ciq EL8 sbat 5

[jason-rodri]

No description provided.

[Copilot]

Pull request overview

This PR updates the EL8 GRUB2 source package to incorporate a large set of upstream security/stability fixes (as patch files), and adds CIQ-specific Secure Boot integration changes (SBAT bump, shim dependency, signing macro overrides, and grub.cfg handling tweaks for EFI/BLS flows).

Changes:

• Bump SBAT generation for grub and add CIQ Secure Boot packaging integration (shim dependency + CIQ sbsign/pesign overrides + cert sources).
• Adjust kernel-install hooks to better handle BLS vs traditional grub.cfg generation and to target the correct grub.cfg path on EFI systems.
• Import a broad set of upstream GRUB patches (memory-safety, overflow/underflow, lockdown hardening, filesystem parsing fixes, and related CVE fixes).

Reviewed changes

Copilot reviewed 114 out of 120 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
SOURCES/sbat.csv.in	Bump grub SBAT generation.
SOURCES/grub.macros	CIQ shim dependency + grub.cfg creation/permission changes.
SOURCES/ciq_sbsign.macros	Add CIQ override macros for pesign/sbsign and SB cert/key selection.
SOURCES/ciq_sb_grub2_aarch64.crt	Add CIQ aarch64 Secure Boot certificate.
SOURCES/99-grub-mkconfig.install	Change when/where to regenerate grub.cfg during kernel installs.
SOURCES/20-grub.install	BLS fragment generation and default-kernel selection logic updates.
SOURCES/0683-gettext-gettext-Unregister-gettext-command-on-module.patch	Upstream fix (gettext command unregister on unload).
SOURCES/0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch	Upstream fix (cryptodisk sector offset calculation).
SOURCES/0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch	Upstream fix (hostdisk sector sizing via sysfs).
SOURCES/0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch	Upstream fix (blocklist end-of-disk addressing).
SOURCES/0678-Strip-correctly-BLS-files-with-conf-extension.patch	Upstream fix (BLS .conf name stripping).
SOURCES/0677-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch	Upstream fix (ext2 extent parsing bounds).
SOURCES/0676-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch	Upstream fix (XFS nrext64 nextents handling).
SOURCES/0675-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch	Upstream fix (XFS dir extents with holes).
SOURCES/0674-fs-xfs-Add-large-extent-counters-incompat-feature-su.patch	Upstream feature/fix (XFS large extent counters).
SOURCES/0672-fs-xfs-Incorrect-short-form-directory-data-boundary-.patch	Upstream fix (XFS shortform dir bounds).
SOURCES/0671-fs-xfs-Fix-memory-leaks-in-XFS-module.patch	Upstream fix (XFS memory leaks).
SOURCES/0669-fs-xfs-Fix-unreadable-filesystem-with-v4-superblock.patch	Upstream fix (XFS v4 superblock inode sizing).
SOURCES/0668-fs-xfs-Add-needsrepair-incompat-feature-support.patch	Upstream feature/fix (XFS needsrepair incompat).
SOURCES/0666-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch	Upstream fix (restore missing allocation).
SOURCES/0665-fs-xfs-Fix-issues-found-while-fuzzing-the-XFS-filesy.patch	Upstream hardening (XFS fuzz fixes / size tracking).
SOURCES/0664-Remove-exttra-bool-definitions.patch	Upstream cleanup (remove redundant bool defs).
SOURCES/0663-types-Make-bool-generally-available.patch	Upstream change (include stdbool.h + rename union member).
SOURCES/0662-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch	Upstream fix (BSD loader underflow).
SOURCES/0661-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch	Upstream fix (shift overflow avoidance).
SOURCES/0660-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch	Upstream fix (printf positional arg validation).
SOURCES/0659-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch	Upstream fix (partition number validation).
SOURCES/0658-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch	Upstream fix (menu index overflow).
SOURCES/0657-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch	Upstream fix (type-correct EHCI toggle).
SOURCES/0656-misc-Ensure-consistent-overflow-error-messages.patch	Upstream cleanup (error message consistency).
SOURCES/0655-osdep-unix-getroot-Fix-potential-underflow.patch	Upstream fix (mountinfo parsing underflow).
SOURCES/0654-script-execute-Fix-potential-underflow-and-NULL-dere.patch	Upstream fix (arglist underflow/NULL).
SOURCES/0653-fs-sfs-Check-if-allocated-memory-is-NULL.patch	Upstream fix (OOM handling).
SOURCES/0652-net-Check-if-returned-pointer-for-allocated-memory-i.patch	Upstream fix (OOM handling).
SOURCES/0651-net-Prevent-overflows-when-allocating-memory-for-arr.patch	Upstream hardening (calloc for arrays).
SOURCES/0649-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch	Upstream fix (NULL check).
SOURCES/0648-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch	Upstream fix (OOM handling).
SOURCES/0647-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch	Upstream hardening (calloc for arrays).
SOURCES/0645-fs-Prevent-overflows-when-assigning-returned-values-.patch	Upstream hardening (cast checks for read_number()).
SOURCES/0644-fs-Prevent-overflows-when-allocating-memory-for-arra.patch	Upstream hardening (calloc for arrays + bounds notes).
SOURCES/0642-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch	Upstream fix (close handle on OOM).
SOURCES/0641-disk-Check-if-returned-pointer-for-allocated-memory-.patch	Upstream fix (OOM checks across disk code).
SOURCES/0640-disk-Prevent-overflows-when-allocating-memory-for-ar.patch	Upstream hardening (calloc for arrays).
SOURCES/0637-fs-bfs-Disable-under-lockdown.patch	Upstream hardening (disable BFS under lockdown).
SOURCES/0636-commands-hexdump-Disable-memory-reading-in-lockdown-.patch	Upstream hardening (lockdown restrict hexdump).
SOURCES/0635-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch	Upstream hardening (lockdown restrict memrw reads).
SOURCES/0634-commands-minicmd-Block-the-dump-command-in-lockdown-.patch	Upstream hardening (lockdown restrict dump).
SOURCES/0633-commands-test-Stack-overflow-due-to-unlimited-recurs.patch	Upstream hardening (limit recursion depth).
SOURCES/0632-commands-read-Fix-an-integer-overflow-when-supplying.patch	Upstream fix (read input overflow protection).
SOURCES/0631-gettext-Integer-overflow-leads-to-heap-OOB-write.patch	Upstream fix (gettext alloc overflow).
SOURCES/0630-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch	Upstream fix (gettext calloc sizing).
SOURCES/0629-gettext-Remove-variables-hooks-on-module-unload.patch	Upstream fix (unregister gettext hooks).
SOURCES/0628-normal-Remove-variables-hooks-on-module-unload.patch	Upstream fix (unregister normal hooks).
SOURCES/0627-commands-pgp-Unregister-the-check_signatures-hooks-o.patch	Upstream fix (unregister check_signatures).
SOURCES/0626-commands-ls-Fix-NULL-dereference.patch	Upstream fix (ls NULL deref).
SOURCES/0625-commands-extcmd-Missing-check-for-failed-allocation.patch	Upstream fix (extcmd state NULL check).
SOURCES/0624-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch	Upstream fix (ELF relocation section validation).
SOURCES/0623-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch	Upstream fix (module refcount overflow/underflow).
SOURCES/0622-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch	Upstream hardening (JPEG duplicate SOF0).
SOURCES/0621-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch	Upstream fix (tftp filename bounds).
SOURCES/0620-net-Fix-OOB-write-in-grub_net_search_config_file.patch	Upstream fix (net config buffer bounds).
SOURCES/0619-net-Remove-variables-hooks-when-interface-is-unregis.patch	Upstream fix (unregister net iface hooks).
SOURCES/0618-net-Unregister-net_default_ip-and-net_default_mac-va.patch	Upstream fix (unregister net default hooks).
SOURCES/0617-script-execute-Limit-the-recursion-depth.patch	Upstream hardening (limit script recursion).
SOURCES/0616-kern-partition-Limit-recursion-in-part_iterate.patch	Upstream hardening (partition recursion cap).
SOURCES/0615-kern-disk-Limit-recursion-depth.patch	Upstream hardening (disk read recursion cap + new err).
SOURCES/0614-disk-loopback-Reference-tracking-for-the-loopback.patch	Upstream fix (loopback refcount).
SOURCES/0612-kern-file-Ensure-file-data-is-set.patch	Upstream fix (ensure file->data set to avoid ref issues).
SOURCES/0611-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch	Upstream fix (XFS mount failure sets errno).
SOURCES/0610-fs-xfs-Fix-out-of-bounds-read.patch	Upstream hardening (XFS root key bounds).
SOURCES/0607-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch	Upstream hardening (NTFS attr buffer end tracking).
SOURCES/0606-fs-ntfs-Fix-out-of-bounds-read.patch	Upstream hardening (NTFS attr list end bounds).
SOURCES/0605-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch	Upstream hardening (ext2 inline extents cap).
SOURCES/0604-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch	Upstream fix (JFS types + error reporting).
SOURCES/0603-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch	Upstream fix (JFS 40-bit extent offsets).
SOURCES/0602-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch	Upstream hardening (JFS dir slot index validation).
SOURCES/0601-fs-jfs-Fix-OOB-read-in-jfs_getent.patch	Upstream hardening (JFS inline dir entry count cap).
SOURCES/0600-fs-iso9660-Fix-invalid-free.patch	Upstream fix (iso9660 filename alloc tracking).
SOURCES/0599-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch	Upstream fix (iso9660 sets errno on fail).
SOURCES/0598-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch	Upstream fix (hfsplus sets errno on fail).
SOURCES/0597-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch	Upstream fix (f2fs sets errno on fail).
SOURCES/0596-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch	Upstream hardening (tar alloc overflow checks).
SOURCES/0595-fs-tar-Initialize-name-in-grub_cpio_find_file.patch	Upstream fix (tar name initialization).
SOURCES/0594-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch	Upstream fix (hfs bounded copy).
SOURCES/0593-fs-ufs-Fix-a-heap-OOB-write.patch	Upstream fix (ufs bounded copy).
SOURCES/0592-misc-Implement-grub_strlcpy.patch	Upstream addition (grub_strlcpy implementation).
SOURCES/0591-grub-mkconfig.in-turn-off-executable-owner-bit.patch	Upstream fix (grub.cfg umask/permissions).
SOURCES/0589-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch	Upstream hardening (NTFS label bounds).
SOURCES/0588-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch	Upstream hardening (NTFS bitmap bounds).
SOURCES/0587-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch	Upstream hardening (NTFS index entry bounds).
SOURCES/0586-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch	Upstream hardening (NTFS resident data bounds).
SOURCES/0585-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch	Upstream hardening (NTFS attribute-list bounds).
SOURCES/0584-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch	Upstream behavior tweak (non-root exit).
SOURCES/0581-util-Enable-default-kernel-for-updates.patch	Upstream behavior change (DEFAULTKERNEL support).
SOURCES/0579-Regenerate-kernelopts-if-missing-on-ppc.patch	Upstream behavior tweak (kernelopts fallback on PPC).
.grub2.metadata	Update source metadata entries.
.grub2.checksum	Change checksum marker for direct import flow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.