Security update for keyboard input vulnerability.

- Fix security issue when reading username and password
  Related: CVE-2015-8370
- Do a better job of handling GRUB2_PASSWORD
  Related: rhbz#1284370

Signed-off-by: Peter Jones <pjones@redhat.com>

.gitignore

@@ -4,3 +4,5 @@ clog
 /unifont-5.1.20080820.pcf.gz
 /theme.tar.bz2
 kojilogs
+/grub-*/
+.build*.log

0069-Use-Distribution-Package-Sort-for-grub2-mkconfig-112.patch

@@ -1,4 +1,4 @@
-From 6656c53125c328613529a52b3dcdf479d49ec475 Mon Sep 17 00:00:00 2001
+From b9f953dc0a2297fab25b968dce4f7320d022c3e1 Mon Sep 17 00:00:00 2001
 From: Robert Marshall <rmarshall@redhat.com>
 Date: Mon, 16 Mar 2015 14:14:19 -0400
 Subject: [PATCH 69/74] Use Distribution Package Sort for grub2-mkconfig
@@ -10,24 +10,14 @@ starting with the most recent. Added an option for rpm-based systems to
 use the rpm-sort library to sort kernels instead.
 
 Resolves rhbz#1124074
-
-And then later we discovered that was wrong and did:
-
-Reverse rpmvercmp return value (#1229329)
-
-RPM sort was returning kernels sorted from oldest to newest
-instead of newest to oldest. Flipped the sign on the return
-value to switch the order.
-
-Resolves: rhbz#1229329
 ---
  .gitignore                |   1 +
  Makefile.util.def         |  16 +++
  configure.ac              |  29 +++++
- util/grub-mkconfig_lib.in |   8 +-
+ util/grub-mkconfig_lib.in |  11 +-
  util/grub-rpm-sort.8      |  12 ++
  util/grub-rpm-sort.c      | 281 ++++++++++++++++++++++++++++++++++++++++++++++
- 6 files changed, 346 insertions(+), 1 deletion(-)
+ 6 files changed, 349 insertions(+), 1 deletion(-)
  create mode 100644 util/grub-rpm-sort.8
  create mode 100644 util/grub-rpm-sort.c
 
@@ -71,7 +61,7 @@ index 591c5e5..f28d73d 100644
    name = grub-mkconfig;
    common = util/grub-mkconfig.in;
 diff --git a/configure.ac b/configure.ac
-index 357c94e..64791d1 100644
+index 357c94e..4f26f6c 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -65,6 +65,7 @@ grub_TRANSFORM([grub-mkrelpath])
@@ -97,7 +87,7 @@ index 357c94e..64791d1 100644
 +AC_ARG_ENABLE([rpm-sort],
 +              [AS_HELP_STRING([--enable-rpm-sort],
 +                              [enable native rpm sorting of kernels in grub (default=guessed)])])
-+if test x"$enable_rpm-sort" = xno ; then
++if test x"$enable_rpm_sort" = xno ; then
 +  rpm_sort_excuse="explicitly disabled"
 +fi
 +
@@ -125,23 +115,33 @@ index 357c94e..64791d1 100644
  if test x$host_kernel = xkfreebsd; then
    AC_CHECK_LIB([geom], [geom_gettree], [],
 diff --git a/util/grub-mkconfig_lib.in b/util/grub-mkconfig_lib.in
-index 10fabee..954844d 100644
+index 10fabee..9c410ea 100644
 --- a/util/grub-mkconfig_lib.in
 +++ b/util/grub-mkconfig_lib.in
-@@ -213,6 +213,12 @@ version_sort ()
+@@ -33,6 +33,9 @@ fi
+ if test "x$grub_mkrelpath" = x; then
+   grub_mkrelpath="${bindir}/@grub_mkrelpath@"
+ fi
++if test "x$grub_rpm_sort" = x; then
++  grub_rpm_sort="${sbindir}/@grub_rpm_sort@"
++fi
+ 
+ if which gettext >/dev/null 2>/dev/null; then
+   :
+@@ -213,6 +216,12 @@ version_sort ()
     esac
  }
  
-+if [ "x$RPMLIB" = x ]; then
-+  kernel_sort=version_sort
++if [ "x$grub_rpm_sort" != x -a -x "$grub_rpm_sort" ]; then
++  kernel_sort="$grub_rpm_sort"
 +else
-+  kernel_sort="${sbindir}/grub-rpm-sort"
++  kernel_sort=version_sort
 +fi
 +
  version_test_numeric ()
  {
    version_test_numeric_a="$1"
-@@ -229,7 +235,7 @@ version_test_numeric ()
+@@ -229,7 +238,7 @@ version_test_numeric ()
      version_test_numeric_a="$version_test_numeric_b"
      version_test_numeric_b="$version_test_numeric_c"
    fi
@@ -170,7 +170,7 @@ index 0000000..8ce2148
 +.BR "info grub"
 diff --git a/util/grub-rpm-sort.c b/util/grub-rpm-sort.c
 new file mode 100644
-index 0000000..4bbba1f
+index 0000000..f33bd1e
 --- /dev/null
 +++ b/util/grub-rpm-sort.c
 @@ -0,0 +1,281 @@
@@ -293,19 +293,19 @@ index 0000000..4bbba1f
 +  vercmpflag = rpmvercmp ((lhs_name == NULL ? "" : lhs_name),
 +                          (rhs_name == NULL ? "" : rhs_name));
 +  if (vercmpflag != 0)
-+    return -vercmpflag;
++    return vercmpflag;
 +
 +  /* Check version and return if unequal */
 +  vercmpflag = rpmvercmp ((lhs_version == NULL ? "" : lhs_version),
 +                          (rhs_version == NULL ? "" : rhs_version));
 +  if (vercmpflag != 0)
-+    return -vercmpflag;
++    return vercmpflag;
 +
 +  /* Check release and return the version compare value */
 +  vercmpflag = rpmvercmp ((lhs_release == NULL ? "" : lhs_release),
 +                          (rhs_release == NULL ? "" : rhs_release));
 +
-+  return -vercmpflag;
++  return vercmpflag;
 +}
 +
 +static void

0070-Add-friendly-grub2-password-config-tool-985962.patch

@@ -1,4 +1,4 @@
-From 9e6914a17245c7a9499c58b5b8c578526f201004 Mon Sep 17 00:00:00 2001
+From 05a8c8724027ddf9cefc0a8be5e2046174f2c38d Mon Sep 17 00:00:00 2001
 From: Robert Marshall <rmarshall@redhat.com>
 Date: Thu, 25 Jun 2015 11:13:11 -0400
 Subject: [PATCH 70/74] Add friendly grub2 password config tool (#985962)
@@ -65,7 +65,7 @@ index f28d73d..bc13d4a 100644
    common = util/grub-mkconfig_lib.in;
    installdir = noinst;
 diff --git a/configure.ac b/configure.ac
-index 64791d1..add5473 100644
+index 4f26f6c..8545b9d 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -65,6 +65,7 @@ grub_TRANSFORM([grub-mkrelpath])

0071-Make-exit-take-a-return-code.patch

@@ -1,4 +1,4 @@
-From 77d0a87d5c1d1864f9a8409cde6fbd29d11bd996 Mon Sep 17 00:00:00 2001
+From 05c9156ed3cee62e6aa8f955b96998b5d9302425 Mon Sep 17 00:00:00 2001
 From: Peter Jones <pjones@redhat.com>
 Date: Tue, 7 Jul 2015 12:00:26 -0400
 Subject: [PATCH 71/74] Make "exit" take a return code.

0072-Add-some-__unused__-where-gcc-5.x-is-more-picky-abou.patch

@@ -1,4 +1,4 @@
-From 9466b1c5194e6c7d388349fa2691e288b4523bc3 Mon Sep 17 00:00:00 2001
+From a8b6f41df623cd777e41e0f6d44e25617f8388c9 Mon Sep 17 00:00:00 2001
 From: Peter Jones <pjones@redhat.com>
 Date: Tue, 7 Jul 2015 12:04:28 -0400
 Subject: [PATCH 72/74] Add some __unused__ where gcc 5.x is more picky about

0073-Fix-race-in-EFI-validation.patch

@@ -1,4 +1,4 @@
-From 6afbd577549250cdd954dfc12f03a6a4e7d3b906 Mon Sep 17 00:00:00 2001
+From 62b86cdfaf57a098ba7c6d8b08df161aa294e7a3 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@coreos.com>
 Date: Tue, 14 Jul 2015 16:58:51 -0700
 Subject: [PATCH 73/74] Fix race in EFI validation

0074-Mark-po-exclude.pot-as-binary-so-git-won-t-try-to-di.patch

@@ -1,4 +1,4 @@
-From 530c5e9d5b84fd87daed817fd11415486bcfd9a6 Mon Sep 17 00:00:00 2001
+From e433d768dd3d11e93a53e7df8d6c0171b8316b1e Mon Sep 17 00:00:00 2001
 From: Peter Jones <pjones@redhat.com>
 Date: Wed, 22 Jul 2015 11:21:01 -0400
 Subject: [PATCH 74/74] Mark po/exclude.pot as binary so git won't try to diff

0075-Fix-security-issue-when-reading-username-and-passwor.patch

@@ -0,0 +1,47 @@
+From b059b6f9c7d236e83829689a1615f180f230baaa Mon Sep 17 00:00:00 2001
+From: Hector Marco-Gisbert <hecmargi@upv.es>
+Date: Fri, 13 Nov 2015 16:21:09 +0100
+Subject: [PATCH 75/76] Fix security issue when reading username and password
+
+  This patch fixes two integer underflows at:
+    * grub-core/lib/crypto.c
+    * grub-core/normal/auth.c
+
+Resolves: CVE-2015-8370
+
+Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
+Signed-off-by: Ismael Ripoll-Ripoll <iripoll@disca.upv.es>
+---
+ grub-core/lib/crypto.c  | 2 +-
+ grub-core/normal/auth.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
+index 010e550..524a3d8 100644
+--- a/grub-core/lib/crypto.c
++++ b/grub-core/lib/crypto.c
+@@ -468,7 +468,7 @@ grub_password_get (char buf[], unsigned buf_size)
+ 	  break;
+ 	}
+ 
+-      if (key == '\b')
++      if (key == '\b' && cur_len)
+ 	{
+ 	  cur_len--;
+ 	  continue;
+diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c
+index c6bd96e..5782ec5 100644
+--- a/grub-core/normal/auth.c
++++ b/grub-core/normal/auth.c
+@@ -172,7 +172,7 @@ grub_username_get (char buf[], unsigned buf_size)
+ 	  break;
+ 	}
+ 
+-      if (key == '\b')
++      if (key == '\b' && cur_len)
+ 	{
+ 	  cur_len--;
+ 	  grub_printf ("\b");
+-- 
+2.5.0
+

0076-01_users-Handle-GRUB_PASSWORD-better.patch

@@ -0,0 +1,44 @@
+From e5e933f4fd449301fc1856db31ef1167b4867cd1 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Fri, 4 Dec 2015 09:28:38 -0500
+Subject: [PATCH 76/76] 01_users: Handle GRUB_PASSWORD better.
+
+Only handle GRUB2_PASSWORD not GRUB_PASSWORD.
+
+Related: rhbz#1284370
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ util/grub-setpassword.8 | 2 +-
+ util/grub.d/01_users.in | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/util/grub-setpassword.8 b/util/grub-setpassword.8
+index 5973abe..49200a8 100644
+--- a/util/grub-setpassword.8
++++ b/util/grub-setpassword.8
+@@ -9,7 +9,7 @@
+ \fBgrub-setpassword\fR outputs the user.cfg file which contains the hashed GRUB bootloader password. This utility only supports configurations where there is a single root user.
+ 
+ The file has the format:
+-GRUB_2PASSWORD=<\fIhashed password\fR>.
++GRUB2_PASSWORD=<\fIhashed password\fR>.
+ 
+ .SH OPTIONS
+ .TP
+diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in
+index facd409..db2f44b 100644
+--- a/util/grub.d/01_users.in
++++ b/util/grub.d/01_users.in
+@@ -2,7 +2,7 @@
+ cat << EOF
+ if [ -f \${prefix}/user.cfg ]; then
+   source \${prefix}/user.cfg
+-  if [ -n \${GRUB2_PASSWORD} ]; then
++  if [ -n "\${GRUB2_PASSWORD}" ]; then
+     set superusers="root"
+     export superusers
+     password_pbkdf2 root \${GRUB2_PASSWORD}
+-- 
+2.5.0
+

grub2.spec

@@ -45,7 +45,7 @@
 Name:           grub2
 Epoch:          1
 Version:        2.02
-Release:        0.19%{?dist}
+Release:        0.25%{?dist}
 Summary:        Bootloader with support for Linux, Multiboot and more
 
 Group:          System Environment/Base
@@ -138,6 +138,10 @@ Patch0071: 0071-Make-exit-take-a-return-code.patch
 Patch0072: 0072-Add-some-__unused__-where-gcc-5.x-is-more-picky-abou.patch
 Patch0073: 0073-Fix-race-in-EFI-validation.patch
 Patch0074: 0074-Mark-po-exclude.pot-as-binary-so-git-won-t-try-to-di.patch
+Patch0075: 0075-Fix-security-issue-when-reading-username-and-passwor.patch
+Patch0076: 0076-01_users-Handle-GRUB_PASSWORD-better.patch
+
+
 
 
 # And these are:
@@ -146,7 +150,7 @@ Patch0074: 0074-Mark-po-exclude.pot-as-binary-so-git-won-t-try-to-di.patch
 Patch10001: 10001-Put-the-correct-.file-directives-in-our-.S-files.patch
 Patch10002: 10002-Make-efi-machines-load-an-env-block-from-a-variable.patch
 Patch10003: 10003-Make-it-possible-to-enabled-build-id-sha1.patch
-Patch10004: 10004-Don-t-tell-the-compiler-to-do-annoying-things-with-f.patch
+#Patch10004: 10004-Don-t-tell-the-compiler-to-do-annoying-things-with-f.patch
 Patch10005: 10005-Add-grub_qdprintf-grub_dprintf-without-the-file-line.patch
 Patch10006: 10006-Make-a-gdb-dprintf-that-tells-us-load-addresses.patch
 
@@ -315,7 +319,7 @@ GRUB_MODULES+=" linux "
 %else
 GRUB_MODULES+=" backtrace usb usbserial_common "
 GRUB_MODULES+=" usbserial_pl2303 usbserial_ftdi usbserial_usbdebug "
-GRUB_MODULES+=" linuxefi multiboot2 multiboot "
+GRUB_MODULES+=" linuxefi"
 %endif
 ./grub-mkimage -O %{grubefiarch} -o %{grubefiname}.orig -p /EFI/%{efidir} \
 		-d grub-core ${GRUB_MODULES}
@@ -465,6 +469,34 @@ cp -a ${RPM_BUILD_ROOT}/usr/sbin %{finddebugroot}/usr/sbin
 %clean    
 rm -rf $RPM_BUILD_ROOT
 
+%pre tools
+if [ -f /boot/grub2/user.cfg ]; then
+    if grep -q '^GRUB_PASSWORD=' /boot/grub2/user.cfg ; then
+	sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' /boot/grub2/user.cfg
+    fi
+elif [ -f /boot/efi/EFI/%{efidir}/user.cfg ]; then
+    if grep -q '^GRUB_PASSWORD=' /boot/efi/EFI/%{efidir}/user.cfg ; then
+	sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' \
+	    /boot/efi/EFI/%{efidir}/user.cfg
+    fi
+elif [ -f /etc/grub.d/01_users ] && \
+	grep -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then
+    if [ -f /boot/efi/EFI/%{efidir}/grub.cfg ]; then
+	# on EFI we don't get permissions on the file, but
+	# the directory is protected.
+	grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
+		sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \
+	    > /boot/efi/EFI/%{efidir}/user.cfg
+    fi
+    if [ -f /boot/grub2/grub.cfg ]; then
+	install -m 0600 /dev/null /boot/grub2/user.cfg
+	chmod 0600 /boot/grub2/user.cfg
+	grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
+		sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \
+	    > /boot/grub2/user.cfg
+    fi
+fi
+
 %post tools
 if [ "$1" = 1 ]; then
 	/sbin/install-info --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz || :
@@ -594,6 +626,28 @@ fi
 %{_datarootdir}/grub/themes/starfield
 
 %changelog
+* Thu Dec 10 2015 Peter Jones <pjones@redhat.com> - 2.02-0.25
+- Fix security issue when reading username and password
+  Related: CVE-2015-8370
+- Do a better job of handling GRUB2_PASSWORD
+  Related: rhbz#1284370
+
+* Fri Nov 20 2015 Peter Jones <pjones@redhat.com> - 2.02-0.24
+- Rebuild without multiboot* modules in the EFI image.
+  Related: rhbz#1264103
+
+* Sat Sep 05 2015 Kalev Lember <klember@redhat.com> - 2.02-0.23
+- Rebuilt for librpm soname bump
+
+* Wed Aug 05 2015 Peter Jones <pjones@redhat.com> - 2.02-0.21
+- Back out one of the debuginfo generation patches; it doesn't work right on
+  aarch64 yet.
+  Resolves: rhbz#1250197
+
+* Mon Aug 03 2015 Peter Jones <pjones@redhat.com> - 2.02-0.20
+- The previous fix was completely not right, so fix it a different way.
+  Resolves: rhbz#1249668
+
 * Fri Jul 31 2015 Peter Jones <pjones@redhat.com> - 2.02-0.19
 - Fix grub2-mkconfig's sort to put kernels in the right order.
   Related: rhbz#1124074