Bug#927888: Need to disable the devicetree command in Secure Boot mode

2019-05-04 Thread Steve McIntyre
On Sat, May 04, 2019 at 10:44:26PM +0100, Colin Watson wrote: >On Fri, May 03, 2019 at 10:42:34PM +0100, Steve McIntyre wrote: >> diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c >> index c9aee74ef..735c56e45 100644 >> --- a/grub-core/loader/efi/fdt.c >> +++ b/grub-core/loader/e

Bug#927888: Need to disable the devicetree command in Secure Boot mode

2019-05-04 Thread Colin Watson
On Fri, May 03, 2019 at 10:42:34PM +0100, Steve McIntyre wrote: > diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c > index c9aee74ef..735c56e45 100644 > --- a/grub-core/loader/efi/fdt.c > +++ b/grub-core/loader/efi/fdt.c > @@ -123,6 +123,14 @@ grub_cmd_devicetree (grub_command_t

Bug#927888: Need to disable the devicetree command in Secure Boot mode

2019-05-03 Thread Steve McIntyre
On Wed, Apr 24, 2019 at 05:37:24PM +0100, Steve McIntyre wrote: >On Wed, Apr 24, 2019 at 05:26:00PM +0100, Steve McIntyre wrote: >>Source: grub2 >>Version: 2.02+dfsg1-16 >>Severity: serious >>Tags: security >> >>In discussion with upstream EFI and arm64 folks, it's become clear >>that in SB mode we

Bug#927888: Need to disable the devicetree command in Secure Boot mode

2019-04-24 Thread Steve McIntyre
On Wed, Apr 24, 2019 at 05:26:00PM +0100, Steve McIntyre wrote: >Source: grub2 >Version: 2.02+dfsg1-16 >Severity: serious >Tags: security > >In discussion with upstream EFI and arm64 folks, it's become clear >that in SB mode we should also be disabling the devicetree command in >Secure Boot mode. I

Bug#927888: Need to disable the devicetree command in Secure Boot mode

2019-04-24 Thread Steve McIntyre
Source: grub2 Version: 2.02+dfsg1-16 Severity: serious Tags: security In discussion with upstream EFI and arm64 folks, it's become clear that in SB mode we should also be disabling the devicetree command in Secure Boot mode. I'm testing a patch right now, coming shortly. -- System Information: De