GRUB2

Nick Crawford neoaeon at gmail.com
Fri Dec 12 15:52:46 UTC 2014


*


      Overview

Grub2 has a number of differences with the original Grub. This is
especially relevant for RHEL 7 content.


Grub2’s grub.cfgis now more script than config file.  There are 2
possible config files; /etc/grub2.cfglinked to /boot/grub2/grub.cfgfor
BIOS mode and /etc/grub2-efi.cfglinked to
/boot/efi/EFI/redhat/grub.cfgfor EFI mode.  Changes to the source files
/etc/default/gruband /etc/grub.d/*are compiled into your grub.cfgby
grub2-mkconfig –o </path/to/relevant/grub.cfg>.


What used to be simple kernel appends in grub.confare now controlled by
/etc/default/grubin the variable GRUB_CMDLINE_LINUXfor persistent changes.


      SSG inconsistency

Much of the work for grub2 has already been done in BIOS mode.  Much of
the completed stuff from SSG RHEL/7/distfor Grub2 seems good and
supports both BIOS and EFI.  SSG RHEL/7/inputlacks consistency with
RHEL/7/distas inputis all BIOS mode only.  There are still references to
grub.confto be addressed.


EFI Grub2 is also unaddressed in the Fedora content.


EFI systems could potentially boot from either EFI or Emulated BIOS,
complicating matters when both Grub2 configs are discovered.  I'm
unaware of a current requirement to boot from one or the other, or to
implement Secure Boot (requires EFI).  EFI systems could potentially be
evaluated by the presence of the efivarfs mount.  I don’t have a
hardware EFI system supporting Emulated BIOS boot to verify this.


# mount | grep efivarfs

efivarfs on /sys/firmware/efi/efivars type efivarfs
(rw,nosuid,nodev,noexec,relatime)

# if [ -d /sys/firmware/efi/efivars ]; then echo do EFI stuff; else echo
do BIOS stuff; fi


Previously checks were against /etc/grub.conf,now checks have to use
either /etc/grub2.cfgor /etc/grub2-efi.cfg.  Additionally checks should
reference GRUB_CMDLINE_LINUXto ensure persistent changes exist (or don't).

Further, there appears to be a default reference from grub.cfgto a
custom.cfgthat can hold additional settings.  Potentially
custom.cfgshould be checked as well if it exists.  The custom.cfglives
along-side grub.cfgin either /boot/grub2or /boot/efi/EFI/redhatand is
sourced into the main grub.cfg.


      Questions for SSG

  *

    When should the symbolic links /boot/grub2.cfgand
    /boot/grub2-efi.cfgbe used? Config checks, REGEX?

  *

    When should the real files /boot/grub2/grub.cfgand
    /boot/efi/EFI/redhat/grub.cfgbe used? Permission/SE Context checks?

  *

    When should /etc/default/grub: GRUB_CMDLINE_LINUXbe referenced?
    Append operations?

  *

    Should /etc/grub.d/*be checked for anything, or just the resulting
    grub.cfg?

  *

    Should custom.cfgbe checked for “hidden” settings?

  *

    In systems that may support both BIOS Grub2 and EFI Grub2 do we need
    to check both when both exist, or attempt to discover which boot
    mode we're using?


Affected SSG sections that I can locate:

 1.

    (bootloader_password) Bootloader password section is BIOS only.

 2.

    (bootloader_audit_argument) Sections adding audit=1still point to
    grub.conf, it should be GRUB_CMDLINE_LINUXin /etc/default/grubfor
    persistence.

 3.

    (enable_selinux_bootloader) Sections checking for selinux=0still
    point to grub.conf, it should be relevant grub2.cfgor grub2-efi.cfg,
    and GRUB_CMDLINE_LINUX.selinux=0could potentially be hidden in
    custom.cfgor grub.d/*.  Perhaps replace this with a check against
    /proc/cmdlineto check if the running kernel was booted selinux=0?

 4.

    (bootloader_nousb_argument) Sections adding nousbstill point to
    grub.conf, it should be GRUB_CMDLINE_LINUXfor persistence.

 5.

    RHEL/7/inputs/fixes/bash/*grub2_cfg.share BIOS only.

 6.

    RHEL/7/inputs/system/accounts/physical.xmlgrub2 sections are BIOS only.

 7.

    PAE-kernel section still lists grub.conf, it's now
    grub2-set-default/ grub2-editenv, further RHEL 7 currently is x86_64
    only so there is no PAE-kernel.


      Documentation Error

If you tried to secure grub2 with a password earlier there were a couple
of typos in the docs from Fedora/Red Hat, this has been corrected.

Fixed https://bugzilla.redhat.com/show_bug.cgi?id=1157161


      grub2-mkconfig vs patched kernel

Running grub2-mkconfig as required by these Grub2 sections will cause
the system to boot the unpatched release kernel.  Running the following
will fix the issue;


CKERN=$(grub2-editenv list | grep saved_entry | cut -d '=' -f2)

DKERN=$(cat /etc/grub2.cfg | grep ^menuentry | grep "${CKERN}" | awk
-F"'" '{print $4}')

grub2-set-default "${DKERN}"


Reported https://bugzilla.redhat.com/show_bug.cgi?id=1154430

*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20141212/bdb58291/attachment-0001.html>


More information about the scap-security-guide mailing list