diff options
| author | Jeremy Cline <jcline@redhat.com> | 2020-03-20 17:56:53 -0400 |
|---|---|---|
| committer | Jeremy Cline <jcline@redhat.com> | 2020-03-23 14:19:30 -0400 |
| commit | e2478b02d5f24647141c9e859b28d20cce8ef675 (patch) | |
| tree | 1927bfd8abd605b2129d8f58e70162e106eb7010 | |
| parent | 7913c4b445b93187f96c95e560ba3e7d859af8f4 (diff) | |
| download | kernel-e2478b02d5f24647141c9e859b28d20cce8ef675.tar.gz kernel-e2478b02d5f24647141c9e859b28d20cce8ef675.tar.xz kernel-e2478b02d5f24647141c9e859b28d20cce8ef675.zip | |
Switch Secure Boot to lock down in integrity mode (rhbz 1815571)
| -rw-r--r-- | efi-secureboot.patch | 2 | ||||
| -rw-r--r-- | s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/efi-secureboot.patch b/efi-secureboot.patch index 326c73a0f..90ac9feca 100644 --- a/efi-secureboot.patch +++ b/efi-secureboot.patch @@ -303,7 +303,7 @@ index 1797623b0c3a..fa8ac411bf6e 100644 + +#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT + if (efi_enabled(EFI_SECURE_BOOT)) -+ security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_CONFIDENTIALITY_MAX); ++ security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX); +#endif + dmi_setup(); diff --git a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch b/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch index 0779418b4..70e3f76a8 100644 --- a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch +++ b/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch @@ -3,7 +3,7 @@ From: Jeremy Cline <jcline@redhat.com> Date: Wed, 30 Oct 2019 14:37:49 +0000 Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set -Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if +Automatically lock down the kernel to LOCKDOWN_INTEGRITY_MAX if the IPL secure flag is set. Suggested-by: Philipp Rudo <prudo@redhat.com> @@ -56,7 +56,7 @@ index 9cbf490fd162..0510ecdfc3f6 100644 log_component_list(); + if (ipl_get_secureboot()) -+ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_CONFIDENTIALITY_MAX); ++ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX); + /* Have one command line that is parsed and saved in /proc/cmdline */ /* boot_command_line has been already set up in early.c */ |