From a64e651cbee88e543457039d218733d80dfc63e8 Mon Sep 17 00:00:00 2001
From: Michael Chang <mchang@suse.com>
Date: Fri, 3 Feb 2023 19:40:31 +0800
Subject: [PATCH 153/272] discard cached key before entering grub shell and
 editor mode

The cached key is cleared in case of anyone poking around it by means of
the interactive shell offerings.

Signed-off-by: Michael Chang <mchang@suse.com>
---
 grub-core/commands/crypttab.c | 16 ++++++++++++++++
 grub-core/normal/main.c       |  2 ++
 grub-core/normal/menu_entry.c |  3 +++
 include/grub/crypttab.h       |  2 ++
 4 files changed, 23 insertions(+)

diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c
index bb6ea5724..c2217ca98 100644
--- a/grub-core/commands/crypttab.c
+++ b/grub-core/commands/crypttab.c
@@ -53,6 +53,22 @@ grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len,
   return GRUB_ERR_NONE;
 }
 
+void
+grub_initrd_discard_key (void)
+{
+  struct grub_key_publisher *cur, *nxt;
+
+  FOR_LIST_ELEMENTS_SAFE (cur, nxt, kpuber)
+	{
+	  grub_list_remove (GRUB_AS_LIST (cur));
+	  grub_memset (cur->key, 0, cur->key_len);
+	  grub_free (cur->name);
+	  grub_free (cur->path);
+	  grub_free (cur->key);
+	  grub_free (cur);
+	}
+}
+
 static grub_err_t
 grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)),
 	       int argc, char **argv)
diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
index b5e17344b..a3f711d1d 100644
--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
@@ -37,6 +37,7 @@
 #ifdef GRUB_MACHINE_IEEE1275
 #include <grub/ieee1275/ieee1275.h>
 #endif
+#include <grub/crypttab.h>
 
 GRUB_MOD_LICENSE ("GPLv3+");
 
@@ -478,6 +479,7 @@ grub_cmdline_run (int nested, int force_auth)
       return;
     }
 
+  grub_initrd_discard_key ();
   grub_normal_reader_init (nested);
 
   while (1)
diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c
index ade56be2b..384ab9ce3 100644
--- a/grub-core/normal/menu_entry.c
+++ b/grub-core/normal/menu_entry.c
@@ -28,6 +28,7 @@
 #include <grub/i18n.h>
 #include <grub/charset.h>
 #include <grub/safemath.h>
+#include <grub/crypttab.h>
 
 enum update_mode
   {
@@ -1262,6 +1263,8 @@ grub_menu_entry_run (grub_menu_entry_t entry)
       return;
     }
 
+  grub_initrd_discard_key();
+
   screen = make_screen (entry);
   if (! screen)
     return;
diff --git a/include/grub/crypttab.h b/include/grub/crypttab.h
index 1e1b55b65..113c53cfc 100644
--- a/include/grub/crypttab.h
+++ b/include/grub/crypttab.h
@@ -19,4 +19,6 @@ extern struct grub_key_publisher *EXPORT_VAR (kpuber);
 grub_err_t
 grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path);
 
+void
+grub_initrd_discard_key (void);
 #endif /* ! GRUB_CRYPTTAB_HEADER */
-- 
2.41.0