13febd78db
The GRUB may use TPM to verify the integrity of boot components and the result can determine whether a previously sealed key can be released. If everything checks out, showing nothing has been tampered with, the key is released and GRUB unlocks the encrypted root partition for the next stage of booting. However, the liberal Command Line Interface (CLI) can be misused by anyone in this case to access files in the encrypted partition one way or another. Despite efforts to keep the CLI secure by preventing utility command output from leaking file content, many techniques in the wild could still be used to exploit the CLI, enabling attacks or learning methods to attack. It's nearly impossible to account for all scenarios where a hack could be applied. Therefore, to mitigate potential misuse of the CLI after the root device has been successfully unlocked via TPM, the user should be required to authenticate using the LUKS password. This added layer of security ensures that only authorized users can access the CLI reducing the risk of exploitation or unauthorized access to the encrypted partition. Fixes: CVE-2024-49504 Signed-off-by: Michael Chang <mchang@suse.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
39 lines
1.4 KiB
C
39 lines
1.4 KiB
C
/*
|
|
* GRUB -- GRand Unified Bootloader
|
|
* Copyright (C) 2009 Free Software Foundation, Inc.
|
|
*
|
|
* GRUB is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* GRUB is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
#ifndef GRUB_AUTH_HEADER
|
|
#define GRUB_AUTH_HEADER 1
|
|
|
|
#include <grub/err.h>
|
|
#include <grub/crypto.h>
|
|
|
|
#define GRUB_AUTH_MAX_PASSLEN 1024
|
|
|
|
typedef grub_err_t (*grub_auth_callback_t) (const char *, const char *, void *);
|
|
|
|
grub_err_t grub_auth_register_authentication (const char *user,
|
|
grub_auth_callback_t callback,
|
|
void *arg);
|
|
grub_err_t grub_auth_unregister_authentication (const char *user);
|
|
|
|
grub_err_t grub_auth_authenticate (const char *user);
|
|
grub_err_t grub_auth_deauthenticate (const char *user);
|
|
grub_err_t grub_auth_check_authentication (const char *userlist);
|
|
grub_err_t grub_auth_check_cli_access (void);
|
|
|
|
#endif /* ! GRUB_AUTH_HEADER */
|