diff --git a/0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch b/0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch index 10e823b..4517745 100644 --- a/0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch +++ b/0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch @@ -1,8 +1,7 @@ -From 0cff1b8b056f408c0dd9f8e5f8071ea9f6193c6e Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 14 May 2020 17:52:53 -0700 -Subject: [PATCH 215/215] 10_linux.in: restore existence check in - `get_sorted_bls` +Subject: [PATCH] 10_linux.in: restore existence check in `get_sorted_bls` This is necessary to handle `/boot/loader/entries` not existing at all (or possibly existing but being empty - not sure about @@ -18,7 +17,7 @@ Signed-off-by: Adam Williamson 1 file changed, 3 insertions(+) diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 80299ecaf..519e2d9e6 100644 +index 80299ecaf00..519e2d9e616 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in @@ -141,6 +141,9 @@ get_sorted_bls() @@ -31,6 +30,3 @@ index 80299ecaf..519e2d9e6 100644 bls="${bls%.conf}" bls="${bls##*/}" echo "${bls}" --- -2.26.2 - diff --git a/0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch b/0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch new file mode 100644 index 0000000..ca125c6 --- /dev/null +++ b/0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch @@ -0,0 +1,62 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Sat, 16 May 2020 11:33:18 +0200 +Subject: [PATCH] tpm: Don't propagate TPM measurement errors to the verifiers + layer + +Currently if the EFI firmware fails to do a TPM measurement for a file, +the error will be propagated to the verifiers framework and so opening +the file will not succeed. + +This mean that buggy firmwares will prevent the system to boot since the +loader won't be able to open any file. But failing to do TPM measurements +shouldn't be a fatal error and the system should still be able to boot. + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/commands/tpm.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c +index 1441c494d81..dbaeae46dfa 100644 +--- a/grub-core/commands/tpm.c ++++ b/grub-core/commands/tpm.c +@@ -49,7 +49,8 @@ grub_tpm_verify_init (grub_file_t io, + static grub_err_t + grub_tpm_verify_write (void *context, void *buf, grub_size_t size) + { +- return grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context); ++ grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context); ++ return GRUB_ERR_NONE; + } + + static grub_err_t +@@ -57,7 +58,6 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type) + { + const char *prefix = NULL; + char *description; +- grub_err_t status; + + switch (type) + { +@@ -73,15 +73,15 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type) + } + description = grub_malloc (grub_strlen (str) + grub_strlen (prefix) + 1); + if (!description) +- return grub_errno; ++ return GRUB_ERR_NONE; + grub_memcpy (description, prefix, grub_strlen (prefix)); + grub_memcpy (description + grub_strlen (prefix), str, + grub_strlen (str) + 1); +- status = +- grub_tpm_measure ((unsigned char *) str, grub_strlen (str), +- GRUB_STRING_PCR, description); ++ ++ grub_tpm_measure ((unsigned char *) str, grub_strlen (str), GRUB_STRING_PCR, ++ description); + grub_free (description); +- return status; ++ return GRUB_ERR_NONE; + } + + struct grub_file_verifier grub_tpm_verifier = { diff --git a/grub.macros b/grub.macros index bb560e5..fc6bfff 100644 --- a/grub.macros +++ b/grub.macros @@ -402,7 +402,7 @@ GRUB_MODULES=" all_video boot blscfg btrfs \\\ password_pbkdf2 pgp png reboot \\\ regexp search search_fs_uuid search_fs_file \\\ search_label serial sleep syslinuxcfg test tftp \\\ - version video xfs zstd " \ + tpm version video xfs zstd " \ GRUB_MODULES+=%{efi_modules} \ %{expand:%%{mkimage %{1} %{2} %{3} %{4}}} \ %{nil} diff --git a/grub.patches b/grub.patches index 717ec73..a833b9e 100644 --- a/grub.patches +++ b/grub.patches @@ -213,3 +213,4 @@ Patch0212: 0212-10_linux.in-fix-early-exit-due-error-when-reading-pe.patch Patch0213: 0213-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch Patch0214: 0214-10_linux.in-Store-cmdline-in-BLS-snippets-instead-of.patch Patch0215: 0215-10_linux.in-restore-existence-check-in-get_sorted_bl.patch +Patch0216: 0216-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch diff --git a/grub2.spec b/grub2.spec index 34c1f1f..591b7d5 100644 --- a/grub2.spec +++ b/grub2.spec @@ -9,7 +9,7 @@ Name: grub2 Epoch: 1 Version: 2.04 -Release: 18%{?dist} +Release: 19%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -504,6 +504,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Sat May 16 2020 Javier Martinez Canillas - 2.04-19 +- Enable tpm module and make system to boot even if TPM measurements fail + Resolves: rhbz#1836433 + * Thu May 14 2020 Adam Williamson - 2.04-18 - 10_linux.in: restore existence check in `get_sorted_bls` Resolves: rhbz#1836020