diff options
author | Justin M. Forbes <jforbes@fedoraproject.org> | 2020-06-30 09:24:22 -0500 |
---|---|---|
committer | Justin M. Forbes <jforbes@fedoraproject.org> | 2020-06-30 09:24:22 -0500 |
commit | d176dfce22f5ead7a6018edb69757bc8840cc008 (patch) | |
tree | aa15398098e0f20a9fb643441ec8443b2ffd6328 /0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch | |
parent | 61b5e2fd06a4be7134afb1cd363002e015123f7f (diff) | |
download | kernel-d176dfce22f5ead7a6018edb69757bc8840cc008.tar.gz kernel-d176dfce22f5ead7a6018edb69757bc8840cc008.tar.xz kernel-d176dfce22f5ead7a6018edb69757bc8840cc008.zip |
kernel-5.8.0-0.rc3.20200630git7c30b859a947.1
* Tue Jun 30 2020 Fedora Kernel Team <kernel-team@fedoraproject.org> [5.8.0-0.rc3.20200630git7c30b859a947.1]
- 7c30b859a947 rebase
- Updated changelog for the release based on v5.8-rc3 (Fedora Kernel Team)
Resolves: rhbz#
Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
Diffstat (limited to '0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch')
-rw-r--r-- | 0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch index 70fc76355..3d262ba84 100644 --- a/0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch +++ b/0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -27,12 +27,12 @@ index 28d43754aeb6..19d57bfc12f9 100644 #include <linux/tboot.h> +#include <linux/security.h> #include <linux/usb/xhci-dbgp.h> - + #include <uapi/linux/mount.h> @@ -1105,6 +1106,13 @@ void __init setup_arch(char **cmdline_p) if (efi_enabled(EFI_BOOT)) efi_init(); - + + efi_set_secure_boot(boot_params.secure_boot); + +#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT @@ -41,7 +41,7 @@ index 28d43754aeb6..19d57bfc12f9 100644 +#endif + dmi_setup(); - + /* diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig index e84ddf484010..d0501353a4b9 100644 @@ -50,7 +50,7 @@ index e84ddf484010..d0501353a4b9 100644 @@ -16,6 +16,19 @@ config SECURITY_LOCKDOWN_LSM_EARLY subsystem is fully initialised. If enabled, lockdown will unconditionally be called before any other LSMs. - + +config LOCK_DOWN_IN_EFI_SECURE_BOOT + bool "Lock down the kernel in EFI Secure Boot mode" + default n @@ -68,5 +68,5 @@ index e84ddf484010..d0501353a4b9 100644 prompt "Kernel default lockdown mode" default LOCK_DOWN_KERNEL_FORCE_NONE -- -2.25.4 +2.26.2 |