diff --git a/0001-CVE-2019-14865.patch b/0001-CVE-2019-14865.patch new file mode 100644 index 0000000..cd4ef77 --- /dev/null +++ b/0001-CVE-2019-14865.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 13 Nov 2019 12:15:43 +0100 +Subject: [PATCH] grub-set-bootflag: Update comment about running as root + through pkexec + +We have stopped using pkexec for grub-set-bootflag, instead it is now +installed suid root, update the comment accordingly. + +Signed-off-by: Hans de Goede +--- + util/grub-set-bootflag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c +index 6a79ee67444..65d74ce010f 100644 +--- a/util/grub-set-bootflag.c ++++ b/util/grub-set-bootflag.c +@@ -18,7 +18,7 @@ + */ + + /* +- * NOTE this gets run by users as root (through pkexec), so this does not ++ * NOTE this gets run by users as root (its suid root), so this does not + * use any grub library / util functions to allow for easy auditing. + * The grub headers are only included to get certain defines. + */ diff --git a/0002-CVE-2019-14865.patch b/0002-CVE-2019-14865.patch new file mode 100644 index 0000000..2f11891 --- /dev/null +++ b/0002-CVE-2019-14865.patch @@ -0,0 +1,156 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 13 Nov 2019 13:02:01 +0100 +Subject: [PATCH] grub-set-bootflag: Write new env to tmpfile and then rename + +Make the grubenv writing code in grub-set-bootflag more robust by +writing the modified grubenv to a tmpfile first and then renaming the +tmpfile over the old grubenv (following symlinks). + +Signed-off-by: Hans de Goede + +--- + util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 78 insertions(+), 9 deletions(-) + +diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c +index 32f1c10..d3b80a0 100644 +--- a/util/grub-set-bootflag.c ++++ b/util/grub-set-bootflag.c +@@ -26,7 +26,9 @@ + #include /* For *_DIR_NAME defines */ + #include + #include /* For GRUB_ENVBLK_DEFCFG define */ ++#include + #include ++#include + #include + #include + +@@ -52,8 +54,10 @@ int main(int argc, char *argv[]) + { + /* NOTE buf must be at least the longest bootflag length + 4 bytes */ + char env[GRUBENV_SIZE + 1], buf[64], *s; ++ /* +1 for 0 termination, +6 for "XXXXXX" in tmp filename */ ++ char env_filename[PATH_MAX + 1], tmp_filename[PATH_MAX + 6 + 1]; + const char *bootflag; +- int i, len, ret; ++ int i, fd, len, ret; + FILE *f; + + if (argc != 2) +@@ -75,7 +79,32 @@ int main(int argc, char *argv[]) + bootflag = bootflags[i]; + len = strlen (bootflag); + +- f = fopen (GRUBENV, "r"); ++ /* ++ * Really become root. setuid avoids an user killing us, possibly leaking ++ * the tmpfile. setgid avoids the new grubenv's gid being that of the user. ++ */ ++ ret = setuid(0); ++ if (ret) ++ { ++ perror ("Error setuid(0) failed"); ++ return 1; ++ } ++ ++ ret = setgid(0); ++ if (ret) ++ { ++ perror ("Error setgid(0) failed"); ++ return 1; ++ } ++ ++ /* Canonicalize GRUBENV filename, resolving symlinks, etc. */ ++ if (!realpath(GRUBENV, env_filename)) ++ { ++ perror ("Error canonicalizing " GRUBENV " filename"); ++ return 1; ++ } ++ ++ f = fopen (env_filename, "r"); + if (!f) + { + perror ("Error opening " GRUBENV " for reading"); +@@ -129,30 +158,70 @@ int main(int argc, char *argv[]) + snprintf(buf, sizeof(buf), "%s=1\n", bootflag); + memcpy(s, buf, len + 3); + +- /* "r+", don't truncate so that the diskspace stays reserved */ +- f = fopen (GRUBENV, "r+"); ++ ++ /* ++ * Create a tempfile for writing the new env. Use the canonicalized filename ++ * for the template so that the tmpfile is in the same dir / on same fs. ++ */ ++ snprintf(tmp_filename, sizeof(tmp_filename), "%sXXXXXX", env_filename); ++ fd = mkstemp(tmp_filename); ++ if (fd == -1) ++ { ++ perror ("Creating tmpfile failed"); ++ return 1; ++ } ++ ++ f = fdopen (fd, "w"); + if (!f) + { +- perror ("Error opening " GRUBENV " for writing"); ++ perror ("Error fdopen of tmpfile failed"); ++ unlink(tmp_filename); + return 1; + } + + ret = fwrite (env, 1, GRUBENV_SIZE, f); + if (ret != GRUBENV_SIZE) + { +- perror ("Error writing to " GRUBENV); ++ perror ("Error writing tmpfile"); ++ unlink(tmp_filename); + return 1; + } + + ret = fflush (f); + if (ret) + { +- perror ("Error flushing " GRUBENV); ++ perror ("Error flushing tmpfile"); ++ unlink(tmp_filename); + return 1; + } + +- fsync (fileno (f)); +- fclose (f); ++ ret = fsync (fileno (f)); ++ if (ret) ++ { ++ perror ("Error syncing tmpfile"); ++ unlink(tmp_filename); ++ return 1; ++ } ++ ++ ret = fclose (f); ++ if (ret) ++ { ++ perror ("Error closing tmpfile"); ++ unlink(tmp_filename); ++ return 1; ++ } ++ ++ /* ++ * And finally rename the tmpfile with the new env over the old env, the ++ * linux kernel guarantees that this is atomic (from a syscall pov). ++ */ ++ ret = rename(tmp_filename, env_filename); ++ if (ret) ++ { ++ perror ("Error renaming tmpfile to " GRUBENV " failed"); ++ unlink(tmp_filename); ++ return 1; ++ } + + return 0; + } +-- +1.8.3.1 + diff --git a/bugfix-remove-excess-qutos.patch b/bugfix-remove-excess-qutos.patch index 1c24769..8dd31fe 100644 --- a/bugfix-remove-excess-qutos.patch +++ b/bugfix-remove-excess-qutos.patch @@ -1,7 +1,7 @@ From a8107bb28cc702806ab74dd8a826d59c2ae7be6a Mon Sep 17 00:00:00 2001 From: fengtao Date: Tue, 10 Sep 2019 21:43:31 +0800 -Subject: [PATCH] fix grub2-setpassword errors for euleros +Subject: [PATCH] fix grub2-setpassword errors for openEuler --- util/grub-set-password.in | 2 +- diff --git a/grub.patches b/grub.patches index d545f7e..cc36190 100644 --- a/grub.patches +++ b/grub.patches @@ -249,6 +249,8 @@ Patch6006: grub-core-loader-efi-fdt.c-Do-not-copy-random-memory.patch Patch6007: arm-Move-initrd-upper-to-leave-more-space-for-kernel.patch Patch6008: normal-menu-Do-not-treat-error-values-as-key-presses.patch Patch6009: osdep-freebsd-Fix-partition-calculation-for-EBR-entr.patch +Patch6010: 0001-CVE-2019-14865.patch +Patch6011: 0002-CVE-2019-14865.patch Patch9000: 0001-fix-grub-search-configfile-failed-in-net.patch Patch9001: Workaround-for-EFI-Bug-Plan3.patch Patch9002: revert-0067-Be-more-aggro.patch diff --git a/grub2.spec b/grub2.spec index 7cd123e..328672c 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 70 +Release: 71 Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -356,6 +356,12 @@ fi %{_datadir}/man/man* %changelog +* Sat Dec 21 2019 openEuler Buildteam - 2.02-71 +- Type:cves +- Id:NA +- SUG:NA +- DESC:add cve patches + * Tue Dec 10 2019 openEuler Buildteam - 2.02-70 - Type:bugfix - Id:NA