diff options
author | Justin M. Forbes <jforbes@fedoraproject.org> | 2021-03-17 12:38:46 -0500 |
---|---|---|
committer | Justin M. Forbes <jforbes@fedoraproject.org> | 2021-03-17 12:38:46 -0500 |
commit | 2d7cbaa6f9fa69d3f60984b67c2d03e57e6d9759 (patch) | |
tree | a1d03aed06bd868aef5d39f73d2bd5b64941612a /0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch | |
parent | 8cb9b8957f6c41855069d943280362fbf45cdbf1 (diff) | |
download | kernel-2d7cbaa6f9fa69d3f60984b67c2d03e57e6d9759.tar.gz kernel-2d7cbaa6f9fa69d3f60984b67c2d03e57e6d9759.tar.xz kernel-2d7cbaa6f9fa69d3f60984b67c2d03e57e6d9759.zip |
kernel-5.11.7-9
* Wed Mar 17 2021 Justin M. Forbes <jforbes@fedoraproject.org> [5.11.7-9]
- Disable weak-modules again rhbz 1828455 (Justin M. Forbes)
- More config updates for gcc-plugin turn off (Justin M. Forbes)
- fedora: the PCH_CAN driver is x86-32 only (Peter Robinson)
- common: disable legacy CAN device support (Peter Robinson)
- common: Enable Microchip MCP251x/MCP251xFD CAN controllers (Peter Robinson)
- common: Bosch MCAN support for Intel Elkhart Lake (Peter Robinson)
- common: enable CAN_PEAK_PCIEFD PCI-E driver (Peter Robinson)
- common: disable CAN_PEAK_PCIEC PCAN-ExpressCard (Peter Robinson)
- common: enable common CAN layer 2 protocols (Peter Robinson)
- ark: disable CAN_LEDS option (Peter Robinson)
Resolves: rhbz#
Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
Diffstat (limited to '0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch')
-rw-r--r-- | 0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch | 67 |
1 files changed, 0 insertions, 67 deletions
diff --git a/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch b/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch deleted file mode 100644 index 6613f6a35..000000000 --- a/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Jeremy Cline <jcline@redhat.com> -Date: Wed, 30 Oct 2019 14:37:49 +0000 -Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set - -Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if -the IPL secure flag is set. - -Upstream Status: RHEL only -Suggested-by: Philipp Rudo <prudo@redhat.com> -Signed-off-by: Jeremy Cline <jcline@redhat.com> ---- - arch/s390/include/asm/ipl.h | 1 + - arch/s390/kernel/ipl.c | 5 +++++ - arch/s390/kernel/setup.c | 4 ++++ - 3 files changed, 10 insertions(+) - -diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h -index 7d5cfdda5277..be66ee5d0437 100644 ---- a/arch/s390/include/asm/ipl.h -+++ b/arch/s390/include/asm/ipl.h -@@ -120,6 +120,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf, - unsigned char flags, unsigned short cert); - int ipl_report_add_certificate(struct ipl_report *report, void *key, - unsigned long addr, unsigned long len); -+bool ipl_get_secureboot(void); - - /* - * DIAG 308 support -diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c -index 90a2a17239b0..be3b72c53656 100644 ---- a/arch/s390/kernel/ipl.c -+++ b/arch/s390/kernel/ipl.c -@@ -2110,3 +2110,8 @@ int ipl_report_free(struct ipl_report *report) - } - - #endif -+ -+bool ipl_get_secureboot(void) -+{ -+ return !!ipl_secure_flag; -+} -diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c -index e600f6953d7c..4264e01824b3 100644 ---- a/arch/s390/kernel/setup.c -+++ b/arch/s390/kernel/setup.c -@@ -49,6 +49,7 @@ - #include <linux/memory.h> - #include <linux/compat.h> - #include <linux/start_kernel.h> -+#include <linux/security.h> - - #include <asm/boot_data.h> - #include <asm/ipl.h> -@@ -1085,6 +1086,9 @@ void __init setup_arch(char **cmdline_p) - - log_component_list(); - -+ if (ipl_get_secureboot()) -+ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX); -+ - /* Have one command line that is parsed and saved in /proc/cmdline */ - /* boot_command_line has been already set up in early.c */ - *cmdline_p = boot_command_line; --- -2.28.0 - |