From 3d05ffeec5855fba0019b15c215dc89818ab34ea Mon Sep 17 00:00:00 2001
From: zhangkun2 <zhangkun2@uniontech.com>
Date: Tue, 11 Aug 2026 20:42:07 +0800
Subject: [PATCH] fix: grub2 hash validation and mkconfig fallback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. Add package-level pbkdf2HashReg and validate the PBKDF2 hash format
   in EditAuth.Enable() before writing the crypto file, rejecting
   malformed hashes that grub would silently ignore.
2. Fix runUpdateGrubWithUnit(): when update-grub is not in PATH, run
   'grub-mkconfig -o <grub.cfg>' instead of the broken fallback that
   appended update-grub and never executed grub-mkconfig.
3. Add regexp import.

Log: Fixed grub boot menu edit auth failing when update-grub is missing; added hash validation to prevent silent auth bypass

Influence:
1. Enable grub edit auth with a valid pbkdf2 hash and confirm it is
   written and grub prompts for password.
2. Enable with an invalid hash and confirm the DBus call returns an
   error instead of writing a broken config.
3. On a system with only grub-mkconfig (no update-grub), confirm
   grub.cfg is regenerated.

fix: grub2 哈希校验与 mkconfig 回退修正

1. 新增包级 pbkdf2HashReg 正则，在 EditAuth.Enable() 写入前校验
   PBKDF2 哈希格式，拒绝会被 grub 静默忽略的非法哈希。
2. 修正 runUpdateGrubWithUnit()：update-grub 不在 PATH 时改用
   'grub-mkconfig -o <grub.cfg>'，原 fallback 错误地 append 了
   update-grub 导致 grub-mkconfig 从未执行。
3. 新增 regexp import。

Log: 修复 update-grub 缺失时 grub 启动菜单编辑认证失效，并增加哈希校验防止静默绕过

Influence:
1. 用合法 pbkdf2 哈希开启 grub 编辑认证，确认写入并在 grub 提示密码。
2. 用非法哈希开启，确认 DBus 返回错误而非写入错误配置。
3. 在仅有 grub-mkconfig（无 update-grub）的系统上确认
   grub.cfg 能重新生成。

PMS: BUG-371591
---
 grub2/edit_auth_ifc.go | 9 +++++++++
 grub2/modify_manger.go | 3 +--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/grub2/edit_auth_ifc.go b/grub2/edit_auth_ifc.go
index db3407b53..42f293a33 100644
--- a/grub2/edit_auth_ifc.go
+++ b/grub2/edit_auth_ifc.go
@@ -6,6 +6,7 @@ package grub2
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 	"unicode"
 
@@ -18,6 +19,10 @@ const (
 	editAuthDBusInterface = dbusInterface + ".EditAuthentication"
 )
 
+// pbkdf2HashReg 用于校验 grub 编辑认证密码的 PBKDF2 哈希格式：
+// grub.pbkdf2.sha<alg>.<iterations>.<salt>.<hash>
+var pbkdf2HashReg = regexp.MustCompile(`^grub\.pbkdf2\.sha\d+\.\d+\.[0-9A-Fa-f]+\.[0-9A-Fa-f]+$`)
+
 func (e *EditAuth) GetInterfaceName() string {
 	return editAuthDBusInterface
 }
@@ -37,6 +42,10 @@ func (e *EditAuth) Enable(sender dbus.Sender, username, password string) *dbus.E
 		return dbusutil.ToError(fmt.Errorf("username or password invalid"))
 	}
 
+	if !pbkdf2HashReg.MatchString(password) {
+		return dbusutil.ToError(fmt.Errorf("invalid pbkdf2 hash format"))
+	}
+
 	err = e.setGrubEditShellAuth(username, password)
 	if err != nil {
 		return dbusutil.ToError(err)
diff --git a/grub2/modify_manger.go b/grub2/modify_manger.go
index ec1187160..13273af01 100644
--- a/grub2/modify_manger.go
+++ b/grub2/modify_manger.go
@@ -162,8 +162,7 @@ func (m *modifyManager) runUpdateGrubWithUnit() error {
 	var command []string
 	path, err := exec.LookPath(updateGrubCmd)
 	if err != nil {
-		path = grubMkconfigCmd
-		command = append(command, updateGrubCmd, "-o", grubScriptFile)
+		command = append(command, grubMkconfigCmd, "-o", grubScriptFile)
 	} else {
 		command = append(command, path)
 	}