diff --git a/.gitignore b/.gitignore
index 618dc68..0342d81 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
SOURCES/grub-2.02~beta2.tar.xz
SOURCES/theme.tar.bz2
SOURCES/unifont-5.1.20080820.pcf.gz
-SOURCES/centos.cer
diff --git a/.grub2.metadata b/.grub2.metadata
index a5c2c6a..261f908 100644
--- a/.grub2.metadata
+++ b/.grub2.metadata
@@ -1,4 +1,3 @@
1bf580f1e8bce4909a7ac7ca485cee02b00ed383 SOURCES/grub-2.02~beta2.tar.xz
cf0b7763c528902da7e8b05cfa248f20c8825ce5 SOURCES/theme.tar.bz2
87f8600ba24e521b5d20bdf6c4b71af8ae861e3a SOURCES/unifont-5.1.20080820.pcf.gz
-6e9105eb51e55a46761838f289a917611cad8091 SOURCES/centos.cer
diff --git a/SOURCES/0186-Fix-security-issue-when-reading-username-and-passwor.patch b/SOURCES/0186-Fix-security-issue-when-reading-username-and-passwor.patch
new file mode 100644
index 0000000..6419faf
--- /dev/null
+++ b/SOURCES/0186-Fix-security-issue-when-reading-username-and-passwor.patch
@@ -0,0 +1,47 @@
+From 3afaf579fb89ee4e1f6fc53f950e8ec574a9489a Mon Sep 17 00:00:00 2001
+From: Hector Marco-Gisbert <hecmargi@upv.es>
+Date: Fri, 13 Nov 2015 16:21:09 +0100
+Subject: [PATCH 186/187] Fix security issue when reading username and password
+
+ This patch fixes two integer underflows at:
+ * grub-core/lib/crypto.c
+ * grub-core/normal/auth.c
+
+Resolves: CVE-2015-8370
+
+Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
+Signed-off-by: Ismael Ripoll-Ripoll <iripoll@disca.upv.es>
+---
+ grub-core/lib/crypto.c | 2 +-
+ grub-core/normal/auth.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
+index 8e8426c..a23519c 100644
+--- a/grub-core/lib/crypto.c
++++ b/grub-core/lib/crypto.c
+@@ -456,7 +456,7 @@ grub_password_get (char buf[], unsigned buf_size)
+ break;
+ }
+
+- if (key == '\b')
++ if (key == '\b' && cur_len)
+ {
+ cur_len--;
+ continue;
+diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c
+index c6bd96e..5782ec5 100644
+--- a/grub-core/normal/auth.c
++++ b/grub-core/normal/auth.c
+@@ -172,7 +172,7 @@ grub_username_get (char buf[], unsigned buf_size)
+ break;
+ }
+
+- if (key == '\b')
++ if (key == '\b' && cur_len)
+ {
+ cur_len--;
+ grub_printf ("\b");
+--
+2.5.0
+
diff --git a/SOURCES/0187-01_users-Handle-GRUB_PASSWORD-better.patch b/SOURCES/0187-01_users-Handle-GRUB_PASSWORD-better.patch
new file mode 100644
index 0000000..18bc327
--- /dev/null
+++ b/SOURCES/0187-01_users-Handle-GRUB_PASSWORD-better.patch
@@ -0,0 +1,45 @@
+From dcc927227824dbcb9a7e1f809aedf2b1e08078b3 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Fri, 4 Dec 2015 09:28:38 -0500
+Subject: [PATCH 187/187] 01_users: Handle GRUB_PASSWORD better.
+
+Only handle GRUB_PASSWORD not GRUB2_PASSWORD (as that's more likely to
+be acceptable upstream).
+
+Related: rhbz#1284370
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ util/grub-setpassword.8 | 2 +-
+ util/grub.d/01_users.in | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/util/grub-setpassword.8 b/util/grub-setpassword.8
+index 5973abe..49200a8 100644
+--- a/util/grub-setpassword.8
++++ b/util/grub-setpassword.8
+@@ -9,7 +9,7 @@
+ \fBgrub-setpassword\fR outputs the user.cfg file which contains the hashed GRUB bootloader password. This utility only supports configurations where there is a single root user.
+
+ The file has the format:
+-GRUB_2PASSWORD=<\fIhashed password\fR>.
++GRUB2_PASSWORD=<\fIhashed password\fR>.
+
+ .SH OPTIONS
+ .TP
+diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in
+index facd409..db2f44b 100644
+--- a/util/grub.d/01_users.in
++++ b/util/grub.d/01_users.in
+@@ -2,7 +2,7 @@
+ cat << EOF
+ if [ -f \${prefix}/user.cfg ]; then
+ source \${prefix}/user.cfg
+- if [ -n \${GRUB2_PASSWORD} ]; then
++ if [ -n "\${GRUB2_PASSWORD}" ]; then
+ set superusers="root"
+ export superusers
+ password_pbkdf2 root \${GRUB2_PASSWORD}
+--
+2.5.0
+
diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec
index 349a48d..307739e 100644
--- a/SPECS/grub2.spec
+++ b/SPECS/grub2.spec
@@ -33,9 +33,6 @@
%if 0%{?fedora}
%global efidir fedora
%endif
-%if 0%{?centos}
-%global efidir centos
-%endif
%endif
@@ -45,7 +42,7 @@
Name: grub2
Epoch: 1
Version: 2.02
-Release: 0.29%{?dist}
+Release: 0.33%{?dist}
Summary: Bootloader with support for Linux, Multiboot and more
Group: System Environment/Base
@@ -53,9 +50,9 @@ License: GPLv3+
URL: http://www.gnu.org/software/grub/
Obsoletes: grub < 1:0.98
Source0: ftp://alpha.gnu.org/gnu/grub/grub-%{tarversion}.tar.xz
-#Source0: ftp://ftp.gnu.org/gnu/grub/grub-%{tarversion}.tar.xz
-Source1: centos.cer
-#(source removed)
+#Source0: ftp://ftp.gnu.org/gnu/grub/grub-%%{tarversion}.tar.xz
+Source1: securebootca.cer
+Source2: secureboot.cer
Source4: http://unifoundry.com/unifont-5.1.20080820.pcf.gz
Source5: theme.tar.bz2
Source6: gitignore
@@ -246,6 +243,8 @@ Patch0182: 0182-tcp-add-window-scaling-support.patch
Patch0183: 0183-efinet-retransmit-if-our-device-is-busy.patch
Patch0184: 0184-Be-more-aggro-about-actually-using-the-configured-ne.patch
Patch0185: 0185-efinet-add-filter-for-the-first-exclusive-reopen-of-.patch
+Patch0186: 0186-Fix-security-issue-when-reading-username-and-passwor.patch
+Patch0187: 0187-01_users-Handle-GRUB_PASSWORD-better.patch
@@ -397,8 +396,8 @@ GRUB_MODULES="${GRUB_MODULES} linuxefi"
mv %{grubefiname}.orig %{grubefiname}
mv %{grubeficdname}.orig %{grubeficdname}
%else
-%pesign -s -i %{grubefiname}.orig -o %{grubefiname} -a %{SOURCE1} -c %{SOURCE1} -n redhatsecureboot301
-%pesign -s -i %{grubeficdname}.orig -o %{grubeficdname} -a %{SOURCE1} -c %{SOURCE1} -n redhatsecureboot301
+%pesign -s -i %{grubefiname}.orig -o %{grubefiname} -a %{SOURCE1} -c %{SOURCE2} -n redhatsecureboot301
+%pesign -s -i %{grubeficdname}.orig -o %{grubeficdname} -a %{SOURCE1} -c %{SOURCE2} -n redhatsecureboot301
%endif
cd ..
%endif
@@ -549,23 +548,30 @@ ln -s /boot/efi/EFI/%{efidir}/grubenv boot/grub2/grubenv
rm -rf $RPM_BUILD_ROOT
%pre tools
-if [ $1 -gt 1 ]; then
- if [ -f /etc/grub.d/01_users ] && \
- grep -c -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then
- if [ -f /boot/efi/EFI/%{efidir}/grub.cfg ]; then
- # on EFI we don't get permissions on the file, but
- # the directory is protected.
- grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
- sed 's/^password_pbkdf2 root \(.*\)$/GRUB_PASSWORD=\1/' \
- > /boot/efi/EFI/%{efidir}/user.cfg
- fi
- if [ -f /boot/grub2/grub.cfg ]; then
- install -m 0600 /dev/null /boot/grub2/user.cfg
- chmod 0600 /boot/grub2/user.cfg
- grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
- sed 's/^password_pbkdf2 root \(.*\)$/GRUB_PASSWORD=\1/' \
- > /boot/grub2/user.cfg
- fi
+if [ -f /boot/grub2/user.cfg ]; then
+ if grep -q '^GRUB_PASSWORD=' /boot/grub2/user.cfg ; then
+ sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' /boot/grub2/user.cfg
+ fi
+elif [ -f /boot/efi/EFI/%{efidir}/user.cfg ]; then
+ if grep -q '^GRUB_PASSWORD=' /boot/efi/EFI/%{efidir}/user.cfg ; then
+ sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' \
+ /boot/efi/EFI/%{efidir}/user.cfg
+ fi
+elif [ -f /etc/grub.d/01_users ] && \
+ grep -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then
+ if [ -f /boot/efi/EFI/%{efidir}/grub.cfg ]; then
+ # on EFI we don't get permissions on the file, but
+ # the directory is protected.
+ grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
+ sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \
+ > /boot/efi/EFI/%{efidir}/user.cfg
+ fi
+ if [ -f /boot/grub2/grub.cfg ]; then
+ install -m 0600 /dev/null /boot/grub2/user.cfg
+ chmod 0600 /boot/grub2/user.cfg
+ grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
+ sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \
+ > /boot/grub2/user.cfg
fi
fi
@@ -695,9 +701,23 @@ fi
%exclude %{_datarootdir}/grub/themes/starfield
%changelog
-* Thu Nov 19 2015 CentOS Sources <bugs@centos.org> - 2.02-0.29.el7.centos
-- Roll in CentOS Secureboot keys
-- Move the edidir to be CentOS, so people can co-install fedora, rhel and centos
+* Thu Dec 10 2015 Peter Jones <pjones@redhat.com> - 2.02-0.33
+- Don't remove 01_users, it's the wrong thing to do.
+ Related:rhbz1290089
+
+* Wed Dec 09 2015 Peter Jones <pjones@redhat.com> - 2.02-0.32
+- Rebuild for .z so the release number is different.
+ Related: rhbz#1290089
+
+* Wed Dec 09 2015 Peter Jones <pjones@redhat.com> - 2.02-0.31
+- More work on handling of GRUB2_PASSWORD
+ Resolves: rhbz#1290089
+
+* Tue Dec 08 2015 Peter Jones <pjones@redhat.com> - 2.02-0.30
+- Fix security issue when reading username and password
+ Resolves: CVE-2015-8370
+- Do a better job of handling GRUB_PASSWORD
+ Resolves: rhbz#1290089
* Fri Oct 09 2015 Peter Jones <pjones@redhat.com> - 2.02-0.29
- Fix DHCP6 timeouts due to failed network stack once more.