Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-03-02 Thread Andrew Hamilton
>> by a Windows application. Thanks for any information. Should the lockdown >> for NTFS remain, is it here to stay indefinitely? > >We did a lot of work to improve the NTFS code but still we are not sure >it is fully correct. If somebody will do full NTFS code analysis and >properly fix all (poten

Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-02-24 Thread Andrew Hamilton
Thanks I will submit a GRUB documentation patch when I get back from vacation. Thanks! Andrew On Mon, Feb 24, 2025 at 9:18 AM Daniel Kiper wrote: > On Wed, Feb 19, 2025 at 09:43:59AM -0600, Andrew Hamilton wrote: > > It seems this may impact some users attempting to use secure boot, I > think I

Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-02-24 Thread Daniel Kiper via Grub-devel
On Wed, Feb 19, 2025 at 09:43:59AM -0600, Andrew Hamilton wrote: > It seems this may impact some users attempting to use secure boot, I think I > understand the reasoning behind this but maybe we should have something on the > roadmap or issue tracker for what it would take to get these file system

Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-02-24 Thread Daniel Kiper
On Fri, Feb 21, 2025 at 12:20:39PM +0100, Pascal Hambourg wrote: > On 20/02/2025 at 17:43, Daniel Kiper wrote: > > On Wed, Feb 19, 2025 at 09:15:50AM +0100, Petr Řehák wrote: > >> > >> why is there a lockdown for the NTFS file system, please? Is it vulnerable > >> as well when no CVE exists for it?

Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-02-21 Thread Pascal Hambourg
On 20/02/2025 at 17:43, Daniel Kiper wrote: > On Wed, Feb 19, 2025 at 09:15:50AM +0100, Petr Řehák wrote: >> >> why is there a lockdown for the NTFS file system, please? Is it vulnerable >> as well when no CVE exists for it? We are developers of computer-aided >> assistive technology for blind and

Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-02-20 Thread Daniel Kiper
Hi Petr, On Wed, Feb 19, 2025 at 09:15:50AM +0100, Petr Řehák wrote: > Hello, > > why is there a lockdown for the NTFS file system, please? Is it vulnerable > as well when no CVE exists for it? We are developers of computer-aided > assistive technology for blind and visually impaired Windows users

Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-02-19 Thread Andrew Hamilton
It seems this may impact some users attempting to use secure boot, I think I understand the reasoning behind this but maybe we should have something on the roadmap or issue tracker for what it would take to get these file systems more robust (fuzzing and/or test coverage)? Also should we update gr

Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-02-19 Thread Petr Řehák
Hello, why is there a lockdown for the NTFS file system, please? Is it vulnerable as well when no CVE exists for it? We are developers of computer-aided assistive technology for blind and visually impaired Windows users and this will prevent our GRUB to communicate with Windows, supplying ne

[SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

2025-02-18 Thread Daniel Kiper via Grub-devel
From: Daniel Axtens The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat, hfsplus, iso9660, squash4, tar, xfs and zfs. The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were reported by Jonathan Bar Or . Fixes: CVE-2025-0677 Fixes: CVE-2025-0684 Fixes: CVE-2025-0