kernel-5.7.0-0.rc2.20200423git7adc4b399952.1

* Thu Apr 23 2020 CKI@GitLab <cki-project@redhat.com> [5.7.0-0.rc2.20200423git7adc4b399952.1]
- 7adc4b399952 rebase
- Match template format in kernel.spec.template ("Justin M. Forbes")
- Break out the Patches into individual files for dist-git ("Justin M. Forbes")
- Break the Red Hat patch into individual commits (Jeremy Cline)
- Adjust module filtering so CONFIG_DRM_DP_CEC can be set (Jeremy Cline)
- Add a script to generate release tags and branches (Jeremy Cline)
- Set CONFIG_VDPA for fedora ("Justin M. Forbes")
- Provide defaults in ark-rebase-patches.sh (Jeremy Cline)
- Default ark-rebase-patches.sh to not report issues (Jeremy Cline)
Resolves: rhbz#

Signed-off-by: Jeremy Cline <jcline@redhat.com>

1 files changed, 67 insertions, 0 deletions

diff --git a/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch b/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
new file mode 100644
index 000000000..792e1880c
--- /dev/null
+++ b/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
@@ -0,0 +1,67 @@
+From 74b1d77af819053398b9b5adde9b49d7481339af Mon Sep 17 00:00:00 2001
+From: Jeremy Cline <jcline@redhat.com>
+Date: Wed, 30 Oct 2019 14:37:49 +0000
+Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set
+
+Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if
+the IPL secure flag is set.
+
+Upstream Status: RHEL only
+Suggested-by: Philipp Rudo <prudo@redhat.com>
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
+---
+ arch/s390/include/asm/ipl.h | 1 +
+ arch/s390/kernel/ipl.c      | 5 +++++
+ arch/s390/kernel/setup.c    | 4 ++++
+ 3 files changed, 10 insertions(+)
+
+diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
+index b63bd66404b8..3482d9602e68 100644
+--- a/arch/s390/include/asm/ipl.h
++++ b/arch/s390/include/asm/ipl.h
+@@ -109,6 +109,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
+ 			     unsigned char flags, unsigned short cert);
+ int ipl_report_add_certificate(struct ipl_report *report, void *key,
+ 			       unsigned long addr, unsigned long len);
++bool ipl_get_secureboot(void);
+ 
+ /*
+  * DIAG 308 support
+diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
+index 4a71061974fd..9baf0b570c3d 100644
+--- a/arch/s390/kernel/ipl.c
++++ b/arch/s390/kernel/ipl.c
+@@ -1901,3 +1901,8 @@ int ipl_report_free(struct ipl_report *report)
+ }
+ 
+ #endif
++
++bool ipl_get_secureboot(void)
++{
++	return !!ipl_secure_flag;
++}
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 36445dd40fdb..b338a050c5aa 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -49,6 +49,7 @@
+ #include <linux/memory.h>
+ #include <linux/compat.h>
+ #include <linux/start_kernel.h>
++#include <linux/security.h>
+ 
+ #include <asm/boot_data.h>
+ #include <asm/ipl.h>
+@@ -1093,6 +1094,9 @@ void __init setup_arch(char **cmdline_p)
+ 
+ 	log_component_list();
+ 
++	if (ipl_get_secureboot())
++		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
++
+ 	/* Have one command line that is parsed and saved in /proc/cmdline */
+ 	/* boot_command_line has been already set up in early.c */
+ 	*cmdline_p = boot_command_line;
+-- 
+2.26.0
+