Linux v4.18-7873-gf91e654474d4

1 files changed, 21 insertions, 20 deletions

diff --git a/efi-lockdown.patch b/efi-lockdown.patch
index 09b89db58..307b272f4 100644
--- a/efi-lockdown.patch
+++ b/efi-lockdown.patch
@@ -530,14 +530,14 @@ in secure boot lockdown mode.
 Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
 Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- security/integrity/ima/ima_policy.c | 39 +++++++++++++++++++++++++++----------
- 1 file changed, 29 insertions(+), 10 deletions(-)
+ security/integrity/ima/ima_policy.c | 34 +++++++++++++++++++++++------
+ 1 file changed, 27 insertions(+), 7 deletions(-)
 
 diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
-index d89bebf85421..da6f55c96a61 100644
+index 8c9499867c91..f8428f579924 100644
 --- a/security/integrity/ima/ima_policy.c
 +++ b/security/integrity/ima/ima_policy.c
-@@ -443,14 +443,21 @@ void ima_update_policy_flag(void)
+@@ -481,14 +481,21 @@ static int ima_appraise_flag(enum ima_hooks func)
   */
  void __init ima_init_policy(void)
  {
@@ -547,7 +547,7 @@ index d89bebf85421..da6f55c96a61 100644
 +	int appraise_entries = 0;
 +	int secure_boot_entries = 0;
 +	bool kernel_locked_down = __kernel_is_locked_down(NULL, false);
-
+ 
  	/* if !ima_policy set entries = 0 so we load NO default rules */
 -	measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 -	appraise_entries = ima_use_appraise_tcb ?
@@ -562,16 +562,17 @@ index d89bebf85421..da6f55c96a61 100644
 +
 +	if (ima_use_secure_boot || kernel_locked_down)
 +		secure_boot_entries = ARRAY_SIZE(secure_boot_rules);
-
+ 
  	for (i = 0; i < measure_entries; i++)
  		list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
-@@ -487,12 +494,24 @@ void __init ima_init_policy(void)
+@@ -509,12 +516,25 @@ void __init ima_init_policy(void)
  
  	/*
- 	 * Insert the appraise rules requiring file signatures, prior to
--	 * any other appraise rules.
-+	 * any other appraise rules.  In secure boot lock-down mode, also
-+	 * require these appraise rules for custom policies.
+ 	 * Insert the builtin "secure_boot" policy rules requiring file
+-	 * signatures, prior to any other appraise rules.
++	 * signatures, prior to any other appraise rules.  In secure boot
++	 * lock-down mode, also require these appraise rules for custom
++	 * policies.
  	 */
  	for (i = 0; i < secure_boot_entries; i++) {
 +		struct ima_rule_entry *entry;
@@ -590,9 +591,9 @@ index d89bebf85421..da6f55c96a61 100644
 +		}
  	}
  
- 	for (i = 0; i < appraise_entries; i++) {
+ 	/*
 -- 
-2.14.3
+2.17.1
 
 From 64b01ecc309c8ae79209e00dd8b95a549e5050b7 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
@@ -811,13 +812,13 @@ cc: kexec@lists.infradead.org
  1 file changed, 7 insertions(+)
 
 diff --git a/kernel/kexec.c b/kernel/kexec.c
-index aed8fb2564b3..1553ac765e73 100644
+index 68559808fdfa..041d505070e1 100644
 --- a/kernel/kexec.c
 +++ b/kernel/kexec.c
-@@ -199,6 +199,13 @@ static inline int kexec_load_check(unsigned long nr_segments,
+@@ -202,6 +202,13 @@ static inline int kexec_load_check(unsigned long nr_segments,
  	if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)
  		return -EPERM;
-
+ 
 +	/*
 +	 * kexec can be used to circumvent module loading restrictions, so
 +	 * prevent loading in that case
@@ -825,11 +826,11 @@ index aed8fb2564b3..1553ac765e73 100644
 +	if (kernel_is_locked_down("kexec of unsigned images"))
 +		return -EPERM;
 +
- 	/*
- 	 * Verify we have a legal set of flags
- 	 * This leaves us room for future extensions.
+ 	/* Permit LSMs and IMA to fail the kexec */
+ 	result = security_kernel_load_data(LOADING_KEXEC_IMAGE);
+ 	if (result < 0)
 -- 
-2.14.3
+2.17.1
 
 From aed8ee965258e3926be6aaeb57aef8a9a03c9989 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>