kumquat-buildroot/boot/grub2/grub2.mk

198 lines
7.2 KiB
Makefile
Raw Normal View History

################################################################################
#
# grub2
#
################################################################################
GRUB2_VERSION = 2.12
GRUB2_SITE = http://ftp.gnu.org/gnu/grub
GRUB2_SOURCE = grub-$(GRUB2_VERSION).tar.xz
GRUB2_LICENSE = GPL-3.0+
GRUB2_LICENSE_FILES = COPYING
boot/grub2: needs host-gawk grub2 build is failing, when compiled on host system not including gawk and host-gawk is not built by another package before. This can be the the case on current Buildroot Docker image, based on Debian, which includes mawk. grub2 was updated in commit 5baf1ffe7e "boot/grub2: bump to version 2.12". This version includes the commit [1], which introduced the use of the asorti() awk function. This function is a specific gawk builtin extension. See [2]. This commit fixes this issue by adding host-gawk as a dependency. Fixes: mawk: ../../grub-core/genmoddep.awk: line 110: function asorti never defined make[4]: *** [Makefile:49030: moddep.lst] Error 1 make[4]: Leaving directory '/buildroot/output/build/grub2-2.12/build-i386-pc/grub-core' make[3]: *** [Makefile:28116: all] Error 2 make[3]: Leaving directory '/buildroot/output/build/grub2-2.12/build-i386-pc/grub-core' make[2]: *** [Makefile:11714: all-recursive] Error 1 make[2]: Leaving directory '/buildroot/output/build/grub2-2.12/build-i386-pc' make[1]: *** [Makefile:3547: all] Error 2 make[1]: Leaving directory '/buildroot/output/build/grub2-2.12/build-i386-pc' make: *** [package/pkg-generic.mk:283: /buildroot/output/build/grub2-2.12/.stamp_built] Error 2 [1] https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commitdiff;h=87648e9c12a32bddb005b899edc44c2c9c63df82 [2] https://www.gnu.org/software/gawk/manual/gawk.html#Sorting-Array-Values-and-Indices-with-gawk Signed-off-by: Julien Olivain <ju.o@free.fr> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-12-23 21:30:32 +01:00
GRUB2_DEPENDENCIES = host-bison host-flex host-gawk host-grub2
HOST_GRUB2_DEPENDENCIES = host-bison host-flex host-gawk
GRUB2_INSTALL_IMAGES = YES
# CVE-2019-14865 is about a flaw in the grub2-set-bootflag tool, which
# doesn't exist upstream, but is added by the Redhat/Fedora
# packaging. Not applicable to Buildroot.
GRUB2_IGNORE_CVES += CVE-2019-14865
# CVE-2020-15705 is related to a flaw in the use of the
# grub_linuxefi_secure_validate(), which was added by Debian/Ubuntu
# patches. The issue doesn't affect upstream Grub, and
# grub_linuxefi_secure_validate() is not implemented in the grub2
# version available in Buildroot.
GRUB2_IGNORE_CVES += CVE-2020-15705
# vulnerability is specific to the SUSE distribution
GRUB2_IGNORE_CVES += CVE-2021-46705
boot/grub2: Backport Boothole securify fixes Details: https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html Fixes the following security issues: * CVE-2020-10713 A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. * CVE-2020-14308 In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process. * CVE-2020-14309 There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data. * CVE-2020-14310 An integer overflow in read_section_from_string may lead to a heap based buffer overflow. * CVE-2020-14311 An integer overflow in grub_ext2_read_link may lead to a heap-based buffer overflow. * CVE-2020-15706 GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass * CVE-2020-15707 Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-08-03 10:00:25 +02:00
ifeq ($(BR2_TARGET_GRUB2_INSTALL_TOOLS),y)
GRUB2_INSTALL_TARGET = YES
else
GRUB2_INSTALL_TARGET = NO
endif
GRUB2_CPE_ID_VENDOR = gnu
GRUB2_BUILTIN_MODULES_PC = $(call qstrip,$(BR2_TARGET_GRUB2_BUILTIN_MODULES_PC))
GRUB2_BUILTIN_MODULES_EFI = $(call qstrip,$(BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI))
GRUB2_BUILTIN_CONFIG_PC = $(call qstrip,$(BR2_TARGET_GRUB2_BUILTIN_CONFIG_PC))
GRUB2_BUILTIN_CONFIG_EFI = $(call qstrip,$(BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI))
GRUB2_BOOT_PARTITION = $(call qstrip,$(BR2_TARGET_GRUB2_BOOT_PARTITION))
GRUB2_IMAGE_i386-pc = $(BINARIES_DIR)/grub.img
GRUB2_CFG_i386-pc = $(TARGET_DIR)/boot/grub/grub.cfg
GRUB2_PREFIX_i386-pc = ($(GRUB2_BOOT_PARTITION))/boot/grub
GRUB2_TARGET_i386-pc = i386
GRUB2_PLATFORM_i386-pc = pc
GRUB2_BUILTIN_CONFIG_i386-pc = $(GRUB2_BUILTIN_CONFIG_PC)
GRUB2_BUILTIN_MODULES_i386-pc = $(GRUB2_BUILTIN_MODULES_PC)
GRUB2_TUPLES-$(BR2_TARGET_GRUB2_I386_PC) += i386-pc
GRUB2_IMAGE_i386-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/bootia32.efi
GRUB2_CFG_i386-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/grub.cfg
GRUB2_PREFIX_i386-efi = /EFI/BOOT
GRUB2_TARGET_i386-efi = i386
GRUB2_PLATFORM_i386-efi = efi
GRUB2_BUILTIN_CONFIG_i386-efi = $(GRUB2_BUILTIN_CONFIG_EFI)
GRUB2_BUILTIN_MODULES_i386-efi = $(GRUB2_BUILTIN_MODULES_EFI)
GRUB2_TUPLES-$(BR2_TARGET_GRUB2_I386_EFI) += i386-efi
GRUB2_IMAGE_x86_64-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/bootx64.efi
GRUB2_CFG_x86_64-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/grub.cfg
GRUB2_PREFIX_x86_64-efi = /EFI/BOOT
GRUB2_TARGET_x86_64-efi = x86_64
GRUB2_PLATFORM_x86_64-efi = efi
GRUB2_BUILTIN_CONFIG_x86_64-efi = $(GRUB2_BUILTIN_CONFIG_EFI)
GRUB2_BUILTIN_MODULES_x86_64-efi = $(GRUB2_BUILTIN_MODULES_EFI)
GRUB2_TUPLES-$(BR2_TARGET_GRUB2_X86_64_EFI) += x86_64-efi
GRUB2_IMAGE_arm-uboot = $(BINARIES_DIR)/boot-part/grub/grub.img
GRUB2_CFG_arm-uboot = $(BINARIES_DIR)/boot-part/grub/grub.cfg
GRUB2_PREFIX_arm-uboot = ($(GRUB2_BOOT_PARTITION))/boot/grub
GRUB2_TARGET_arm-uboot = arm
GRUB2_PLATFORM_arm-uboot = uboot
GRUB2_BUILTIN_CONFIG_arm-uboot = $(GRUB2_BUILTIN_CONFIG_PC)
GRUB2_BUILTIN_MODULES_arm-uboot = $(GRUB2_BUILTIN_MODULES_PC)
GRUB2_TUPLES-$(BR2_TARGET_GRUB2_ARM_UBOOT) += arm-uboot
GRUB2_IMAGE_arm-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/bootarm.efi
GRUB2_CFG_arm-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/grub.cfg
GRUB2_PREFIX_arm-efi = /EFI/BOOT
GRUB2_TARGET_arm-efi = arm
GRUB2_PLATFORM_arm-efi = efi
GRUB2_BUILTIN_CONFIG_arm-efi = $(GRUB2_BUILTIN_CONFIG_EFI)
GRUB2_BUILTIN_MODULES_arm-efi = $(GRUB2_BUILTIN_MODULES_EFI)
GRUB2_TUPLES-$(BR2_TARGET_GRUB2_ARM_EFI) += arm-efi
GRUB2_IMAGE_arm64-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/bootaa64.efi
GRUB2_CFG_arm64-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/grub.cfg
GRUB2_PREFIX_arm64-efi = /EFI/BOOT
GRUB2_TARGET_arm64-efi = aarch64
GRUB2_PLATFORM_arm64-efi = efi
GRUB2_BUILTIN_CONFIG_arm64-efi = $(GRUB2_BUILTIN_CONFIG_EFI)
GRUB2_BUILTIN_MODULES_arm64-efi = $(GRUB2_BUILTIN_MODULES_EFI)
GRUB2_TUPLES-$(BR2_TARGET_GRUB2_ARM64_EFI) += arm64-efi
GRUB2_IMAGE_riscv64-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/bootriscv64.efi
GRUB2_CFG_riscv64-efi = $(BINARIES_DIR)/efi-part/EFI/BOOT/grub.cfg
GRUB2_PREFIX_riscv64-efi = /EFI/BOOT
GRUB2_TARGET_riscv64-efi = riscv64
GRUB2_PLATFORM_riscv64-efi = efi
GRUB2_BUILTIN_CONFIG_riscv64-efi = $(GRUB2_BUILTIN_CONFIG_EFI)
GRUB2_BUILTIN_MODULES_riscv64-efi = $(GRUB2_BUILTIN_MODULES_EFI)
GRUB2_TUPLES-$(BR2_TARGET_GRUB2_RISCV64_EFI) += riscv64-efi
# Grub2 is kind of special: it considers CC, LD and so on to be the
# tools to build the host programs and uses TARGET_CC, TARGET_CFLAGS,
# TARGET_CPPFLAGS, TARGET_LDFLAGS to build the bootloader itself.
#
# NOTE: TARGET_STRIP is overridden by !BR2_STRIP_strip, so always
# use the cross compile variant to ensure grub2 builds
HOST_GRUB2_CONF_ENV = \
CPP="$(HOSTCC) -E"
GRUB2_CONF_ENV = \
CPP="$(TARGET_CC) -E" \
TARGET_CC="$(TARGET_CC)" \
CFLAGS="$(TARGET_CFLAGS) -Os" \
TARGET_CFLAGS="$(TARGET_CFLAGS) -Os" \
CPPFLAGS="$(TARGET_CPPFLAGS) -Os -fno-stack-protector" \
TARGET_CPPFLAGS="$(TARGET_CPPFLAGS) -Os -fno-stack-protector" \
TARGET_LDFLAGS="$(TARGET_LDFLAGS) -Os" \
TARGET_NM="$(TARGET_NM)" \
TARGET_OBJCOPY="$(TARGET_OBJCOPY)" \
TARGET_STRIP="$(TARGET_CROSS)strip"
HOST_GRUB2_CONF_OPTS = \
--with-platform=none \
--disable-grub-mkfont \
--enable-efiemu=no \
ac_cv_lib_lzma_lzma_code=no \
--enable-device-mapper=no \
--enable-libzfs=no \
--disable-werror
define GRUB2_CONFIGURE_CMDS
$(foreach tuple, $(GRUB2_TUPLES-y), \
@$(call MESSAGE,Configuring $(tuple))
mkdir -p $(@D)/build-$(tuple)
cd $(@D)/build-$(tuple) && \
$(TARGET_CONFIGURE_OPTS) \
$(TARGET_CONFIGURE_ARGS) \
$(GRUB2_CONF_ENV) \
../configure \
--target=$(GRUB2_TARGET_$(tuple)) \
--with-platform=$(GRUB2_PLATFORM_$(tuple)) \
--host=$(GNU_TARGET_NAME) \
--build=$(GNU_HOST_NAME) \
--prefix=/ \
--exec-prefix=/ \
--disable-grub-mkfont \
--enable-efiemu=no \
ac_cv_lib_lzma_lzma_code=no \
--enable-device-mapper=no \
--enable-libzfs=no \
--disable-werror
)
endef
define GRUB2_BUILD_CMDS
$(foreach tuple, $(GRUB2_TUPLES-y), \
@$(call MESSAGE,Building $(tuple))
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D)/build-$(tuple)
)
endef
define GRUB2_INSTALL_IMAGES_CMDS
$(foreach tuple, $(GRUB2_TUPLES-y), \
@$(call MESSAGE,Installing $(tuple) to images directory)
mkdir -p $(dir $(GRUB2_IMAGE_$(tuple)))
pacakge: drop remnants of $(HOST_DIR)/usr It's been ages (5 years at the next release) that we've not installed host packages in $(HOST_DIR)/usr, but we still have a few packages that reference it or install things in there. Drop all of those in one fell swoop. The run-time test still succeeds, and the following defconfig, which should exercise all touched packages [*], does build: BR2_x86_i686=y BR2_TOOLCHAIN_EXTERNAL=y BR2_INIT_NONE=y BR2_SYSTEM_BIN_SH_NONE=y # BR2_PACKAGE_BUSYBOX is not set BR2_PACKAGE_GAWK=y BR2_PACKAGE_GETTEXT=y BR2_PACKAGE_ABOOTIMG=y BR2_PACKAGE_DBUS_PYTHON=y BR2_PACKAGE_OLA=y BR2_PACKAGE_JIMTCL=y BR2_PACKAGE_LUA=y # BR2_PACKAGE_LUA_32BITS is not set BR2_PACKAGE_ARGPARSE=y BR2_PACKAGE_PERL=y BR2_PACKAGE_PHP=y BR2_PACKAGE_PHP_APCU=y BR2_PACKAGE_PHP_LUA=y BR2_PACKAGE_PHP_PAM=y BR2_PACKAGE_PHP_PECL_DBUS=y BR2_PACKAGE_PYTHON3=y BR2_PACKAGE_PYTHON_CRYPTOGRAPHY=y BR2_PACKAGE_PYTHON_PLY=y BR2_PACKAGE_PYTHON_PYBIND=y BR2_PACKAGE_LIBVA=y BR2_PACKAGE_BIND=y BR2_PACKAGE_BIND_SERVER=y BR2_PACKAGE_BIND_TOOLS=y BR2_PACKAGE_APPARMOR=y BR2_PACKAGE_APPARMOR_BINUTILS=y BR2_PACKAGE_APPARMOR_UTILS=y BR2_PACKAGE_APPARMOR_UTILS_EXTRA=y BR2_PACKAGE_APPARMOR_PROFILES=y BR2_PACKAGE_REFPOLICY=y BR2_PACKAGE_URANDOM_SCRIPTS=y BR2_PACKAGE_BASH=y # embiggen-disk to exercise go BR2_PACKAGE_EMBIGGEN_DISK=y BR2_TARGET_GRUB2=y BR2_TARGET_GRUB2_I386_PC=y BR2_TARGET_GRUB2_I386_EFI=y [*] exceptions: - zfs was not tested: it needs a kernel to be built; - compiler-rt was not tsted: it needs llvm to be built, that takes ages, and other packages already reference the correct location for llvm-config, so it was assumed that is OK. Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Angelo Compagnucci <angelo.compagnucci@gmail.com> Cc: Anisse Astier <anisse@astier.eu> Cc: Antoine Tenart <atenart@kernel.org> Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Cc: Asaf Kahlon <asafka7@gmail.com> Cc: Bernd Kuhls <bernd.kuhls@t-online.de> Cc: Christian Stewart <christian@paral.in> Cc: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Cc: Francois Perrad <francois.perrad@gadz.org> Cc: Guillaume William Brs <guillaume.bressaix@gmail.com> Cc: Hervé Codina <herve.codina@bootlin.com> Cc: James Hilliard <james.hilliard1@gmail.com> Cc: José Luis Salvador Rufo <salvador.joseluis@gmail.com> Cc: Julien Boibessot <julien.boibessot@armadeus.com> Cc: Julien Olivain <ju.o@free.fr> Cc: Matt Weber <matthew.weber@collins.com> Cc: Nicolas Carrier <nicolas.carrier@orolia.com> Cc: Peter Korsgaard <peter@korsgaard.com> Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Cc: Vadim Kochan <vadim4j@gmail.com> Cc: Yegor Yefremov <yegorslists@googlemail.com> Reviewed-by: Romain Naour <romain.naour@smile.fr> --- Changes v1 -> v2: - fix new instance that have crept in (Romain)
2022-07-16 23:04:49 +02:00
$(HOST_DIR)/bin/grub-mkimage \
-d $(@D)/build-$(tuple)/grub-core/ \
-O $(tuple) \
-o $(GRUB2_IMAGE_$(tuple)) \
-p "$(GRUB2_PREFIX_$(tuple))" \
$(if $(GRUB2_BUILTIN_CONFIG_$(tuple)), \
-c $(GRUB2_BUILTIN_CONFIG_$(tuple))) \
$(GRUB2_BUILTIN_MODULES_$(tuple))
$(INSTALL) -D -m 0644 boot/grub2/grub.cfg $(GRUB2_CFG_$(tuple))
$(if $(findstring $(GRUB2_PLATFORM_$(tuple)), pc), \
cat $(@D)/build-$(tuple)/grub-core/cdboot.img $(GRUB2_IMAGE_$(tuple)) > \
$(BINARIES_DIR)/grub-eltorito.img
) \
)
endef
ifeq ($(BR2_TARGET_GRUB2_INSTALL_TOOLS),y)
define GRUB2_INSTALL_TARGET_CMDS
$(foreach tuple, $(GRUB2_TUPLES-y), \
@$(call MESSAGE,Installing $(tuple) to target directory)
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D)/build-$(tuple) DESTDIR=$(TARGET_DIR) install
)
endef
endif
$(eval $(generic-package))
$(eval $(host-autotools-package))