1 |
commit: bb354734b6b31239b78614a28f0ebd94affeb6d2 |
2 |
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org> |
3 |
AuthorDate: Tue Dec 15 18:29:54 2015 +0000 |
4 |
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org> |
5 |
CommitDate: Tue Dec 15 18:30:33 2015 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bb354734 |
7 |
|
8 |
sys-boot/grub: Security bump for CVE-2015-8370 |
9 |
|
10 |
Bug: https://bugs.gentoo.org/568326 |
11 |
|
12 |
Package-Manager: portage-2.2.26_p32 |
13 |
|
14 |
sys-boot/grub/files/CVE-2015-8370.patch | 45 +++++ |
15 |
sys-boot/grub/grub-2.02_beta2-r8.ebuild | 313 ++++++++++++++++++++++++++++++++ |
16 |
2 files changed, 358 insertions(+) |
17 |
|
18 |
diff --git a/sys-boot/grub/files/CVE-2015-8370.patch b/sys-boot/grub/files/CVE-2015-8370.patch |
19 |
new file mode 100644 |
20 |
index 0000000..5701b54 |
21 |
--- /dev/null |
22 |
+++ b/sys-boot/grub/files/CVE-2015-8370.patch |
23 |
@@ -0,0 +1,45 @@ |
24 |
+From 88c9657960a6c5d3673a25c266781e876c181add Mon Sep 17 00:00:00 2001 |
25 |
+From: Hector Marco-Gisbert <hecmargi@×××.es> |
26 |
+Date: Fri, 13 Nov 2015 16:21:09 +0100 |
27 |
+Subject: [PATCH] Fix security issue when reading username and password |
28 |
+ |
29 |
+ This patch fixes two integer underflows at: |
30 |
+ * grub-core/lib/crypto.c |
31 |
+ * grub-core/normal/auth.c |
32 |
+ |
33 |
+Signed-off-by: Hector Marco-Gisbert <hecmargi@×××.es> |
34 |
+Signed-off-by: Ismael Ripoll-Ripoll <iripoll@×××××××××.es> |
35 |
+--- |
36 |
+ grub-core/lib/crypto.c | 2 +- |
37 |
+ grub-core/normal/auth.c | 2 +- |
38 |
+ 2 files changed, 2 insertions(+), 2 deletions(-) |
39 |
+ |
40 |
+diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c |
41 |
+index 010e550..524a3d8 100644 |
42 |
+--- a/grub-core/lib/crypto.c |
43 |
++++ b/grub-core/lib/crypto.c |
44 |
+@@ -468,7 +468,7 @@ grub_password_get (char buf[], unsigned buf_size) |
45 |
+ break; |
46 |
+ } |
47 |
+ |
48 |
+- if (key == '\b') |
49 |
++ if (key == '\b' && cur_len) |
50 |
+ { |
51 |
+ cur_len--; |
52 |
+ continue; |
53 |
+diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c |
54 |
+index c6bd96e..5782ec5 100644 |
55 |
+--- a/grub-core/normal/auth.c |
56 |
++++ b/grub-core/normal/auth.c |
57 |
+@@ -172,7 +172,7 @@ grub_username_get (char buf[], unsigned buf_size) |
58 |
+ break; |
59 |
+ } |
60 |
+ |
61 |
+- if (key == '\b') |
62 |
++ if (key == '\b' && cur_len) |
63 |
+ { |
64 |
+ cur_len--; |
65 |
+ grub_printf ("\b"); |
66 |
+-- |
67 |
+1.9.1 |
68 |
+ |
69 |
|
70 |
diff --git a/sys-boot/grub/grub-2.02_beta2-r8.ebuild b/sys-boot/grub/grub-2.02_beta2-r8.ebuild |
71 |
new file mode 100644 |
72 |
index 0000000..c617cab |
73 |
--- /dev/null |
74 |
+++ b/sys-boot/grub/grub-2.02_beta2-r8.ebuild |
75 |
@@ -0,0 +1,313 @@ |
76 |
+# Copyright 1999-2015 Gentoo Foundation |
77 |
+# Distributed under the terms of the GNU General Public License v2 |
78 |
+# $Id$ |
79 |
+ |
80 |
+EAPI=5 |
81 |
+ |
82 |
+AUTOTOOLS_AUTORECONF=1 |
83 |
+GRUB_AUTOGEN=1 |
84 |
+ |
85 |
+if [[ -n ${GRUB_AUTOGEN} ]]; then |
86 |
+ PYTHON_COMPAT=( python{2_7,3_3,3_4} ) |
87 |
+ inherit python-any-r1 |
88 |
+fi |
89 |
+ |
90 |
+inherit autotools-utils bash-completion-r1 eutils flag-o-matic mount-boot multibuild pax-utils toolchain-funcs versionator |
91 |
+ |
92 |
+if [[ ${PV} != 9999 ]]; then |
93 |
+ if [[ ${PV} == *_alpha* || ${PV} == *_beta* || ${PV} == *_rc* ]]; then |
94 |
+ # The quote style is to work with <=bash-4.2 and >=bash-4.3 #503860 |
95 |
+ MY_P=${P/_/'~'} |
96 |
+ SRC_URI="mirror://gnu-alpha/${PN}/${MY_P}.tar.xz |
97 |
+ https://dev.gentoo.org/~floppym/dist/${P}-gentoo-r3.tar.xz" |
98 |
+ S=${WORKDIR}/${MY_P} |
99 |
+ else |
100 |
+ SRC_URI="mirror://gnu/${PN}/${P}.tar.xz |
101 |
+ https://dev.gentoo.org/~floppym/dist/${P}.tar.xz" |
102 |
+ S=${WORKDIR}/${P%_*} |
103 |
+ fi |
104 |
+ KEYWORDS="~amd64 ~x86" |
105 |
+else |
106 |
+ inherit git-r3 |
107 |
+ EGIT_REPO_URI="git://git.sv.gnu.org/grub.git |
108 |
+ http://git.savannah.gnu.org/r/grub.git" |
109 |
+fi |
110 |
+ |
111 |
+DEJAVU=dejavu-sans-ttf-2.34 |
112 |
+UNIFONT=unifont-7.0.06 |
113 |
+SRC_URI+=" fonts? ( mirror://gnu/unifont/${UNIFONT}/${UNIFONT}.pcf.gz ) |
114 |
+ themes? ( mirror://sourceforge/dejavu/${DEJAVU}.zip )" |
115 |
+ |
116 |
+DESCRIPTION="GNU GRUB boot loader" |
117 |
+HOMEPAGE="https://www.gnu.org/software/grub/" |
118 |
+ |
119 |
+# Includes licenses for dejavu and unifont |
120 |
+LICENSE="GPL-3 fonts? ( GPL-2-with-font-exception ) themes? ( BitstreamVera )" |
121 |
+SLOT="2" |
122 |
+IUSE="debug device-mapper doc efiemu +fonts mount +multislot nls static sdl test +themes truetype libzfs" |
123 |
+ |
124 |
+GRUB_ALL_PLATFORMS=( coreboot efi-32 efi-64 emu ieee1275 loongson multiboot qemu qemu-mips pc uboot xen ) |
125 |
+IUSE+=" ${GRUB_ALL_PLATFORMS[@]/#/grub_platforms_}" |
126 |
+ |
127 |
+REQUIRED_USE=" |
128 |
+ grub_platforms_coreboot? ( fonts ) |
129 |
+ grub_platforms_qemu? ( fonts ) |
130 |
+ grub_platforms_ieee1275? ( fonts ) |
131 |
+ grub_platforms_loongson? ( fonts ) |
132 |
+" |
133 |
+ |
134 |
+# os-prober: Used on runtime to detect other OSes |
135 |
+# xorriso (dev-libs/libisoburn): Used on runtime for mkrescue |
136 |
+RDEPEND=" |
137 |
+ app-arch/xz-utils |
138 |
+ >=sys-libs/ncurses-5.2-r5:0= |
139 |
+ debug? ( |
140 |
+ sdl? ( media-libs/libsdl ) |
141 |
+ ) |
142 |
+ device-mapper? ( >=sys-fs/lvm2-2.02.45 ) |
143 |
+ libzfs? ( sys-fs/zfs ) |
144 |
+ mount? ( sys-fs/fuse ) |
145 |
+ truetype? ( media-libs/freetype:2= ) |
146 |
+ ppc? ( sys-apps/ibm-powerpc-utils sys-apps/powerpc-utils ) |
147 |
+ ppc64? ( sys-apps/ibm-powerpc-utils sys-apps/powerpc-utils ) |
148 |
+" |
149 |
+DEPEND="${RDEPEND} |
150 |
+ ${PYTHON_DEPS} |
151 |
+ app-misc/pax-utils |
152 |
+ sys-devel/flex |
153 |
+ sys-devel/bison |
154 |
+ sys-apps/help2man |
155 |
+ sys-apps/texinfo |
156 |
+ fonts? ( media-libs/freetype:2 ) |
157 |
+ grub_platforms_xen? ( app-emulation/xen-tools:= ) |
158 |
+ static? ( |
159 |
+ app-arch/xz-utils[static-libs(+)] |
160 |
+ truetype? ( |
161 |
+ app-arch/bzip2[static-libs(+)] |
162 |
+ media-libs/freetype[static-libs(+)] |
163 |
+ sys-libs/zlib[static-libs(+)] |
164 |
+ ) |
165 |
+ ) |
166 |
+ test? ( |
167 |
+ dev-libs/libisoburn |
168 |
+ app-emulation/qemu |
169 |
+ ) |
170 |
+ themes? ( |
171 |
+ app-arch/unzip |
172 |
+ media-libs/freetype:2 |
173 |
+ ) |
174 |
+" |
175 |
+RDEPEND+=" |
176 |
+ kernel_linux? ( |
177 |
+ grub_platforms_efi-32? ( sys-boot/efibootmgr ) |
178 |
+ grub_platforms_efi-64? ( sys-boot/efibootmgr ) |
179 |
+ ) |
180 |
+ !multislot? ( !sys-boot/grub:0 ) |
181 |
+ nls? ( sys-devel/gettext ) |
182 |
+" |
183 |
+ |
184 |
+DEPEND+=" !!=media-libs/freetype-2.5.4" |
185 |
+ |
186 |
+STRIP_MASK="*/grub/*/*.{mod,img}" |
187 |
+RESTRICT="test" |
188 |
+ |
189 |
+QA_EXECSTACK=" |
190 |
+ usr/bin/grub*-emu* |
191 |
+ usr/lib*/grub/*/*.mod |
192 |
+ usr/lib*/grub/*/*.module |
193 |
+ usr/lib*/grub/*/kernel.exec |
194 |
+ usr/lib*/grub/*/kernel.img |
195 |
+" |
196 |
+ |
197 |
+QA_WX_LOAD=" |
198 |
+ usr/lib*/grub/*/kernel.exec |
199 |
+ usr/lib*/grub/*/kernel.img |
200 |
+ usr/lib*/grub/*/*.image |
201 |
+" |
202 |
+ |
203 |
+QA_PRESTRIPPED=" |
204 |
+ usr/lib.*/grub/.*/kernel.img |
205 |
+" |
206 |
+ |
207 |
+src_unpack() { |
208 |
+ if [[ ${PV} == 9999 ]]; then |
209 |
+ git-r3_src_unpack |
210 |
+ fi |
211 |
+ default_src_unpack |
212 |
+} |
213 |
+ |
214 |
+src_prepare() { |
215 |
+ EPATCH_SUFFIX="patch" EPATCH_FORCE="yes" epatch |
216 |
+ |
217 |
+ epatch "${FILESDIR}"/CVE-2015-8370.patch |
218 |
+ |
219 |
+ sed -i -e /autoreconf/d autogen.sh || die |
220 |
+ |
221 |
+ if use multislot; then |
222 |
+ # fix texinfo file name, bug 416035 |
223 |
+ sed -i -e 's/^\* GRUB:/* GRUB2:/' -e 's/(grub)/(grub2)/' docs/grub.texi || die |
224 |
+ fi |
225 |
+ |
226 |
+ epatch_user |
227 |
+ |
228 |
+ if [[ -n ${GRUB_AUTOGEN} ]]; then |
229 |
+ python_setup |
230 |
+ bash autogen.sh || die |
231 |
+ fi |
232 |
+ |
233 |
+ if [[ -n ${AUTOTOOLS_AUTORECONF} ]]; then |
234 |
+ autopoint() { return 0; } |
235 |
+ eautoreconf |
236 |
+ fi |
237 |
+} |
238 |
+ |
239 |
+setup_fonts() { |
240 |
+ ln -s "${WORKDIR}/${UNIFONT}.pcf" unifont.pcf || die |
241 |
+ if use themes; then |
242 |
+ ln -s "${WORKDIR}/${DEJAVU}/ttf/DejaVuSans.ttf" DejaVuSans.ttf || die |
243 |
+ fi |
244 |
+} |
245 |
+ |
246 |
+grub_configure() { |
247 |
+ local platform |
248 |
+ |
249 |
+ case ${MULTIBUILD_VARIANT} in |
250 |
+ efi-32) |
251 |
+ platform=efi |
252 |
+ if [[ ${CTARGET:-${CHOST}} == x86_64* ]]; then |
253 |
+ local CTARGET=${CTARGET:-i386} |
254 |
+ fi ;; |
255 |
+ efi-64) |
256 |
+ platform=efi |
257 |
+ if [[ ${CTARGET:-${CHOST}} == i?86* ]]; then |
258 |
+ local CTARGET=${CTARGET:-x86_64} |
259 |
+ local TARGET_CFLAGS="-Os -march=x86-64 ${TARGET_CFLAGS}" |
260 |
+ local TARGET_CPPFLAGS="-march=x86-64 ${TARGET_CPPFLAGS}" |
261 |
+ export TARGET_CFLAGS TARGET_CPPFLAGS |
262 |
+ fi ;; |
263 |
+ guessed) ;; |
264 |
+ *) platform=${MULTIBUILD_VARIANT} ;; |
265 |
+ esac |
266 |
+ |
267 |
+ local myeconfargs=( |
268 |
+ --disable-werror |
269 |
+ --program-prefix= |
270 |
+ --libdir="${EPREFIX}"/usr/lib |
271 |
+ --htmldir="${EPREFIX}"/usr/share/doc/${PF}/html |
272 |
+ $(use_enable debug mm-debug) |
273 |
+ $(use_enable debug grub-emu-usb) |
274 |
+ $(use_enable device-mapper) |
275 |
+ $(use_enable mount grub-mount) |
276 |
+ $(use_enable nls) |
277 |
+ $(use_enable themes grub-themes) |
278 |
+ $(use_enable truetype grub-mkfont) |
279 |
+ $(use_enable libzfs) |
280 |
+ $(use sdl && use_enable debug grub-emu-sdl) |
281 |
+ ${platform:+--with-platform=}${platform} |
282 |
+ |
283 |
+ # Let configure detect this where supported |
284 |
+ $(usex efiemu '' '--disable-efiemu') |
285 |
+ ) |
286 |
+ |
287 |
+ if use multislot; then |
288 |
+ myeconfargs+=( --program-transform-name="s,grub,grub2," ) |
289 |
+ fi |
290 |
+ |
291 |
+ mkdir -p "${BUILD_DIR}" || die |
292 |
+ run_in_build_dir setup_fonts |
293 |
+ |
294 |
+ autotools-utils_src_configure |
295 |
+} |
296 |
+ |
297 |
+src_configure() { |
298 |
+ # Bug 508758. |
299 |
+ replace-flags -O3 -O2 |
300 |
+ |
301 |
+ # We don't want to leak flags onto boot code. |
302 |
+ export HOST_CCASFLAGS=${CCASFLAGS} |
303 |
+ export HOST_CFLAGS=${CFLAGS} |
304 |
+ export HOST_CPPFLAGS=${CPPFLAGS} |
305 |
+ export HOST_LDFLAGS=${LDFLAGS} |
306 |
+ unset CCASFLAGS CFLAGS CPPFLAGS LDFLAGS |
307 |
+ |
308 |
+ use static && HOST_LDFLAGS+=" -static" |
309 |
+ |
310 |
+ tc-ld-disable-gold #439082 #466536 #526348 |
311 |
+ export TARGET_LDFLAGS="${TARGET_LDFLAGS} ${LDFLAGS}" |
312 |
+ unset LDFLAGS |
313 |
+ |
314 |
+ tc-export CC NM OBJCOPY RANLIB STRIP |
315 |
+ tc-export BUILD_CC # Bug 485592 |
316 |
+ |
317 |
+ # Portage will take care of cleaning up GRUB_PLATFORMS |
318 |
+ MULTIBUILD_VARIANTS=( ${GRUB_PLATFORMS:-guessed} ) |
319 |
+ multibuild_parallel_foreach_variant grub_configure |
320 |
+} |
321 |
+ |
322 |
+src_compile() { |
323 |
+ # Sandbox bug 404013. |
324 |
+ use libzfs && addpredict /etc/dfs:/dev/zfs |
325 |
+ |
326 |
+ multibuild_foreach_variant autotools-utils_src_compile |
327 |
+ |
328 |
+ use doc && multibuild_for_best_variant \ |
329 |
+ autotools-utils_src_compile -C docs html |
330 |
+} |
331 |
+ |
332 |
+src_test() { |
333 |
+ # The qemu dependency is a bit complex. |
334 |
+ # You will need to adjust QEMU_SOFTMMU_TARGETS to match the cpu/platform. |
335 |
+ multibuild_foreach_variant autotools-utils_src_test |
336 |
+} |
337 |
+ |
338 |
+src_install() { |
339 |
+ multibuild_foreach_variant autotools-utils_src_install \ |
340 |
+ bashcompletiondir="$(get_bashcompdir)" |
341 |
+ |
342 |
+ local grub=grub |
343 |
+ if use multislot; then |
344 |
+ grub=grub2 |
345 |
+ mv "${ED%/}"/usr/share/info/grub{,2}.info || die |
346 |
+ mv "${ED%/}"/$(get_bashcompdir)/grub{,2} || die |
347 |
+ fi |
348 |
+ |
349 |
+ bashcomp_alias ${grub} ${grub}-{install,set-default,mkrescue,reboot,script-check,editenv,sparc64-setup,mkfont,mkpasswd-pbkdf2,mkimage,bios-setup,mkconfig,probe} |
350 |
+ |
351 |
+ use doc && multibuild_for_best_variant run_in_build_dir \ |
352 |
+ emake -C docs DESTDIR="${D}" install-html |
353 |
+ |
354 |
+ insinto /etc/default |
355 |
+ newins "${FILESDIR}"/grub.default-3 grub |
356 |
+} |
357 |
+ |
358 |
+pkg_postinst() { |
359 |
+ mount-boot_mount_boot_partition |
360 |
+ |
361 |
+ if [[ -e "${ROOT%/}/boot/grub2/grub.cfg" ]]; then |
362 |
+ ewarn "The grub directory has changed from /boot/grub2 to /boot/grub." |
363 |
+ ewarn "Please run grub2-install and grub2-mkconfig -o /boot/grub/grub.cfg." |
364 |
+ |
365 |
+ if [[ ! -e "${ROOT%/}/boot/grub/grub.cfg" ]]; then |
366 |
+ mkdir -p "${ROOT%/}/boot/grub" |
367 |
+ ln -s ../grub2/grub.cfg "${ROOT%/}/boot/grub/grub.cfg" |
368 |
+ fi |
369 |
+ fi |
370 |
+ |
371 |
+ mount-boot_pkg_postinst |
372 |
+ |
373 |
+ elog "For information on how to configure GRUB2 please refer to the guide:" |
374 |
+ elog " https://wiki.gentoo.org/wiki/GRUB2_Quick_Start" |
375 |
+ |
376 |
+ if has_version 'sys-boot/grub:0'; then |
377 |
+ elog "A migration guide for GRUB Legacy users is available:" |
378 |
+ elog " https://wiki.gentoo.org/wiki/GRUB2_Migration" |
379 |
+ fi |
380 |
+ |
381 |
+ if [[ -z ${REPLACING_VERSIONS} ]]; then |
382 |
+ elog |
383 |
+ elog "You may consider installing the following optional packages:" |
384 |
+ optfeature "Detect other operating systems (grub-mkconfig)" sys-boot/os-prober |
385 |
+ optfeature "Create rescue media (grub-mkrescue)" dev-libs/libisoburn |
386 |
+ optfeature "Enable RAID device detection" sys-fs/mdadm |
387 |
+ fi |
388 |
+} |