commands: Restrict commands that can load BIOS or DT blobs when locked down

There are some more commands that should be restricted when the GRUB is
locked down. Following is the list of commands and reasons to restrict:

  * fakebios:   creates BIOS-like structures for backward compatibility with
                existing OSes. This should not be allowed when locked down.

  * loadbios:   reads a BIOS dump from storage and loads it. This action
                should not be allowed when locked down.

  * devicetree: loads a Device Tree blob and passes it to the OS. It replaces
                any Device Tree provided by the firmware. This also should
                not be allowed when locked down.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

diff --git a/docs/grub.texi b/docs/grub.texi
index 5dbb02f1c1e52e0abbab55e4c755927dc403fbf9..91666781bf2263fed6bc6be9d0df728c8e607b26 100644 (file)
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -4324,6 +4324,9 @@ hour, minute, and second unchanged.
 Load a device tree blob (.dtb) from a filesystem, for later use by a Linux
 kernel. Does not perform merging with any device tree supplied by firmware,
 but rather replaces it completely.
+
+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
+      This is done to prevent subverting various security mechanisms.
 @end deffn
 
 @node distrust

diff --git a/grub-core/commands/efi/loadbios.c b/grub-core/commands/efi/loadbios.c
index d41d521a4aebd21465fff9303d4556f763d53aa4..5c7725f8bd8f9d2f679bd35d95f0ab88883cdec5 100644 (file)
--- a/grub-core/commands/efi/loadbios.c
+++ b/grub-core/commands/efi/loadbios.c
@@ -205,14 +205,14 @@ static grub_command_t cmd_fakebios, cmd_loadbios;
 
 GRUB_MOD_INIT(loadbios)
 {
-  cmd_fakebios = grub_register_command ("fakebios", grub_cmd_fakebios,
-                                       0, N_("Create BIOS-like structures for"
-                                             " backward compatibility with"
-                                             " existing OS."));
-
-  cmd_loadbios = grub_register_command ("loadbios", grub_cmd_loadbios,
-                                       N_("BIOS_DUMP [INT10_DUMP]"),
-                                       N_("Load BIOS dump."));
+  cmd_fakebios = grub_register_command_lockdown ("fakebios", grub_cmd_fakebios,
+                                                0, N_("Create BIOS-like structures for"
+                                                      " backward compatibility with"
+                                                      " existing OS."));
+
+  cmd_loadbios = grub_register_command_lockdown ("loadbios", grub_cmd_loadbios,
+                                                N_("BIOS_DUMP [INT10_DUMP]"),
+                                                N_("Load BIOS dump."));
 }
 
 GRUB_MOD_FINI(loadbios)

diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c
index d70c174868ec7735fd103b7405bf985398129d41..ed23dc71e880439d01e33c1b7484e5c72593acc2 100644 (file)
--- a/grub-core/loader/arm/linux.c
+++ b/grub-core/loader/arm/linux.c
@@ -493,9 +493,9 @@ GRUB_MOD_INIT (linux)
                                     0, N_("Load Linux."));
   cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd,
                                      0, N_("Load initrd."));
-  cmd_devicetree = grub_register_command ("devicetree", grub_cmd_devicetree,
-                                         /* TRANSLATORS: DTB stands for device tree blob.  */
-                                         0, N_("Load DTB file."));
+  cmd_devicetree = grub_register_command_lockdown ("devicetree", grub_cmd_devicetree,
+                                                  /* TRANSLATORS: DTB stands for device tree blob. */
+                                                  0, N_("Load DTB file."));
   my_mod = mod;
   current_fdt = (const void *) grub_arm_firmware_get_boot_data ();
   machine_type = grub_arm_firmware_get_machine_type ();

diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c
index ee9c5592c7008813649ff50840b930195b602fd8..003d07cd86d362409e16fc2139179a341c1ad699 100644 (file)
--- a/grub-core/loader/efi/fdt.c
+++ b/grub-core/loader/efi/fdt.c
@@ -165,8 +165,8 @@ static grub_command_t cmd_devicetree;
 GRUB_MOD_INIT (fdt)
 {
   cmd_devicetree =
-    grub_register_command ("devicetree", grub_cmd_devicetree, 0,
-                          N_("Load DTB file."));
+    grub_register_command_lockdown ("devicetree", grub_cmd_devicetree, 0,
+                                   N_("Load DTB file."));
 }
 
 GRUB_MOD_FINI (fdt)