Personal patches
ea60da8202
sysutils/grub2-bhyve: Neutralize privileged guest commands GRUB was designed to run in a trusted environment, where anyone with access to grub2.cfg could also modify grub itself. In grub2-bhyve, we have modified it to run in host context, but interpret the commands of guest grub2.cfg. This means we have to worry about malicious guests. This patch addresses two escalation vectors: font-loading, and the direct 'read', 'write', 'in', and 'out' commands (which read/write arbitrary addresses). Both reported by Reno Robert. Disable font-loading by neutering the command. It is believed to be non- essential and there is at least one buffer overflow in the font loading code. Disable reading and writing host memory and IO ports. It is believed to be non-essential. admbugs: 948 Reported by: Reno Robert <renorobert AT gmail.com> Approved by: bapt Security: yes Approved by: portmgr (bapt) |
||
---|---|---|
accessibility | ||
arabic | ||
archivers | ||
astro | ||
audio | ||
base | ||
benchmarks | ||
biology | ||
cad | ||
chinese | ||
comms | ||
converters | ||
databases | ||
deskutils | ||
devel | ||
dns | ||
editors | ||
emulators | ||
finance | ||
french | ||
ftp | ||
games | ||
german | ||
graphics | ||
hebrew | ||
hungarian | ||
irc | ||
japanese | ||
java | ||
Keywords | ||
korean | ||
lang | ||
math | ||
misc | ||
Mk | ||
multimedia | ||
net | ||
net-im | ||
net-mgmt | ||
net-p2p | ||
news | ||
polish | ||
ports-mgmt | ||
portuguese | ||
russian | ||
science | ||
security | ||
shells | ||
sysutils | ||
Templates | ||
textproc | ||
Tools | ||
ukrainian | ||
vietnamese | ||
www | ||
x11 | ||
x11-clocks | ||
x11-drivers | ||
x11-fm | ||
x11-fonts | ||
x11-servers | ||
x11-themes | ||
x11-toolkits | ||
x11-wm | ||
.arcconfig | ||
.gitattributes | ||
.gitauthors | ||
.gitignore | ||
.gitmessage | ||
CHANGES | ||
CONTRIBUTING.md | ||
COPYRIGHT | ||
GIDs | ||
LEGAL | ||
Makefile | ||
MOVED | ||
README | ||
UIDs | ||
UPDATING |
This is the FreeBSD Ports Collection. For an easy to use WEB-based interface to it, please see: https://www.FreeBSD.org/ports For general information on the Ports Collection, please see the FreeBSD Handbook ports section which is available from: https://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/ports.html for the latest official version or: The ports(7) manual page (man ports). These will explain how to use ports and packages. If you would like to search for a port, you can do so easily by saying (in /usr/ports): make search name="<name>" or: make search key="<keyword>" which will generate a list of all ports matching <name> or <keyword>. make search also supports wildcards, such as: make search name="gtk*" For information about contributing to FreeBSD ports, please see the Porter's Handbook, available at: https://www.FreeBSD.org/doc/en_US.ISO8859-1/books/porters-handbook/ NOTE: This tree will GROW significantly in size during normal usage! The distribution tar files can and do accumulate in /usr/ports/distfiles, and the individual ports will also use up lots of space in their work subdirectories unless you remember to "make clean" after you're done building a given port. /usr/ports/distfiles can also be periodically cleaned without ill-effect.