tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs: Disable many filesystems under lockdown

Browse Source 
The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat,
hfsplus, iso9660, squash4, tar, xfs and zfs.

The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were
reported by Jonathan Bar Or <jonathanbaror@gmail.com>.

Fixes: CVE-2025-0677
Fixes: CVE-2025-0684
Fixes: CVE-2025-0685
Fixes: CVE-2025-0686
Fixes: CVE-2025-0689

Suggested-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens 2024-03-23 16:20:45 +11:00 committed by Daniel Kiper
parent 26db660503
commit c4bc55da28
11 changed files with 88 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
grub-core/fs/affs.c
View File

@ -26,6 +26,7 @@
#include <grub/types.h>
#include <grub/fshelp.h>
#include <grub/charset.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -702,13 +703,17 @@ static struct grub_fs grub_affs_fs =
};
GRUB_MOD_INIT(affs)
{
if (!grub_is_lockdown ())
{
grub_affs_fs.mod = mod;
grub_fs_register (&grub_affs_fs);
}
my_mod = mod;
}
GRUB_MOD_FINI(affs)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_affs_fs);
}

5
grub-core/fs/cbfs.c
View File

@ -26,6 +26,7 @@
#include <grub/dl.h>
#include <grub/i18n.h>
#include <grub/cbfs_core.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -390,12 +391,16 @@ GRUB_MOD_INIT (cbfs)
#if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
init_cbfsdisk ();
#endif
if (!grub_is_lockdown ())
{
grub_cbfs_fs.mod = mod;
grub_fs_register (&grub_cbfs_fs);
}
}
GRUB_MOD_FINI (cbfs)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_cbfs_fs);
#if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
fini_cbfsdisk ();

5
grub-core/fs/jfs.c
View File

@ -26,6 +26,7 @@
#include <grub/types.h>
#include <grub/charset.h>
#include <grub/i18n.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -1003,13 +1004,17 @@ static struct grub_fs grub_jfs_fs =
};
GRUB_MOD_INIT(jfs)
{
if (!grub_is_lockdown ())
{
grub_jfs_fs.mod = mod;
grub_fs_register (&grub_jfs_fs);
}
my_mod = mod;
}
GRUB_MOD_FINI(jfs)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_jfs_fs);
}

5
grub-core/fs/minix.c
View File

@ -25,6 +25,7 @@
#include <grub/dl.h>
#include <grub/types.h>
#include <grub/i18n.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -733,9 +734,12 @@ GRUB_MOD_INIT(minix2)
GRUB_MOD_INIT(minix)
#endif
#endif
{
if (!grub_is_lockdown ())
{
grub_minix_fs.mod = mod;
grub_fs_register (&grub_minix_fs);
}
my_mod = mod;
}
@ -757,5 +761,6 @@ GRUB_MOD_FINI(minix)
#endif
#endif
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_minix_fs);
}

5
grub-core/fs/nilfs2.c
View File

@ -34,6 +34,7 @@
#include <grub/dl.h>
#include <grub/types.h>
#include <grub/fshelp.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -1231,12 +1232,16 @@ GRUB_MOD_INIT (nilfs2)
grub_nilfs2_dat_entry));
COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE
== sizeof (struct grub_nilfs2_inode));
if (!grub_is_lockdown ())
{
grub_nilfs2_fs.mod = mod;
grub_fs_register (&grub_nilfs2_fs);
}
my_mod = mod;
}
GRUB_MOD_FINI (nilfs2)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_nilfs2_fs);
}

5
grub-core/fs/ntfs.c
View File

@ -27,6 +27,7 @@
#include <grub/fshelp.h>
#include <grub/ntfs.h>
#include <grub/charset.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -1540,13 +1541,17 @@ static struct grub_fs grub_ntfs_fs =
};
GRUB_MOD_INIT (ntfs)
{
if (!grub_is_lockdown ())
{
grub_ntfs_fs.mod = mod;
grub_fs_register (&grub_ntfs_fs);
}
my_mod = mod;
}
GRUB_MOD_FINI (ntfs)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_ntfs_fs);
}

5
grub-core/fs/reiserfs.c
View File

@ -39,6 +39,7 @@
#include <grub/types.h>
#include <grub/fshelp.h>
#include <grub/i18n.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -1416,13 +1417,17 @@ static struct grub_fs grub_reiserfs_fs =
};
GRUB_MOD_INIT(reiserfs)
{
if (!grub_is_lockdown ())
{
grub_reiserfs_fs.mod = mod;
grub_fs_register (&grub_reiserfs_fs);
}
my_mod = mod;
}
GRUB_MOD_FINI(reiserfs)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_reiserfs_fs);
}

5
grub-core/fs/romfs.c
View File

@ -23,6 +23,7 @@
#include <grub/disk.h>
#include <grub/fs.h>
#include <grub/fshelp.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -474,12 +475,16 @@ static struct grub_fs grub_romfs_fs =
};
GRUB_MOD_INIT(romfs)
{
if (!grub_is_lockdown ())
{
grub_romfs_fs.mod = mod;
grub_fs_register (&grub_romfs_fs);
}
}
GRUB_MOD_FINI(romfs)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_romfs_fs);
}

5
grub-core/fs/sfs.c
View File

@ -26,6 +26,7 @@
#include <grub/types.h>
#include <grub/fshelp.h>
#include <grub/charset.h>
#include <grub/lockdown.h>
#include <grub/safemath.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -778,13 +779,17 @@ static struct grub_fs grub_sfs_fs =
};
GRUB_MOD_INIT(sfs)
{
if (!grub_is_lockdown ())
{
grub_sfs_fs.mod = mod;
grub_fs_register (&grub_sfs_fs);
}
my_mod = mod;
}
GRUB_MOD_FINI(sfs)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_sfs_fs);
}

5
grub-core/fs/udf.c
View File

@ -27,6 +27,7 @@
#include <grub/fshelp.h>
#include <grub/charset.h>
#include <grub/datetime.h>
#include <grub/lockdown.h>
#include <grub/udf.h>
#include <grub/safemath.h>
@ -1454,13 +1455,17 @@ static struct grub_fs grub_udf_fs = {
};
GRUB_MOD_INIT (udf)
{
if (!grub_is_lockdown ())
{
grub_udf_fs.mod = mod;
grub_fs_register (&grub_udf_fs);
}
my_mod = mod;
}
GRUB_MOD_FINI (udf)
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_udf_fs);
}

5
grub-core/fs/ufs.c
View File

@ -25,6 +25,7 @@
#include <grub/dl.h>
#include <grub/types.h>
#include <grub/i18n.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -898,9 +899,12 @@ GRUB_MOD_INIT(ufs1_be)
GRUB_MOD_INIT(ufs1)
#endif
#endif
{
if (!grub_is_lockdown ())
{
grub_ufs_fs.mod = mod;
grub_fs_register (&grub_ufs_fs);
}
my_mod = mod;
}
@ -914,6 +918,7 @@ GRUB_MOD_FINI(ufs1)
#endif
#endif
{
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_ufs_fs);
}