summaryrefslogtreecommitdiff
path: root/config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch
diff options
context:
space:
mode:
authorLeah Rowe <leah@libreboot.org>2024-06-22 21:44:49 +0100
committerLeah Rowe <leah@libreboot.org>2024-06-22 21:44:49 +0100
commit71137b12b497e6935c81bf5fc73a0c17246fafd2 (patch)
tree0446ae765af2fb3db9f461e135def0e629bec9cd /config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch
parentd4d5d2902c020419057d63c9791804906a6c60dd (diff)
roms: remove support for "grubonly" seabios
due to lbmk issue #216, it is now unwise to use grub as the primary payload on any machine; the sheer complexity of grub and the number of memory corruption bugs that have been fixed due to auditing over the years, means more such bugs exist. we now provide seabios as the primary payload on all x86 ports, but provide a "grubfirst" configuration where a bootorder file in seabios can be added via cbfs, which tells seabios to load grub from cbfs first, while still allowing use of the boot select menu by pressing esc in seabios. well, the "grubonly" option also disables the seabios esc menu, so that *only* grub runs. there is no point in using this unless you want to harden your setup, for example if you want to set up encrypted /boot and boot that from grub, and have a grub password disallowing unauthorised bootup of your machine. see grub hardening guide; https://libreboot.org/docs/linux/grub_hardening.html at least as of today, 22 June 2024, that page already says how to manually disable the seabios menu in the same way, if that is the setup you want. alternatively, a user may be wily enough to edit target.cfg for their board and compile a rom that only has the grub payload in it, if that is what the user wishes to do. regardless, the default configurations provided by lbmk must never be unsafe, norc should the build system support such unsafe settings; yes, grub as primary payload is technically still supported in lbmk. actually, at the time of this revision, i have half a mind to remove that functionality altogether, so that only seabios is allowed as primary payload, when compiling a rom image that also has grub, chainloading grub from the seabios menu instead. Signed-off-by: Leah Rowe <leah@libreboot.org>
Diffstat (limited to 'config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch')
0 files changed, 0 insertions, 0 deletions