diff mbox series

Hardening: Declare content of /usr/lib/grub as firmware files

Message ID 20230328085521.92868-1-stefan.schantl@ipfire.org
State Accepted
Commit 0e3f8ea032583ef8c3900e83678931429abc9e64
Headers
Series Hardening: Declare content of /usr/lib/grub as firmware files |

Commit Message

Stefan Schantl March 28, 2023, 8:55 a.m. UTC 
  This folder contains the neccessary files, which are written to
the MBR, dealing with EFI, or loading additional required grub
modules unless the whole grub menu can be displayed or a selected
OS will start up.

Some of these files are 32bit ELF files or do not have SSP etc.

So I would suggest to mark them as firmware files and therefore
skip some of the hardening tests.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 src/libpakfire/file.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/src/libpakfire/file.c b/src/libpakfire/file.c
index 33e26fea..819587ef 100644
--- a/src/libpakfire/file.c
+++ b/src/libpakfire/file.c
@@ -1509,6 +1509,7 @@  static const struct pattern {
 	{ "*.pm", PAKFIRE_FILE_PERL },
 	{ "*.pc", PAKFIRE_FILE_PKGCONFIG },
 	{ "/usr/lib/firmware/*", PAKFIRE_FILE_FIRMWARE },
+	{ "/usr/lib/grub/*", PAKFIRE_FILE_FIRMWARE },
 	{ "/usr/lib*/ld-*.so*", PAKFIRE_FILE_RUNTIME_LINKER },
 	{ NULL },
 };