ciq EL8 sbat 5 - #3
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the EL8 GRUB2 source package to incorporate a large set of upstream security/stability fixes (as patch files), and adds CIQ-specific Secure Boot integration changes (SBAT bump, shim dependency, signing macro overrides, and grub.cfg handling tweaks for EFI/BLS flows).
Changes:
- Bump SBAT generation for
gruband add CIQ Secure Boot packaging integration (shim dependency + CIQ sbsign/pesign overrides + cert sources). - Adjust kernel-install hooks to better handle BLS vs traditional grub.cfg generation and to target the correct grub.cfg path on EFI systems.
- Import a broad set of upstream GRUB patches (memory-safety, overflow/underflow, lockdown hardening, filesystem parsing fixes, and related CVE fixes).
Reviewed changes
Copilot reviewed 114 out of 120 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| SOURCES/sbat.csv.in | Bump grub SBAT generation. |
| SOURCES/grub.macros | CIQ shim dependency + grub.cfg creation/permission changes. |
| SOURCES/ciq_sbsign.macros | Add CIQ override macros for pesign/sbsign and SB cert/key selection. |
| SOURCES/ciq_sb_grub2_aarch64.crt | Add CIQ aarch64 Secure Boot certificate. |
| SOURCES/99-grub-mkconfig.install | Change when/where to regenerate grub.cfg during kernel installs. |
| SOURCES/20-grub.install | BLS fragment generation and default-kernel selection logic updates. |
| SOURCES/0683-gettext-gettext-Unregister-gettext-command-on-module.patch | Upstream fix (gettext command unregister on unload). |
| SOURCES/0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch | Upstream fix (cryptodisk sector offset calculation). |
| SOURCES/0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch | Upstream fix (hostdisk sector sizing via sysfs). |
| SOURCES/0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch | Upstream fix (blocklist end-of-disk addressing). |
| SOURCES/0678-Strip-correctly-BLS-files-with-conf-extension.patch | Upstream fix (BLS .conf name stripping). |
| SOURCES/0677-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch | Upstream fix (ext2 extent parsing bounds). |
| SOURCES/0676-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch | Upstream fix (XFS nrext64 nextents handling). |
| SOURCES/0675-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch | Upstream fix (XFS dir extents with holes). |
| SOURCES/0674-fs-xfs-Add-large-extent-counters-incompat-feature-su.patch | Upstream feature/fix (XFS large extent counters). |
| SOURCES/0672-fs-xfs-Incorrect-short-form-directory-data-boundary-.patch | Upstream fix (XFS shortform dir bounds). |
| SOURCES/0671-fs-xfs-Fix-memory-leaks-in-XFS-module.patch | Upstream fix (XFS memory leaks). |
| SOURCES/0669-fs-xfs-Fix-unreadable-filesystem-with-v4-superblock.patch | Upstream fix (XFS v4 superblock inode sizing). |
| SOURCES/0668-fs-xfs-Add-needsrepair-incompat-feature-support.patch | Upstream feature/fix (XFS needsrepair incompat). |
| SOURCES/0666-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch | Upstream fix (restore missing allocation). |
| SOURCES/0665-fs-xfs-Fix-issues-found-while-fuzzing-the-XFS-filesy.patch | Upstream hardening (XFS fuzz fixes / size tracking). |
| SOURCES/0664-Remove-exttra-bool-definitions.patch | Upstream cleanup (remove redundant bool defs). |
| SOURCES/0663-types-Make-bool-generally-available.patch | Upstream change (include stdbool.h + rename union member). |
| SOURCES/0662-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch | Upstream fix (BSD loader underflow). |
| SOURCES/0661-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch | Upstream fix (shift overflow avoidance). |
| SOURCES/0660-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch | Upstream fix (printf positional arg validation). |
| SOURCES/0659-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch | Upstream fix (partition number validation). |
| SOURCES/0658-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch | Upstream fix (menu index overflow). |
| SOURCES/0657-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch | Upstream fix (type-correct EHCI toggle). |
| SOURCES/0656-misc-Ensure-consistent-overflow-error-messages.patch | Upstream cleanup (error message consistency). |
| SOURCES/0655-osdep-unix-getroot-Fix-potential-underflow.patch | Upstream fix (mountinfo parsing underflow). |
| SOURCES/0654-script-execute-Fix-potential-underflow-and-NULL-dere.patch | Upstream fix (arglist underflow/NULL). |
| SOURCES/0653-fs-sfs-Check-if-allocated-memory-is-NULL.patch | Upstream fix (OOM handling). |
| SOURCES/0652-net-Check-if-returned-pointer-for-allocated-memory-i.patch | Upstream fix (OOM handling). |
| SOURCES/0651-net-Prevent-overflows-when-allocating-memory-for-arr.patch | Upstream hardening (calloc for arrays). |
| SOURCES/0649-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch | Upstream fix (NULL check). |
| SOURCES/0648-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch | Upstream fix (OOM handling). |
| SOURCES/0647-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch | Upstream hardening (calloc for arrays). |
| SOURCES/0645-fs-Prevent-overflows-when-assigning-returned-values-.patch | Upstream hardening (cast checks for read_number()). |
| SOURCES/0644-fs-Prevent-overflows-when-allocating-memory-for-arra.patch | Upstream hardening (calloc for arrays + bounds notes). |
| SOURCES/0642-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch | Upstream fix (close handle on OOM). |
| SOURCES/0641-disk-Check-if-returned-pointer-for-allocated-memory-.patch | Upstream fix (OOM checks across disk code). |
| SOURCES/0640-disk-Prevent-overflows-when-allocating-memory-for-ar.patch | Upstream hardening (calloc for arrays). |
| SOURCES/0637-fs-bfs-Disable-under-lockdown.patch | Upstream hardening (disable BFS under lockdown). |
| SOURCES/0636-commands-hexdump-Disable-memory-reading-in-lockdown-.patch | Upstream hardening (lockdown restrict hexdump). |
| SOURCES/0635-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch | Upstream hardening (lockdown restrict memrw reads). |
| SOURCES/0634-commands-minicmd-Block-the-dump-command-in-lockdown-.patch | Upstream hardening (lockdown restrict dump). |
| SOURCES/0633-commands-test-Stack-overflow-due-to-unlimited-recurs.patch | Upstream hardening (limit recursion depth). |
| SOURCES/0632-commands-read-Fix-an-integer-overflow-when-supplying.patch | Upstream fix (read input overflow protection). |
| SOURCES/0631-gettext-Integer-overflow-leads-to-heap-OOB-write.patch | Upstream fix (gettext alloc overflow). |
| SOURCES/0630-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch | Upstream fix (gettext calloc sizing). |
| SOURCES/0629-gettext-Remove-variables-hooks-on-module-unload.patch | Upstream fix (unregister gettext hooks). |
| SOURCES/0628-normal-Remove-variables-hooks-on-module-unload.patch | Upstream fix (unregister normal hooks). |
| SOURCES/0627-commands-pgp-Unregister-the-check_signatures-hooks-o.patch | Upstream fix (unregister check_signatures). |
| SOURCES/0626-commands-ls-Fix-NULL-dereference.patch | Upstream fix (ls NULL deref). |
| SOURCES/0625-commands-extcmd-Missing-check-for-failed-allocation.patch | Upstream fix (extcmd state NULL check). |
| SOURCES/0624-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch | Upstream fix (ELF relocation section validation). |
| SOURCES/0623-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch | Upstream fix (module refcount overflow/underflow). |
| SOURCES/0622-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch | Upstream hardening (JPEG duplicate SOF0). |
| SOURCES/0621-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch | Upstream fix (tftp filename bounds). |
| SOURCES/0620-net-Fix-OOB-write-in-grub_net_search_config_file.patch | Upstream fix (net config buffer bounds). |
| SOURCES/0619-net-Remove-variables-hooks-when-interface-is-unregis.patch | Upstream fix (unregister net iface hooks). |
| SOURCES/0618-net-Unregister-net_default_ip-and-net_default_mac-va.patch | Upstream fix (unregister net default hooks). |
| SOURCES/0617-script-execute-Limit-the-recursion-depth.patch | Upstream hardening (limit script recursion). |
| SOURCES/0616-kern-partition-Limit-recursion-in-part_iterate.patch | Upstream hardening (partition recursion cap). |
| SOURCES/0615-kern-disk-Limit-recursion-depth.patch | Upstream hardening (disk read recursion cap + new err). |
| SOURCES/0614-disk-loopback-Reference-tracking-for-the-loopback.patch | Upstream fix (loopback refcount). |
| SOURCES/0612-kern-file-Ensure-file-data-is-set.patch | Upstream fix (ensure file->data set to avoid ref issues). |
| SOURCES/0611-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch | Upstream fix (XFS mount failure sets errno). |
| SOURCES/0610-fs-xfs-Fix-out-of-bounds-read.patch | Upstream hardening (XFS root key bounds). |
| SOURCES/0607-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch | Upstream hardening (NTFS attr buffer end tracking). |
| SOURCES/0606-fs-ntfs-Fix-out-of-bounds-read.patch | Upstream hardening (NTFS attr list end bounds). |
| SOURCES/0605-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch | Upstream hardening (ext2 inline extents cap). |
| SOURCES/0604-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch | Upstream fix (JFS types + error reporting). |
| SOURCES/0603-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch | Upstream fix (JFS 40-bit extent offsets). |
| SOURCES/0602-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch | Upstream hardening (JFS dir slot index validation). |
| SOURCES/0601-fs-jfs-Fix-OOB-read-in-jfs_getent.patch | Upstream hardening (JFS inline dir entry count cap). |
| SOURCES/0600-fs-iso9660-Fix-invalid-free.patch | Upstream fix (iso9660 filename alloc tracking). |
| SOURCES/0599-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch | Upstream fix (iso9660 sets errno on fail). |
| SOURCES/0598-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch | Upstream fix (hfsplus sets errno on fail). |
| SOURCES/0597-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch | Upstream fix (f2fs sets errno on fail). |
| SOURCES/0596-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch | Upstream hardening (tar alloc overflow checks). |
| SOURCES/0595-fs-tar-Initialize-name-in-grub_cpio_find_file.patch | Upstream fix (tar name initialization). |
| SOURCES/0594-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch | Upstream fix (hfs bounded copy). |
| SOURCES/0593-fs-ufs-Fix-a-heap-OOB-write.patch | Upstream fix (ufs bounded copy). |
| SOURCES/0592-misc-Implement-grub_strlcpy.patch | Upstream addition (grub_strlcpy implementation). |
| SOURCES/0591-grub-mkconfig.in-turn-off-executable-owner-bit.patch | Upstream fix (grub.cfg umask/permissions). |
| SOURCES/0589-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch | Upstream hardening (NTFS label bounds). |
| SOURCES/0588-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch | Upstream hardening (NTFS bitmap bounds). |
| SOURCES/0587-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch | Upstream hardening (NTFS index entry bounds). |
| SOURCES/0586-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch | Upstream hardening (NTFS resident data bounds). |
| SOURCES/0585-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch | Upstream hardening (NTFS attribute-list bounds). |
| SOURCES/0584-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch | Upstream behavior tweak (non-root exit). |
| SOURCES/0581-util-Enable-default-kernel-for-updates.patch | Upstream behavior change (DEFAULTKERNEL support). |
| SOURCES/0579-Regenerate-kernelopts-if-missing-on-ppc.patch | Upstream behavior tweak (kernelopts fallback on PPC). |
| .grub2.metadata | Update source metadata entries. |
| .grub2.checksum | Change checksum marker for direct import flow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+11
to
25
| # Assume GRUB_ENABLE_BLSCFG is true if | ||
| # GRUB_ENABLE_BLSCFG is not set, e.g. /etc/default/grub does not exist | ||
| # GRUB_ENABLE_BLSCFG is set to true | ||
| if [[ x$GRUB_ENABLE_BLSCFG != xfalse ]]; then | ||
| # Can't assume a BLS capable bootloader on ppc64 | ||
| if [[ $ARCH = "ppc64" || $ARCH = "ppc64le" ]]; then | ||
| RUN_MKCONFIG="true" | ||
| fi | ||
| fi | ||
|
|
||
| # A traditional grub configuration file needs to be generated only in the case when | ||
| # the bootloaders are not capable of populating a menu entry from the BLS fragments. | ||
| if [[ $RUN_MKCONFIG != "true" ]]; then | ||
| exit 0 | ||
| fi |
Comment on lines
+594
to
+595
| touch grub.cfg \ | ||
| install -m 0600 grub.cfg ${RPM_BUILD_ROOT}/boot/%{name}/ \ |
thefossguy-ciq
approved these changes
Jun 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.