grub2: disable os-prober by default (security)#17740
Closed
vinceaperri wants to merge 1 commit into
Closed
Conversation
Azure Linux's grub2 is sourced from Fedora dist-git and customized via
azldev comp.toml overlays; the rendered specs/g/grub2 tree is build output,
not build input. Fedora ships two downstream reverts (Patch0002, Patch0003)
that re-enable os-prober by default. Automatic, silent execution of os-prober
is a known attack vector, so restore upstream GRUB's secure default.
Add three overlays to base/comps/grub2/grub2.comp.toml:
- file-add 0383 (exact git revert of Fedora Patch0003)
- file-add 0384 (exact git revert of Fedora Patch0002; restores
GRUB_DISABLE_OS_PROBER="true" in grub-mkconfig)
- file-search-replace appending Patch0383/Patch0384 to the end of the
grub.patches series
Appending at the end (rather than dropping the Fedora reverts) keeps the
context of all 382 prior patches intact, avoiding the apply failure that
caused the previous attempt (PR #17375) to be reverted by f526821.
Verified locally: azldev component build -p grub2 --no-check succeeds, and
the built grub2-tools RPM ships grub2-mkconfig with
GRUB_DISABLE_OS_PROBER="true" and 30_os-prober gated on "xtrue".
|
Hello, and thank you for opening this pull request! 👋🏼 We appreciate the contribution. We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted. Commits in this repo will typically be prefixed with Details: |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR restores upstream GRUB’s secure default by ensuring os-prober is disabled by default in Azure Linux’s Fedora-sourced grub2, while avoiding patch-series renumbering by appending trailing “revert of Fedora revert” patches.
Changes:
- Adds two new trailing patches (Patch0383/Patch0384) that revert Fedora’s downstream reverts which re-enabled
os-proberby default. - Updates the
grub2component overlays to stage those patch files and append them togrub.patches. - Updates the
grub2lock fingerprint to reflect the component input changes.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
locks/grub2.lock |
Updates lock input fingerprint for the modified component inputs. |
base/comps/grub2/grub2.comp.toml |
Adds overlays to stage two new patch files and append Patch0383/0384 to the end of grub.patches. |
base/comps/grub2/0383-Revert-Revert-templates-Disable-the-os-prober-by-default.patch |
New patch re-applying upstream “disable os-prober by default” behavior and related docs text. |
base/comps/grub2/0384-Revert-Revert-templates-Properly-disable-the-os-prober-by-d.patch |
New patch restoring GRUB_DISABLE_OS_PROBER="true" default and gating behavior in 30_os-prober. |
Comment on lines
+20
to
+24
| # Re-disable os-prober by default (security). The Fedora grub2 package carries | ||
| # two downstream reverts -- Patch0002 and Patch0003 -- that re-enable os-prober | ||
| # by default. Automatic, silent execution of os-prober is a known attack vector, | ||
| # so Azure Linux restores upstream GRUB's secure default. Rather than dropping | ||
| # the Fedora reverts (which would shift line numbers and break the context of |
Comment on lines
+49
to
+53
| file = "grub.patches" | ||
| regex = 'Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P\.patch' | ||
| replacement = '''Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch | ||
| Patch0383: 0383-Revert-Revert-templates-Disable-the-os-prober-by-default.patch | ||
| Patch0384: 0384-Revert-Revert-templates-Properly-disable-the-os-prober-by-d.patch''' |
Comment on lines
+34
to
+38
| [[components.grub2.overlays]] | ||
| description = "Stage os-prober revert patch 0383 (revert of Fedora Patch0003)" | ||
| type = "file-add" | ||
| file = "0383-Revert-Revert-templates-Disable-the-os-prober-by-default.patch" | ||
| source = "0383-Revert-Revert-templates-Disable-the-os-prober-by-default.patch" |
📄❌ Rendered specs are out of dateFIX: — run this and commit the result: azldev component render grub2Or download the fix patch and apply it: gh run download 27640224466 -R microsoft/azurelinux -n rendered-specs-patch
git apply rendered-specs.patch
Content diffs`specs/g/grub2/grub.patches`--- committed/specs/g/grub2/grub.patches
+++ rendered/specs/g/grub2/grub.patches
@@ -378,4 +378,6 @@
Patch0379: 0379-loader-efi-chainloader-Fix-double-free.patch
Patch0380: 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch
Patch0381: 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch
-Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch+Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch
+Patch0383: 0383-Revert-Revert-templates-Disable-the-os-prober-by-default.patch
+Patch0384: 0384-Revert-Revert-templates-Properly-disable-the-os-prober-by-d.patch`specs/g/grub2/grub2.spec`--- committed/specs/g/grub2/grub2.spec
+++ rendered/specs/g/grub2/grub2.spec
@@ -20,7 +20,7 @@
Name: grub2
Epoch: 1
Version: 2.12
-Release: 44%{?dist}
+Release: 45%{?dist}
Summary: Bootloader with support for Linux, Multiboot and more
License: GPL-3.0-or-later
URL: http://www.gnu.org/software/grub/
Files to addThese files are produced by
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restore upstream GRUB's secure default in which os-prober is disabled by default. Automatic, silent execution of
os-prober(and creating boot entries from its output) is a known attack vector, so it must not run unless an admin explicitly opts in.Azure Linux's
grub2is sourced from Fedora dist-git and customized via azldevcomp.tomloverlays. Fedora ships two downstream reverts —Patch0002andPatch0003— that re-enable os-prober by default. This change re-disables it.Approach
Rather than dropping the Fedora reverts (which shifts patch line numbers and breaks the context of later patches in the 382-patch series — exactly the failure that caused the previous attempt, #17375, to be reverted by f526821), this PR appends two trailing patches that are exact
git reverts of the Fedora reverts:Patch0383Patch0003(Revert "templates: Disable the os-prober by default")30_os-probergatePatch0384Patch0002(Revert "templates: Properly disable the os-prober by default")GRUB_DISABLE_OS_PROBER="true"default ingrub-mkconfigImplemented as three overlays in
base/comps/grub2/grub2.comp.toml(twofile-add+ onefile-search-replaceappendingPatch0383/Patch0384to the end ofgrub.patches). Because they apply last, all 382 prior patches keep their context and the build does not break.Verification
Built locally with
azldev component build -p grub2 --no-check(succeeds end-to-end). The resultinggrub2-toolsRPM was extracted and confirmed:grub2-mkconfigcontainsGRUB_DISABLE_OS_PROBER="true"(the security default)etc/grub.d/30_os-proberis gated on[ "x${GRUB_DISABLE_OS_PROBER}" = "xtrue" ]→exit 0