summaryrefslogtreecommitdiffstats
path: root/efi-lockdown.patch
diff options
context:
space:
mode:
Diffstat (limited to 'efi-lockdown.patch')
-rw-r--r--efi-lockdown.patch402
1 files changed, 201 insertions, 201 deletions
diff --git a/efi-lockdown.patch b/efi-lockdown.patch
index dcdd2e99a..d6517d5ed 100644
--- a/efi-lockdown.patch
+++ b/efi-lockdown.patch
@@ -1,4 +1,4 @@
-From 9079547f4808ea5c8cd844bf40d3895994bd175e Mon Sep 17 00:00:00 2001
+From df7d76ae50f18d4465e59fdf7f19d3df44906cb5 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@fedoraproject.org>
Date: Mon, 21 Nov 2016 23:55:55 +0000
Subject: [PATCH 07/32] efi: Add EFI_SECURE_BOOT bit
@@ -13,9 +13,9 @@ out whether secure boot mode is enabled so that it can be disabled.
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: David Howells <dhowells@redhat.com>
---
- arch/x86/kernel/setup.c | 15 +++++++++++++++
- include/linux/efi.h | 1 +
- 2 files changed, 16 insertions(+)
+ arch/x86/kernel/setup.c | 1 +
+ include/linux/efi.h | 1 +
+ 2 files changed, 2 insertions(+)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 69780ed..447905e 100644
@@ -38,13 +38,13 @@ index 94d34e0..6049600 100644
#define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */
#define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
+#define EFI_SECURE_BOOT 11 /* Are we in Secure Boot mode? */
-
+
#ifdef CONFIG_EFI
/*
--
-2.9.3
+2.7.4
-From eada0243f0b8fc21588a21c564187219dee03e3c Mon Sep 17 00:00:00 2001
+From 0f9281e3b77bf5f767f1993d52b152a1ef317a0a Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Fri, 25 Nov 2016 11:52:05 +0000
Subject: [PATCH 08/32] efi: Handle secure boot from UEFI-2.6
@@ -60,20 +60,20 @@ Signed-off-by: David Howells <dhowells@redhat.com>
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
-index ba6ef71..333b159 100644
+index 6def402..77af519 100644
--- a/drivers/firmware/efi/libstub/secureboot.c
+++ b/drivers/firmware/efi/libstub/secureboot.c
-@@ -22,6 +22,9 @@ static const efi_char16_t const efi_SecureBoot_name[] = {
+@@ -20,6 +20,9 @@ static const efi_char16_t const efi_SecureBoot_name[] = {
static const efi_char16_t const efi_SetupMode_name[] = {
'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0
};
+static const efi_char16_t const efi_DeployedMode_name[] = {
+ 'D', 'e', 'p', 'l', 'o', 'y', 'e', 'd', 'M', 'o', 'd', 'e', 0
+};
-
+
/* SHIM variables */
static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID;
-@@ -40,7 +43,7 @@ static efi_char16_t const shim_MokSBState_name[] = {
+@@ -38,7 +41,7 @@ static efi_char16_t const shim_MokSBState_name[] = {
enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
{
u32 attr;
@@ -81,11 +81,11 @@ index ba6ef71..333b159 100644
+ u8 secboot, setupmode, deployedmode, moksbstate;
unsigned long size;
efi_status_t status;
-
-@@ -57,6 +57,17 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
+
+@@ -57,6 +60,17 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
if (secboot == 0 || setupmode == 1)
return efi_secureboot_mode_disabled;
-
+
+ /* UEFI-2.6 requires DeployedMode to be 1. */
+ if (sys_table_arg->hdr.revision >= EFI_2_60_SYSTEM_TABLE_REVISION) {
+ size = sizeof(deployedmode);
@@ -100,15 +100,14 @@ index ba6ef71..333b159 100644
/*
* See if a user has put the shim into insecure mode. If so, and if the
* variable doesn't have the runtime attribute set, we might as well
- * honor that.
diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 135ca9c..e1893f5 100644
+index 6049600..784a276 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
-@@ -645,6 +645,10 @@ typedef struct {
-
+@@ -646,6 +646,10 @@ typedef struct {
+
#define EFI_SYSTEM_TABLE_SIGNATURE ((u64)0x5453595320494249ULL)
-
+
+#define EFI_2_60_SYSTEM_TABLE_REVISION ((2 << 16) | (60))
+#define EFI_2_50_SYSTEM_TABLE_REVISION ((2 << 16) | (50))
+#define EFI_2_40_SYSTEM_TABLE_REVISION ((2 << 16) | (40))
@@ -117,9 +116,9 @@ index 135ca9c..e1893f5 100644
#define EFI_2_20_SYSTEM_TABLE_REVISION ((2 << 16) | (20))
#define EFI_2_10_SYSTEM_TABLE_REVISION ((2 << 16) | (10))
--
-2.9.3
+2.7.4
-From 3b0695eda22ad712a2b9be9bb70979d875a37816 Mon Sep 17 00:00:00 2001
+From f05a90c19a9613d8d50597319ed91f691e25b689 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Mon, 21 Nov 2016 23:36:17 +0000
Subject: [PATCH 09/32] Add the ability to lock down access to the running
@@ -142,13 +141,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
create mode 100644 security/lock_down.c
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
-index bc6ed52..8ab309d 100644
+index cb09238..3cd3be9 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
-@@ -268,6 +268,15 @@ extern int oops_may_print(void);
+@@ -273,6 +273,15 @@ extern int oops_may_print(void);
void do_exit(long error_code) __noreturn;
void complete_and_exit(struct completion *, long) __noreturn;
-
+
+#ifdef CONFIG_LOCK_DOWN_KERNEL
+extern bool kernel_is_locked_down(void);
+#else
@@ -162,13 +161,13 @@ index bc6ed52..8ab309d 100644
int __must_check _kstrtoul(const char *s, unsigned int base, unsigned long *res);
int __must_check _kstrtol(const char *s, unsigned int base, long *res);
diff --git a/include/linux/security.h b/include/linux/security.h
-index c2125e9..41a7325 100644
+index d3868f2..187b74b 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
-@@ -1685,5 +1685,16 @@ static inline void free_secdata(void *secdata)
+@@ -1679,5 +1679,16 @@ static inline void free_secdata(void *secdata)
{ }
#endif /* CONFIG_SECURITY */
-
+
+#ifdef CONFIG_LOCK_DOWN_KERNEL
+extern void lock_kernel_down(void);
+#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT
@@ -181,15 +180,15 @@ index c2125e9..41a7325 100644
+#endif
+
#endif /* ! __LINUX_SECURITY_H */
-
+
diff --git a/security/Kconfig b/security/Kconfig
-index 118f454..fa1a678 100644
+index d900f47..d9b391d 100644
--- a/security/Kconfig
+++ b/security/Kconfig
-@@ -158,6 +158,21 @@ config HARDENED_USERCOPY_PAGESPAN
- been removed. This config is intended to be used only while
- trying to find such users.
-
+@@ -193,6 +193,21 @@ config STATIC_USERMODEHELPER_PATH
+ If you wish for all usermode helper programs to be disabled,
+ specify an empty string here (i.e. "").
+
+config LOCK_DOWN_KERNEL
+ bool "Allow the kernel to be 'locked down'"
+ help
@@ -266,9 +265,9 @@ index 0000000..5788c60
+}
+EXPORT_SYMBOL(kernel_is_locked_down);
--
-2.9.3
+2.7.4
-From c1cc643f82e1c9efee123eb81befb58e41b87310 Mon Sep 17 00:00:00 2001
+From fb6feb38e297260d050fc477c72683ac51d07ae3 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Mon, 21 Nov 2016 23:55:55 +0000
Subject: [PATCH 10/32] efi: Lock down the kernel if booted in secure boot mode
@@ -286,13 +285,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index bada636..5b19997 100644
+index 874c123..a315974 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
-@@ -1786,6 +1786,18 @@ config EFI_MIXED
-
+@@ -1816,6 +1816,18 @@ config EFI_MIXED
+
If unsure, say N.
-
+
+config EFI_SECURE_BOOT_LOCK_DOWN
+ def_bool n
+ depends on EFI
@@ -309,7 +308,7 @@ index bada636..5b19997 100644
def_bool y
prompt "Enable seccomp to safely compute untrusted bytecode"
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index d8972ec..facaeb9 100644
+index 447905e..d44e60e 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -69,6 +69,7 @@
@@ -317,10 +316,10 @@ index d8972ec..facaeb9 100644
#include <linux/tboot.h>
#include <linux/jiffies.h>
+#include <linux/security.h>
-
+
#include <video/edid.h>
-
-@@ -1159,7 +1160,12 @@ void __init setup_arch(char **cmdline_p)
+
+@@ -1183,7 +1184,12 @@ void __init setup_arch(char **cmdline_p)
break;
case efi_secureboot_mode_enabled:
set_bit(EFI_SECURE_BOOT, &efi.flags);
@@ -335,9 +334,9 @@ index d8972ec..facaeb9 100644
default:
pr_info("Secure boot could not be determined\n");
--
-2.9.3
+2.7.4
-From 03ff1bcf82c3acc3df8e8fd1badbbc9f6a27a2e6 Mon Sep 17 00:00:00 2001
+From 7182f2f5b254d6dc6d3105d2f99219a76adf9de0 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Wed, 23 Nov 2016 13:22:22 +0000
Subject: [PATCH 11/32] Enforce module signatures if the kernel is locked down
@@ -351,22 +350,22 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/module.c b/kernel/module.c
-index f57dd63..2a021c3 100644
+index 7eba6de..3331f2e 100644
--- a/kernel/module.c
+++ b/kernel/module.c
-@@ -2744,7 +2744,7 @@ static int module_sig_check(struct load_info *info, int flags)
+@@ -2756,7 +2756,7 @@ static int module_sig_check(struct load_info *info, int flags)
}
-
+
/* Not having a signature is only an error if we're strict. */
- if (err == -ENOKEY && !sig_enforce)
+ if (err == -ENOKEY && !sig_enforce && !kernel_is_locked_down())
err = 0;
-
+
return err;
--
-2.9.3
+2.7.4
-From 328104a3a9859084a25240ea031572e0d20ceaf4 Mon Sep 17 00:00:00 2001
+From 7e97c58bcd0b4c082b889fb093a2779147532b9f Mon Sep 17 00:00:00 2001
From: Matthew Garrett <matthew.garrett@nebula.com>
Date: Tue, 22 Nov 2016 08:46:16 +0000
Subject: [PATCH 12/32] Restrict /dev/mem and /dev/kmem when the kernel is
@@ -383,23 +382,23 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 6 insertions(+)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 5bb1985..6441d21 100644
+index 6d9cc2d..f814404 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -163,6 +163,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
if (p != *ppos)
return -EFBIG;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
if (!valid_phys_addr_range(p, count))
return -EFAULT;
-
-@@ -515,6 +518,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
+
+@@ -513,6 +516,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
int err = 0;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
@@ -407,9 +406,9 @@ index 5bb1985..6441d21 100644
unsigned long to_write = min_t(unsigned long, count,
(unsigned long)high_memory - p);
--
-2.9.3
+2.7.4
-From 2cfe484bdc7e42b42be4887f2b4d23ac9de79593 Mon Sep 17 00:00:00 2001
+From b83b68a9a13120664eaabf21a7b3ff0b065bd5b2 Mon Sep 17 00:00:00 2001
From: Kyle McMartin <kyle@redhat.com>
Date: Mon, 21 Nov 2016 23:55:56 +0000
Subject: [PATCH 13/32] Add a sysrq option to exit secure boot mode
@@ -429,13 +428,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
7 files changed, 68 insertions(+), 8 deletions(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 5b19997..c2b481b 100644
+index a315974..6931e68 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
-@@ -1798,6 +1798,16 @@ config EFI_SECURE_BOOT_LOCK_DOWN
+@@ -1828,6 +1828,16 @@ config EFI_SECURE_BOOT_LOCK_DOWN
image. Say Y here to automatically lock down the kernel when a
system boots with UEFI Secure Boot enabled.
-
+
+config EFI_ALLOW_SECURE_BOOT_EXIT
+ def_bool n
+ depends on EFI_SECURE_BOOT_LOCK_DOWN && MAGIC_SYSRQ
@@ -450,25 +449,25 @@ index 5b19997..c2b481b 100644
def_bool y
prompt "Enable seccomp to safely compute untrusted bytecode"
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index facaeb9..de24041 100644
+index d44e60e..f7635d0 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -71,6 +71,11 @@
#include <linux/jiffies.h>
#include <linux/security.h>
-
+
+#include <linux/fips.h>
+#include <linux/cred.h>
+#include <linux/sysrq.h>
+#include <linux/init_task.h>
+
#include <video/edid.h>
-
+
#include <asm/mtrr.h>
-@@ -1304,6 +1309,32 @@ void __init i386_reserve_resources(void)
-
+@@ -1328,6 +1333,32 @@ void __init i386_reserve_resources(void)
+
#endif /* CONFIG_X86_32 */
-
+
+#ifdef CONFIG_EFI_ALLOW_SECURE_BOOT_EXIT
+
+static void sysrq_handle_secure_boot(int key)
@@ -499,19 +498,19 @@ index facaeb9..de24041 100644
.notifier_call = dump_kernel_offset
};
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
-index 92595b9..894ed3f 100644
+index 022be0e..4a054a5 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
-@@ -379,6 +379,7 @@ static int uinput_allocate_device(struct uinput_device *udev)
+@@ -387,6 +387,7 @@ static int uinput_allocate_device(struct uinput_device *udev)
if (!udev->dev)
return -ENOMEM;
-
+
+ udev->dev->flags |= INPUTDEV_FLAGS_SYNTHETIC;
udev->dev->event = uinput_dev_event;
input_set_drvdata(udev->dev, udev);
-
+
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index 52bbd27..72f46a1 100644
+index 7113674..e1addc3 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -479,6 +479,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
@@ -525,14 +524,14 @@ index 52bbd27..72f46a1 100644
@@ -522,7 +523,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p)
sysrq_key_table[i] = op_p;
}
-
+
-void __handle_sysrq(int key, bool check_mask)
+void __handle_sysrq(int key, unsigned int from)
{
struct sysrq_key_op *op_p;
int orig_log_level;
@@ -542,11 +543,15 @@ void __handle_sysrq(int key, bool check_mask)
-
+
op_p = __sysrq_get_key_op(key);
if (op_p) {
+ /* Ban synthetic events from some sysrq functionality */
@@ -556,18 +555,18 @@ index 52bbd27..72f46a1 100644
+ __handle_sysrq(key, SYSRQ_FROM_KERNEL);
}
EXPORT_SYMBOL(handle_sysrq);
-
+
@@ -659,7 +664,7 @@ static void sysrq_do_reset(unsigned long _state)
static void sysrq_handle_reset_request(struct sysrq_state *state)
{
if (state->reset_requested)
- __handle_sysrq(sysrq_xlate[KEY_B], false);
+ __handle_sysrq(sysrq_xlate[KEY_B], SYSRQ_FROM_KERNEL);
-
+
if (sysrq_reset_downtime_ms)
mod_timer(&state->keyreset_timer,
@@ -810,8 +815,10 @@ static bool sysrq_handle_keypress(struct sysrq_state *sysrq,
-
+
default:
if (sysrq->active && value && value != 2) {
+ int from = sysrq->handle.dev->flags & INPUTDEV_FLAGS_SYNTHETIC ?
@@ -579,13 +578,13 @@ index 52bbd27..72f46a1 100644
break;
}
@@ -1095,7 +1102,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
-
+
if (get_user(c, buf))
return -EFAULT;
- __handle_sysrq(c, false);
+ __handle_sysrq(c, SYSRQ_FROM_PROC);
}
-
+
return count;
diff --git a/include/linux/input.h b/include/linux/input.h
index a65e3b2..8b03571 100644
@@ -602,16 +601,16 @@ index a65e3b2..8b03571 100644
@@ -124,6 +125,8 @@ struct input_dev {
const char *uniq;
struct input_id id;
-
+
+ unsigned int flags;
+
unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)];
-
+
unsigned long evbit[BITS_TO_LONGS(EV_CNT)];
@@ -190,6 +193,8 @@ struct input_dev {
};
#define to_input_dev(d) container_of(d, struct input_dev, dev)
-
+
+#define INPUTDEV_FLAGS_SYNTHETIC 0x000000001
+
/*
@@ -624,7 +623,7 @@ index 387fa7d..f7c52a9 100644
@@ -28,6 +28,8 @@
#define SYSRQ_ENABLE_BOOT 0x0080
#define SYSRQ_ENABLE_RTNICE 0x0100
-
+
+#define SYSRQ_DISABLE_USERSPACE 0x00010000
+
struct sysrq_key_op {
@@ -633,7 +632,7 @@ index 387fa7d..f7c52a9 100644
@@ -42,8 +44,12 @@ struct sysrq_key_op {
* are available -- else NULL's).
*/
-
+
+#define SYSRQ_FROM_KERNEL 0x0001
+#define SYSRQ_FROM_PROC 0x0002
+#define SYSRQ_FROM_SYNTHETIC 0x0004
@@ -645,22 +644,22 @@ index 387fa7d..f7c52a9 100644
int unregister_sysrq_key(int key, struct sysrq_key_op *op);
struct sysrq_key_op *__sysrq_get_key_op(int key);
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
-index 2a20c0d..d46d2e1 100644
+index ca18391..c4524b8 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
-@@ -1968,7 +1968,7 @@ static int kdb_sr(int argc, const char **argv)
+@@ -1967,7 +1967,7 @@ static int kdb_sr(int argc, const char **argv)
return KDB_ARGCOUNT;
-
+
kdb_trap_printk++;
- __handle_sysrq(*argv[1], check_mask);
+ __handle_sysrq(*argv[1], check_mask ? SYSRQ_FROM_KERNEL : 0);
kdb_trap_printk--;
-
+
return 0;
--
-2.9.3
+2.7.4
-From a82fdfceffac8e9cdc0287d874a8ba1b9d875e70 Mon Sep 17 00:00:00 2001
+From 8884bd44932e595323fcddfb09c2a2a586134cdf Mon Sep 17 00:00:00 2001
From: Matthew Garrett <matthew.garrett@nebula.com>
Date: Tue, 22 Nov 2016 08:46:15 +0000
Subject: [PATCH 14/32] kexec: Disable at runtime if the kernel is locked down
@@ -684,7 +683,7 @@ index 980936a..46de8e6 100644
+++ b/kernel/kexec.c
@@ -194,6 +194,13 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
return -EPERM;
-
+
/*
+ * kexec can be used to circumvent module loading restrictions, so
+ * prevent loading in that case
@@ -697,9 +696,9 @@ index 980936a..46de8e6 100644
* This leaves us room for future extensions.
*/
--
-2.9.3
+2.7.4
-From 43d4cec4b9acbe2954afb355cc32dbd456ca77bd Mon Sep 17 00:00:00 2001
+From cace563d1743c3d2faf1e46bd4df8e63e2310207 Mon Sep 17 00:00:00 2001
From: Dave Young <dyoung@redhat.com>
Date: Tue, 22 Nov 2016 08:46:15 +0000
Subject: [PATCH 15/32] Copy secure_boot flag in boot params across kexec
@@ -723,21 +722,21 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 1 insertion(+)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
-index 3407b14..b843a4e 100644
+index d0a814a..3551bca 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -179,6 +179,7 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
if (efi_enabled(EFI_OLD_MEMMAP))
return 0;
-
+
+ params->secure_boot = boot_params.secure_boot;
ei->efi_loader_signature = current_ei->efi_loader_signature;
ei->efi_systab = current_ei->efi_systab;
ei->efi_systab_hi = current_ei->efi_systab_hi;
--
-2.9.3
+2.7.4
-From 7f303a867209a3641d3da378d914967314b60254 Mon Sep 17 00:00:00 2001
+From 08a3467acbc28bb469d1eebd0f5fd40b944d984a Mon Sep 17 00:00:00 2001
From: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
Date: Wed, 23 Nov 2016 13:49:19 +0000
Subject: [PATCH 16/32] kexec_file: Disable at runtime if securelevel has been
@@ -757,13 +756,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 6 insertions(+)
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
-index 037c321..04f48f2 100644
+index b56a558..003cade 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
-@@ -264,6 +264,12 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
+@@ -268,6 +268,12 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)
return -EPERM;
-
+
+ /* Don't permit images to be loaded into trusted kernels if we're not
+ * going to verify the signature on them
+ */
@@ -774,9 +773,9 @@ index 037c321..04f48f2 100644
if (flags != (flags & KEXEC_FILE_FLAGS))
return -EINVAL;
--
-2.9.3
+2.7.4
-From 7b42e60e328109fc2a04434c3cfedeb53eae6426 Mon Sep 17 00:00:00 2001
+From 925fd10d7a99a6f999dde76daf2b1ef1238b251a Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@fedoraproject.org>
Date: Tue, 22 Nov 2016 08:46:15 +0000
Subject: [PATCH 17/32] hibernate: Disable when the kernel is locked down
@@ -793,22 +792,22 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
-index b26dbc4..3732187 100644
+index 86385af..1629798 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -67,7 +67,7 @@ static const struct platform_hibernation_ops *hibernation_ops;
-
+
bool hibernation_available(void)
{
- return (nohibernate == 0);
+ return nohibernate == 0 && !kernel_is_locked_down();
}
-
+
/**
--
-2.9.3
+2.7.4
-From a2a550718c501375c22f5afdead9d25225abdcd3 Mon Sep 17 00:00:00 2001
+From b14fb5fcd60c84a09a15bd7ec974b6fbce68335c Mon Sep 17 00:00:00 2001
From: Matthew Garrett <mjg59@srcf.ucam.org>
Date: Wed, 23 Nov 2016 13:28:17 +0000
Subject: [PATCH 18/32] uswsusp: Disable when the kernel is locked down
@@ -824,23 +823,23 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 3 insertions(+)
diff --git a/kernel/power/user.c b/kernel/power/user.c
-index 35310b6..c9ef5e1 100644
+index 22df9f7..e4b926d 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -52,6 +52,9 @@ static int snapshot_open(struct inode *inode, struct file *filp)
if (!hibernation_available())
return -EPERM;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
lock_system_sleep();
-
+
if (!atomic_add_unless(&snapshot_device_available, -1, 0)) {
--
-2.9.3
+2.7.4
-From 81204660ab5d1914cb59fb246f103288ecf9a177 Mon Sep 17 00:00:00 2001
+From d8167273e7562e5aa866d2b65e25bb1962de972c Mon Sep 17 00:00:00 2001
From: Matthew Garrett <matthew.garrett@nebula.com>
Date: Tue, 22 Nov 2016 08:46:15 +0000
Subject: [PATCH 19/32] PCI: Lock down BAR access when the kernel is locked
@@ -861,30 +860,30 @@ Signed-off-by: David Howells <dhowells@redhat.com>
3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index bcd10c7..02b9c9e 100644
+index 0666287..b10992c 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
-@@ -716,6 +716,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj,
+@@ -718,6 +718,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj,
loff_t init_off = off;
u8 *data = (u8 *) buf;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
if (off > dev->cfg_size)
return 0;
if (off + count > dev->cfg_size) {
-@@ -1007,6 +1010,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
+@@ -1009,6 +1012,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
resource_size_t start, end;
int i;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
for (i = 0; i < PCI_ROM_RESOURCE; i++)
if (res == &pdev->resource[i])
break;
-@@ -1106,6 +1112,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj,
+@@ -1108,6 +1114,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj,
struct bin_attribute *attr, char *buf,
loff_t off, size_t count)
{
@@ -893,15 +892,15 @@ index bcd10c7..02b9c9e 100644
+
return pci_resource_io(filp, kobj, attr, buf, off, count, true);
}
-
+
diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
-index 2408abe..eaccf9b 100644
+index f82710a..139d6f0 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -116,6 +116,9 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf,
int size = dev->cfg_size;
int cnt;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
@@ -911,7 +910,7 @@ index 2408abe..eaccf9b 100644
@@ -195,6 +198,9 @@ static long proc_bus_pci_ioctl(struct file *file, unsigned int cmd,
#endif /* HAVE_PCI_MMAP */
int ret = 0;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
@@ -921,29 +920,29 @@ index 2408abe..eaccf9b 100644
@@ -233,7 +239,7 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma)
struct pci_filp_private *fpriv = file->private_data;
int i, ret, write_combine;
-
+
- if (!capable(CAP_SYS_RAWIO))
+ if (!capable(CAP_SYS_RAWIO) || kernel_is_locked_down())
return -EPERM;
-
+
/* Make sure the caller is mapping a real resource for this device */
diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
-index b91c4da..81544dc 100644
+index 9bf993e..c095247 100644
--- a/drivers/pci/syscall.c
+++ b/drivers/pci/syscall.c
@@ -92,7 +92,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
u32 dword;
int err = 0;
-
+
- if (!capable(CAP_SYS_ADMIN))
+ if (!capable(CAP_SYS_ADMIN) || kernel_is_locked_down())
return -EPERM;
-
+
dev = pci_get_bus_and_slot(bus, dfn);
--
-2.9.3
+2.7.4
-From 18f4177e0a147adccbbacb1fa95e340352228db3 Mon Sep 17 00:00:00 2001
+From 169d13e0c5240ac6aad13aace5ecbdb3de2cfada Mon Sep 17 00:00:00 2001
From: Matthew Garrett <matthew.garrett@nebula.com>
Date: Tue, 22 Nov 2016 08:46:16 +0000
Subject: [PATCH 20/32] x86: Lock down IO port access when the kernel is locked
@@ -965,19 +964,19 @@ Signed-off-by: David Howells <dhowells@redhat.com>
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
-index 589b319..f0789ab 100644
+index b01bc8517..4ccaace 100644
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
-@@ -28,7 +28,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
-
+@@ -29,7 +29,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
+
if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
return -EINVAL;
- if (turn_on && !capable(CAP_SYS_RAWIO))
+ if (turn_on && (!capable(CAP_SYS_RAWIO) || kernel_is_locked_down()))
return -EPERM;
-
+
/*
-@@ -108,7 +108,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
+@@ -113,7 +113,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
return -EINVAL;
/* Trying to gain more privileges? */
if (level > old) {
@@ -987,22 +986,22 @@ index 589b319..f0789ab 100644
}
regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 6441d21..f653c36 100644
+index f814404..9afebb6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
-@@ -743,6 +743,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig)
-
+@@ -741,6 +741,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig)
+
static int open_port(struct inode *inode, struct file *filp)
{
+ if (kernel_is_locked_down())
+ return -EPERM;
return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
}
-
+
--
-2.9.3
+2.7.4
-From bdd2ae6c0c8ce5a4dadaa41019a6e065e9aa9128 Mon Sep 17 00:00:00 2001
+From efd24f7e9af624b62f39efce4f60b31f0ca643d8 Mon Sep 17 00:00:00 2001
From: Matthew Garrett <matthew.garrett@nebula.com>
Date: Tue, 22 Nov 2016 08:46:17 +0000
Subject: [PATCH 21/32] x86: Restrict MSR access when the kernel is locked down
@@ -1019,20 +1018,20 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 7 insertions(+)
diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
-index 7f3550a..90cddc1 100644
+index ef68880..fbcce02 100644
--- a/arch/x86/kernel/msr.c
+++ b/arch/x86/kernel/msr.c
-@@ -83,6 +83,9 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
+@@ -84,6 +84,9 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
int err = 0;
ssize_t bytes = 0;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
if (count % 8)
return -EINVAL; /* Invalid chunk size */
-
-@@ -130,6 +133,10 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
+
+@@ -131,6 +134,10 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
err = -EBADF;
break;
}
@@ -1044,9 +1043,9 @@ index 7f3550a..90cddc1 100644
err = -EFAULT;
break;
--
-2.9.3
+2.7.4
-From 50d0b2fd4e13f1da62d7bfabe7559cdaaceee06b Mon Sep 17 00:00:00 2001
+From 62ebdffbcb0726b98562e9f1173a6d5967755764 Mon Sep 17 00:00:00 2001
From: Matthew Garrett <matthew.garrett@nebula.com>
Date: Tue, 22 Nov 2016 08:46:16 +0000
Subject: [PATCH 22/32] asus-wmi: Restrict debugfs interface when the kernel is
@@ -1065,33 +1064,33 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 9 insertions(+)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
-index ce6ca31..d860017 100644
+index 43cb680..9be3e08 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
-@@ -1872,6 +1872,9 @@ static int show_dsts(struct seq_file *m, void *data)
+@@ -1898,6 +1898,9 @@ static int show_dsts(struct seq_file *m, void *data)
int err;
u32 retval = -1;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
err = asus_wmi_get_devstate(asus, asus->debug.dev_id, &retval);
-
+
if (err < 0)
-@@ -1888,6 +1891,9 @@ static int show_devs(struct seq_file *m, void *data)
+@@ -1914,6 +1917,9 @@ static int show_devs(struct seq_file *m, void *data)
int err;
u32 retval = -1;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
err = asus_wmi_set_devstate(asus->debug.dev_id, asus->debug.ctrl_param,
&retval);
-
-@@ -1912,6 +1918,9 @@ static int show_call(struct seq_file *m, void *data)
+
+@@ -1938,6 +1944,9 @@ static int show_call(struct seq_file *m, void *data)
union acpi_object *obj;
acpi_status status;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
@@ -1099,9 +1098,9 @@ index ce6ca31..d860017 100644
1, asus->debug.method_id,
&input, &output);
--
-2.9.3
+2.7.4
-From 88156357adede0ba4060adb0934d08e75afb6e9d Mon Sep 17 00:00:00 2001
+From 31f493d03dde1854fa9e540f87a751fbeeb41cb9 Mon Sep 17 00:00:00 2001
From: Matthew Garrett <matthew.garrett@nebula.com>
Date: Tue, 22 Nov 2016 08:46:16 +0000
Subject: [PATCH 23/32] ACPI: Limit access to custom_method when the kernel is
@@ -1124,7 +1123,7 @@ index c68e724..e4d721c 100644
@@ -29,6 +29,9 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
struct acpi_table_header table;
acpi_status status;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
@@ -1132,9 +1131,9 @@ index c68e724..e4d721c 100644
/* parse the table header to get the table length */
if (count <= sizeof(struct acpi_table_header))
--
-2.9.3
+2.7.4
-From 960205f64271826552eec6d7ba34144b1615c376 Mon Sep 17 00:00:00 2001
+From 1dec5dc62c78f78b9efe44aac3d6119d97b67017 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@redhat.com>
Date: Tue, 22 Nov 2016 08:46:16 +0000
Subject: [PATCH 24/32] acpi: Ignore acpi_rsdp kernel param when the kernel has
@@ -1151,10 +1150,10 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 416953a..79f3d03 100644
+index db78d35..d4d4ba3 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
-@@ -191,7 +191,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp);
+@@ -192,7 +192,7 @@ acpi_physical_address __init acpi_os_get_root_pointer(void)
acpi_physical_address pa = 0;
#ifdef CONFIG_KEXEC
@@ -1162,11 +1161,11 @@ index 416953a..79f3d03 100644
+ if (acpi_rsdp && !kernel_is_locked_down())
return acpi_rsdp;
#endif
-
+
--
-2.9.3
+2.7.4
-From 2f200d295a041b154f3938940c2d8aa1742f1379 Mon Sep 17 00:00:00 2001
+From 96eaf04100d7365d93f898013175351c7d2702a6 Mon Sep 17 00:00:00 2001
From: Linn Crosetto <linn@hpe.com>
Date: Wed, 23 Nov 2016 13:32:27 +0000
Subject: [PATCH 25/32] acpi: Disable ACPI table override if the kernel is
@@ -1189,13 +1188,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 5 insertions(+)
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
-index cdd56c4..c657c08 100644
+index 2604189..601096d 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
-@@ -545,6 +545,11 @@ void __init acpi_table_upgrade(void)
+@@ -542,6 +542,11 @@ void __init acpi_table_upgrade(void)
if (table_nr == 0)
return;
-
+
+ if (kernel_is_locked_down()) {
+ pr_notice("kernel is locked down, ignoring table override\n");
+ return;
@@ -1205,9 +1204,9 @@ index cdd56c4..c657c08 100644
memblock_find_in_range(0, ACPI_TABLE_UPGRADE_MAX_PHYS,
all_tables_size, PAGE_SIZE);
--
-2.9.3
+2.7.4
-From 6244dff831988f59797add76cee80c73961d5ac5 Mon Sep 17 00:00:00 2001
+From 521979b819b853f7578ba8edef8b33bc2077026d Mon Sep 17 00:00:00 2001
From: Linn Crosetto <linn@hpe.com>
Date: Wed, 23 Nov 2016 13:39:41 +0000
Subject: [PATCH 26/32] acpi: Disable APEI error injection if the kernel is
@@ -1235,13 +1234,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 3 insertions(+)
diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c
-index eebb7e3..e4f126a 100644
+index ec50c32..e082718 100644
--- a/drivers/acpi/apei/einj.c
+++ b/drivers/acpi/apei/einj.c
@@ -518,6 +518,9 @@ static int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2,
int rc;
u64 base_addr, size;
-
+
+ if (kernel_is_locked_down())
+ return -EPERM;
+
@@ -1249,9 +1248,9 @@ index eebb7e3..e4f126a 100644
if (flags && (flags &
~(SETWA_FLAGS_APICID|SETWA_FLAGS_MEM|SETWA_FLAGS_PCIE_SBDF)))
--
-2.9.3
+2.7.4
-From a17a541d1af379c3d6ff21924c212f9e2e38c1c8 Mon Sep 17 00:00:00 2001
+From fe597dad1cba83345d62c4079c0d8861c426698c Mon Sep 17 00:00:00 2001
From: Matthew Garrett <mjg59@coreos.com>
Date: Wed, 23 Nov 2016 13:41:23 +0000
Subject: [PATCH 27/32] Enable cold boot attack mitigation
@@ -1261,13 +1260,13 @@ Subject: [PATCH 27/32] Enable cold boot attack mitigation
1 file changed, 28 insertions(+)
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index 5b151c2..5093a76 100644
+index 801c7a1..ef9409b 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
-@@ -774,6 +774,31 @@ void setup_graphics(struct boot_params *boot_params)
+@@ -604,6 +604,31 @@ void setup_graphics(struct boot_params *boot_params)
}
}
-
+
+#define MEMORY_ONLY_RESET_CONTROL_GUID \
+ EFI_GUID (0xe20939be, 0x32d4, 0x41be, 0xa1, 0x50, 0x89, 0x7f, 0x85, 0xd4, 0x98, 0x29)
+
@@ -1296,10 +1295,10 @@ index 5b151c2..5093a76 100644
/*
* Because the x86 boot code expects to be passed a boot_params we
* need to create one ourselves (usually the bootloader would create
-@@ -1158,6 +1183,9 @@ struct boot_params *efi_main(struct efi_config *c,
+@@ -988,6 +1013,9 @@ struct boot_params *efi_main(struct efi_config *c,
else
setup_boot_services32(efi_early);
-
+
+ /* Ask the firmware to clear memory if we don't have a clean shutdown */
+ enable_reset_attack_mitigation();
+
@@ -1307,9 +1306,9 @@ index 5b151c2..5093a76 100644
* If the boot loader gave us a value for secure_boot then we use that,
* otherwise we ask the BIOS.
--
-2.9.3
+2.7.4
-From c9c34942d873f7a09b9c7211bda3063354ff5706 Mon Sep 17 00:00:00 2001
+From 04fac895731801bc6cb26a6061f1c353c80a866c Mon Sep 17 00:00:00 2001
From: "Lee, Chun-Yi" <jlee@suse.com>
Date: Wed, 23 Nov 2016 13:52:16 +0000
Subject: [PATCH 28/32] bpf: Restrict kernel image access functions when the
@@ -1328,13 +1327,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 11 insertions(+)
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
-index 5dcb992..474e001 100644
+index cee9802..7fde851 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -65,6 +65,11 @@ BPF_CALL_3(bpf_probe_read, void *, dst, u32, size, const void *, unsafe_ptr)
{
int ret;
-
+
+ if (kernel_is_locked_down()) {
+ memset(dst, 0, size);
+ return -EPERM;
@@ -1356,7 +1355,7 @@ index 5dcb992..474e001 100644
@@ -143,6 +151,9 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
if (fmt[--fmt_size] != 0)
return -EINVAL;
-
+
+ if (kernel_is_locked_down())
+ return __trace_printk(1, fmt, 0, 0, 0);
+
@@ -1364,9 +1363,9 @@ index 5dcb992..474e001 100644
for (i = 0; i < fmt_size; i++) {
if ((!isprint(fmt[i]) && !isspace(fmt[i])) || !isascii(fmt[i]))
--
-2.9.3
+2.7.4
-From 04485aa7865dc340f38e32ad29793c625167acf3 Mon Sep 17 00:00:00 2001
+From 707d0e14c2c0d6c3139ff4bcb16ee22c462b4304 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 22 Nov 2016 10:10:34 +0000
Subject: [PATCH 29/32] scsi: Lock down the eata driver
@@ -1392,13 +1391,13 @@ cc: linux-scsi@vger.kernel.org
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
-index 227dd2c..5c036d1 100644
+index 227dd2c..5c036d10 100644
--- a/drivers/scsi/eata.c
+++ b/drivers/scsi/eata.c
@@ -1552,8 +1552,13 @@ static int eata2x_detect(struct scsi_host_template *tpnt)
-
+
tpnt->proc_name = "eata2x";
-
+
- if (strlen(boot_options))
+ if (strlen(boot_options)) {
+ if (kernel_is_locked_down()) {
@@ -1407,13 +1406,13 @@ index 227dd2c..5c036d1 100644
+ }
option_setup(boot_options);
+ }
-
+
#if defined(MODULE)
/* io_port could have been modified when loading as a module */
--
-2.9.3
+2.7.4
-From b1e8f012b7b17e0146f8e63de51f6f45819c859e Mon Sep 17 00:00:00 2001
+From 07e05e0b7d806a05eba55092630bb75a92311344 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Fri, 25 Nov 2016 14:37:45 +0000
Subject: [PATCH 30/32] Prohibit PCMCIA CIS storage when the kernel is locked
@@ -1434,19 +1433,19 @@ index 55ef7d1..193e4f7 100644
@@ -1578,6 +1578,11 @@ static ssize_t pccard_store_cis(struct file *filp, struct kobject *kobj,
struct pcmcia_socket *s;
int error;
-
+
+ if (kernel_is_locked_down()) {
+ pr_err("Direct CIS storage isn't permitted when the kernel is locked down\n");
+ return -EPERM;
+ }
+
s = to_socket(container_of(kobj, struct device, kobj));
-
+
if (off)
--
-2.9.3
+2.7.4
-From 66d9c09b9427719e3c6a34132e9ca0724cb1e3a8 Mon Sep 17 00:00:00 2001
+From cf1e877adbe35c5f72a9d85570b494aa3f35be6a Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Wed, 7 Dec 2016 10:28:39 +0000
Subject: [PATCH 31/32] Lock down TIOCSSERIAL
@@ -1463,13 +1462,13 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 6 insertions(+)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
-index f2303f3..f2c07fa 100644
+index 9939c3d..7c040e2 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
-@@ -819,6 +819,12 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
+@@ -820,6 +820,12 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
new_flags = new_info->flags;
old_custom_divisor = uport->custom_divisor;
-
+
+ if ((change_port || change_irq) && kernel_is_locked_down()) {
+ pr_err("Using TIOCSSERIAL to change device addresses, irqs and dma channels is not permitted when the kernel is locked down\n");
+ retval = -EPERM;
@@ -1480,4 +1479,5 @@ index f2303f3..f2c07fa 100644
retval = -EPERM;
if (change_irq || change_port ||
--
-2.9.3
+2.7.4
+
generated by cgit (git 2.34.1) at 2024-11-20 17:25:34 +0000