update and apply patches for grub and update shim

[sky1122]

Issue number:

Closes #198

Description of changes:
The patches in this serial is for grub6.12 etc upper version of grub not 2.06(the version used in kernel kit). As a result I used patches from Alma because fedora is already in GRUB 2.12. Applying Alma patches, there are 34 patches not applied and after checking there are three patches didn't not exist in the email serial. After checking these 31 patches, manual fixed the rejection, consume extra patches and applied patches. All the patches applied.

• Based on Full mitigation against all will require updated shim with latest SBAT so I also update the shim

In order to consume the patches there are some extra patches I consumed:

• 0588-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
• 0590-fs-ntfs-Make-code-more-readable.patch

These two patches will not introduce new issue based on what they are doing.

In order to applied the patches, the patches I manual fix to apply are

• 0017-gpt-add-search-by-disk-uuid-command.patch
• 0048-fs-tar-Initialize-name-in-grub_cpio_find_file.patch
• 0058-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch
• 0060-2-fs-ntfs-Make-code-more-readable.patch
• 0067-disk-cryptodisk-Require-authentication-after-TPM-unl.patch
• 0075-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch
• 0081-disk-Use-safe-math-macros-to-prevent-overflows.patch

There are also existing patches that we currently carry already took by upsteam so drop them, detail see the commit (grub: update to grub2-2.06-61.amzn2023.0.18)

there is one patch does not take amount all the upstream so I did not take

• [SECURITY PATCH 34/73] kern/dl: Use correct segment in grub_dl_set_mem_attrs(),
• the grub we carry

/* Return the address of a section whose index is N.  */
static void *
grub_dl_get_section_addr (grub_dl_t mod, unsigned n)
{
  grub_dl_segment_t seg;

  for (seg = mod->segment; seg; seg = seg->next)
    if (seg->section == n)
      return seg->addr;

  return 0;
}

• the patches

From: B Horn <b@horn.uk>

The previous code would never actually call grub_update_mem_attrs()
as sh_info will always be zero for the sections that exist in memory.

Reported-by: B Horn <b@horn.uk>
Signed-off-by: B Horn <b@horn.uk>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/kern/dl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
index 99bc12385..acc6ccad6 100644
--- a/grub-core/kern/dl.c
+++ b/grub-core/kern/dl.c
@@ -668,7 +668,7 @@ grub_dl_set_mem_attrs (grub_dl_t mod, void *ehdr)
 
       for (seg = mod->segment; seg; seg = seg->next)
        /* Does this ELF section's index match GRUB DL segment? */
-       if (seg->section == s->sh_info)
+       if (seg->section == i)
          break;
 
       /* No GRUB DL segment found for this ELF section, skip it. */
-- 
2.11.0

so we are not affected by this patch based on the current version is using idx and Elf_Sym *sym from the caller function grub_dl_resolve_symbols

Testing done:
Building the AMI with kernel 6.1, kernel 6.12 to boot and upgrade/downgrade test

• aws-k8s-1.27
  boot sucess

[ssm-user@control]$ apiclient get os
{
  "os": {
    "arch": "x86_64",
    "build_id": "807acc8b",
    "pretty_name": "Bottlerocket OS 1.40.0 (aws-k8s-1.27)",
    "variant_id": "aws-k8s-1.27",
    "version_id": "1.40.0"
  }
}

upgrade

[ssm-user@control]$ apiclient get os
{
  "os": {
    "arch": "x86_64",
    "build_id": "bc3ad241",
    "pretty_name": "Bottlerocket OS 1.41.0 (aws-k8s-1.27)",
    "variant_id": "aws-k8s-1.27",
    "version_id": "1.41.0"
  }
}

downgrade

[ssm-user@control]$ apiclient get os
{
  "os": {
    "arch": "x86_64",
    "build_id": "807acc8b",
    "pretty_name": "Bottlerocket OS 1.40.0 (aws-k8s-1.27)",
    "variant_id": "aws-k8s-1.27",
    "version_id": "1.40.0"
  }
}

• aws-k8s-1.33

upgrade to 1.41.0

[ssm-user@control]$ apiclient get os

{
  "os": {
    "arch": "x86_64",
    "build_id": "bc3ad241",
    "pretty_name": "Bottlerocket OS 1.41.0 (aws-k8s-1.33)",
    "variant_id": "aws-k8s-1.33",
    "version_id": "1.41.0"
  }
}

downgrade to 1.40.0

[root@admin]# apiclient get os
{
  "os": {
    "arch": "x86_64",
    "build_id": "807acc8b-dirty",
    "pretty_name": "Bottlerocket OS 1.40.0 (aws-k8s-1.33)",
    "variant_id": "aws-k8s-1.33",
    "version_id": "1.40.0"
  }
}

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[sky1122]

Build will fail as expected

[sky1122]

forced pushed to add sign-off for the patches that manually fix the rejection

[sky1122]

forced pushed to add left over sign-off for the patch

[sky1122]

forced pushed to change one commit message

[bcressey]

You also need to update the commit below this line.

[bcressey]

These patches definitely should not go away.