dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone
b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Javier Martinez Canillas <javierm@redhat.com>
b1bcb2
Date: Wed, 24 Feb 2021 15:03:26 +0100
b1bcb2
Subject: [PATCH] gdb: Restrict GDB access when locked down
b1bcb2
b1bcb2
The gdbstub* commands allow to start and control a GDB stub running on
b1bcb2
local host that can be used to connect from a remote debugger. Restrict
b1bcb2
this functionality when the GRUB is locked down.
b1bcb2
b1bcb2
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/gdb/gdb.c | 32 ++++++++++++++++++--------------
b1bcb2
 1 file changed, 18 insertions(+), 14 deletions(-)
b1bcb2
b1bcb2
diff --git a/grub-core/gdb/gdb.c b/grub-core/gdb/gdb.c
b1bcb2
index 847a1e1e36f..1818cb6f8eb 100644
b1bcb2
--- a/grub-core/gdb/gdb.c
b1bcb2
+++ b/grub-core/gdb/gdb.c
b1bcb2
@@ -75,20 +75,24 @@ static grub_command_t cmd, cmd_stop, cmd_break;
b1bcb2
 GRUB_MOD_INIT (gdb)
b1bcb2
 {
b1bcb2
   grub_gdb_idtinit ();
b1bcb2
-  cmd = grub_register_command ("gdbstub", grub_cmd_gdbstub,
b1bcb2
-			       N_("PORT"), 
b1bcb2
-			       /* TRANSLATORS: GDB stub is a small part of
b1bcb2
-				  GDB functionality running on local host
b1bcb2
-				  which allows remote debugger to
b1bcb2
-				  connect to it.  */
b1bcb2
-			       N_("Start GDB stub on given port"));
b1bcb2
-  cmd_break = grub_register_command ("gdbstub_break", grub_cmd_gdb_break,
b1bcb2
-				     /* TRANSLATORS: this refers to triggering
b1bcb2
-					a breakpoint so that the user will land
b1bcb2
-					into GDB.  */
b1bcb2
-				     0, N_("Break into GDB"));
b1bcb2
-  cmd_stop = grub_register_command ("gdbstub_stop", grub_cmd_gdbstop,
b1bcb2
-				    0, N_("Stop GDB stub"));
b1bcb2
+  cmd = grub_register_command_lockdown ("gdbstub", grub_cmd_gdbstub,
b1bcb2
+					N_("PORT"),
b1bcb2
+					/*
b1bcb2
+					 * TRANSLATORS: GDB stub is a small part of
b1bcb2
+					 * GDB functionality running on local host
b1bcb2
+					 * which allows remote debugger to
b1bcb2
+					 * connect to it.
b1bcb2
+					 */
b1bcb2
+					N_("Start GDB stub on given port"));
b1bcb2
+  cmd_break = grub_register_command_lockdown ("gdbstub_break", grub_cmd_gdb_break,
b1bcb2
+					      /*
b1bcb2
+					       * TRANSLATORS: this refers to triggering
b1bcb2
+					       * a breakpoint so that the user will land
b1bcb2
+					       * into GDB.
b1bcb2
+					       */
b1bcb2
+					      0, N_("Break into GDB"));
b1bcb2
+  cmd_stop = grub_register_command_lockdown ("gdbstub_stop", grub_cmd_gdbstop,
b1bcb2
+					     0, N_("Stop GDB stub"));
b1bcb2
 }
b1bcb2
 
b1bcb2
 GRUB_MOD_FINI (gdb)