From d1b6f8c7af0eb9a0a44b2d4723e58dde5eafa236 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Thu, 23 Apr 2020 16:47:21 -0400 Subject: kernel-5.7.0-0.rc2.20200423git7adc4b399952.1 * Thu Apr 23 2020 CKI@GitLab [5.7.0-0.rc2.20200423git7adc4b399952.1] - 7adc4b399952 rebase - Match template format in kernel.spec.template ("Justin M. Forbes") - Break out the Patches into individual files for dist-git ("Justin M. Forbes") - Break the Red Hat patch into individual commits (Jeremy Cline) - Adjust module filtering so CONFIG_DRM_DP_CEC can be set (Jeremy Cline) - Add a script to generate release tags and branches (Jeremy Cline) - Set CONFIG_VDPA for fedora ("Justin M. Forbes") - Provide defaults in ark-rebase-patches.sh (Jeremy Cline) - Default ark-rebase-patches.sh to not report issues (Jeremy Cline) Resolves: rhbz# Signed-off-by: Jeremy Cline --- ...own-the-kernel-when-the-IPL-secure-flag-i.patch | 67 ++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch (limited to '0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch') diff --git a/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch b/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch new file mode 100644 index 000000000..792e1880c --- /dev/null +++ b/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch @@ -0,0 +1,67 @@ +From 74b1d77af819053398b9b5adde9b49d7481339af Mon Sep 17 00:00:00 2001 +From: Jeremy Cline +Date: Wed, 30 Oct 2019 14:37:49 +0000 +Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set + +Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if +the IPL secure flag is set. + +Upstream Status: RHEL only +Suggested-by: Philipp Rudo +Signed-off-by: Jeremy Cline +--- + arch/s390/include/asm/ipl.h | 1 + + arch/s390/kernel/ipl.c | 5 +++++ + arch/s390/kernel/setup.c | 4 ++++ + 3 files changed, 10 insertions(+) + +diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h +index b63bd66404b8..3482d9602e68 100644 +--- a/arch/s390/include/asm/ipl.h ++++ b/arch/s390/include/asm/ipl.h +@@ -109,6 +109,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf, + unsigned char flags, unsigned short cert); + int ipl_report_add_certificate(struct ipl_report *report, void *key, + unsigned long addr, unsigned long len); ++bool ipl_get_secureboot(void); + + /* + * DIAG 308 support +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index 4a71061974fd..9baf0b570c3d 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -1901,3 +1901,8 @@ int ipl_report_free(struct ipl_report *report) + } + + #endif ++ ++bool ipl_get_secureboot(void) ++{ ++ return !!ipl_secure_flag; ++} +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index 36445dd40fdb..b338a050c5aa 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1093,6 +1094,9 @@ void __init setup_arch(char **cmdline_p) + + log_component_list(); + ++ if (ipl_get_secureboot()) ++ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX); ++ + /* Have one command line that is parsed and saved in /proc/cmdline */ + /* boot_command_line has been already set up in early.c */ + *cmdline_p = boot_command_line; +-- +2.26.0 + -- cgit