From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1p05TF-0005pm-Dh for mharc-grub-devel@gnu.org; Tue, 29 Nov 2022 13:36:41 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p05TD-0005pV-At for grub-devel@gnu.org; Tue, 29 Nov 2022 13:36:39 -0500 Received: from cheddar.halon.org.uk ([93.93.131.118]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p05TB-00032U-79 for grub-devel@gnu.org; Tue, 29 Nov 2022 13:36:39 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=einval.com; s=default; h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date:From: Reply-To:Subject:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References:X-Debbugs-Cc; bh=BV0OMoxwmNBv78bRM9EVqVZPRoiHa07UdkVgh0pq6NA=; b=4TGd3aM8OTb2WjsZite4KfOfG7 bFQZVwDv4usbMDgmKLGUmjc7Y4Qy5ZuCc3XkqiZR2lMqdSIHQCgs+3zN7seBa19LPG9gVEx+2Brcs RigvuNbEEbQGpmQUoPBunYUQLrUs5ncnIWn5qS4KeOd6hi5jX77jds6eeRSPO0q3HsfhbX7rfFgSM fweLVUknpv7Yl6eUVD005AJ5tFpLCKSxRb8HhA8YnzrClXa8R5cYqSZQDbubWTvBtVq4AfYfCaWfY VuiTPP6NYQuKrzU+CIyJIVzZV+5BdjaCb1GBlW0/HdUUDaNX7klgtlpriAnYHSEwQiN2/eAma7x5d kL3hL99g==; Received: from bsmtp by cheddar.halon.org.uk with local-bsmtp (Exim 4.92) (envelope-from ) id 1p05T6-0007DT-8E for grub-devel@gnu.org; Tue, 29 Nov 2022 18:36:32 +0000 Received: from steve by tack.einval.org with local (Exim 4.94.2) (envelope-from ) id 1p05SK-00Ft5w-Op for grub-devel@gnu.org; Tue, 29 Nov 2022 18:35:44 +0000 Date: Tue, 29 Nov 2022 18:35:44 +0000 From: Steve McIntyre To: grub-devel@gnu.org Subject: Fonts and theming and what to do in future with SB Message-ID: <20221129183523.GN3245702@tack.einval.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-attached: none User-Agent: Mutt/1.10.1 (2018-07-13) Received-SPF: pass client-ip=93.93.131.118; envelope-from=steve@einval.com; helo=cheddar.halon.org.uk X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Nov 2022 18:36:39 -0000 Hey folks! So, with the latest set of GRUB CVE patches we've fixed up a bunch of potential crashes in font-handling code that could lead to Secure Boot holes. These are good and useful fixes, and thanks to Zhang Boyang and everyone else involved! There were also a few other changes: * In SB mode, refuse to load fonts from outside of the signed GRUB image * Restrictions to image dimensions * Fix integer overflow in fbutil Locking down fonts here has caused some issues that I've seen. We didn't update the config generation code in util/grub.d, so we're still generating grub.cfg files that will try (and fail!) to load fonts from other locations at runtime in SB mode. This causes ugly errors, and also causes GRUB to fail to set up video as normal. We can fix this, but it would be nice to agree on something upstream rather than as diverging distro patches. AFAIK Chris Coulson has a patch for the font loader to cause it to try loading fonts from the embedded memdisk first. Is that the best approach? If so, what fonts should we be embedding in the signed image? It's a tradeoff between size and functionality, of course - some people are happy with just "unicode" while others may want a wider choice for added theming options. Is the size an issue for most people? Or... Could/should we look at options to sign fonts separately? I've heard suggestions to embed them into faked-up modules that we could load with insmod, but of course we don't support signing modules yet anyway... :-) Thoughts?? -- Steve McIntyre, Cambridge, UK. steve@einval.com "I used to be the first kid on the block wanting a cranial implant, now I want to be the first with a cranial firewall. " -- Charlie Stross