From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0ACB9CA1017 for ; Sun, 7 Sep 2025 13:41:50 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uvFdi-0003sE-Na; Sun, 07 Sep 2025 09:41:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uvFdf-0003rp-2K for grub-devel@gnu.org; Sun, 07 Sep 2025 09:41:03 -0400 Received: from mail-io1-xd2a.google.com ([2607:f8b0:4864:20::d2a]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1uvFda-0001m6-61 for grub-devel@gnu.org; Sun, 07 Sep 2025 09:41:02 -0400 Received: by mail-io1-xd2a.google.com with SMTP id ca18e2360f4ac-88a07171217so2432839f.1 for ; Sun, 07 Sep 2025 06:40:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1757252450; x=1757857250; darn=gnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=SzmhQcEm+JmWxH5a22is7oGtO6S3PmITxoJN5n/jqro=; b=j2AjX5lOKWKWd+X2Ho0Dzu+sYXWxmKHcsPRE7nSMvynTadyBiQwj1X0hBsIOeje/Yd zhouHS2eQlGyR//Y0wH5w0AOxow7kEUdwFXsySX9shOfbYgfQ+paOFPouQ9b66n9QyN4 87plzxBco8Q8S72L4wk/nFUNONgLdVsh1tVTn4kmuhomy31BTV/XEPzK3xVqTOuKyj33 AMrslSQaEQMre0abzmTg2vL6Q7jK8dtvuFc75EqFW0+idJNJqH0WYRbOTG4uY1MRD/w0 rgECRVOAfi5iRx8KrSF6S4yoQM95K4Lqh6nWR3atZ264X3bsihek2WC+Qdy82Zrz+ojI J/uA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1757252450; x=1757857250; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=SzmhQcEm+JmWxH5a22is7oGtO6S3PmITxoJN5n/jqro=; b=YJEv3jYmWqygVHlKl9nfl5101+05zYy17E6i6eASCdYJKg9tVFdUEBODYgLUIiySwG 3mmgzmqTzuqxp9Fo/3XPH1ZemHDhaOGFeOCwnwb8b1liCcCUW2ONq+R4Pb/tBKiDW0SP Cq1PfWixlGzfEH1DXRNEVPn1oJSVse+n0WoNOhaMDB5GODsL7xuHsrqB9HtFNldZDbpn W84LTje3EZhzdq1WSJaSG5DPIXQsIV5Xp1B2mY8lvuTaOVqR3mWhRw0qDTjPCIDEpVZh m7m8grQhqamf0FVJcU9sCHs7+0mvLbliUdH1Z4vwhcaif7Zz7ac/KMLZPYKX5ffOV4Bo 0Xjg== X-Gm-Message-State: AOJu0YyN8MT8cfmr+j05JmR1WAB+iVjcyhbA6FT/ftClZP2sv/TL/GEB vNdZJ0mJgGxr5XkBsKe1IKd1ZFIzxldfORtlkKjSNkALL7uwvdFuLXRGEIWPfA== X-Gm-Gg: ASbGncsm3+R2Bsg595JM7N0IF5I3qvtpClfkvVria4hsoE1IUDvidIRpidRDOuEh5yr p4k1er4AXsCzKiDk63/wcbkn9l9864jskoWY5jQpYYLWxq1Wqd5c0QH2Pyhh7r1cfrVwq+Ls+d6 OJcb1Mzav4hbXj/o2nUOZ/Il+jlCVHT2ZWeTq/8NrRQ0K3sbRGiqR87b3u/vBVK7iKBzrgpHF+s U7GN4Babqwvh/PlNsV0HXg5MMjgqz+xkZ6BxrfCOw2l9dYroTUU4OcxuS4PKMyL4NSUgIUqlE+Q VkZQdClxrNMuDmRrUtLEVONVOlQTuCRPyS5nw8zwRbr3uTRGviwHnDV030UJGRYyxq9VoBAVYUI v1of3+P0wvd6cNSd3NNFiUj2eOwqUZExu40njXDdCdEdEwH0X6/6jhwJeXVghq/pNp+8CEoo7SW JZKsHrT6Ii0sA5Gw8tuSbCpGKU3g== X-Google-Smtp-Source: AGHT+IHyeZhfYTy2V92ZMWuW0MjnRvIFZ8OugRX5IqGaJ1R8rbTv9HQq1H9pFd9n6cNKAcl0osQH8g== X-Received: by 2002:a05:6e02:1aa1:b0:3f6:618f:6b2b with SMTP id e9e14a558f8ab-3fd87c4d5b5mr69404925ab.28.1757252450002; Sun, 07 Sep 2025 06:40:50 -0700 (PDT) Received: from e039302dk.home.local (204-144-198-4.cgn.imoncommunications.net. [204.144.198.4]) by smtp.gmail.com with ESMTPSA id 8926c6da1cb9f-50d8f31c680sm7655657173.52.2025.09.07.06.40.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 07 Sep 2025 06:40:49 -0700 (PDT) From: Andrew Hamilton To: grub-devel@gnu.org Cc: daniel.kiper@oracle.com, Andrew Hamilton Subject: [PATCH] docs: Add Security Hardening Suggestions Date: Sun, 7 Sep 2025 08:40:41 -0500 Message-ID: <20250907134041.2313-1-adhamilt@gmail.com> X-Mailer: git-send-email 2.47.2 MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::d2a; envelope-from=adhamilt@gmail.com; helo=mail-io1-xd2a.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The development of GNU GRUB Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: grub-devel-bounces+grub-devel=archiver.kernel.org@gnu.org Sender: grub-devel-bounces+grub-devel=archiver.kernel.org@gnu.org QWRkIHNvbWUgc3VnZ2VzdGlvbnMgdG8gdGhlIHNlY3VyaXR5IHNlY3Rpb24gb24gbWF4aW1pemlu ZyB0aGUKc2VjdXJpdHkgaGFyZGVuaW5nIG9mIEdSVUIuCgpTaWduZWQtb2ZmLWJ5OiBBbmRyZXcg SGFtaWx0b24gPGFkaGFtaWx0QGdtYWlsLmNvbT4KLS0tCiBkb2NzL2dydWIudGV4aSB8IDQ1ICsr KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKwogMSBmaWxlIGNoYW5n ZWQsIDQ1IGluc2VydGlvbnMoKykKCmRpZmYgLS1naXQgYS9kb2NzL2dydWIudGV4aSBiL2RvY3Mv Z3J1Yi50ZXhpCmluZGV4IDM0YjM0ODRkYy4uNTUxNzBlNTg5IDEwMDY0NAotLS0gYS9kb2NzL2dy dWIudGV4aQorKysgYi9kb2NzL2dydWIudGV4aQpAQCAtODY3NSw2ICs4Njc1LDcgQEAgZW52aXJv bm1lbnQgdmFyaWFibGVzIGFuZCBjb21tYW5kcyBhcmUgbGlzdGVkIGluIHRoZSBzYW1lIG9yZGVy LgogKiBNZWFzdXJlZCBCb290OjogICAgICAgICAgICAgICAgICAgIE1lYXN1cmluZyBib290IGNv bXBvbmVudHMKICogTG9ja2Rvd246OiAgICAgICAgICAgICAgICAgICAgICAgICBMb2NrZG93biB3 aGVuIGJvb3Rpbmcgb24gYSBzZWN1cmUgc2V0dXAKICogVFBNMiBrZXkgcHJvdGVjdG9yOjogICAg ICAgICAgICAgICBNYW5hZ2luZyBkaXNrIGtleSB3aXRoIFRQTTIga2V5IHByb3RlY3RvcgorKiBI YXJkZW5pbmc6OiAgICAgICAgICAgICAgICAgICAgICAgIENvbmZpZ3VyYXRpb24gYW5kIGN1c3Rv bWl6YXRpb24gdG8gbWF4aW1pemUgc2VjdXJpdHkKIEBlbmQgbWVudQogCiBAbm9kZSBBdXRoZW50 aWNhdGlvbiBhbmQgYXV0aG9yaXNhdGlvbgpAQCAtOTM2Myw2ICs5MzY0LDUwIEBAIHdoaWNoIGlu Y3JlYXNlcyB0aGUgcmlzayBvZiBwYXNzd29yZCBsZWFrYWdlIGR1cmluZyB0aGUgcHJvY2Vzcy4g TW9yZW92ZXIsIHRoZQogc3VwZXJ1c2VyIGxpc3QgbXVzdCBiZSB3ZWxsIG1haW50YWluZWQsIGFu ZCB0aGUgcGFzc3dvcmQgdXNlZCBjYW5ub3QgYmUKIHN5bmNocm9uaXplZCB3aXRoIExVS1Mga2V5 IHJvdGF0aW9uLgogCitAbm9kZSBIYXJkZW5pbmcKK0BzZWN0aW9uIEhhcmRlbmluZworCitTZWN1 cml0eSBoYXJkZW5pbmcgaW52b2x2ZXMgYWRkaXRpb25hbCAvIG9wdGlvbmFsIGNvbmZpZ3VyYXRp b24gYW5kCitjdXN0b21pemF0aW9uIHN0ZXBzIHRvIEdSVUIgdG8gbWF4aW1pemUgc2VjdXJpdHku IFRoZSBleHRlbnQgdG8gd2hpY2gKK2hhcmRlbmluZyBjYW4gYmUgYWNjb21wbGlzaGVkIGRlcGVu ZHMgb24gdGhlIHRocmVhdHMgYXR0ZW1wdGluZyB0byBiZQorbWl0aWdhdGVkIGZvciBhIGdpdmVu IHN5c3RlbSAvIGRldmljZSwgdGhlIGRldmljZSBhcmNoaXRlY3R1cmUsIGFuZCBudW1iZXIKK29m IEdSVUIgZmVhdHVyZXMgcmVxdWlyZWQuIFRoZSBmb2xsb3dpbmcgaXMgYSBsaXN0aW5nIG9mIGhh cmRlbmluZyBzdGVwcyB3aGljaAorbWF5IGJlIGNvbnNpZGVyZWQ6CisKK0BpdGVtaXplCitAaXRl bSAoRUZJIE9ubHkpIEVuYWJsZSBzZWN1cmUgYm9vdCB0byBlbmFibGUgbG9ja2Rvd24gbW9kZS4g VGhpcyB3aWxsIGxpbWl0Cit0aGUgYXR0YWNrIHN1cmZhY2Ugb2YgR1JVQiBieSBsaW1pdGluZyB0 aGUgY29tbWFuZHMgYW5kIGZpbGUgc3lzdGVtcworc3VwcG9ydGVkLiAoQHB4cmVme0xvY2tkb3du fSkKK0BpdGVtIChFRkkgT25seSkgTm8tRXhlY3V0ZSBjYXBhYmlsaXR5IG9mIG1lbW9yeSBzZWdt ZW50cyB3aWxsIGJlIGNvbmZpZ3VyZWQKK2J5IEdSVUIgYXMgaW5kaWNhdGVkIGJ5IHRoZSBVRUZJ LiBUaGlzIG1ha2VzIHNvbWUgY2xhc3NlcyBvZiB2dWxuZXJhYmlsaXRpZXMKK21vcmUgZGlmZmlj dWx0IGJ5IHByb3ZpZGluZyBzdXBwb3J0IGZvciBtYXJraW5nIG1lbW9yeSBhcyBlaXRoZXIgd3Jp dGFibGUgb3IKK2V4ZWN1dGFibGUuCitAaXRlbSAoRUZJIE9ubHkpIFdoaWxlIGJ1aWxkaW5nIEdS VUIsIHRoZSBzdGFjayBwcm90ZWN0b3IgZmVhdHVyZSBtYXkgYmUKK2VuYWJsZWQgZHVyaW5nIHRo ZSBjb25maWd1cmF0aW9uIHN0ZXAuIFRoaXMgZmVhdHVyZSBjYW4gbWFrZSBjZXJ0YWluCit2dWxu ZXJhYmlsaXRpZXMgY2F1c2VkIGJ5IHN0YWNrIGJ1ZmZlciBvdmVyZmxvd3MgbW9yZSBkaWZmaWN1 bHQgdG8gZXhwbG9pdC4KK1RoaXMgY2FuIGJlIGVuYWJsZWQgYnkgaW5jbHVkaW5nIHRoZSAiLS1l bmFibGUtc3RhY2stcHJvdGVjdG9yIiBmbGFnIHRvIHRoZQorY29uZmlndXJlIHNjcmlwdDoKK0Bl eGFtcGxlCisjIEBrYmR7Li9jb25maWd1cmUgLS1lbmFibGUtc3RhY2stcHJvdGVjdG9yfQorQGVu ZCBleGFtcGxlCitQbGVhc2UgcmVmZXJlbmNlIHRoZSBmaWxlIEBmaWxle0lOU1RBTEx9IGZvciBk ZXRhaWxlZCBpbnN0cnVjdGlvbnMgb24gaG93IHRvCitidWlsZCBHUlVCLgorQGl0ZW0gTWluaW1p emUgdGhlIGluc3RhbGxlZCBtb2R1bGVzIGluY2x1ZGVkIHdpdGggdGhlIEdSVUIgaW5zdGFsbGF0 aW9uLgorRm9yIGluc3RhbmNlLCBpZiBhIHNwZWNpZmljIGZpbGUgc3lzdGVtIGlzIHVzZWQgZm9y IGEgZ2l2ZW4gc3lzdGVtLCBtb2R1bGVzCitmb3Igb3RoZXIgZmlsZSBzeXN0ZW1zIG1heSBiZSBl eGNsdWRlZC4gQHB4cmVme01vZHVsZXN9IGZvciBhIGxpc3Qgb2YKK21vZHVsZXMuCitAaXRlbSBN aW5pbWl6ZSBib290IHNvdXJjZXMuIEluIHRoZSBHUlVCIGNvbmZpZ3VyYXRpb24sIHJlZHVjZSB0 aGUgcG9zc2libGUKK2Jvb3Qgc291cmNlcyB0byB0aGUgbWluaW11bSBuZWVkZWQgZm9yIHN5c3Rl bSBvcGVyYXRpb24uIEZvciBpbnN0YW5jZSwgaWYKK2Jvb3Rpbmcgb25seSBmcm9tIGFuIGludGVy bmFsIGRyaXZlLCByZW1vdmUgc3VwcG9ydCBmb3IgbmV0d29yayBib290aW5nCithbmQgYm9vdGlu ZyBmcm9tIHJlbW92YWJsZSBtZWRpYS4KK0BpdGVtIERpc2FibGUgbmV0d29yayBzdXBwb3J0IGlu IEdSVUIgaWYgbm90IHJlcXVpcmVkLiBFbnN1cmUgbmV0d29yaworaW50ZXJmYWNlcyBhcmUgbm90 IGNvbmZpZ3VyZWQgaW4gdGhlIEdSVUIgY29uZmlndXJhdGlvbiBhbmQgY29uc2lkZXIKK3NldHRp bmcgZW52aXJvbm1lbnQgdmFyaWFibGUgQHNhbXB7ZmVhdHVyZV9uZXRfc2VhcmNoX2NmZ30gdG8g QHNhbXB7bn0gaW4gYW4KK2VtYmVkZGVkIEdSVUIgY29uZmlnIGZpbGUgaW4gb3JkZXIgdG8gZGlz YWJsZSBhdHRlbXB0aW5nIHRvIHVzZSB0aGUKK25ldHdvcmsgZm9yIG9idGFpbmluZyBhIEdSVUIg Y29uZmlnIGZpbGUuCitAZW5kIGl0ZW1pemUKKworCiBAbm9kZSBQbGF0Zm9ybSBsaW1pdGF0aW9u cwogQGNoYXB0ZXIgUGxhdGZvcm0gbGltaXRhdGlvbnMKIAotLSAKMi40Ny4yCgoKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KR3J1Yi1kZXZlbCBtYWlsaW5n IGxpc3QKR3J1Yi1kZXZlbEBnbnUub3JnCmh0dHBzOi8vbGlzdHMuZ251Lm9yZy9tYWlsbWFuL2xp c3RpbmZvL2dydWItZGV2ZWwK