1*4882a593SmuzhiyunFrom 58b77d4069823b44c5fa916fa8ddfc9c4cd51e02 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Javier Martinez Canillas <javierm@redhat.com> 3*4882a593SmuzhiyunDate: Wed, 24 Feb 2021 22:59:59 +0100 4*4882a593SmuzhiyunSubject: [PATCH] commands/setpci: Restrict setpci command when locked down 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunThis command can set PCI devices register values, which makes it dangerous 7*4882a593Smuzhiyunin a locked down configuration. Restrict it so can't be used on this setup. 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunSigned-off-by: Javier Martinez Canillas <javierm@redhat.com> 10*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 11*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 12*4882a593Smuzhiyun--- 13*4882a593Smuzhiyun grub-core/commands/setpci.c | 8 ++++---- 14*4882a593Smuzhiyun 1 file changed, 4 insertions(+), 4 deletions(-) 15*4882a593Smuzhiyun 16*4882a593Smuzhiyundiff --git a/grub-core/commands/setpci.c b/grub-core/commands/setpci.c 17*4882a593Smuzhiyunindex d5bc97d..fa2ba7d 100644 18*4882a593Smuzhiyun--- a/grub-core/commands/setpci.c 19*4882a593Smuzhiyun+++ b/grub-core/commands/setpci.c 20*4882a593Smuzhiyun@@ -329,10 +329,10 @@ static grub_extcmd_t cmd; 21*4882a593Smuzhiyun 22*4882a593Smuzhiyun GRUB_MOD_INIT(setpci) 23*4882a593Smuzhiyun { 24*4882a593Smuzhiyun- cmd = grub_register_extcmd ("setpci", grub_cmd_setpci, 0, 25*4882a593Smuzhiyun- N_("[-s POSITION] [-d DEVICE] [-v VAR] " 26*4882a593Smuzhiyun- "REGISTER[=VALUE[:MASK]]"), 27*4882a593Smuzhiyun- N_("Manipulate PCI devices."), options); 28*4882a593Smuzhiyun+ cmd = grub_register_extcmd_lockdown ("setpci", grub_cmd_setpci, 0, 29*4882a593Smuzhiyun+ N_("[-s POSITION] [-d DEVICE] [-v VAR] " 30*4882a593Smuzhiyun+ "REGISTER[=VALUE[:MASK]]"), 31*4882a593Smuzhiyun+ N_("Manipulate PCI devices."), options); 32*4882a593Smuzhiyun } 33*4882a593Smuzhiyun 34*4882a593Smuzhiyun GRUB_MOD_FINI(setpci) 35*4882a593Smuzhiyun-- 36*4882a593Smuzhiyun2.14.2 37*4882a593Smuzhiyun 38