summaryrefslogtreecommitdiffstats
path: root/efi-secureboot.patch
diff options
context:
space:
mode:
authorJustin M. Forbes <jforbes@fedoraproject.org>2020-04-01 16:38:37 -0500
committerJustin M. Forbes <jforbes@fedoraproject.org>2020-04-01 16:38:37 -0500
commit661a43444c58b51be205f68eb9c8cf2431984962 (patch)
tree2fd23622755ce2deac843598e5f8228f8d1f9350 /efi-secureboot.patch
parent9949db6070c6ca501d7235760ca8aba120db7448 (diff)
downloadkernel-661a43444c58b51be205f68eb9c8cf2431984962.tar.gz
kernel-661a43444c58b51be205f68eb9c8cf2431984962.tar.xz
kernel-661a43444c58b51be205f68eb9c8cf2431984962.zip
Linux v5.6-5611-g1a323ea5356e
Diffstat (limited to 'efi-secureboot.patch')
-rw-r--r--efi-secureboot.patch49
1 files changed, 23 insertions, 26 deletions
diff --git a/efi-secureboot.patch b/efi-secureboot.patch
index 04aacae97..b58d90bfc 100644
--- a/efi-secureboot.patch
+++ b/efi-secureboot.patch
@@ -14,39 +14,36 @@ Signed-off-by: Jeremy Cline <jcline@redhat.com>
security/security.c | 6 ++++++
4 files changed, 20 insertions(+)
+diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
+index 9cd4455528e5..f79007bf439d 100644
+--- a/include/linux/lsm_hook_defs.h
++++ b/include/linux/lsm_hook_defs.h
+@@ -371,6 +371,8 @@ LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free_security, struct bpf_prog_aux *aux)
+ #endif /* CONFIG_BPF_SYSCALL */
+
+ LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)
++LSM_HOOK(int, 0, lock_kernel_down, const char *where, enum lockdown_reason level);
++
+
+ #ifdef CONFIG_PERF_EVENTS
+ LSM_HOOK(int, 0, perf_event_open, struct perf_event_attr *attr, int type)
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
-index a3763247547c..8d76d1f153ed 100644
+index 988ca0df7824..4ed37b95417c 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
-@@ -1454,6 +1454,12 @@
- * code execution in kernel space should be permitted.
+@@ -1476,6 +1476,12 @@
*
* @what: kernel feature being accessed
-+ *
+ *
+ * @lock_kernel_down
-+ * Put the kernel into lock-down mode.
++ * Put the kernel into lock-down mode.
+ *
-+ * @where: Where the lock-down is originating from (e.g. command line option)
-+ * @level: The lock-down level (can only increase)
- */
- union security_list_options {
- int (*binder_set_context_mgr)(struct task_struct *mgr);
-@@ -1818,6 +1824,7 @@ union security_list_options {
- void (*bpf_prog_free_security)(struct bpf_prog_aux *aux);
- #endif /* CONFIG_BPF_SYSCALL */
- int (*locked_down)(enum lockdown_reason what);
-+ int (*lock_kernel_down)(const char *where, enum lockdown_reason level);
- #ifdef CONFIG_PERF_EVENTS
- int (*perf_event_open)(struct perf_event_attr *attr, int type);
- int (*perf_event_alloc)(struct perf_event *event);
-@@ -2060,6 +2067,7 @@ struct security_hook_heads {
- struct hlist_head bpf_prog_free_security;
- #endif /* CONFIG_BPF_SYSCALL */
- struct hlist_head locked_down;
-+ struct hlist_head lock_kernel_down;
- #ifdef CONFIG_PERF_EVENTS
- struct hlist_head perf_event_open;
- struct hlist_head perf_event_alloc;
++ * @where: Where the lock-down is originating from (e.g. command line option)
++ * @level: The lock-down level (can only increase)
++ *
+ * Security hooks for perf events
+ *
+ * @perf_event_open:
diff --git a/include/linux/security.h b/include/linux/security.h
index a8d59d612d27..467b9ccdf993 100644
--- a/include/linux/security.h