summaryrefslogtreecommitdiffstats
path: root/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
diff options
context:
space:
mode:
authorJeremy Cline <jcline@redhat.com>2020-04-14 17:53:23 -0400
committerJeremy Cline <jcline@redhat.com>2020-04-14 17:53:23 -0400
commit0310b312a7e5dffcdf24ae835ed732f7a6a9c471 (patch)
treeca12edc19a6f6e05ef31919d65adf895a39d12c0 /s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
parent48b75e92d6f4024e7f99442334f6969345516a72 (diff)
downloadkernel-0310b312a7e5dffcdf24ae835ed732f7a6a9c471.tar.gz
kernel-0310b312a7e5dffcdf24ae835ed732f7a6a9c471.tar.xz
kernel-0310b312a7e5dffcdf24ae835ed732f7a6a9c471.zip
kernel-5.7.0-0.rc1.20200414git8632e9b5645b.1
This is an automated commit generated from the kernel-5.7.0-0.rc1.20200414git8632e9b5645b.1 tag in https://gitlab.com/cki-project/kernel-ark.git
Diffstat (limited to 's390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch')
-rw-r--r--s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch66
1 files changed, 0 insertions, 66 deletions
diff --git a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch b/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
deleted file mode 100644
index 70e3f76a8..000000000
--- a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From eaa12998810bd9db85dec71f0da55fd5aae73d0f Mon Sep 17 00:00:00 2001
-From: Jeremy Cline <jcline@redhat.com>
-Date: Wed, 30 Oct 2019 14:37:49 +0000
-Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set
-
-Automatically lock down the kernel to LOCKDOWN_INTEGRITY_MAX if
-the IPL secure flag is set.
-
-Suggested-by: Philipp Rudo <prudo@redhat.com>
-Signed-off-by: Jeremy Cline <jcline@redhat.com>
----
- arch/s390/include/asm/ipl.h | 1 +
- arch/s390/kernel/ipl.c | 5 +++++
- arch/s390/kernel/setup.c | 4 ++++
- 3 files changed, 10 insertions(+)
-
-diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
-index 084e71b7272a..1d1b5ec7357b 100644
---- a/arch/s390/include/asm/ipl.h
-+++ b/arch/s390/include/asm/ipl.h
-@@ -109,6 +109,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
- unsigned char flags, unsigned short cert);
- int ipl_report_add_certificate(struct ipl_report *report, void *key,
- unsigned long addr, unsigned long len);
-+bool ipl_get_secureboot(void);
-
- /*
- * DIAG 308 support
-diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
-index 6837affc19e8..2d3f3d00e05c 100644
---- a/arch/s390/kernel/ipl.c
-+++ b/arch/s390/kernel/ipl.c
-@@ -1842,3 +1842,8 @@ int ipl_report_free(struct ipl_report *report)
- }
-
- #endif
-+
-+bool ipl_get_secureboot(void)
-+{
-+ return !!ipl_secure_flag;
-+}
-diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
-index 9cbf490fd162..0510ecdfc3f6 100644
---- a/arch/s390/kernel/setup.c
-+++ b/arch/s390/kernel/setup.c
-@@ -49,6 +49,7 @@
- #include <linux/memory.h>
- #include <linux/compat.h>
- #include <linux/start_kernel.h>
-+#include <linux/security.h>
-
- #include <asm/boot_data.h>
- #include <asm/ipl.h>
-@@ -1096,6 +1097,9 @@ void __init setup_arch(char **cmdline_p)
-
- log_component_list();
-
-+ if (ipl_get_secureboot())
-+ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
-+
- /* Have one command line that is parsed and saved in /proc/cmdline */
- /* boot_command_line has been already set up in early.c */
- *cmdline_p = boot_command_line;
---
-2.24.1
-