kernel/0001-s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch

68 lines
2.1 KiB
Diff
Raw Normal View History

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jcline@redhat.com>
Date: Wed, 30 Oct 2019 14:37:49 +0000
Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set
Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if
the IPL secure flag is set.
Upstream Status: RHEL only
Suggested-by: Philipp Rudo <prudo@redhat.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>
---
arch/s390/include/asm/ipl.h | 1 +
arch/s390/kernel/ipl.c | 5 +++++
arch/s390/kernel/setup.c | 4 ++++
3 files changed, 10 insertions(+)
diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
kernel-5.8.0-0.rc0.20200610git84fc461db99b.1 * Wed Jun 10 2020 Fedora Kernel Team <kernel-team@fedoraproject.org> [5.8.0-0.rc0.20200610git84fc461db99b.1] - 84fc461db99b rebase - Fix PATCHLEVEL for merge window ("Justin M. Forbes") - PCI: tegra: Revert raw_violation_fixup for tegra124 (Nicolas Chauvet) - Change ark CONFIG_COMMON_CLK to yes, it is selected already by other options ("Justin M. Forbes") - More module filtering for Fedora ("Justin M. Forbes") - Update filters for rnbd in Fedora ("Justin M. Forbes") - Fix up module filtering for 5.8 ("Justin M. Forbes") - More Fedora config work ("Justin M. Forbes") - RTW88BE and CE have been extracted to their own modules ("Justin M. Forbes") - Set CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK for Fedora ("Justin M. Forbes") - Arm64 Use Branch Target Identification for kernel ("Justin M. Forbes") - Fedora config updates ("Justin M. Forbes") - Change value of CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE ("Justin M. Forbes") - Fix configs for Fedora ("Justin M. Forbes") - Fix update_scripts.sh unselective pattern sub (David Howells) - Updated changelog for the release based on b0c3ba31be3e ("CKI@GitLab") - Drop the static path configuration for the Sphinx docs (Jeremy Cline) - Sign off generated configuration patches (Jeremy Cline) - Use __make macro instead of make (Tom Stellard) - redhat/configs: Enable CONFIG_SMC91X and disable CONFIG_SMC911X (Prarit Bhargava) [http://bugzilla.redhat.com/1722136] Resolves: rhbz# Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
2020-06-10 22:01:45 +00:00
index 7d5cfdda5277..be66ee5d0437 100644
--- a/arch/s390/include/asm/ipl.h
+++ b/arch/s390/include/asm/ipl.h
kernel-5.8.0-0.rc0.20200610git84fc461db99b.1 * Wed Jun 10 2020 Fedora Kernel Team <kernel-team@fedoraproject.org> [5.8.0-0.rc0.20200610git84fc461db99b.1] - 84fc461db99b rebase - Fix PATCHLEVEL for merge window ("Justin M. Forbes") - PCI: tegra: Revert raw_violation_fixup for tegra124 (Nicolas Chauvet) - Change ark CONFIG_COMMON_CLK to yes, it is selected already by other options ("Justin M. Forbes") - More module filtering for Fedora ("Justin M. Forbes") - Update filters for rnbd in Fedora ("Justin M. Forbes") - Fix up module filtering for 5.8 ("Justin M. Forbes") - More Fedora config work ("Justin M. Forbes") - RTW88BE and CE have been extracted to their own modules ("Justin M. Forbes") - Set CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK for Fedora ("Justin M. Forbes") - Arm64 Use Branch Target Identification for kernel ("Justin M. Forbes") - Fedora config updates ("Justin M. Forbes") - Change value of CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE ("Justin M. Forbes") - Fix configs for Fedora ("Justin M. Forbes") - Fix update_scripts.sh unselective pattern sub (David Howells) - Updated changelog for the release based on b0c3ba31be3e ("CKI@GitLab") - Drop the static path configuration for the Sphinx docs (Jeremy Cline) - Sign off generated configuration patches (Jeremy Cline) - Use __make macro instead of make (Tom Stellard) - redhat/configs: Enable CONFIG_SMC91X and disable CONFIG_SMC911X (Prarit Bhargava) [http://bugzilla.redhat.com/1722136] Resolves: rhbz# Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
2020-06-10 22:01:45 +00:00
@@ -120,6 +120,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
unsigned char flags, unsigned short cert);
int ipl_report_add_certificate(struct ipl_report *report, void *key,
unsigned long addr, unsigned long len);
+bool ipl_get_secureboot(void);
/*
* DIAG 308 support
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index 90a2a17239b0..be3b72c53656 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
kernel-5.8.0-0.rc0.20200610git84fc461db99b.1 * Wed Jun 10 2020 Fedora Kernel Team <kernel-team@fedoraproject.org> [5.8.0-0.rc0.20200610git84fc461db99b.1] - 84fc461db99b rebase - Fix PATCHLEVEL for merge window ("Justin M. Forbes") - PCI: tegra: Revert raw_violation_fixup for tegra124 (Nicolas Chauvet) - Change ark CONFIG_COMMON_CLK to yes, it is selected already by other options ("Justin M. Forbes") - More module filtering for Fedora ("Justin M. Forbes") - Update filters for rnbd in Fedora ("Justin M. Forbes") - Fix up module filtering for 5.8 ("Justin M. Forbes") - More Fedora config work ("Justin M. Forbes") - RTW88BE and CE have been extracted to their own modules ("Justin M. Forbes") - Set CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK for Fedora ("Justin M. Forbes") - Arm64 Use Branch Target Identification for kernel ("Justin M. Forbes") - Fedora config updates ("Justin M. Forbes") - Change value of CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE ("Justin M. Forbes") - Fix configs for Fedora ("Justin M. Forbes") - Fix update_scripts.sh unselective pattern sub (David Howells) - Updated changelog for the release based on b0c3ba31be3e ("CKI@GitLab") - Drop the static path configuration for the Sphinx docs (Jeremy Cline) - Sign off generated configuration patches (Jeremy Cline) - Use __make macro instead of make (Tom Stellard) - redhat/configs: Enable CONFIG_SMC91X and disable CONFIG_SMC911X (Prarit Bhargava) [http://bugzilla.redhat.com/1722136] Resolves: rhbz# Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
2020-06-10 22:01:45 +00:00
@@ -2110,3 +2110,8 @@ int ipl_report_free(struct ipl_report *report)
}
#endif
+
+bool ipl_get_secureboot(void)
+{
+ return !!ipl_secure_flag;
+}
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index e600f6953d7c..4264e01824b3 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -49,6 +49,7 @@
#include <linux/memory.h>
#include <linux/compat.h>
#include <linux/start_kernel.h>
+#include <linux/security.h>
#include <asm/boot_data.h>
#include <asm/ipl.h>
@@ -1085,6 +1086,9 @@ void __init setup_arch(char **cmdline_p)
log_component_list();
+ if (ipl_get_secureboot())
+ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
+
/* Have one command line that is parsed and saved in /proc/cmdline */
/* boot_command_line has been already set up in early.c */
*cmdline_p = boot_command_line;
--
2.26.2