tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Capture additional commands restricted by lockdown

Browse Source 
Update documentation to capture that all memrw commands, the minicmd
dump command, and raw memory dumping via hexdump are restricted when
lockdown is enabled. This aligns to recent GRUB code updates.

Signed-off-by: Andrew Hamilton <adhamilt@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Andrew Hamilton 2025-02-28 15:55:24 -06:00 committed by Daniel Kiper
parent 6a168afd32
commit 1acf11fe4c
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
docs/grub.texi
View File

@ -5124,6 +5124,8 @@ This module provides support for commands @command{read_byte},
write data to physical memory (addresses). The "read" commands accept one write data to physical memory (addresses). The "read" commands accept one
parameter to specify the source address. The "write" commands require either two parameter to specify the source address. The "write" commands require either two
or three parameters, with the order: address, value, <optional mask>. or three parameters, with the order: address, value, <optional mask>.
Note: The commands provided by this module are not allowed when lockdown is
enforced (@pxref{Lockdown}).
@node memtools_module @node memtools_module
@section memtools @section memtools
@ -5137,6 +5139,8 @@ including: @command{cat}, @command{help}, @command{dump}, @command{rmmod},
@command{lsmod}, and @command{exit}. The version of the commands in this module @command{lsmod}, and @command{exit}. The version of the commands in this module
are similar to their full-fledged counterparts implemented in other GRUB are similar to their full-fledged counterparts implemented in other GRUB
modules. modules.
Note: The @command{dump} command is not allowed when lockdown is enforced
(@pxref{Lockdown}).
@node minix_module @node minix_module
@section minix @section minix
@ -7196,6 +7200,11 @@ to be shown.
If given the special device named @samp{(mem)}, then the @samp{offset} given to If given the special device named @samp{(mem)}, then the @samp{offset} given to
@option{--skip} is treated as the address of a memory location to dump from. @option{--skip} is treated as the address of a memory location to dump from.
Note: The dumping of RAM memory (by the (mem) argument) is not allowed when
when lockdown is enforced (@pxref{Lockdown}). The dumping of disk or file
data is allowed when lockdown is enforced.
@end deffn @end deffn