From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001

From: Vladimir Serbinenko <phcoder@gmail.com>

Date: Wed, 20 Nov 2013 02:28:29 +0100

Subject: [PATCH] verifiers: File type for fine-grained signature-verification

 controlling

Let's provide file type info to the I/O layer. This way verifiers

framework and its users will be able to differentiate files and verify

only required ones.

This is preparatory patch.

Signed-off-by: Vladimir Serbinenko <phcoder@gmail.com>

Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>

Reviewed-by: Ross Philipson <ross.philipson@oracle.com>

(backported from commit ca0a4f689a02c2c5a5e385f874aaaa38e151564e)

Signed-off-by: Daniel Axtens <dja@axtens.net>

---

 grub-core/commands/acpi.c                    |   2 +-

 grub-core/commands/blocklist.c               |   4 +-

 grub-core/commands/cat.c                     |   2 +-

 grub-core/commands/cmp.c                     |   4 +-

 grub-core/commands/efi/loadbios.c            |   4 +-

 grub-core/commands/file.c                    |   5 +-

 grub-core/commands/hashsum.c                 |  22 ++--

 grub-core/commands/hexdump.c                 |   2 +-

 grub-core/commands/i386/pc/play.c            |   2 +-

 grub-core/commands/keylayouts.c              |   2 +-

 grub-core/commands/legacycfg.c               |   2 +-

 grub-core/commands/loadenv.c                 |  24 +++--

 grub-core/commands/ls.c                      |   8 +-

 grub-core/commands/minicmd.c                 |   2 +-

 grub-core/commands/nativedisk.c              |   3 +-

 grub-core/commands/parttool.c                |   2 +-

 grub-core/commands/search.c                  |   4 +-

 grub-core/commands/test.c                    |   4 +-

 grub-core/commands/testload.c                |   2 +-

 grub-core/commands/testspeed.c               |   2 +-

 grub-core/commands/verify.c                  |  51 ++++-----

 grub-core/disk/loopback.c                    |   3 +-

 grub-core/efiemu/main.c                      |   2 +-

 grub-core/font/font.c                        |   4 +-

 grub-core/fs/zfs/zfscrypt.c                  |   2 +-

 grub-core/gettext/gettext.c                  |   2 +-

 grub-core/gfxmenu/theme_loader.c             |   2 +-

 grub-core/io/bufio.c                         |   4 +-

 grub-core/io/gzio.c                          |   5 +-

 grub-core/io/lzopio.c                        |   6 +-

 grub-core/io/offset.c                        |   7 +-

 grub-core/io/xzio.c                          |   6 +-

 grub-core/kern/dl.c                          |   2 +-

 grub-core/kern/elf.c                         |   4 +-

 grub-core/kern/file.c                        |  22 ++--

 grub-core/lib/syslinux_parse.c               |   2 +-

 grub-core/loader/efi/chainloader.c           |   2 +-

 grub-core/loader/i386/bsd.c                  |  16 +--

 grub-core/loader/i386/coreboot/chainloader.c |   2 +-

 grub-core/loader/i386/linux.c                |   2 +-

 grub-core/loader/i386/pc/chainloader.c       |   4 +-

 grub-core/loader/i386/pc/freedos.c           |   2 +-

 grub-core/loader/i386/pc/linux.c             |   2 +-

 grub-core/loader/i386/pc/ntldr.c             |   2 +-

 grub-core/loader/i386/pc/plan9.c             |   2 +-

 grub-core/loader/i386/pc/pxechainloader.c    |   2 +-

 grub-core/loader/i386/pc/truecrypt.c         |   2 +-

 grub-core/loader/i386/xen.c                  |   7 +-

 grub-core/loader/i386/xen_file.c             |   2 +-

 grub-core/loader/i386/xnu.c                  |   2 +-

 grub-core/loader/linux.c                     |   6 +-

 grub-core/loader/macho.c                     |   4 +-

 grub-core/loader/mips/linux.c                |   2 +-

 grub-core/loader/multiboot.c                 |   8 +-

 grub-core/loader/xnu.c                       |  16 +--

 grub-core/loader/xnu_resume.c                |   4 +-

 grub-core/normal/autofs.c                    |  11 +-

 grub-core/normal/crypto.c                    |   2 +-

 grub-core/normal/dyncmd.c                    |   2 +-

 grub-core/normal/main.c                      |   2 +-

 grub-core/normal/term.c                      |   2 +-

 grub-core/video/readers/jpeg.c               |   2 +-

 grub-core/video/readers/png.c                |   2 +-

 grub-core/video/readers/tga.c                |   2 +-

 util/grub-fstest.c                           |   6 +-

 util/grub-mount.c                            |   6 +-

 include/grub/bufio.h                         |   4 +-

 include/grub/elfload.h                       |   2 +-

 include/grub/file.h                          | 152 +++++++++++++++++++--------

 include/grub/machoload.h                     |   3 +-

 70 files changed, 292 insertions(+), 221 deletions(-)

diff --git a/grub-core/commands/acpi.c b/grub-core/commands/acpi.c

index 9f02f22019a..5a1499aa0e3 100644

--- a/grub-core/commands/acpi.c

+++ b/grub-core/commands/acpi.c

@@ -635,7 +635,7 @@ grub_cmd_acpi (struct grub_extcmd_context *ctxt, int argc, char **args)

       grub_size_t size;

       char *buf;

-      file = grub_file_open (args[i]);

+      file = grub_file_open (args[i], GRUB_FILE_TYPE_ACPI_TABLE);

       if (! file)

 	{

 	  free_tables ();

diff --git a/grub-core/commands/blocklist.c b/grub-core/commands/blocklist.c

index d1a47b504bf..944449b77d4 100644

--- a/grub-core/commands/blocklist.c

+++ b/grub-core/commands/blocklist.c

@@ -121,8 +121,8 @@ grub_cmd_blocklist (grub_command_t cmd __attribute__ ((unused)),

   if (argc < 1)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));

-  grub_file_filter_disable_compression ();

-  file = grub_file_open (args[0]);

+  file = grub_file_open (args[0], GRUB_FILE_TYPE_PRINT_BLOCKLIST

+			 | GRUB_FILE_TYPE_NO_DECOMPRESS);

   if (! file)

     return grub_errno;

diff --git a/grub-core/commands/cat.c b/grub-core/commands/cat.c

index 88d90443602..ba5f0061aa5 100644

--- a/grub-core/commands/cat.c

+++ b/grub-core/commands/cat.c

@@ -56,7 +56,7 @@ grub_cmd_cat (grub_extcmd_context_t ctxt, int argc, char **args)

   if (argc != 1)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));

-  file = grub_file_open (args[0]);

+  file = grub_file_open (args[0], GRUB_FILE_TYPE_CAT);

   if (! file)

     return grub_errno;

diff --git a/grub-core/commands/cmp.c b/grub-core/commands/cmp.c

index cc23ee67ea3..e9c3b25d34c 100644

--- a/grub-core/commands/cmp.c

+++ b/grub-core/commands/cmp.c

@@ -45,8 +45,8 @@ grub_cmd_cmp (grub_command_t cmd __attribute__ ((unused)),

   grub_printf_ (N_("Compare file `%s' with `%s':\n"), args[0],

 		args[1]);

-  file1 = grub_file_open (args[0]);

-  file2 = grub_file_open (args[1]);

+  file1 = grub_file_open (args[0], GRUB_FILE_TYPE_CMP);

+  file2 = grub_file_open (args[1], GRUB_FILE_TYPE_CMP);

   if (! file1 || ! file2)

     goto cleanup;

diff --git a/grub-core/commands/efi/loadbios.c b/grub-core/commands/efi/loadbios.c

index 132cadbc764..d41d521a4ae 100644

--- a/grub-core/commands/efi/loadbios.c

+++ b/grub-core/commands/efi/loadbios.c

@@ -169,7 +169,7 @@ grub_cmd_loadbios (grub_command_t cmd __attribute__ ((unused)),

   if (argc > 1)

     {

-      file = grub_file_open (argv[1]);

+      file = grub_file_open (argv[1], GRUB_FILE_TYPE_VBE_DUMP);

       if (! file)

 	return grub_errno;

@@ -183,7 +183,7 @@ grub_cmd_loadbios (grub_command_t cmd __attribute__ ((unused)),

 	return grub_errno;

     }

-  file = grub_file_open (argv[0]);

+  file = grub_file_open (argv[0], GRUB_FILE_TYPE_VBE_DUMP);

   if (! file)

     return grub_errno;

diff --git a/grub-core/commands/file.c b/grub-core/commands/file.c

index 3ff6d5522d2..4f81aa1f9e1 100644

--- a/grub-core/commands/file.c

+++ b/grub-core/commands/file.c

@@ -165,7 +165,7 @@ grub_cmd_file (grub_extcmd_context_t ctxt, int argc, char **args)

   if (type == -1)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, "no type specified");

-  file = grub_file_open (args[0]);

+  file = grub_file_open (args[0], GRUB_FILE_TYPE_XNU_KERNEL);

   if (!file)

     return grub_errno;

   switch (type)

@@ -546,7 +546,8 @@ grub_cmd_file (grub_extcmd_context_t ctxt, int argc, char **args)

     case IS_XNU64:

     case IS_XNU32:

       {

-	macho = grub_macho_open (args[0], (type == IS_XNU64));

+	macho = grub_macho_open (args[0], GRUB_FILE_TYPE_XNU_KERNEL,

+				 (type == IS_XNU64));

 	if (!macho)

 	  break;

 	/* FIXME: more checks?  */

diff --git a/grub-core/commands/hashsum.c b/grub-core/commands/hashsum.c

index d18687351a5..456ba908b6f 100644

--- a/grub-core/commands/hashsum.c

+++ b/grub-core/commands/hashsum.c

@@ -113,7 +113,7 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename,

   if (hash->mdlen > GRUB_CRYPTO_MAX_MDLEN)

     return grub_error (GRUB_ERR_BUG, "mdlen is too long");

-  hashlist = grub_file_open (hashfilename);

+  hashlist = grub_file_open (hashfilename, GRUB_FILE_TYPE_HASHLIST);

   if (!hashlist)

     return grub_errno;

@@ -141,17 +141,15 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename,

 	  filename = grub_xasprintf ("%s/%s", prefix, p);

 	  if (!filename)

 	    return grub_errno;

-	  if (!uncompress)

-	    grub_file_filter_disable_compression ();

-	  file = grub_file_open (filename);

+	  file = grub_file_open (filename, GRUB_FILE_TYPE_TO_HASH

+				 | (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS

+				    : GRUB_FILE_TYPE_NONE));

 	  grub_free (filename);

 	}

       else

-	{

-	  if (!uncompress)

-	    grub_file_filter_disable_compression ();

-	  file = grub_file_open (p);

-	}

+	file = grub_file_open (p, GRUB_FILE_TYPE_TO_HASH

+			       | (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS

+				  : GRUB_FILE_TYPE_NONE));

       if (!file)

 	{

 	  grub_file_close (hashlist);

@@ -242,9 +240,9 @@ grub_cmd_hashsum (struct grub_extcmd_context *ctxt,

       grub_file_t file;

       grub_err_t err;

       unsigned j;

-      if (!uncompress)

-	grub_file_filter_disable_compression ();

-      file = grub_file_open (args[i]);

+      file = grub_file_open (args[i], GRUB_FILE_TYPE_TO_HASH

+			     | (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS

+				: GRUB_FILE_TYPE_NONE));

       if (!file)

 	{

 	  if (!keep)

diff --git a/grub-core/commands/hexdump.c b/grub-core/commands/hexdump.c

index 4c884b3a19a..eaa12465bb3 100644

--- a/grub-core/commands/hexdump.c

+++ b/grub-core/commands/hexdump.c

@@ -90,7 +90,7 @@ grub_cmd_hexdump (grub_extcmd_context_t ctxt, int argc, char **args)

     {

       grub_file_t file;

-      file = grub_file_open (args[0]);

+      file = grub_file_open (args[0], GRUB_FILE_TYPE_HEXCAT);

       if (! file)

 	return 0;

diff --git a/grub-core/commands/i386/pc/play.c b/grub-core/commands/i386/pc/play.c

index 7712e2a36a1..c8181310515 100644

--- a/grub-core/commands/i386/pc/play.c

+++ b/grub-core/commands/i386/pc/play.c

@@ -93,7 +93,7 @@ grub_cmd_play (grub_command_t cmd __attribute__ ((unused)),

       grub_uint32_t tempo;

       grub_file_t file;

-      file = grub_file_open (args[0]);

+      file = grub_file_open (args[0], GRUB_FILE_TYPE_AUDIO);

       if (! file)

         return grub_errno;

diff --git a/grub-core/commands/keylayouts.c b/grub-core/commands/keylayouts.c

index f35d3a369ba..c05d6128a6d 100644

--- a/grub-core/commands/keylayouts.c

+++ b/grub-core/commands/keylayouts.c

@@ -220,7 +220,7 @@ grub_cmd_keymap (struct grub_command *cmd __attribute__ ((unused)),

   else

     filename = argv[0];

-  file = grub_file_open (filename);

+  file = grub_file_open (filename, GRUB_FILE_TYPE_KEYBOARD_LAYOUT);

   if (! file)

     goto fail;

diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c

index 0de070eacc4..f5696a51a75 100644

--- a/grub-core/commands/legacycfg.c

+++ b/grub-core/commands/legacycfg.c

@@ -56,7 +56,7 @@ legacy_file (const char *filename)

   if (!suffix)

     return grub_errno;

-  file = grub_file_open (filename);

+  file = grub_file_open (filename, GRUB_FILE_TYPE_CONFIG);

   if (! file)

     {

       grub_free (suffix);

diff --git a/grub-core/commands/loadenv.c b/grub-core/commands/loadenv.c

index 91c99456091..163b9a09042 100644

--- a/grub-core/commands/loadenv.c

+++ b/grub-core/commands/loadenv.c

@@ -46,7 +46,8 @@ static const struct grub_arg_option options[] =

    PUBKEY filter (that insists upon properly signed files) as well.  PUBKEY

    filter is restored before the function returns. */

 static grub_file_t

-open_envblk_file (char *filename, int untrusted)

+open_envblk_file (char *filename,

+		  enum grub_file_type type)

 {

   grub_file_t file;

   char *buf = 0;

@@ -74,13 +75,7 @@ open_envblk_file (char *filename, int untrusted)

       grub_strcpy (filename + len + 1, GRUB_ENVBLK_DEFCFG);

     }

-  /* The filters that are disabled will be re-enabled by the call to

-     grub_file_open() after this particular file is opened. */

-  grub_file_filter_disable_compression ();

-  if (untrusted)

-    grub_file_filter_disable_pubkey ();

-

-  file = grub_file_open (filename);

+  file = grub_file_open (filename, type);

   grub_free (buf);

   return file;

@@ -98,7 +93,10 @@ grub_cmd_load_env (grub_extcmd_context_t ctxt, int argc, char **args)

   whitelist.list = args;

   /* state[0] is the -f flag; state[1] is the --skip-sig flag */

-  file = open_envblk_file ((state[0].set) ? state[0].arg : 0, state[1].set);

+  file = open_envblk_file ((state[0].set) ? state[0].arg : 0,

+			   GRUB_FILE_TYPE_LOADENV

+			   | (state[1].set

+			      ? GRUB_FILE_TYPE_SKIP_SIGNATURE : GRUB_FILE_TYPE_NONE));

   if (! file)

     return grub_errno;

@@ -133,7 +131,10 @@ grub_cmd_list_env (grub_extcmd_context_t ctxt,

   grub_file_t file;

   grub_envblk_t envblk;

-  file = open_envblk_file ((state[0].set) ? state[0].arg : 0, 0);

+  file = open_envblk_file ((state[0].set) ? state[0].arg : 0,

+			   GRUB_FILE_TYPE_LOADENV

+			   | (state[1].set

+			      ? GRUB_FILE_TYPE_SKIP_SIGNATURE : GRUB_FILE_TYPE_NONE));

   if (! file)

     return grub_errno;

@@ -317,7 +318,8 @@ grub_cmd_save_env (grub_extcmd_context_t ctxt, int argc, char **args)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, "no variable is specified");

   file = open_envblk_file ((state[0].set) ? state[0].arg : 0,

-                           1 /* allow untrusted */);

+			   GRUB_FILE_TYPE_SAVEENV

+			   | GRUB_FILE_TYPE_SKIP_SIGNATURE);

   if (! file)

     return grub_errno;

diff --git a/grub-core/commands/ls.c b/grub-core/commands/ls.c

index c25161cc4f2..2cdb2acc552 100644

--- a/grub-core/commands/ls.c

+++ b/grub-core/commands/ls.c

@@ -129,8 +129,8 @@ print_files_long (const char *filename, const struct grub_dirhook_info *info,

       /* XXX: For ext2fs symlinks are detected as files while they

 	 should be reported as directories.  */

-      grub_file_filter_disable_compression ();

-      file = grub_file_open (pathname);

+      file = grub_file_open (pathname, GRUB_FILE_TYPE_GET_SIZE

+			     | GRUB_FILE_TYPE_NO_DECOMPRESS);

       if (! file)

 	{

 	  grub_errno = 0;

@@ -234,8 +234,8 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human)

 	  struct grub_dirhook_info info;

 	  grub_errno = 0;

-	  grub_file_filter_disable_compression ();

-	  file = grub_file_open (dirname);

+	  file = grub_file_open (dirname, GRUB_FILE_TYPE_GET_SIZE

+				 | GRUB_FILE_TYPE_NO_DECOMPRESS);

 	  if (! file)

 	    goto fail;

diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c

index b25ca4b9f17..46bf135e8f0 100644

--- a/grub-core/commands/minicmd.c

+++ b/grub-core/commands/minicmd.c

@@ -43,7 +43,7 @@ grub_mini_cmd_cat (struct grub_command *cmd __attribute__ ((unused)),

   if (argc < 1)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));

-  file = grub_file_open (argv[0]);

+  file = grub_file_open (argv[0], GRUB_FILE_TYPE_CAT);

   if (! file)

     return grub_errno;

diff --git a/grub-core/commands/nativedisk.c b/grub-core/commands/nativedisk.c

index d69214f6de0..f200a5ce092 100644

--- a/grub-core/commands/nativedisk.c

+++ b/grub-core/commands/nativedisk.c

@@ -242,7 +242,8 @@ grub_cmd_nativedisk (grub_command_t cmd __attribute__ ((unused)),

       if (! filename)

 	goto fail;

-      file = grub_file_open (filename);

+      file = grub_file_open (filename,

+			     GRUB_FILE_TYPE_GRUB_MODULE);

       grub_free (filename);

       if (! file)

 	goto fail;

diff --git a/grub-core/commands/parttool.c b/grub-core/commands/parttool.c

index 36dadc0b1db..051e31320e9 100644

--- a/grub-core/commands/parttool.c

+++ b/grub-core/commands/parttool.c

@@ -199,7 +199,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)),

 	  {

 	    grub_file_t file;

-	    file = grub_file_open (filename);

+	    file = grub_file_open (filename, GRUB_FILE_TYPE_GRUB_MODULE_LIST);

 	    if (file)

 	      {

 		char *buf = 0;

diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c

index 7dd32e445c9..ddda6e7c590 100644

--- a/grub-core/commands/search.c

+++ b/grub-core/commands/search.c

@@ -81,8 +81,8 @@ iterate_device (const char *name, void *data)

       if (! buf)

 	return 1;

-      grub_file_filter_disable_compression ();

-      file = grub_file_open (buf);

+      file = grub_file_open (buf, GRUB_FILE_TYPE_FS_SEARCH

+			     | GRUB_FILE_TYPE_NO_DECOMPRESS);

       if (file)

 	{

 	  found = 1;

diff --git a/grub-core/commands/test.c b/grub-core/commands/test.c

index 5f06642f6c6..13c6ed9534a 100644

--- a/grub-core/commands/test.c

+++ b/grub-core/commands/test.c

@@ -355,8 +355,8 @@ test_parse (char **args, int *argn, int argc)

 	  if (grub_strcmp (args[*argn], "-s") == 0)

 	    {

 	      grub_file_t file;

-	      grub_file_filter_disable_compression ();

-	      file = grub_file_open (args[*argn + 1]);

+	      file = grub_file_open (args[*argn + 1], GRUB_FILE_TYPE_GET_SIZE

+				     | GRUB_FILE_TYPE_NO_DECOMPRESS);

 	      update_val (file && (grub_file_size (file) != 0), &ctx;;

 	      if (file)

 		grub_file_close (file);

diff --git a/grub-core/commands/testload.c b/grub-core/commands/testload.c

index cfab6763dc3..ff01a0516dd 100644

--- a/grub-core/commands/testload.c

+++ b/grub-core/commands/testload.c

@@ -57,7 +57,7 @@ grub_cmd_testload (struct grub_command *cmd __attribute__ ((unused)),

   if (argc < 1)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));

-  file = grub_file_open (argv[0]);

+  file = grub_file_open (argv[0], GRUB_FILE_TYPE_TESTLOAD);

   if (! file)

     return grub_errno;

diff --git a/grub-core/commands/testspeed.c b/grub-core/commands/testspeed.c

index 042645f8d26..c13a9b8d8d2 100644

--- a/grub-core/commands/testspeed.c

+++ b/grub-core/commands/testspeed.c

@@ -61,7 +61,7 @@ grub_cmd_testspeed (grub_extcmd_context_t ctxt, int argc, char **args)

   if (buffer == NULL)

     return grub_errno;

-  file = grub_file_open (args[0]);

+  file = grub_file_open (args[0], GRUB_FILE_TYPE_TESTLOAD);

   if (file == NULL)

     goto quit;

diff --git a/grub-core/commands/verify.c b/grub-core/commands/verify.c

index 67cb1c78509..f0dfeceebd4 100644

--- a/grub-core/commands/verify.c

+++ b/grub-core/commands/verify.c

@@ -680,10 +680,12 @@ grub_cmd_trust (grub_extcmd_context_t ctxt,

   if (argc < 1)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected"));

-  grub_file_filter_disable_compression ();

-  if (ctxt->state[OPTION_SKIP_SIG].set)

-    grub_file_filter_disable_pubkey ();

-  pkf = grub_file_open (args[0]);

+  pkf = grub_file_open (args[0],

+			GRUB_FILE_TYPE_PUBLIC_KEY_TRUST

+			| GRUB_FILE_TYPE_NO_DECOMPRESS

+			| (ctxt->state[OPTION_SKIP_SIG].set

+			   ? GRUB_FILE_TYPE_SKIP_SIGNATURE

+			   : GRUB_FILE_TYPE_NONE));

   if (!pkf)

     return grub_errno;

   pk = grub_load_public_key (pkf);

@@ -771,10 +773,12 @@ grub_cmd_verify_signature (grub_extcmd_context_t ctxt,

   if (argc > 2)

     {

       grub_file_t pkf;

-      grub_file_filter_disable_compression ();

-      if (ctxt->state[OPTION_SKIP_SIG].set)

-	grub_file_filter_disable_pubkey ();

-      pkf = grub_file_open (args[2]);

+      pkf = grub_file_open (args[2],

+			    GRUB_FILE_TYPE_PUBLIC_KEY

+			    | GRUB_FILE_TYPE_NO_DECOMPRESS

+			    | (ctxt->state[OPTION_SKIP_SIG].set

+			       ? GRUB_FILE_TYPE_SKIP_SIGNATURE

+			       : GRUB_FILE_TYPE_NONE));

       if (!pkf)

 	return grub_errno;

       pk = grub_load_public_key (pkf);

@@ -786,16 +790,16 @@ grub_cmd_verify_signature (grub_extcmd_context_t ctxt,

       grub_file_close (pkf);

     }

-  grub_file_filter_disable_all ();

-  f = grub_file_open (args[0]);

+  f = grub_file_open (args[0], GRUB_FILE_TYPE_VERIFY_SIGNATURE);

   if (!f)

     {

       err = grub_errno;

       goto fail;

     }

-  grub_file_filter_disable_all ();

-  sig = grub_file_open (args[1]);

+  sig = grub_file_open (args[1],

+			GRUB_FILE_TYPE_SIGNATURE

+			| GRUB_FILE_TYPE_NO_DECOMPRESS);

   if (!sig)

     {

       err = grub_errno;

@@ -858,33 +862,32 @@ struct grub_fs verified_fs =

 };

 static grub_file_t

-grub_pubkey_open (grub_file_t io, const char *filename)

+grub_pubkey_open (grub_file_t io, enum grub_file_type type)

 {

   grub_file_t sig;

   char *fsuf, *ptr;

   grub_err_t err;

-  grub_file_filter_t curfilt[GRUB_FILE_FILTER_MAX];

   grub_file_t ret;

   grub_verified_t verified;

+  if ((type & GRUB_FILE_TYPE_MASK) == GRUB_FILE_TYPE_SIGNATURE

+      || (type & GRUB_FILE_TYPE_MASK) == GRUB_FILE_TYPE_VERIFY_SIGNATURE

+      || (type & GRUB_FILE_TYPE_SKIP_SIGNATURE))

+    return io;

+

   if (!sec)

     return io;

   if (io->device->disk && 

       (io->device->disk->dev->id == GRUB_DISK_DEVICE_MEMDISK_ID

        || io->device->disk->dev->id == GRUB_DISK_DEVICE_PROCFS_ID))

     return io;

-  fsuf = grub_malloc (grub_strlen (filename) + sizeof (".sig"));

+  fsuf = grub_malloc (grub_strlen (io->name) + sizeof (".sig"));

   if (!fsuf)

     return NULL;

-  ptr = grub_stpcpy (fsuf, filename);

+  ptr = grub_stpcpy (fsuf, io->name);

   grub_memcpy (ptr, ".sig", sizeof (".sig"));

-  grub_memcpy (curfilt, grub_file_filters_enabled,

-	       sizeof (curfilt));

-  grub_file_filter_disable_all ();

-  sig = grub_file_open (fsuf);

-  grub_memcpy (grub_file_filters_enabled, curfilt,

-	       sizeof (curfilt));

+  sig = grub_file_open (fsuf, GRUB_FILE_TYPE_SIGNATURE);

   grub_free (fsuf);

   if (!sig)

     return NULL;

@@ -918,7 +921,7 @@ grub_pubkey_open (grub_file_t io, const char *filename)

   if (!verified->buf)

     {

       grub_file_close (sig);

-      grub_free (verified);

+      verified_free (verified);

       grub_free (ret);

       return NULL;

     }

@@ -926,7 +929,7 @@ grub_pubkey_open (grub_file_t io, const char *filename)

     {

       if (!grub_errno)

 	grub_error (GRUB_ERR_FILE_READ_ERROR, N_("premature end of file %s"),

-		    filename);

+		    io->name);

       grub_file_close (sig);

       verified_free (verified);

       grub_free (ret);

diff --git a/grub-core/disk/loopback.c b/grub-core/disk/loopback.c

index 2d8deaeafbd..9406d931cdd 100644

--- a/grub-core/disk/loopback.c

+++ b/grub-core/disk/loopback.c

@@ -92,7 +92,8 @@ grub_cmd_loopback (grub_extcmd_context_t ctxt, int argc, char **args)

   if (argc < 2)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));

-  file = grub_file_open (args[1]);

+  file = grub_file_open (args[1], GRUB_FILE_TYPE_LOOPBACK

+			 | GRUB_FILE_TYPE_NO_DECOMPRESS);

   if (! file)

     return grub_errno;

diff --git a/grub-core/efiemu/main.c b/grub-core/efiemu/main.c

index f6813b1ed15..a81934725be 100644

--- a/grub-core/efiemu/main.c

+++ b/grub-core/efiemu/main.c

@@ -187,7 +187,7 @@ grub_efiemu_load_file (const char *filename)

   grub_file_t file;

   grub_err_t err;

-  file = grub_file_open (filename);

+  file = grub_file_open (filename, GRUB_FILE_TYPE_GRUB_MODULE);

   if (! file)

     return grub_errno;

diff --git a/grub-core/font/font.c b/grub-core/font/font.c

index b36a099b856..b67507fcc82 100644

--- a/grub-core/font/font.c

+++ b/grub-core/font/font.c

@@ -422,7 +422,7 @@ grub_font_load (const char *filename)

 #endif

   if (filename[0] == '(' || filename[0] == '/' || filename[0] == '+')

-    file = grub_buffile_open (filename, 1024);

+    file = grub_buffile_open (filename, GRUB_FILE_TYPE_FONT, 1024);

   else

     {

       const char *prefix = grub_env_get ("prefix");

@@ -442,7 +442,7 @@ grub_font_load (const char *filename)

       ptr = grub_stpcpy (ptr, filename);

       ptr = grub_stpcpy (ptr, ".pf2");

       *ptr = 0;

-      file = grub_buffile_open (fullname, 1024);

+      file = grub_buffile_open (fullname, GRUB_FILE_TYPE_FONT, 1024);

       grub_free (fullname);

     }

   if (!file)

diff --git a/grub-core/fs/zfs/zfscrypt.c b/grub-core/fs/zfs/zfscrypt.c

index f8488c35344..de3b015f582 100644

--- a/grub-core/fs/zfs/zfscrypt.c

+++ b/grub-core/fs/zfs/zfscrypt.c

@@ -430,7 +430,7 @@ grub_cmd_zfs_key (grub_extcmd_context_t ctxt, int argc, char **args)

   if (argc > 0)

     {

       grub_file_t file;

-      file = grub_file_open (args[0]);

+      file = grub_file_open (args[0], GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY);

       if (!file)

 	return grub_errno;

       real_size = grub_file_read (file, buf, 1024);

diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c

index b22e1bcc94b..84d520cd494 100644

--- a/grub-core/gettext/gettext.c

+++ b/grub-core/gettext/gettext.c

@@ -291,7 +291,7 @@ grub_mofile_open (struct grub_gettext_context *ctx,

   /* Using fd_mo and not another variable because

      it's needed for grub_gettext_get_info.  */

-  fd = grub_file_open (filename);

+  fd = grub_file_open (filename, GRUB_FILE_TYPE_GETTEXT_CATALOG);

   if (!fd)

     return grub_errno;

diff --git a/grub-core/gfxmenu/theme_loader.c b/grub-core/gfxmenu/theme_loader.c

index 02978392ccc..d6829bb5e90 100644

--- a/grub-core/gfxmenu/theme_loader.c

+++ b/grub-core/gfxmenu/theme_loader.c

@@ -743,7 +743,7 @@ grub_gfxmenu_view_load_theme (grub_gfxmenu_view_t view, const char *theme_path)

   p.view = view;

   p.theme_dir = grub_get_dirname (theme_path);

-  file = grub_file_open (theme_path);

+  file = grub_file_open (theme_path, GRUB_FILE_TYPE_THEME);

   if (! file)

     {

       grub_free (p.theme_dir);

diff --git a/grub-core/io/bufio.c b/grub-core/io/bufio.c

index 2781afe0515..0dbac1b3a1e 100644

--- a/grub-core/io/bufio.c

+++ b/grub-core/io/bufio.c

@@ -88,11 +88,11 @@ grub_bufio_open (grub_file_t io, grub_size_t size)

 }

 grub_file_t

-grub_buffile_open (const char *name, grub_size_t size)

+grub_buffile_open (const char *name, enum grub_file_type type, grub_size_t size)

 {

   grub_file_t io, file;

-  io = grub_file_open (name);

+  io = grub_file_open (name, type);

   if (! io)

     return 0;

diff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c

index 7024cda84ea..2ecf076dd5e 100644

--- a/grub-core/io/gzio.c

+++ b/grub-core/io/gzio.c

@@ -1156,11 +1156,14 @@ initialize_tables (grub_gzio_t gzio)

    even if IO does not contain data compressed by gzip, return a valid file

    object. Note that this function won't close IO, even if an error occurs.  */

 static grub_file_t

-grub_gzio_open (grub_file_t io, const char *name __attribute__ ((unused)))

+grub_gzio_open (grub_file_t io, enum grub_file_type type)

 {

   grub_file_t file;

   grub_gzio_t gzio = 0;

+  if (type & GRUB_FILE_TYPE_NO_DECOMPRESS)