Skip to content

Commit e65dc8a

Browse files
ader1990ader1990
committed
kernel: use new patches for secure boot
From: https://sources.debian.org/data/main/l/linux/6.12~rc6-1~exp1/debian/patches/features/all/lockdown/
1 parent 49a4848 commit e65dc8a

5 files changed

+54
-100
lines changed

‎sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.12.20.ebuild

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,8 @@ UNIPATCH_LIST="
3838
${PATCH_DIR}/z0001-kbuild-derive-relative-path-for-srctree-from-CURDIR.patch \
3939
${PATCH_DIR}/z0002-revert-pahole-flags.patch \
4040
${PATCH_DIR}/z0003-Revert-x86-boot-Remove-the-bugger-off-message.patch \
41-
${PATCH_DIR}/z0004-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch \
42-
${PATCH_DIR}/z0005-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \
43-
${PATCH_DIR}/z0006-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch \
44-
${PATCH_DIR}/z0007-arm64-add-kernel-config-option-to-lock-down-when-in-.patch \
45-
${PATCH_DIR}/z0008-tools-hv-fix-cross-compilation-for-ARM64.patch \
41+
${PATCH_DIR}/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch \
42+
${PATCH_DIR}/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \
43+
${PATCH_DIR}/z0006-mtd-disable-slram-and-phram-when-locked-down.patch \
44+
${PATCH_DIR}/z0007-arm64-add-kernel-config-option-to-lock-down-when.patch \
4645
"

‎sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch renamed to ‎sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0004-efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch

Lines changed: 10 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
1-
From 1e2ffbec195c89d887bc088691ebb19c9173ecad Mon Sep 17 00:00:00 2001
21
From: David Howells <dhowells@redhat.com>
32
Date: Mon, 18 Feb 2019 12:45:03 +0000
4-
Subject: [PATCH 1/4] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot
5-
mode
3+
Subject: [28/30] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
4+
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit?id=a5d70c55c603233c192b375f72116a395909da28
65

76
UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT
87
flag that can be passed to efi_enabled() to find out whether secure boot is
@@ -26,15 +25,13 @@ cc: linux-efi@vger.kernel.org
2625
arch/x86/kernel/setup.c | 14 +----------
2726
drivers/firmware/efi/Makefile | 1 +
2827
drivers/firmware/efi/secureboot.c | 39 +++++++++++++++++++++++++++++++
29-
include/linux/efi.h | 17 ++++++++------
30-
4 files changed, 51 insertions(+), 20 deletions(-)
28+
include/linux/efi.h | 16 ++++++++-----
29+
4 files changed, 51 insertions(+), 19 deletions(-)
3130
create mode 100644 drivers/firmware/efi/secureboot.c
3231

33-
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
34-
index eb129277dcdd..7c4a6697e39d 100644
3532
--- a/arch/x86/kernel/setup.c
3633
+++ b/arch/x86/kernel/setup.c
37-
@@ -1190,19 +1190,7 @@ void __init setup_arch(char **cmdline_p)
34+
@@ -1193,19 +1193,7 @@ void __init setup_arch(char **cmdline_p)
3835
/* Allocate bigger log buffer */
3936
setup_log_buf(1);
4037

@@ -55,21 +52,16 @@ index eb129277dcdd..7c4a6697e39d 100644
5552

5653
reserve_initrd();
5754

58-
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
59-
index e489fefd23da..f2dfae764fb5 100644
6055
--- a/drivers/firmware/efi/Makefile
6156
+++ b/drivers/firmware/efi/Makefile
62-
@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB) += libstub
57+
@@ -25,6 +25,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_m
6358
obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o
6459
obj-$(CONFIG_EFI_TEST) += test/
6560
obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o
6661
+obj-$(CONFIG_EFI) += secureboot.o
6762
obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o
6863
obj-$(CONFIG_EFI_RCI2_TABLE) += rci2-table.o
6964
obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE) += embedded-firmware.o
70-
diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c
71-
new file mode 100644
72-
index 000000000000..b6620669e32b
7365
--- /dev/null
7466
+++ b/drivers/firmware/efi/secureboot.c
7567
@@ -0,0 +1,39 @@
@@ -112,11 +104,9 @@ index 000000000000..b6620669e32b
112104
+ }
113105
+ }
114106
+}
115-
diff --git a/include/linux/efi.h b/include/linux/efi.h
116-
index 80b21d1c6eaf..d267ddba8369 100644
117107
--- a/include/linux/efi.h
118108
+++ b/include/linux/efi.h
119-
@@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console(char *);
109+
@@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console
120110
#define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
121111
#define EFI_MEM_NO_SOFT_RESERVE 11 /* Is the kernel configured to ignore soft reservations? */
122112
#define EFI_PRESERVE_BS_REGIONS 12 /* Are EFI boot-services memory segments available? */
@@ -131,23 +121,23 @@ index 80b21d1c6eaf..d267ddba8369 100644
131121

132122
#ifdef CONFIG_EFI
133123
/*
134-
@@ -895,6 +903,7 @@ static inline bool efi_rt_services_supported(unsigned int mask)
124+
@@ -895,6 +903,7 @@ static inline bool efi_rt_services_suppo
135125
return (efi.runtime_supported_mask & mask) == mask;
136126
}
137127
extern void efi_find_mirror(void);
138128
+extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode);
139129
#else
140130
static inline bool efi_enabled(int feature)
141131
{
142-
@@ -914,6 +923,7 @@ static inline bool efi_rt_services_supported(unsigned int mask)
132+
@@ -914,6 +923,7 @@ static inline bool efi_rt_services_suppo
143133
}
144134

145135
static inline void efi_find_mirror(void) {}
146136
+static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {}
147137
#endif
148138

149139
extern int efi_status_to_err(efi_status_t status);
150-
@@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled(void) { return true; }
140+
@@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled(
151141
extern void efi_call_virt_check_flags(unsigned long flags, const void *caller);
152142
extern unsigned long efi_call_virt_save_flags(void);
153143

@@ -161,6 +151,3 @@ index 80b21d1c6eaf..d267ddba8369 100644
161151
static inline
162152
enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var)
163153
{
164-
--
165-
2.39.2
166-

‎sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch renamed to ‎sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0005-efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch

Lines changed: 20 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1-
From fa96a2ef86466da0a43756ee39ce3b1cb555a55a Mon Sep 17 00:00:00 2001
21
From: Ben Hutchings <ben@decadent.org.uk>
32
Date: Tue, 10 Sep 2019 11:54:28 +0100
4-
Subject: [PATCH 2/4] efi: Lock down the kernel if booted in secure boot mode
3+
Subject: efi: Lock down the kernel if booted in secure boot mode
54

65
Based on an earlier patch by David Howells, who wrote the following
76
description:
@@ -18,18 +17,16 @@ help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that
1817
lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)]
1918
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
2019
---
21-
arch/x86/kernel/setup.c | 4 ++--
22-
drivers/firmware/efi/secureboot.c | 5 +++++
23-
include/linux/security.h | 6 ++++++
24-
security/lockdown/Kconfig | 15 +++++++++++++++
25-
security/lockdown/lockdown.c | 2 +-
26-
5 files changed, 29 insertions(+), 3 deletions(-)
20+
arch/x86/kernel/setup.c | 4 ++--
21+
drivers/firmware/efi/secureboot.c | 3 +++
22+
include/linux/security.h | 6 ++++++
23+
security/lockdown/Kconfig | 15 +++++++++++++++
24+
security/lockdown/lockdown.c | 2 +-
25+
5 files changed, 27 insertions(+), 3 deletions(-)
2726

28-
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
29-
index 7c4a6697e39d..04e73973098e 100644
3027
--- a/arch/x86/kernel/setup.c
3128
+++ b/arch/x86/kernel/setup.c
32-
@@ -1028,6 +1028,8 @@ void __init setup_arch(char **cmdline_p)
29+
@@ -904,6 +904,8 @@ void __init setup_arch(char **cmdline_p)
3330
if (efi_enabled(EFI_BOOT))
3431
efi_init();
3532

@@ -38,7 +35,7 @@ index 7c4a6697e39d..04e73973098e 100644
3835
reserve_ibft_region();
3936
x86_init.resources.dmi_setup();
4037

41-
@@ -1190,8 +1192,6 @@ void __init setup_arch(char **cmdline_p)
38+
@@ -1070,8 +1072,6 @@ void __init setup_arch(char **cmdline_p)
4239
/* Allocate bigger log buffer */
4340
setup_log_buf(1);
4441

@@ -47,8 +44,6 @@ index 7c4a6697e39d..04e73973098e 100644
4744
reserve_initrd();
4845

4946
acpi_table_upgrade();
50-
diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c
51-
index b6620669e32b..8f2554291fb1 100644
5247
--- a/drivers/firmware/efi/secureboot.c
5348
+++ b/drivers/firmware/efi/secureboot.c
5449
@@ -15,6 +15,7 @@
@@ -59,7 +54,7 @@ index b6620669e32b..8f2554291fb1 100644
5954

6055
/*
6156
* Decide what to do when UEFI secure boot mode is enabled.
62-
@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi_secureboot_mode mode)
57+
@@ -28,6 +29,10 @@ void __init efi_set_secure_boot(enum efi
6358
break;
6459
case efi_secureboot_mode_enabled:
6560
set_bit(EFI_SECURE_BOOT, &efi.flags);
@@ -70,19 +65,17 @@ index b6620669e32b..8f2554291fb1 100644
7065
pr_info("Secure boot enabled\n");
7166
break;
7267
default:
73-
diff --git a/include/linux/security.h b/include/linux/security.h
74-
index 4bd0f6fc553e..08258ecbb5f9 100644
7568
--- a/include/linux/security.h
7669
+++ b/include/linux/security.h
77-
@@ -486,6 +486,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
70+
@@ -522,6 +522,7 @@ int security_inode_notifysecctx(struct i
7871
int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
7972
int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
8073
int security_locked_down(enum lockdown_reason what);
8174
+int lock_kernel_down(const char *where, enum lockdown_reason level);
82-
#else /* CONFIG_SECURITY */
83-
84-
static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
85-
@@ -1404,6 +1405,11 @@ static inline int security_locked_down(enum lockdown_reason what)
75+
int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
76+
void *val, size_t val_len, u64 id, u64 flags);
77+
int security_bdev_alloc(struct block_device *bdev);
78+
@@ -1504,6 +1505,11 @@ static inline int security_locked_down(e
8679
{
8780
return 0;
8881
}
@@ -91,14 +84,12 @@ index 4bd0f6fc553e..08258ecbb5f9 100644
9184
+{
9285
+ return -EOPNOTSUPP;
9386
+}
94-
#endif /* CONFIG_SECURITY */
95-
96-
#if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
97-
diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
98-
index e84ddf484010..4175b50b1e6e 100644
87+
static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx,
88+
u32 *uctx_len, void *val, size_t val_len,
89+
u64 id, u64 flags)
9990
--- a/security/lockdown/Kconfig
10091
+++ b/security/lockdown/Kconfig
101-
@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY
92+
@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTI
10293
disabled.
10394

10495
endchoice
@@ -117,11 +108,9 @@ index e84ddf484010..4175b50b1e6e 100644
117108
+
118109
+ Enabling this option results in kernel lockdown being
119110
+ triggered in integrity mode if EFI Secure Boot is set.
120-
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
121-
index 68d19632aeb7..67cc9839952f 100644
122111
--- a/security/lockdown/lockdown.c
123112
+++ b/security/lockdown/lockdown.c
124-
@@ -23,7 +23,7 @@ static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE,
113+
@@ -24,7 +24,7 @@ static const enum lockdown_reason lockdo
125114
/*
126115
* Put the kernel into lock-down mode.
127116
*/
@@ -130,6 +119,3 @@ index 68d19632aeb7..67cc9839952f 100644
130119
{
131120
if (kernel_locked_down >= level)
132121
return -EPERM;
133-
--
134-
2.39.2
135-

‎sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-phram-slram-Disable-when-the-kernel-is-locked-do.patch renamed to ‎sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/6.12/z0006-mtd-disable-slram-and-phram-when-locked-down.patch

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
From bb8912cf807feab56cf8e924d33229d800ae71a6 Mon Sep 17 00:00:00 2001
21
From: Ben Hutchings <ben@decadent.org.uk>
32
Date: Fri, 30 Aug 2019 15:54:24 +0100
4-
Subject: [PATCH 3/4] mtd: phram,slram: Disable when the kernel is locked down
3+
Subject: mtd: phram,slram: Disable when the kernel is locked down
4+
Forwarded: https://lore.kernel.org/linux-security-module/20190830154720.eekfjt6c4jzvlbfz@decadent.org.uk/
55

66
These drivers allow mapping arbitrary memory ranges as MTD devices.
77
This should be disabled to preserve the kernel's integrity when it is
@@ -21,11 +21,9 @@ Cc: linux-mtd@lists.infradead.org
2121
drivers/mtd/devices/slram.c | 9 ++++++++-
2222
2 files changed, 13 insertions(+), 2 deletions(-)
2323

24-
diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
25-
index 208bd4d871f4..30f84a91692d 100644
2624
--- a/drivers/mtd/devices/phram.c
2725
+++ b/drivers/mtd/devices/phram.c
28-
@@ -364,7 +364,11 @@ static int phram_param_call(const char *val, const struct kernel_param *kp)
26+
@@ -364,7 +364,11 @@ static int phram_param_call(const char *
2927
#endif
3028
}
3129

@@ -38,8 +36,6 @@ index 208bd4d871f4..30f84a91692d 100644
3836
MODULE_PARM_DESC(phram, "Memory region to map. \"phram=<name>,<start>,<length>[,<erasesize>]\"");
3937

4038
#ifdef CONFIG_OF
41-
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
42-
index 28131a127d06..d92a2461e2ce 100644
4339
--- a/drivers/mtd/devices/slram.c
4440
+++ b/drivers/mtd/devices/slram.c
4541
@@ -43,6 +43,7 @@
@@ -77,6 +73,3 @@ index 28131a127d06..d92a2461e2ce 100644
7773
while (map) {
7874
devname = devstart = devlength = NULL;
7975

80-
--
81-
2.39.2
82-

0 commit comments

Comments
 (0)