCE16}
%define sb_key redhatsecureboot502
%ifarch x86_64 aarch64 ppc64le
%define sb_ca %{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
%define sb_cer %{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
%endif
%if 0%{?centos}
%ifarch x86_64 aarch64 ppc64le
%define sb_key centossecureboot202
%endif
%else
%ifarch x86_64 aarch64
%define sb_key redhatsecureboot502
%endif
%ifarch ppc64le
%define old_sb_cer %{SOURCE17}
%define sb_cer %{SOURCE18}
%define sb_key redhatsecureboot602
%endif
%endif
BuildRequires: gcc efi-srpm-macros
BuildRequires: flex bison binutils python3
@ -72,6 +70,9 @@ BuildRequires: systemd
%ifarch %{efi_arch}
BuildRequires: pesign >= 0.99-8
%endif
%ifarch aarch64 ppc64le x86_64
BuildRequires: system-sb-certs
%endif
%if %{?_with_ccache: 1}%{?!_with_ccache: 0}
BuildRequires: ccache
%endif
@ -156,9 +157,6 @@ This subpackage provides tools for support of all platforms.
%if 0%{with_efi_arch}
%{expand:%define_efi_variant %%{package_arch} -o}
%endif
%if 0%{with_alt_efi_arch}
%{expand:%define_efi_variant %%{alt_package_arch}}
%endif
%if 0%{with_legacy_arch}
%{expand:%define_legacy_variant %%{legacy_package_arch}}
%endif
@ -191,12 +189,6 @@ sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{relea
%{SOURCE12} > grub-%{grubefiarch}-%{tarversion}/sbat.csv
git add grub-%{grubefiarch}-%{tarversion}
%endif
%if 0%{with_alt_efi_arch}
mkdir grub-%{grubaltefiarch}-%{tarversion}
grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grubaltefiarch}-%{tarversion}/.gitignore
cp %{SOURCE4} grub-%{grubaltefiarch}-%{tarversion}/unifont.pcf.gz
git add grub-%{grubaltefiarch}-%{tarversion}
%endif
%if 0%{with_legacy_arch}
mkdir grub-%{grublegacyarch}-%{tarversion}
grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grublegacyarch}-%{tarversion}/.gitignore
@ -213,10 +205,7 @@ git commit -m "After making subdirs"
%build
%if 0%{with_efi_arch}
%{expand:%do_primary_efi_build %%{grubefiarch} %%{grubefiname} %%{grubeficdname} %%{_target_platform} %%{efi_target_cflags} %%{efi_host_cflags} %{old_sb_ca} %{old_sb_cer} %{old_sb_key} %{sb_ca} %{sb_cer} %{sb_key}}
%endif
%if 0%{with_alt_efi_arch}
%{expand:%do_alt_efi_build %%{grubaltefiarch} %%{grubaltefiname} %%{grubalteficdname} %%{_alt_target_platform} %%{alt_efi_target_cflags} %%{alt_efi_host_cflags} %{old_sb_ca} %{old_sb_cer} %{old_sb_key} %{sb_ca} %{sb_cer} %{sb_key}}
%{expand:%do_primary_efi_build %%{grubefiarch} %%{grubefiname} %%{grubeficdname} %%{_target_platform} %%{efi_target_cflags} %%{efi_host_cflags} %{sb_ca} %{sb_cer} %{sb_key}}
%endif
%if 0%{with_legacy_arch}
%{expand:%do_legacy_build %%{grublegacyarch}}
@ -225,7 +214,7 @@ git commit -m "After making subdirs"
%{expand:%do_emu_build}
%endif
%ifarch ppc64le
%{expand:%do_ieee1275_build_images %%{grublegacyarch} %{grubelfname} %{old_sb_cer} %{sb_cer} %{sb_key}}
%{expand:%do_ieee1275_build_images %%{grublegacyarch} %{grubelfname} %{sb_cer} %{sb_key}}
%endif
makeinfo --info --no-split -I docs -o docs/grub-dev.info \
docs/grub-dev.texi
@ -244,11 +233,8 @@ rm -fr $RPM_BUILD_ROOT
%if 0%{with_efi_arch}
%{expand:%do_efi_install %%{grubefiarch} %%{grubefiname} %%{grubeficdname}}
%endif
%if 0%{with_alt_efi_arch}
%{expand:%do_alt_efi_install %%{grubaltefiarch} %%{grubaltefiname} %%{grubalteficdname}}
%endif
%if 0%{with_legacy_arch}
%{expand:%do_legacy_install %%{grublegacyarch} %%{alt_grub_target_name} 0%{with_efi_arch}}
%{expand:%do_legacy_install %%{grublegacyarch} 0%{with_efi_arch}}
%endif
%if 0%{with_emu_arch}
%{expand:%do_emu_install %%{package_arch}}
@ -529,9 +515,6 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
%if 0%{with_efi_arch}
%{expand:%define_efi_variant_files %%{package_arch} %%{grubefiname} %%{grubeficdname} %%{grubefiarch} %%{target_cpu_name} %%{grub_target_name}}
%endif
%if 0%{with_alt_efi_arch}
%{expand:%define_efi_variant_files %%{alt_package_arch} %%{grubaltefiname} %%{grubalteficdname} %%{grubaltefiarch} %%{alt_target_cpu_name} %%{alt_grub_target_name}}
%endif
%if 0%{with_legacy_arch}
%{expand:%define_legacy_variant_files %%{legacy_package_arch} %%{grublegacyarch}}
%endif
@ -547,7 +530,35 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
%endif
%changelog
* Tue Jan 04 2021 Robbie Harwood <rharwood@redhat.com> - 2.06-16
* Fri Feb 18 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-23
- Re-arm GRUB_ENABLE_BLSCFG=false
- Resolves: #2018331
* Fri Feb 18 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-22
- Stop building unsupported 32-bit UEFI stuff
- Resolves: #2038401
* Wed Feb 16 2022 Brian Stinson <bstinson@redhat.com> - 2.06-21
- Require Secure Boot certs based on architecture
- Resolves: #2049214
* Wed Feb 16 2022 Brian Stinson <bstinson@redhat.com> - 2.06-20
- Conditionalize Secure Boot settings per architecture
- Resolves: #2049214
* Wed Feb 16 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-19
- Attempt to fix ppc64le signing bugs in previous change
- Resolves: #2049214
* Wed Feb 16 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-18
- Switch to single-signing and use certs from package (bstinson)
- Resolves: #2049214
* Wed Feb 02 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-17
- CVE-2021-3981 (Incorrect read permission in grub.cfg)
- Resolves: rhbz#2030724
* Tue Jan 04 2022 Robbie Harwood <rharwood@redhat.com> - 2.06-16
- Stop having this problem and just copy over the beta tree
- Resolves: rhbz#2006784