diff options
| author | Jeremy Cline <jcline@redhat.com> | 2020-04-14 17:53:23 -0400 |
|---|---|---|
| committer | Jeremy Cline <jcline@redhat.com> | 2020-04-14 17:53:23 -0400 |
| commit | 0310b312a7e5dffcdf24ae835ed732f7a6a9c471 (patch) | |
| tree | ca12edc19a6f6e05ef31919d65adf895a39d12c0 /s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch | |
| parent | 48b75e92d6f4024e7f99442334f6969345516a72 (diff) | |
| download | kernel-0310b312a7e5dffcdf24ae835ed732f7a6a9c471.tar.gz kernel-0310b312a7e5dffcdf24ae835ed732f7a6a9c471.tar.xz kernel-0310b312a7e5dffcdf24ae835ed732f7a6a9c471.zip | |
kernel-5.7.0-0.rc1.20200414git8632e9b5645b.1
This is an automated commit generated from the
kernel-5.7.0-0.rc1.20200414git8632e9b5645b.1 tag in
https://gitlab.com/cki-project/kernel-ark.git
Diffstat (limited to 's390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch')
| -rw-r--r-- | s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch | 66 |
1 files changed, 0 insertions, 66 deletions
diff --git a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch b/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch deleted file mode 100644 index 70e3f76a8..000000000 --- a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch +++ /dev/null @@ -1,66 +0,0 @@ -From eaa12998810bd9db85dec71f0da55fd5aae73d0f Mon Sep 17 00:00:00 2001 -From: Jeremy Cline <jcline@redhat.com> -Date: Wed, 30 Oct 2019 14:37:49 +0000 -Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set - -Automatically lock down the kernel to LOCKDOWN_INTEGRITY_MAX if -the IPL secure flag is set. - -Suggested-by: Philipp Rudo <prudo@redhat.com> -Signed-off-by: Jeremy Cline <jcline@redhat.com> ---- - arch/s390/include/asm/ipl.h | 1 + - arch/s390/kernel/ipl.c | 5 +++++ - arch/s390/kernel/setup.c | 4 ++++ - 3 files changed, 10 insertions(+) - -diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h -index 084e71b7272a..1d1b5ec7357b 100644 ---- a/arch/s390/include/asm/ipl.h -+++ b/arch/s390/include/asm/ipl.h -@@ -109,6 +109,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf, - unsigned char flags, unsigned short cert); - int ipl_report_add_certificate(struct ipl_report *report, void *key, - unsigned long addr, unsigned long len); -+bool ipl_get_secureboot(void); - - /* - * DIAG 308 support -diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c -index 6837affc19e8..2d3f3d00e05c 100644 ---- a/arch/s390/kernel/ipl.c -+++ b/arch/s390/kernel/ipl.c -@@ -1842,3 +1842,8 @@ int ipl_report_free(struct ipl_report *report) - } - - #endif -+ -+bool ipl_get_secureboot(void) -+{ -+ return !!ipl_secure_flag; -+} -diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c -index 9cbf490fd162..0510ecdfc3f6 100644 ---- a/arch/s390/kernel/setup.c -+++ b/arch/s390/kernel/setup.c -@@ -49,6 +49,7 @@ - #include <linux/memory.h> - #include <linux/compat.h> - #include <linux/start_kernel.h> -+#include <linux/security.h> - - #include <asm/boot_data.h> - #include <asm/ipl.h> -@@ -1096,6 +1097,9 @@ void __init setup_arch(char **cmdline_p) - - log_component_list(); - -+ if (ipl_get_secureboot()) -+ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX); -+ - /* Have one command line that is parsed and saved in /proc/cmdline */ - /* boot_command_line has been already set up in early.c */ - *cmdline_p = boot_command_line; --- -2.24.1 - |