diff options
| author | Justin M. Forbes <jforbes@fedoraproject.org> | 2020-04-26 21:15:20 -0500 |
|---|---|---|
| committer | Justin M. Forbes <jforbes@fedoraproject.org> | 2020-04-26 21:15:20 -0500 |
| commit | 6c2cc50051831fa502a8b082a312ca90e7039f3f (patch) | |
| tree | bb474cc356d09fb7963eadaeb127a00f7fed6531 /0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch | |
| parent | d1b6f8c7af0eb9a0a44b2d4723e58dde5eafa236 (diff) | |
| download | kernel-6c2cc50051831fa502a8b082a312ca90e7039f3f.tar.gz kernel-6c2cc50051831fa502a8b082a312ca90e7039f3f.tar.xz kernel-6c2cc50051831fa502a8b082a312ca90e7039f3f.zip | |
kernel-5.7.0-0.rc3.1
* Sun Apr 26 2020 CKI@GitLab <cki-project@redhat.com> [5.7.0-0.rc3.1]
- v5.7-rc3 rebase
- Add cec to the filter overrides ("Justin M. Forbes")
- Add overrides to filter-modules.sh ("Justin M. Forbes")
- Adjust the changelog update script to not push anything (Jeremy Cline)
- Drop --target noarch from the rh-rpms make target (Jeremy Cline)
Resolves: rhbz#
Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
Diffstat (limited to '0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch')
| -rw-r--r-- | 0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch index 4d3d56713..3d48363fc 100644 --- a/0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch +++ b/0001-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -1,4 +1,4 @@ -From f8b4469d9bd35b145296f904130218afe52982e4 Mon Sep 17 00:00:00 2001 +From c5b7b6e1b5ef0fedcd96cd4c4fd62f41ecb0275e Mon Sep 17 00:00:00 2001 From: David Howells <dhowells@redhat.com> Date: Mon, 30 Sep 2019 21:28:16 +0000 Subject: [PATCH] efi: Lock down the kernel if booted in secure boot mode @@ -27,12 +27,12 @@ index 08e9f5fc26a8..b6f5510f3d91 100644 #include <linux/tboot.h> +#include <linux/security.h> #include <linux/usb/xhci-dbgp.h> - + #include <uapi/linux/mount.h> @@ -1099,6 +1100,13 @@ void __init setup_arch(char **cmdline_p) if (efi_enabled(EFI_BOOT)) efi_init(); - + + efi_set_secure_boot(boot_params.secure_boot); + +#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT @@ -41,7 +41,7 @@ index 08e9f5fc26a8..b6f5510f3d91 100644 +#endif + dmi_setup(); - + /* diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig index e84ddf484010..d0501353a4b9 100644 @@ -50,7 +50,7 @@ index e84ddf484010..d0501353a4b9 100644 @@ -16,6 +16,19 @@ config SECURITY_LOCKDOWN_LSM_EARLY subsystem is fully initialised. If enabled, lockdown will unconditionally be called before any other LSMs. - + +config LOCK_DOWN_IN_EFI_SECURE_BOOT + bool "Lock down the kernel in EFI Secure Boot mode" + default n @@ -68,5 +68,5 @@ index e84ddf484010..d0501353a4b9 100644 prompt "Kernel default lockdown mode" default LOCK_DOWN_KERNEL_FORCE_NONE -- -2.26.0 +2.26.2 |