All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ross Lagerwall via Grub-devel <grub-devel@gnu.org>
To: The development of GNU GRUB <grub-devel@gnu.org>
Cc: Ross Lagerwall <ross.lagerwall@citrix.com>
Subject: Re: [PATCH 7/7] verifiers: Verify after decompression
Date: Thu, 28 Mar 2024 14:55:20 +0000	[thread overview]
Message-ID: <CAG7k0Epd9aHkha-3Lw5cSGqDkBgzRrMQ-nmZXCEDMj08Xkj=dA@mail.gmail.com> (raw)
In-Reply-To: <CAEaD8JOAfQ=fsze+a=+LQRB5Krh+uohCK2bd3adXKwfqyUzTkw@mail.gmail.com>

On Fri, Mar 15, 2024 at 7:26 AM Vladimir 'phcoder' Serbinenko
<phcoder@gmail.com> wrote:
>
> Verifying after decompression is a bad security practice. It relies on decompression having no security holes. Given how complex decompression is, this is almost guaranteed to be false.
>

Point taken... I'll drop this patch as it is not essential to the goal
of booting Secure Booting Xen via GRUB.

Thanks,
Ross

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

      reply	other threads:[~2024-03-28 14:56 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-03-13 15:07 [PATCH 0/7] GRUB: Supporting Secure Boot of xen.gz Ross Lagerwall
2024-03-13 15:07 ` Ross Lagerwall via Grub-devel
2024-03-13 15:07 ` [PATCH 1/7] multiboot2: Add load type header and support for the PE binary type Ross Lagerwall
2024-03-13 15:07   ` Ross Lagerwall via Grub-devel
2024-03-14  7:24   ` Jan Beulich
2024-03-14  7:24     ` Jan Beulich via Grub-devel
2024-03-14  8:12     ` Damien Zammit via Grub-devel
2024-03-14  8:12       ` Damien Zammit
2024-03-14  8:49     ` Vladimir 'phcoder' Serbinenko
2024-03-14  9:30     ` Ross Lagerwall
2024-03-14  9:30       ` Ross Lagerwall via Grub-devel
2024-03-14 13:37       ` Jan Beulich
2024-03-14 13:37         ` Jan Beulich via Grub-devel
2024-03-14 14:24         ` Ross Lagerwall
2024-03-14 14:24           ` Ross Lagerwall via Grub-devel
2024-03-14 14:33           ` Jan Beulich
2024-03-14 14:33             ` Jan Beulich via Grub-devel
2024-03-19 12:12           ` Roger Pau Monné
2024-03-19 12:12             ` Roger Pau Monné via Grub-devel
2024-03-19 13:18   ` Roger Pau Monné
2024-03-19 13:18     ` Roger Pau Monné via Grub-devel
2024-03-19 14:46     ` Ross Lagerwall
2024-03-19 14:46       ` Ross Lagerwall via Grub-devel
2024-03-20 11:04       ` Roger Pau Monné
2024-03-20 11:04         ` Roger Pau Monné via Grub-devel
2024-03-13 15:07 ` [PATCH 2/7] multiboot2: Allow 64-bit entry tags Ross Lagerwall
2024-03-13 15:07   ` Ross Lagerwall via Grub-devel
2024-03-19 10:07   ` Roger Pau Monné
2024-03-19 10:07     ` Roger Pau Monné via Grub-devel
2024-03-28 15:05     ` Ross Lagerwall
2024-03-28 15:05       ` Ross Lagerwall via Grub-devel
2024-03-28 15:41       ` Roger Pau Monné
2024-03-28 15:41         ` Roger Pau Monné via Grub-devel
2024-03-13 15:07 ` [PATCH 3/7] multiboot2: Add support for the load type header tag Ross Lagerwall
2024-03-13 15:07   ` Ross Lagerwall via Grub-devel
2024-03-15  7:30   ` Vladimir 'phcoder' Serbinenko
2024-03-15  7:30     ` Vladimir 'phcoder' Serbinenko
2024-03-28 14:58     ` Ross Lagerwall
2024-03-28 14:58       ` Ross Lagerwall via Grub-devel
2024-03-13 15:07 ` [PATCH 4/7] multiboot2: Add PE load support Ross Lagerwall
2024-03-13 15:07   ` Ross Lagerwall via Grub-devel
2024-03-13 15:07 ` [PATCH 5/7] multiboot2: Add support for 64-bit entry addresses Ross Lagerwall
2024-03-13 15:07   ` Ross Lagerwall via Grub-devel
2024-03-13 15:07 ` [PATCH 6/7] efi: Allow loading multiboot modules without verification Ross Lagerwall
2024-03-13 15:07   ` Ross Lagerwall via Grub-devel
2024-03-13 15:07 ` [PATCH 7/7] verifiers: Verify after decompression Ross Lagerwall
2024-03-13 15:07   ` Ross Lagerwall via Grub-devel
2024-03-15  3:50   ` Michael Chang
2024-03-15  3:50     ` Michael Chang via Grub-devel
2024-03-15  7:25   ` Vladimir 'phcoder' Serbinenko
2024-03-28 14:55     ` Ross Lagerwall via Grub-devel [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAG7k0Epd9aHkha-3Lw5cSGqDkBgzRrMQ-nmZXCEDMj08Xkj=dA@mail.gmail.com' \
    --to=grub-devel@gnu.org \
    --cc=ross.lagerwall@citrix.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.