summaryrefslogtreecommitdiffstats
path: root/Add-option-to-automatically-enforce-module-signature.patch
diff options
context:
space:
mode:
authorLaura Abbott <labbott@fedoraproject.org>2017-05-15 12:41:31 -0700
committerLaura Abbott <labbott@fedoraproject.org>2017-05-15 14:26:51 -0700
commit42d57b05d4d637ef0082c68e6cbb6528e1c8808d (patch)
tree5d351212f499cbb01b1d49996771604def322809 /Add-option-to-automatically-enforce-module-signature.patch
parent2772b1ac627db8629b28d35d30785496842cb07c (diff)
downloadkernel-42d57b05d4d637ef0082c68e6cbb6528e1c8808d.tar.gz
kernel-42d57b05d4d637ef0082c68e6cbb6528e1c8808d.tar.xz
kernel-42d57b05d4d637ef0082c68e6cbb6528e1c8808d.zip
Linux v4.11.1 rebase
Diffstat (limited to 'Add-option-to-automatically-enforce-module-signature.patch')
-rw-r--r--Add-option-to-automatically-enforce-module-signature.patch217
1 files changed, 0 insertions, 217 deletions
diff --git a/Add-option-to-automatically-enforce-module-signature.patch b/Add-option-to-automatically-enforce-module-signature.patch
deleted file mode 100644
index ebabac62e..000000000
--- a/Add-option-to-automatically-enforce-module-signature.patch
+++ /dev/null
@@ -1,217 +0,0 @@
-From 6b6203b92cfb457a0669a9c87a29b360405bffc6 Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <matthew.garrett@nebula.com>
-Date: Fri, 9 Aug 2013 18:36:30 -0400
-Subject: [PATCH 10/20] Add option to automatically enforce module signatures
- when in Secure Boot mode
-
-UEFI Secure Boot provides a mechanism for ensuring that the firmware will
-only load signed bootloaders and kernels. Certain use cases may also
-require that all kernel modules also be signed. Add a configuration option
-that enforces this automatically when enabled.
-
-Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
----
- Documentation/x86/zero-page.txt | 2 ++
- arch/x86/Kconfig | 11 ++++++
- arch/x86/boot/compressed/eboot.c | 66 +++++++++++++++++++++++++++++++++++
- arch/x86/include/uapi/asm/bootparam.h | 3 +-
- arch/x86/kernel/setup.c | 6 ++++
- include/linux/module.h | 6 ++++
- kernel/module.c | 7 ++++
- 7 files changed, 100 insertions(+), 1 deletion(-)
-
-diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt
-index 95a4d34af3fd..b8527c6b7646 100644
---- a/Documentation/x86/zero-page.txt
-+++ b/Documentation/x86/zero-page.txt
-@@ -31,6 +31,8 @@ Offset Proto Name Meaning
- 1E9/001 ALL eddbuf_entries Number of entries in eddbuf (below)
- 1EA/001 ALL edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer
- (below)
-+1EB/001 ALL kbd_status Numlock is enabled
-+1EC/001 ALL secure_boot Secure boot is enabled in the firmware
- 1EF/001 ALL sentinel Used to detect broken bootloaders
- 290/040 ALL edd_mbr_sig_buffer EDD MBR signatures
- 2D0/A00 ALL e820_map E820 memory map table
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index bada636d1065..d666ef8b616c 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -1786,6 +1786,17 @@ config EFI_MIXED
-
- If unsure, say N.
-
-+config EFI_SECURE_BOOT_SIG_ENFORCE
-+ def_bool n
-+ depends on EFI
-+ prompt "Force module signing when UEFI Secure Boot is enabled"
-+ ---help---
-+ UEFI Secure Boot provides a mechanism for ensuring that the
-+ firmware will only load signed bootloaders and kernels. Certain
-+ use cases may also require that all kernel modules also be signed.
-+ Say Y here to automatically enable module signature enforcement
-+ when a system boots with UEFI Secure Boot enabled.
-+
- config SECCOMP
- def_bool y
- prompt "Enable seccomp to safely compute untrusted bytecode"
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index cc69e37548db..ebc85c1eefd6 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -12,6 +12,7 @@
- #include <asm/efi.h>
- #include <asm/setup.h>
- #include <asm/desc.h>
-+#include <asm/bootparam_utils.h>
-
- #include "../string.h"
- #include "eboot.h"
-@@ -537,6 +538,67 @@ static void setup_efi_pci(struct boot_params *params)
- efi_call_early(free_pool, pci_handle);
- }
-
-+static int get_secure_boot(void)
-+{
-+ u8 sb, setup;
-+ unsigned long datasize = sizeof(sb);
-+ efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID;
-+ efi_status_t status;
-+
-+ status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
-+ L"SecureBoot", &var_guid, NULL, &datasize, &sb);
-+
-+ if (status != EFI_SUCCESS)
-+ return 0;
-+
-+ if (sb == 0)
-+ return 0;
-+
-+
-+ status = efi_early->call((unsigned long)sys_table->runtime->get_variable,
-+ L"SetupMode", &var_guid, NULL, &datasize,
-+ &setup);
-+
-+ if (status != EFI_SUCCESS)
-+ return 0;
-+
-+ if (setup == 1)
-+ return 0;
-+
-+ return 1;
-+}
-+
-+
-+/*
-+ * See if we have Graphics Output Protocol
-+ */
-+static efi_status_t setup_gop(struct screen_info *si, efi_guid_t *proto,
-+ unsigned long size)
-+{
-+ efi_status_t status;
-+ void **gop_handle = NULL;
-+
-+ status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
-+ size, (void **)&gop_handle);
-+ if (status != EFI_SUCCESS)
-+ return status;
-+
-+ status = efi_call_early(locate_handle,
-+ EFI_LOCATE_BY_PROTOCOL,
-+ proto, NULL, &size, gop_handle);
-+ if (status != EFI_SUCCESS)
-+ goto free_handle;
-+
-+ if (efi_early->is64)
-+ status = setup_gop64(si, proto, size, gop_handle);
-+ else
-+ status = setup_gop32(si, proto, size, gop_handle);
-+
-+free_handle:
-+ efi_call_early(free_pool, gop_handle);
-+ return status;
-+}
-+
- static efi_status_t
- setup_uga32(void **uga_handle, unsigned long size, u32 *width, u32 *height)
- {
-@@ -1094,6 +1156,10 @@ struct boot_params *efi_main(struct efi_config *c,
- else
- setup_boot_services32(efi_early);
-
-+ sanitize_boot_params(boot_params);
-+
-+ boot_params->secure_boot = get_secure_boot();
-+
- setup_graphics(boot_params);
-
- setup_efi_pci(boot_params);
-diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
-index c18ce67495fa..2b3e5427097b 100644
---- a/arch/x86/include/uapi/asm/bootparam.h
-+++ b/arch/x86/include/uapi/asm/bootparam.h
-@@ -134,7 +134,8 @@ struct boot_params {
- __u8 eddbuf_entries; /* 0x1e9 */
- __u8 edd_mbr_sig_buf_entries; /* 0x1ea */
- __u8 kbd_status; /* 0x1eb */
-- __u8 _pad5[3]; /* 0x1ec */
-+ __u8 secure_boot; /* 0x1ec */
-+ __u8 _pad5[2]; /* 0x1ed */
- /*
- * The sentinel is set to a nonzero value (0xff) in header.S.
- *
-diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index bbfbca5fea0c..d40e961753c9 100644
---- a/arch/x86/kernel/setup.c
-+++ b/arch/x86/kernel/setup.c
-@@ -1160,6 +1160,12 @@ void __init setup_arch(char **cmdline_p)
-
- io_delay_init();
-
-+#ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE
-+ if (boot_params.secure_boot) {
-+ enforce_signed_modules();
-+ }
-+#endif
-+
- /*
- * Parse the ACPI tables for possible boot-time SMP configuration.
- */
-diff --git a/include/linux/module.h b/include/linux/module.h
-index 05bd6c989a0c..32327704e18d 100644
---- a/include/linux/module.h
-+++ b/include/linux/module.h
-@@ -260,6 +260,12 @@ extern const typeof(name) __mod_##type##__##name##_device_table \
-
- struct notifier_block;
-
-+#ifdef CONFIG_MODULE_SIG
-+extern void enforce_signed_modules(void);
-+#else
-+static inline void enforce_signed_modules(void) {};
-+#endif
-+
- #ifdef CONFIG_MODULES
-
- extern int modules_disabled; /* for sysctl */
-diff --git a/kernel/module.c b/kernel/module.c
-index cb864505d020..cb1f1da69bf4 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -4285,6 +4285,13 @@ void module_layout(struct module *mod,
- EXPORT_SYMBOL(module_layout);
- #endif
-
-+#ifdef CONFIG_MODULE_SIG
-+void enforce_signed_modules(void)
-+{
-+ sig_enforce = true;
-+}
-+#endif
-+
- bool secure_modules(void)
- {
- #ifdef CONFIG_MODULE_SIG
---
-2.9.3
-