Linux v5.0-7001-g610cd4eadec4

1 files changed, 205 insertions, 291 deletions

diff --git a/efi-lockdown.patch b/efi-lockdown.patch
index 471f4222f..8bce057fa 100644
--- a/efi-lockdown.patch
+++ b/efi-lockdown.patch
@@ -1,7 +1,7 @@
-From 73958cc1f78cfc69f3b1ec26a3406b3c45f6d202 Mon Sep 17 00:00:00 2001
+From e8b9c4420c929255708e0bff42142de49ff1971b Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Mon, 9 Apr 2018 09:52:45 +0100
-Subject: [PATCH 01/24] Add the ability to lock down access to the running
+Subject: [PATCH 01/22] Add the ability to lock down access to the running
  kernel image
 
 Provide a single call to allow kernel code to determine whether the system
@@ -43,34 +43,34 @@ primarily applies to ISA hardware devices.
 Signed-off-by: David Howells <dhowells@redhat.com>
 ---
  arch/x86/kernel/setup.c |  2 ++
- include/linux/kernel.h  | 32 ++++++++++++++++++++++++
- security/Kconfig        | 23 ++++++++++++++++-
- security/Makefile       |  3 +++
- security/lock_down.c    | 65 +++++++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/kernel.h  | 32 ++++++++++++++++++++
+ security/Kconfig        | 23 ++++++++++++++-
+ security/Makefile       |  3 ++
+ security/lock_down.c    | 65 +++++++++++++++++++++++++++++++++++++++++
  5 files changed, 124 insertions(+), 1 deletion(-)
  create mode 100644 security/lock_down.c
 
 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index 6285697b6e56..566f0f447053 100644
+index 3d872a527cd9..cf2f3df1b8d7 100644
 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
-@@ -996,6 +996,8 @@ void __init setup_arch(char **cmdline_p)
+@@ -1005,6 +1005,8 @@ void __init setup_arch(char **cmdline_p)
  	if (efi_enabled(EFI_BOOT))
  		efi_init();
-
+ 
 +	init_lockdown();
 +
  	dmi_scan_machine();
  	dmi_memdev_walk();
  	dmi_set_dump_stack_arch_desc();
 diff --git a/include/linux/kernel.h b/include/linux/kernel.h
-index 4ae1dfd9bf05..7d085cca9cee 100644
+index a8868a32098c..4e63db72cfea 100644
 --- a/include/linux/kernel.h
 +++ b/include/linux/kernel.h
-@@ -306,6 +306,38 @@ static inline void refcount_error_report(struct pt_regs *regs, const char *err)
+@@ -350,6 +350,38 @@ static inline void refcount_error_report(struct pt_regs *regs, const char *err)
  { }
  #endif
-
+ 
 +#ifdef CONFIG_LOCK_DOWN_KERNEL
 +extern void __init init_lockdown(void);
 +extern bool __kernel_is_locked_down(const char *what, bool first);
@@ -107,13 +107,13 @@ index 4ae1dfd9bf05..7d085cca9cee 100644
  int __must_check _kstrtoul(const char *s, unsigned int base, unsigned long *res);
  int __must_check _kstrtol(const char *s, unsigned int base, long *res);
 diff --git a/security/Kconfig b/security/Kconfig
-index c4302067a3ad..a68e5bdebad5 100644
+index 1d6463fb1450..44c6a0da6f21 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
-@@ -231,6 +231,28 @@ config STATIC_USERMODEHELPER_PATH
+@@ -229,6 +229,28 @@ config STATIC_USERMODEHELPER_PATH
  	  If you wish for all usermode helper programs to be disabled,
  	  specify an empty string here (i.e. "").
-
+ 
 +config LOCK_DOWN_KERNEL
 +	bool "Allow the kernel to be 'locked down'"
 +	help
@@ -139,16 +139,16 @@ index c4302067a3ad..a68e5bdebad5 100644
  source "security/selinux/Kconfig"
  source "security/smack/Kconfig"
  source "security/tomoyo/Kconfig"
-@@ -278,4 +300,3 @@ config DEFAULT_SECURITY
- 	default "" if DEFAULT_SECURITY_DAC
-
+@@ -250,4 +272,3 @@ config LSM
+ 	  If unsure, leave this as the default.
+ 
  endmenu
 -
 diff --git a/security/Makefile b/security/Makefile
-index 4d2d3782ddef..507ac8c520ce 100644
+index c598b904938f..5ff090149c88 100644
 --- a/security/Makefile
 +++ b/security/Makefile
-@@ -30,3 +30,6 @@ obj-$(CONFIG_CGROUP_DEVICE)		+= device_cgroup.o
+@@ -32,3 +32,6 @@ obj-$(CONFIG_CGROUP_DEVICE)		+= device_cgroup.o
  # Object integrity file lists
  subdir-$(CONFIG_INTEGRITY)		+= integrity
  obj-$(CONFIG_INTEGRITY)			+= integrity/
@@ -227,12 +227,12 @@ index 000000000000..f35ffdd096ad
 +}
 +EXPORT_SYMBOL(__kernel_is_locked_down);
 -- 
-2.14.3
+2.20.1
 
-From 13dada34d9aa56ac4ee5438c7ebefde2d30d5542 Mon Sep 17 00:00:00 2001
+From 2779f0447b80b3cf94fb0252a4b209aa36250ed6 Mon Sep 17 00:00:00 2001
 From: Kyle McMartin <kyle@redhat.com>
 Date: Mon, 9 Apr 2018 09:52:45 +0100
-Subject: [PATCH 02/24] Add a SysRq option to lift kernel lockdown
+Subject: [PATCH 02/22] Add a SysRq option to lift kernel lockdown
 
 Make an option to provide a sysrq key that will lift the kernel lockdown,
 thereby allowing the running kernel image to be accessed and modified.
@@ -248,44 +248,44 @@ cc: x86@kernel.org
 ---
  arch/x86/include/asm/setup.h |  2 ++
  drivers/input/misc/uinput.c  |  1 +
- drivers/tty/sysrq.c          | 19 ++++++++++++------
- include/linux/input.h        |  5 +++++
- include/linux/sysrq.h        |  8 +++++++-
+ drivers/tty/sysrq.c          | 19 ++++++++++-----
+ include/linux/input.h        |  5 ++++
+ include/linux/sysrq.h        |  8 +++++-
  kernel/debug/kdb/kdb_main.c  |  2 +-
- security/Kconfig             | 11 +++++++++++
- security/lock_down.c         | 47 ++++++++++++++++++++++++++++++++++++++++++++
+ security/Kconfig             | 11 +++++++++
+ security/lock_down.c         | 47 ++++++++++++++++++++++++++++++++++++
  8 files changed, 87 insertions(+), 8 deletions(-)
 
 diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
-index ae13bc974416..3108e297d87d 100644
+index ed8ec011a9fd..8daf633a5347 100644
 --- a/arch/x86/include/asm/setup.h
 +++ b/arch/x86/include/asm/setup.h
 @@ -9,6 +9,8 @@
  #include <linux/linkage.h>
  #include <asm/page_types.h>
-
+ 
 +#define LOCKDOWN_LIFT_KEY 'x'
 +
  #ifdef __i386__
-
+ 
  #include <linux/pfn.h>
 diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
-index 96a887f33698..027c730631cc 100644
+index 26ec603fe220..a73e92490286 100644
 --- a/drivers/input/misc/uinput.c
 +++ b/drivers/input/misc/uinput.c
-@@ -365,6 +365,7 @@ static int uinput_create_device(struct uinput_device *udev)
+@@ -366,6 +366,7 @@ static int uinput_create_device(struct uinput_device *udev)
  		dev->flush = uinput_dev_flush;
  	}
-
+ 
 +	dev->flags |= INPUTDEV_FLAGS_SYNTHETIC;
  	dev->event = uinput_dev_event;
-
+ 
  	input_set_drvdata(udev->dev, udev);
 diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index 6364890575ec..ffeb3aa86cd1 100644
+index fa0ce7dd9e24..06c60fed7656 100644
 --- a/drivers/tty/sysrq.c
 +++ b/drivers/tty/sysrq.c
-@@ -487,6 +487,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
+@@ -480,6 +480,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
  	/* x: May be registered on mips for TLB dump */
  	/* x: May be registered on ppc/powerpc for xmon */
  	/* x: May be registered on sparc64 for global PMU dump */
@@ -293,17 +293,17 @@ index 6364890575ec..ffeb3aa86cd1 100644
  	NULL,				/* x */
  	/* y: May be registered on sparc64 for global register dump */
  	NULL,				/* y */
-@@ -530,7 +531,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p)
+@@ -523,7 +524,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p)
                  sysrq_key_table[i] = op_p;
  }
-
+ 
 -void __handle_sysrq(int key, bool check_mask)
 +void __handle_sysrq(int key, unsigned int from)
  {
  	struct sysrq_key_op *op_p;
  	int orig_log_level;
-@@ -550,11 +551,15 @@ void __handle_sysrq(int key, bool check_mask)
-
+@@ -542,11 +543,15 @@ void __handle_sysrq(int key, bool check_mask)
+ 
          op_p = __sysrq_get_key_op(key);
          if (op_p) {
 +		/* Ban synthetic events from some sysrq functionality */
@@ -319,7 +319,7 @@ index 6364890575ec..ffeb3aa86cd1 100644
  			pr_info("%s\n", op_p->action_msg);
  			console_loglevel = orig_log_level;
  			op_p->handler(key);
-@@ -586,7 +591,7 @@ void __handle_sysrq(int key, bool check_mask)
+@@ -579,7 +584,7 @@ void __handle_sysrq(int key, bool check_mask)
  void handle_sysrq(int key)
  {
  	if (sysrq_on())
@@ -327,18 +327,18 @@ index 6364890575ec..ffeb3aa86cd1 100644
 +		__handle_sysrq(key, SYSRQ_FROM_KERNEL);
  }
  EXPORT_SYMBOL(handle_sysrq);
-
-@@ -667,7 +672,7 @@ static void sysrq_do_reset(struct timer_list *t)
+ 
+@@ -659,7 +664,7 @@ static void sysrq_do_reset(struct timer_list *t)
  static void sysrq_handle_reset_request(struct sysrq_state *state)
  {
  	if (state->reset_requested)
 -		__handle_sysrq(sysrq_xlate[KEY_B], false);
 +		__handle_sysrq(sysrq_xlate[KEY_B], SYSRQ_FROM_KERNEL);
-
+ 
  	if (sysrq_reset_downtime_ms)
  		mod_timer(&state->keyreset_timer,
-@@ -818,8 +823,10 @@ static bool sysrq_handle_keypress(struct sysrq_state *sysrq,
-
+@@ -812,8 +817,10 @@ static bool sysrq_handle_keypress(struct sysrq_state *sysrq,
+ 
  	default:
  		if (sysrq->active && value && value != 2) {
 +			int from = sysrq->handle.dev->flags & INPUTDEV_FLAGS_SYNTHETIC ?
@@ -349,14 +349,14 @@ index 6364890575ec..ffeb3aa86cd1 100644
  		}
  		break;
  	}
-@@ -1102,7 +1109,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
-
+@@ -1096,7 +1103,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
+ 
  		if (get_user(c, buf))
  			return -EFAULT;
 -		__handle_sysrq(c, false);
 +		__handle_sysrq(c, SYSRQ_FROM_PROC);
  	}
-
+ 
  	return count;
 diff --git a/include/linux/input.h b/include/linux/input.h
 index 7c7516eb7d76..38cd0ea72c37 100644
@@ -373,16 +373,16 @@ index 7c7516eb7d76..38cd0ea72c37 100644
 @@ -124,6 +125,8 @@ struct input_dev {
  	const char *uniq;
  	struct input_id id;
-
+ 
 +	unsigned int flags;
 +
  	unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)];
-
+ 
  	unsigned long evbit[BITS_TO_LONGS(EV_CNT)];
 @@ -190,6 +193,8 @@ struct input_dev {
  };
  #define to_input_dev(d) container_of(d, struct input_dev, dev)
-
+ 
 +#define	INPUTDEV_FLAGS_SYNTHETIC	0x000000001
 +
  /*
@@ -395,7 +395,7 @@ index 8c71874e8485..7de1f08b60a9 100644
 @@ -29,6 +29,8 @@
  #define SYSRQ_ENABLE_BOOT	0x0080
  #define SYSRQ_ENABLE_RTNICE	0x0100
-
+ 
 +#define SYSRQ_DISABLE_USERSPACE	0x00010000
 +
  struct sysrq_key_op {
@@ -404,7 +404,7 @@ index 8c71874e8485..7de1f08b60a9 100644
 @@ -43,8 +45,12 @@ struct sysrq_key_op {
   * are available -- else NULL's).
   */
-
+ 
 +#define SYSRQ_FROM_KERNEL	0x0001
 +#define SYSRQ_FROM_PROC		0x0002
 +#define SYSRQ_FROM_SYNTHETIC	0x0004
@@ -416,26 +416,26 @@ index 8c71874e8485..7de1f08b60a9 100644
  int unregister_sysrq_key(int key, struct sysrq_key_op *op);
  struct sysrq_key_op *__sysrq_get_key_op(int key);
 diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
-index dbb0781a0533..aae9a0f44058 100644
+index 82a3b32a7cfc..efee1abf5e8e 100644
 --- a/kernel/debug/kdb/kdb_main.c
 +++ b/kernel/debug/kdb/kdb_main.c
-@@ -1970,7 +1970,7 @@ static int kdb_sr(int argc, const char **argv)
+@@ -1981,7 +1981,7 @@ static int kdb_sr(int argc, const char **argv)
  		return KDB_ARGCOUNT;
-
+ 
  	kdb_trap_printk++;
 -	__handle_sysrq(*argv[1], check_mask);
 +	__handle_sysrq(*argv[1], check_mask ? SYSRQ_FROM_KERNEL : 0);
  	kdb_trap_printk--;
-
+ 
  	return 0;
 diff --git a/security/Kconfig b/security/Kconfig
-index a68e5bdebad5..46967ee77dfd 100644
+index 44c6a0da6f21..f885e88e0705 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
-@@ -253,6 +253,17 @@ config LOCK_DOWN_MANDATORY
+@@ -251,6 +251,17 @@ config LOCK_DOWN_MANDATORY
  	  Makes the lockdown non-negotiable.  It is always on and cannot be
  	  disabled.
-
+ 
 +config ALLOW_LOCKDOWN_LIFT_BY_SYSRQ
 +	bool "Allow the kernel lockdown to be lifted by SysRq"
 +	depends on LOCK_DOWN_KERNEL
@@ -455,12 +455,12 @@ index f35ffdd096ad..2615669dbf03 100644
 --- a/security/lock_down.c
 +++ b/security/lock_down.c
 @@ -11,9 +11,15 @@
-
+ 
  #include <linux/export.h>
  #include <linux/sched.h>
 +#include <linux/sysrq.h>
 +#include <asm/setup.h>
-
+ 
  #ifndef CONFIG_LOCK_DOWN_MANDATORY
 +#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ
 +static __read_mostly bool kernel_locked_down;
@@ -516,12 +516,12 @@ index f35ffdd096ad..2615669dbf03 100644
 +
 +#endif /* CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ */
 -- 
-2.14.3
+2.20.1
 
-From 7948946e19294e7560c81b177b2788d21ed79f59 Mon Sep 17 00:00:00 2001
+From 597069f3ba9dbf3537bd2ab5642f203fa24fd1f4 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@srcf.ucam.org>
 Date: Mon, 9 Apr 2018 09:52:46 +0100
-Subject: [PATCH 05/24] Restrict /dev/{mem,kmem,port} when the kernel is locked
+Subject: [PATCH 03/22] Restrict /dev/{mem,kmem,port} when the kernel is locked
  down
 
 Allowing users to read and write to core kernel memory makes it possible
@@ -542,25 +542,25 @@ Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index ffeb60d3434c..b2fca26e5765 100644
+index b08dc50f9f26..0a2f2e75d5f4 100644
 --- a/drivers/char/mem.c
 +++ b/drivers/char/mem.c
-@@ -784,6 +784,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig)
-
+@@ -786,6 +786,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig)
+ 
  static int open_port(struct inode *inode, struct file *filp)
  {
 +	if (kernel_is_locked_down("/dev/mem,kmem,port"))
 +		return -EPERM;
  	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
  }
-
+ 
 -- 
-2.14.3
+2.20.1
 
-From a19b6b9637f114388cc7087176860eee962cac79 Mon Sep 17 00:00:00 2001
+From 97b73030d3ccb2c4595c4fe948b0af368a6b10e3 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@srcf.ucam.org>
 Date: Mon, 9 Apr 2018 09:52:46 +0100
-Subject: [PATCH 06/24] kexec_load: Disable at runtime if the kernel is locked
+Subject: [PATCH 04/22] kexec_load: Disable at runtime if the kernel is locked
  down
 
 The kexec_load() syscall permits the loading and execution of arbitrary
@@ -576,6 +576,7 @@ Acked-by: Dave Young <dyoung@redhat.com>
 Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
 Reviewed-by: James Morris <james.l.morris@oracle.com>
 cc: kexec@lists.infradead.org
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
 ---
  kernel/kexec.c | 7 +++++++
  1 file changed, 7 insertions(+)
@@ -599,12 +600,12 @@ index 68559808fdfa..041d505070e1 100644
  	result = security_kernel_load_data(LOADING_KEXEC_IMAGE);
  	if (result < 0)
 -- 
-2.17.1
+2.20.1
 
-From aed8ee965258e3926be6aaeb57aef8a9a03c9989 Mon Sep 17 00:00:00 2001
+From 1b27ccaab50813a5a3c29f7be294a3cf98966d3b Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
 Date: Mon, 9 Apr 2018 09:52:47 +0100
-Subject: [PATCH 07/24] hibernate: Disable when the kernel is locked down
+Subject: [PATCH 05/22] hibernate: Disable when the kernel is locked down
 
 There is currently no way to verify the resume image when returning
 from hibernate.  This might compromise the signed modules trust model,
@@ -615,30 +616,31 @@ Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
 Signed-off-by: David Howells <dhowells@redhat.com>
 Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
 cc: linux-pm@vger.kernel.org
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
 ---
  kernel/power/hibernate.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
-index 5454cc639a8d..629f158f5a0c 100644
+index abef759de7c8..802795becb88 100644
 --- a/kernel/power/hibernate.c
 +++ b/kernel/power/hibernate.c
 @@ -70,7 +70,7 @@ static const struct platform_hibernation_ops *hibernation_ops;
-
+ 
  bool hibernation_available(void)
  {
 -	return (nohibernate == 0);
 +	return nohibernate == 0 && !kernel_is_locked_down("Hibernation");
  }
-
+ 
  /**
 -- 
-2.14.3
+2.20.1
 
-From 8732c1663d7c0305ae01ba5a1ee4d2299b7b4612 Mon Sep 17 00:00:00 2001
+From 65c098838ab0e21528ecbd5ad27e1b5174b42b14 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@srcf.ucam.org>
 Date: Mon, 9 Apr 2018 09:52:47 +0100
-Subject: [PATCH 08/24] uswsusp: Disable when the kernel is locked down
+Subject: [PATCH 06/22] uswsusp: Disable when the kernel is locked down
 
 uswsusp allows a user process to dump and then restore kernel state, which
 makes it possible to modify the running kernel.  Disable this if the kernel
@@ -654,26 +656,26 @@ cc: linux-pm@vger.kernel.org
  1 file changed, 3 insertions(+)
 
 diff --git a/kernel/power/user.c b/kernel/power/user.c
-index 75c959de4b29..959b336d8eca 100644
+index 2d8b60a3c86b..0305d513c274 100644
 --- a/kernel/power/user.c
 +++ b/kernel/power/user.c
 @@ -52,6 +52,9 @@ static int snapshot_open(struct inode *inode, struct file *filp)
  	if (!hibernation_available())
  		return -EPERM;
-
+ 
 +	if (kernel_is_locked_down("/dev/snapshot"))
 +		return -EPERM;
 +
  	lock_system_sleep();
-
+ 
  	if (!atomic_add_unless(&snapshot_device_available, -1, 0)) {
 -- 
-2.14.3
+2.20.1
 
-From 4f5f0aae410d1929872eec346954c85e3a85f4f3 Mon Sep 17 00:00:00 2001
+From 05eecdf72d557817d7613733dca6eac08e61377e Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@srcf.ucam.org>
 Date: Mon, 9 Apr 2018 09:52:48 +0100
-Subject: [PATCH 09/24] PCI: Lock down BAR access when the kernel is locked
+Subject: [PATCH 07/22] PCI: Lock down BAR access when the kernel is locked
  down
 
 Any hardware that can potentially generate DMA has to be locked down in
@@ -694,30 +696,30 @@ cc: linux-pci@vger.kernel.org
  3 files changed, 19 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index 366d93af051d..1e149ec006a4 100644
+index 25794c27c7a4..0d969598e273 100644
 --- a/drivers/pci/pci-sysfs.c
 +++ b/drivers/pci/pci-sysfs.c
-@@ -903,6 +903,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj,
+@@ -904,6 +904,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj,
  	loff_t init_off = off;
  	u8 *data = (u8 *) buf;
-
+ 
 +	if (kernel_is_locked_down("Direct PCI access"))
 +		return -EPERM;
 +
  	if (off > dev->cfg_size)
  		return 0;
  	if (off + count > dev->cfg_size) {
-@@ -1165,6 +1168,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
+@@ -1166,6 +1169,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
  	enum pci_mmap_state mmap_type;
  	struct resource *res = &pdev->resource[bar];
-
+ 
 +	if (kernel_is_locked_down("Direct PCI access"))
 +		return -EPERM;
 +
  	if (res->flags & IORESOURCE_MEM && iomem_is_exclusive(res->start))
  		return -EINVAL;
-
-@@ -1240,6 +1246,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj,
+ 
+@@ -1241,6 +1247,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj,
  				     struct bin_attribute *attr, char *buf,
  				     loff_t off, size_t count)
  {
@@ -726,15 +728,15 @@ index 366d93af051d..1e149ec006a4 100644
 +
  	return pci_resource_io(filp, kobj, attr, buf, off, count, true);
  }
-
+ 
 diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
-index 1ee8927a0635..469445a9019b 100644
+index 6fa1627ce08d..1549cdd0710e 100644
 --- a/drivers/pci/proc.c
 +++ b/drivers/pci/proc.c
 @@ -117,6 +117,9 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf,
  	int size = dev->cfg_size;
  	int cnt;
-
+ 
 +	if (kernel_is_locked_down("Direct PCI access"))
 +		return -EPERM;
 +
@@ -744,7 +746,7 @@ index 1ee8927a0635..469445a9019b 100644
 @@ -196,6 +199,9 @@ static long proc_bus_pci_ioctl(struct file *file, unsigned int cmd,
  #endif /* HAVE_PCI_MMAP */
  	int ret = 0;
-
+ 
 +	if (kernel_is_locked_down("Direct PCI access"))
 +		return -EPERM;
 +
@@ -754,12 +756,12 @@ index 1ee8927a0635..469445a9019b 100644
 @@ -237,7 +243,8 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma)
  	struct pci_filp_private *fpriv = file->private_data;
  	int i, ret, write_combine = 0, res_bit = IORESOURCE_MEM;
-
+ 
 -	if (!capable(CAP_SYS_RAWIO))
 +	if (!capable(CAP_SYS_RAWIO) ||
 +	    kernel_is_locked_down("Direct PCI access"))
  		return -EPERM;
-
+ 
  	if (fpriv->mmap_state == pci_mmap_io) {
 diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
 index d96626c614f5..b8a08d3166a1 100644
@@ -768,20 +770,20 @@ index d96626c614f5..b8a08d3166a1 100644
 @@ -90,7 +90,8 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
  	u32 dword;
  	int err = 0;
-
+ 
 -	if (!capable(CAP_SYS_ADMIN))
 +	if (!capable(CAP_SYS_ADMIN) ||
 +	    kernel_is_locked_down("Direct PCI access"))
  		return -EPERM;
-
+ 
  	dev = pci_get_domain_bus_and_slot(0, bus, dfn);
 -- 
-2.14.3
+2.20.1
 
-From 677537cdec42804f1936b57ffaa6181f633bc015 Mon Sep 17 00:00:00 2001
+From 00ead3a144b821267a941a26c646a1fd07d8163a Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@srcf.ucam.org>
 Date: Mon, 9 Apr 2018 09:52:48 +0100
-Subject: [PATCH 10/24] x86: Lock down IO port access when the kernel is locked
+Subject: [PATCH 08/22] x86: Lock down IO port access when the kernel is locked
  down
 
 IO port access would permit users to gain access to PCI configuration
@@ -806,14 +808,14 @@ index 0fe1c8782208..abc702a6ae9c 100644
 --- a/arch/x86/kernel/ioport.c
 +++ b/arch/x86/kernel/ioport.c
 @@ -31,7 +31,8 @@ long ksys_ioperm(unsigned long from, unsigned long num, int turn_on)
-
+ 
  	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
  		return -EINVAL;
 -	if (turn_on && !capable(CAP_SYS_RAWIO))
 +	if (turn_on && (!capable(CAP_SYS_RAWIO) ||
 +			kernel_is_locked_down("ioperm")))
  		return -EPERM;
-
+ 
  	/*
 @@ -126,7 +127,8 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
  		return -EINVAL;
@@ -826,12 +828,12 @@ index 0fe1c8782208..abc702a6ae9c 100644
  	}
  	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
 -- 
-2.14.3
+2.20.1
 
-From f005be07fababf8c698a556fe465871ad168c9d9 Mon Sep 17 00:00:00 2001
+From 6efd2de8172dac74fbea76d7205657c4cf22ef6a Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@srcf.ucam.org>
 Date: Mon, 9 Apr 2018 09:52:48 +0100
-Subject: [PATCH 11/24] x86/msr: Restrict MSR access when the kernel is locked
+Subject: [PATCH 09/22] x86/msr: Restrict MSR access when the kernel is locked
  down
 
 Writing to MSRs should not be allowed if the kernel is locked down, since
@@ -852,13 +854,13 @@ cc: x86@kernel.org
  1 file changed, 10 insertions(+)
 
 diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
-index ef688804f80d..dfb61d358196 100644
+index 4588414e2561..f5a2cf07972f 100644
 --- a/arch/x86/kernel/msr.c
 +++ b/arch/x86/kernel/msr.c
 @@ -84,6 +84,11 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
  	int err = 0;
  	ssize_t bytes = 0;
-
+ 
 +	if (kernel_is_locked_down("Direct MSR access")) {
 +		pr_info("Direct access to MSR %x\n", reg);
 +		return -EPERM;
@@ -866,7 +868,7 @@ index ef688804f80d..dfb61d358196 100644
 +
  	if (count % 8)
  		return -EINVAL;	/* Invalid chunk size */
-
+ 
 @@ -135,6 +140,11 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
  			err = -EFAULT;
  			break;
@@ -880,12 +882,12 @@ index ef688804f80d..dfb61d358196 100644
  		if (err)
  			break;
 -- 
-2.14.3
+2.20.1
 
-From 0a48b7c936757dda851ab2d3ecde7f6a79de7a5b Mon Sep 17 00:00:00 2001
+From 7e4c9369ca56ec7508ad851fb3f8af7b7e83c4e5 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@srcf.ucam.org>
 Date: Mon, 9 Apr 2018 09:52:48 +0100
-Subject: [PATCH 12/24] ACPI: Limit access to custom_method when the kernel is
+Subject: [PATCH 10/22] ACPI: Limit access to custom_method when the kernel is
  locked down
 
 custom_method effectively allows arbitrary access to system memory, making
@@ -901,13 +903,13 @@ cc: linux-acpi@vger.kernel.org
  1 file changed, 3 insertions(+)
 
 diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
-index e967c1173ba3..a07fbe999eb6 100644
+index aa972dc5cb7e..af1d161f188f 100644
 --- a/drivers/acpi/custom_method.c
 +++ b/drivers/acpi/custom_method.c
 @@ -29,6 +29,9 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
  	struct acpi_table_header table;
  	acpi_status status;
-
+ 
 +	if (kernel_is_locked_down("ACPI custom methods"))
 +		return -EPERM;
 +
@@ -915,12 +917,12 @@ index e967c1173ba3..a07fbe999eb6 100644
  		/* parse the table header to get the table length */
  		if (count <= sizeof(struct acpi_table_header))
 -- 
-2.14.3
+2.20.1
 
-From 2ed74b084366d7dba7b4a611ba13d99b82c4e11e Mon Sep 17 00:00:00 2001
+From 20f5e7cfa6d01d10a5bb83a6b276d6f403aa012c Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@redhat.com>
 Date: Mon, 9 Apr 2018 09:52:49 +0100
-Subject: [PATCH 13/24] acpi: Ignore acpi_rsdp kernel param when the kernel has
+Subject: [PATCH 11/22] acpi: Ignore acpi_rsdp kernel param when the kernel has
  been locked down
 
 This option allows userspace to pass the RSDP address to the kernel, which
@@ -937,12 +939,12 @@ cc: linux-acpi@vger.kernel.org
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 7ca41bf023c9..34e4ce7939f4 100644
+index f29e427d0d1d..3e44cef7a0cd 100644
 --- a/drivers/acpi/osl.c
 +++ b/drivers/acpi/osl.c
-@@ -192,7 +192,7 @@ acpi_physical_address __init acpi_os_get_root_pointer(void)
+@@ -194,7 +194,7 @@ acpi_physical_address __init acpi_os_get_root_pointer(void)
  	acpi_physical_address pa;
-
+ 
  #ifdef CONFIG_KEXEC
 -	if (acpi_rsdp)
 +	if (acpi_rsdp && !kernel_is_locked_down("ACPI RSDP specification"))
@@ -950,12 +952,12 @@ index 7ca41bf023c9..34e4ce7939f4 100644
  #endif
  	pa = acpi_arch_get_root_pointer();
 -- 
-2.14.3
+2.20.1
 
-From 7fb2ddf683c23cc4b227d7d75a5d039970ca910e Mon Sep 17 00:00:00 2001
+From 700ce42e36ac0b7387c55d8fe13dd1dda3d4f178 Mon Sep 17 00:00:00 2001
 From: Linn Crosetto <linn@hpe.com>
 Date: Mon, 9 Apr 2018 09:52:49 +0100
-Subject: [PATCH 14/24] acpi: Disable ACPI table override if the kernel is
+Subject: [PATCH 12/22] acpi: Disable ACPI table override if the kernel is
  locked down
 
 From the kernel documentation (initrd_table_override.txt):
@@ -977,13 +979,13 @@ cc: linux-acpi@vger.kernel.org
  1 file changed, 5 insertions(+)
 
 diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
-index 849c4fb19b03..6c5ee7e66842 100644
+index 8fccbe49612a..1794f5b4afae 100644
 --- a/drivers/acpi/tables.c
 +++ b/drivers/acpi/tables.c
-@@ -527,6 +527,11 @@ void __init acpi_table_upgrade(void)
+@@ -539,6 +539,11 @@ void __init acpi_table_upgrade(void)
  	if (table_nr == 0)
  		return;
-
+ 
 +	if (kernel_is_locked_down("ACPI table override")) {
 +		pr_notice("kernel is locked down, ignoring table override\n");
 +		return;
@@ -993,12 +995,12 @@ index 849c4fb19b03..6c5ee7e66842 100644
  		memblock_find_in_range(0, ACPI_TABLE_UPGRADE_MAX_PHYS,
  				       all_tables_size, PAGE_SIZE);
 -- 
-2.14.3
+2.20.1
 
-From d1ff6505c76cec9438217f2c284f024a1ac2ac59 Mon Sep 17 00:00:00 2001
+From 795cc6dc11944a24309cd29b02efc6ff6eea241e Mon Sep 17 00:00:00 2001
 From: Linn Crosetto <linn@hpe.com>
 Date: Mon, 9 Apr 2018 09:52:50 +0100
-Subject: [PATCH 15/24] acpi: Disable APEI error injection if the kernel is
+Subject: [PATCH 13/22] acpi: Disable APEI error injection if the kernel is
  locked down
 
 ACPI provides an error injection mechanism, EINJ, for debugging and testing
@@ -1025,13 +1027,13 @@ cc: linux-acpi@vger.kernel.org
  1 file changed, 3 insertions(+)
 
 diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c
-index b38737c83a24..6d71e1e97b20 100644
+index 2d4be94f8c00..6ee4ad207e8b 100644
 --- a/drivers/acpi/apei/einj.c
 +++ b/drivers/acpi/apei/einj.c
 @@ -518,6 +518,9 @@ static int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2,
  	int rc;
  	u64 base_addr, size;
-
+ 
 +	if (kernel_is_locked_down("ACPI error injection"))
 +		return -EPERM;
 +
@@ -1039,12 +1041,12 @@ index b38737c83a24..6d71e1e97b20 100644
  	if (flags && (flags &
  		~(SETWA_FLAGS_APICID|SETWA_FLAGS_MEM|SETWA_FLAGS_PCIE_SBDF)))
 -- 
-2.14.3
+2.20.1
 
-From 3153be0328e3a752aacab95d503fbd460f517402 Mon Sep 17 00:00:00 2001
+From fbdf91419289d47c747d5535bb92a8923a0fce97 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 4 Apr 2018 14:45:37 +0100
-Subject: [PATCH 16/24] Prohibit PCMCIA CIS storage when the kernel is locked
+Subject: [PATCH 14/22] Prohibit PCMCIA CIS storage when the kernel is locked
  down
 
 Prohibit replacement of the PCMCIA Card Information Structure when the
@@ -1058,26 +1060,26 @@ cc: linux-pcmcia@lists.infradead.org
  1 file changed, 3 insertions(+)
 
 diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
-index 102646fedb56..e46c948d7246 100644
+index ac0672b8dfca..8adf092d0e18 100644
 --- a/drivers/pcmcia/cistpl.c
 +++ b/drivers/pcmcia/cistpl.c
 @@ -1578,6 +1578,9 @@ static ssize_t pccard_store_cis(struct file *filp, struct kobject *kobj,
  	struct pcmcia_socket *s;
  	int error;
-
+ 
 +	if (kernel_is_locked_down("Direct PCMCIA CIS storage"))
 +		return -EPERM;
 +
  	s = to_socket(container_of(kobj, struct device, kobj));
-
+ 
  	if (off)
 -- 
-2.14.3
+2.20.1
 
-From 9fedc1427e8589edf2e16a481f8588711adba69a Mon Sep 17 00:00:00 2001
+From 9a3726b9bf16e62fce77570c972857abc303fcd1 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 4 Apr 2018 14:45:37 +0100
-Subject: [PATCH 17/24] Lock down TIOCSSERIAL
+Subject: [PATCH 15/22] Lock down TIOCSSERIAL
 
 Lock down TIOCSSERIAL as that can be used to change the ioport and irq
 settings on a serial port.  This only appears to be an issue for the serial
@@ -1092,13 +1094,13 @@ cc: Jiri Slaby <jslaby@suse.com>
  1 file changed, 6 insertions(+)
 
 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
-index 0466f9f08a91..360f8e4416c4 100644
+index 351843f847c0..3cffe2f5d132 100644
 --- a/drivers/tty/serial/serial_core.c
 +++ b/drivers/tty/serial/serial_core.c
-@@ -829,6 +829,12 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
+@@ -852,6 +852,12 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
  	new_flags = (__force upf_t)new_info->flags;
  	old_custom_divisor = uport->custom_divisor;
-
+ 
 +	if ((change_port || change_irq) &&
 +	    kernel_is_locked_down("Using TIOCSSERIAL to change device addresses, irqs and dma channels")) {
 +		retval = -EPERM;
@@ -1109,12 +1111,12 @@ index 0466f9f08a91..360f8e4416c4 100644
  		retval = -EPERM;
  		if (change_irq || change_port ||
 -- 
-2.14.3
+2.20.1
 
-From f8fd52e2b077ce5a993807f8fc6e27a17cf4d19f Mon Sep 17 00:00:00 2001
+From 3602dd89747ed890d31fcb4d64a3fcd48490fff7 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 4 Apr 2018 14:45:37 +0100
-Subject: [PATCH 18/24] Lock down module params that specify hardware
+Subject: [PATCH 16/22] Lock down module params that specify hardware
  parameters (eg. ioport)
 
 Provided an annotation for module parameters that specify hardware
@@ -1128,13 +1130,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
  1 file changed, 21 insertions(+), 5 deletions(-)
 
 diff --git a/kernel/params.c b/kernel/params.c
-index cc9108c2a1fd..2c08c4aa376b 100644
+index ce89f757e6da..8ac751c938f8 100644
 --- a/kernel/params.c
 +++ b/kernel/params.c
 @@ -108,13 +108,19 @@ bool parameq(const char *a, const char *b)
  	return parameqn(a, b, strlen(a)+1);
  }
-
+ 
 -static void param_check_unsafe(const struct kernel_param *kp)
 +static bool param_check_unsafe(const struct kernel_param *kp,
 +			       const char *doing)
@@ -1150,7 +1152,7 @@ index cc9108c2a1fd..2c08c4aa376b 100644
 +		return false;
 +	return true;
  }
-
+ 
  static int parse_one(char *param,
 @@ -144,8 +150,10 @@ static int parse_one(char *param,
  			pr_debug("handling %s with %p\n", param,
@@ -1168,7 +1170,7 @@ index cc9108c2a1fd..2c08c4aa376b 100644
 @@ -553,6 +561,12 @@ static ssize_t param_attr_show(struct module_attribute *mattr,
  	return count;
  }
-
+ 
 +#ifdef CONFIG_MODULES
 +#define mod_name(mod) (mod)->name
 +#else
@@ -1180,7 +1182,7 @@ index cc9108c2a1fd..2c08c4aa376b 100644
  				struct module_kobject *mk,
 @@ -565,8 +579,10 @@ static ssize_t param_attr_store(struct module_attribute *mattr,
  		return -EPERM;
-
+ 
  	kernel_param_lock(mk->mod);
 -	param_check_unsafe(attribute->param);
 -	err = attribute->param->ops->set(buf, attribute->param);
@@ -1192,12 +1194,12 @@ index cc9108c2a1fd..2c08c4aa376b 100644
  	if (!err)
  		return len;
 -- 
-2.14.3
+2.20.1
 
-From 9c88e2ab392f5ac9c80529e43175fe65d00cdb67 Mon Sep 17 00:00:00 2001
+From 5c8a455102b3ca36e84694d888fad219726bd268 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 4 Apr 2018 14:45:38 +0100
-Subject: [PATCH 19/24] x86/mmiotrace: Lock down the testmmiotrace module
+Subject: [PATCH 17/22] x86/mmiotrace: Lock down the testmmiotrace module
 
 The testmmiotrace module shouldn't be permitted when the kernel is locked
 down as it can be used to arbitrarily read and write MMIO space.
@@ -1220,7 +1222,7 @@ index f6ae6830b341..bbaad357f5d7 100644
 @@ -115,6 +115,9 @@ static int __init init(void)
  {
  	unsigned long size = (read_far) ? (8 << 20) : (16 << 10);
-
+ 
 +	if (kernel_is_locked_down("MMIO trace testing"))
 +		return -EPERM;
 +
@@ -1228,12 +1230,12 @@ index f6ae6830b341..bbaad357f5d7 100644
  		pr_err("you have to use the module argument mmio_address.\n");
  		pr_err("DO NOT LOAD THIS MODULE UNLESS YOU REALLY KNOW WHAT YOU ARE DOING!\n");
 -- 
-2.14.3
+2.20.1
 
-From 256e20401f9f5dd19028d4220095897a15daa67c Mon Sep 17 00:00:00 2001
+From 711e6f9ef237fd513eddfc1f0e3796c419bc138e Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 4 Apr 2018 14:45:38 +0100
-Subject: [PATCH 20/24] Lock down /proc/kcore
+Subject: [PATCH 18/22] Lock down /proc/kcore
 
 Disallow access to /proc/kcore when the kernel is locked down to prevent
 access to cryptographic data.
@@ -1245,25 +1247,25 @@ Reviewed-by: James Morris <james.l.morris@oracle.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
-index d1e82761de81..cdebdee81719 100644
+index bbcc185062bb..d50ebfbf3dbb 100644
 --- a/fs/proc/kcore.c
 +++ b/fs/proc/kcore.c
-@@ -546,6 +546,8 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
-
+@@ -518,6 +518,8 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+ 
  static int open_kcore(struct inode *inode, struct file *filp)
  {
 +	if (kernel_is_locked_down("/proc/kcore"))
 +		return -EPERM;
  	if (!capable(CAP_SYS_RAWIO))
  		return -EPERM;
-
+ 
 -- 
-2.14.3
+2.20.1
 
-From f68ca24bc8d8a64cf30e59a595fad0e6782e933f Mon Sep 17 00:00:00 2001
+From f2a835a43a6463abfe6781156ebdb7346d7a3c51 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 4 Apr 2018 14:45:38 +0100
-Subject: [PATCH 21/24] Lock down kprobes
+Subject: [PATCH 19/22] Lock down kprobes
 
 Disallow the creation of kprobes when the kernel is locked down by
 preventing their registration.  This prevents kprobes from being used to
@@ -1276,13 +1278,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/kernel/kprobes.c b/kernel/kprobes.c
-index 102160ff5c66..4f5757732553 100644
+index c83e54727131..743c40bd1982 100644
 --- a/kernel/kprobes.c
 +++ b/kernel/kprobes.c
-@@ -1561,6 +1561,9 @@ int register_kprobe(struct kprobe *p)
+@@ -1571,6 +1571,9 @@ int register_kprobe(struct kprobe *p)
  	struct module *probed_mod;
  	kprobe_opcode_t *addr;
-
+ 
 +	if (kernel_is_locked_down("Use of kprobes"))
 +		return -EPERM;
 +
@@ -1290,12 +1292,12 @@ index 102160ff5c66..4f5757732553 100644
  	addr = kprobe_addr(p);
  	if (IS_ERR(addr))
 -- 
-2.14.3
+2.20.1
 
-From d44a6ae3a7cad5cd9b01f7b0a48b3c788af968e8 Mon Sep 17 00:00:00 2001
+From 23afb750c60b6b2d8025eb4d52ce6ff565ca1a63 Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 4 Apr 2018 14:45:38 +0100
-Subject: [PATCH 23/24] Lock down perf
+Subject: [PATCH 20/22] Lock down perf
 
 Disallow the use of certain perf facilities that might allow userspace to
 access kernel data.
@@ -1306,13 +1308,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
  1 file changed, 5 insertions(+)
 
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index fc1c330c6bd6..1922f2e0980a 100644
+index 5f59d848171e..ddf0fa63cb80 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
-@@ -10407,6 +10407,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -10727,6 +10727,11 @@ SYSCALL_DEFINE5(perf_event_open,
  			return -EINVAL;
  	}
-
+ 
 +	if ((attr.sample_type & PERF_SAMPLE_REGS_INTR) &&
 +	    kernel_is_locked_down("PERF_SAMPLE_REGS_INTR"))
 +		/* REGS_INTR can leak data, lockdown must prevent this */
@@ -1322,12 +1324,12 @@ index fc1c330c6bd6..1922f2e0980a 100644
  	if ((attr.sample_type & PERF_SAMPLE_PHYS_ADDR) &&
  	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
 -- 
-2.14.3
+2.20.1
 
-From fe5091f97838c8c64b891280bcd30367e71cd5c3 Mon Sep 17 00:00:00 2001
+From dc6da5e583b02c04a6e0518158ef3d82735aeb5d Mon Sep 17 00:00:00 2001
 From: David Howells <dhowells@redhat.com>
 Date: Wed, 4 Apr 2018 14:45:38 +0100
-Subject: [PATCH 24/24] debugfs: Restrict debugfs when the kernel is locked
+Subject: [PATCH 21/22] debugfs: Restrict debugfs when the kernel is locked
  down
 
 Disallow opening of debugfs files that might be used to muck around when
@@ -1371,13 +1373,13 @@ cc: Thomas Gleixner <tglx@linutronix.de>
  2 files changed, 56 insertions(+), 2 deletions(-)
 
 diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
-index 1f99678ff5d3..51cb894c21f2 100644
+index 4fce1da7db23..c33042c1eff3 100644
 --- a/fs/debugfs/file.c
 +++ b/fs/debugfs/file.c
 @@ -136,6 +136,25 @@ void debugfs_file_put(struct dentry *dentry)
  }
  EXPORT_SYMBOL_GPL(debugfs_file_put);
-
+ 
 +/*
 + * Only permit access to world-readable files when the kernel is locked down.
 + * We also need to exclude any file that has ways to write or alter it as root
@@ -1402,7 +1404,7 @@ index 1f99678ff5d3..51cb894c21f2 100644
  	struct dentry *dentry = F_DENTRY(filp);
 @@ -147,6 +166,11 @@ static int open_proxy_open(struct inode *inode, struct file *filp)
  		return r == -EIO ? -ENOENT : r;
-
+ 
  	real_fops = debugfs_real_fops(filp);
 +
 +	r = -EPERM;
@@ -1414,7 +1416,7 @@ index 1f99678ff5d3..51cb894c21f2 100644
  		/* Huh? Module did not clean up after itself at exit? */
 @@ -272,6 +296,10 @@ static int full_proxy_open(struct inode *inode, struct file *filp)
  		return r == -EIO ? -ENOENT : r;
-
+ 
  	real_fops = debugfs_real_fops(filp);
 +	r = -EPERM;
 +	if (debugfs_is_locked_down(inode, filp, real_fops))
@@ -1424,13 +1426,13 @@ index 1f99678ff5d3..51cb894c21f2 100644
  	if (!real_fops) {
  		/* Huh? Module did not cleanup after itself at exit? */
 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index 13b01351dd1c..4daec17b8215 100644
+index 95b5e78c22b1..ce99ea07fdb4 100644
 --- a/fs/debugfs/inode.c
 +++ b/fs/debugfs/inode.c
 @@ -32,6 +32,31 @@ static struct vfsmount *debugfs_mount;
  static int debugfs_mount_count;
  static bool debugfs_registered;
-
+ 
 +/*
 + * Don't allow access attributes to be changed whilst the kernel is locked down
 + * so that we can use the file mode as part of a heuristic to determine whether
@@ -1462,21 +1464,21 @@ index 13b01351dd1c..4daec17b8215 100644
 @@ -356,6 +381,7 @@ static struct dentry *__debugfs_create_file(const char *name, umode_t mode,
  	inode->i_mode = mode;
  	inode->i_private = data;
-
+ 
 +	inode->i_op = &debugfs_file_inode_operations;
  	inode->i_fop = proxy_fops;
  	dentry->d_fsdata = (void *)((unsigned long)real_fops |
  				DEBUGFS_FSDATA_IS_REAL_FOPS_BIT);
-@@ -515,7 +541,7 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
+@@ -516,7 +542,7 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
  		return failed_creating(dentry);
  
  	inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
 -	inode->i_op = &simple_dir_inode_operations;
 +	inode->i_op = &debugfs_dir_inode_operations;
  	inode->i_fop = &simple_dir_operations;
-
+ 
  	/* directory inodes start off with i_nlink == 2 (for "." entry) */
-@@ -608,7 +634,7 @@ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
+@@ -611,7 +637,7 @@ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
  		return failed_creating(dentry);
  	}
  	inode->i_mode = S_IFLNK | S_IRWXUGO;
@@ -1486,104 +1488,13 @@ index 13b01351dd1c..4daec17b8215 100644
  	d_instantiate(dentry, inode);
  	return end_creating(dentry);
 -- 
-2.14.3
-
-From patchwork Wed Nov 21 12:05:10 2018
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-X-Patchwork-Submitter: Vasily Gorbik <gor@linux.ibm.com>
-X-Patchwork-Id: 1015495
-Return-Path: <SRS0=ejdu=OA=vger.kernel.org=linux-kernel-owner@kernel.org>
-Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
-	by smtp.lore.kernel.org (Postfix) with ESMTP id AF80FC04EBA
-	for <linux-kernel@archiver.kernel.org>; Wed, 21 Nov 2018 12:05:25 +0000 (UTC)
-Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
-	by mail.kernel.org (Postfix) with ESMTP id 80EA921479
-	for <linux-kernel@archiver.kernel.org>; Wed, 21 Nov 2018 12:05:25 +0000 (UTC)
-DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 80EA921479
-Authentication-Results: mail.kernel.org;
- dmarc=fail (p=none dis=none) header.from=linux.ibm.com
-Authentication-Results: mail.kernel.org;
- spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org
-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
-        id S1730155AbeKUWjb (ORCPT
-        <rfc822;linux-kernel@archiver.kernel.org>);
-        Wed, 21 Nov 2018 17:39:31 -0500
-Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:33574 "EHLO
-        mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL)
-        by vger.kernel.org with ESMTP id S1729128AbeKUWjb (ORCPT
-        <rfc822;linux-kernel@vger.kernel.org>);
-        Wed, 21 Nov 2018 17:39:31 -0500
-Received: from pps.filterd (m0098420.ppops.net [127.0.0.1])
-        by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id
- wALBx6kw056071
-        for <linux-kernel@vger.kernel.org>; Wed, 21 Nov 2018 07:05:22 -0500
-Received: from e06smtp02.uk.ibm.com (e06smtp02.uk.ibm.com [195.75.94.98])
-        by mx0b-001b2d01.pphosted.com with ESMTP id 2nw5p847fp-1
-        (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT)
-        for <linux-kernel@vger.kernel.org>; Wed, 21 Nov 2018 07:05:22 -0500
-Received: from localhost
-        by e06smtp02.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use
- Only! Violators will be prosecuted
-        for <linux-kernel@vger.kernel.org> from <gor@linux.ibm.com>;
-        Wed, 21 Nov 2018 12:05:20 -0000
-Received: from b06cxnps4075.portsmouth.uk.ibm.com (9.149.109.197)
-        by e06smtp02.uk.ibm.com (192.168.101.132) with IBM ESMTP SMTP Gateway:
- Authorized Use Only! Violators will be prosecuted;
-        (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256)
-        Wed, 21 Nov 2018 12:05:17 -0000
-Received: from b06wcsmtp001.portsmouth.uk.ibm.com
- (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160])
-        by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with
- ESMTP id wALC5GXF60817580
-        (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
- verify=FAIL);
-        Wed, 21 Nov 2018 12:05:16 GMT
-Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1])
-        by IMSVA (Postfix) with ESMTP id 4EB1CA4060;
-        Wed, 21 Nov 2018 12:05:16 +0000 (GMT)
-Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1])
-        by IMSVA (Postfix) with ESMTP id 0C844A405F;
-        Wed, 21 Nov 2018 12:05:16 +0000 (GMT)
-Received: from localhost (unknown [9.152.212.229])
-        by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTPS;
-        Wed, 21 Nov 2018 12:05:15 +0000 (GMT)
-Date: Wed, 21 Nov 2018 13:05:10 +0100
+2.20.1
+
+From 29131d94aceb11ad6be4b0d8820db23986f1a0b2 Mon Sep 17 00:00:00 2001
 From: Vasily Gorbik <gor@linux.ibm.com>
-To: David Howells <dhowells@redhat.com>,
-        James Morris <jmorris@namei.org>
-Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>,
-        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
-        linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org
-Subject: [PATCH next-lockdown 1/1] debugfs: avoid EPERM when no open file
- operation defined
-References: <4136.1522452584@warthog.procyon.org.uk>
- <cover.thread-bfac1b.your-ad-here.call-01542799656-ext-6093@work.hours>
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf-8
-Content-Disposition: inline
-In-Reply-To: 
- <cover.thread-bfac1b.your-ad-here.call-01542799656-ext-6093@work.hours>
-X-TM-AS-GCONF: 00
-x-cbid: 18112112-0008-0000-0000-000002963F3F
-X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused
-x-cbparentid: 18112112-0009-0000-0000-000022006F52
-Message-Id: 
- <patch-1.thread-bfac1b.git-bfac1b60354c.your-ad-here.call-01542799656-ext-6093@work.hours>
-X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,,
- definitions=2018-11-21_05:,,
- signatures=0
-X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0
- priorityscore=1501
- malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0
- clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0
- mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx
- scancount=1 engine=8.0.1-1810050000 definitions=main-1811210107
-Sender: linux-kernel-owner@vger.kernel.org
-Precedence: bulk
-List-ID: <linux-kernel.vger.kernel.org>
-X-Mailing-List: linux-kernel@vger.kernel.org
+Date: Wed, 21 Nov 2018 13:05:10 +0100
+Subject: [PATCH 22/22] debugfs: avoid EPERM when no open file operation
+ defined
 
 With "debugfs: Restrict debugfs when the kernel is locked down"
 return code "r" is unconditionally set to -EPERM, which stays like that
@@ -1605,7 +1516,7 @@ Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
  1 file changed, 6 insertions(+), 4 deletions(-)
 
 diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
-index 51cb894c21f2..89c86faaa02a 100644
+index c33042c1eff3..3a5033ff9ec7 100644
 --- a/fs/debugfs/file.c
 +++ b/fs/debugfs/file.c
 @@ -167,9 +167,10 @@ static int open_proxy_open(struct inode *inode, struct file *filp)
@@ -1634,3 +1545,6 @@ index 51cb894c21f2..89c86faaa02a 100644
  
  	real_fops = fops_get(real_fops);
  	if (!real_fops) {
+-- 
+2.20.1
+