From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001

From: Jeremy Cline <jcline@redhat.com>

Date: Wed, 30 Oct 2019 14:37:49 +0000

Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set

Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if

the IPL secure flag is set.

Upstream Status: RHEL only

Suggested-by: Philipp Rudo <prudo@redhat.com>

Signed-off-by: Jeremy Cline <jcline@redhat.com>

---

 arch/s390/include/asm/ipl.h | 1 +

 arch/s390/kernel/ipl.c      | 5 +++++

 arch/s390/kernel/setup.c    | 4 ++++

 3 files changed, 10 insertions(+)

diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h

index 7d5cfdda5277..be66ee5d0437 100644

--- a/arch/s390/include/asm/ipl.h

+++ b/arch/s390/include/asm/ipl.h

@@ -120,6 +120,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,

 			     unsigned char flags, unsigned short cert);

 int ipl_report_add_certificate(struct ipl_report *report, void *key,

 			       unsigned long addr, unsigned long len);

+bool ipl_get_secureboot(void);

 /*

  * DIAG 308 support

diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c

index ccea9a245867..558f9fbfd114 100644

--- a/arch/s390/kernel/ipl.c

+++ b/arch/s390/kernel/ipl.c

@@ -2110,3 +2110,8 @@ int ipl_report_free(struct ipl_report *report)

 }

 #endif

+

+bool ipl_get_secureboot(void)

+{

+	return !!ipl_secure_flag;

+}

diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c

index 5853c9872dfe..fab9bc9889da 100644

--- a/arch/s390/kernel/setup.c

+++ b/arch/s390/kernel/setup.c

@@ -49,6 +49,7 @@

 #include <linux/memory.h>

 #include <linux/compat.h>

 #include <linux/start_kernel.h>

+#include <linux/security.h>

 #include <asm/boot_data.h>

 #include <asm/ipl.h>

@@ -1086,6 +1087,9 @@ void __init setup_arch(char **cmdline_p)

 	log_component_list();

+	if (ipl_get_secureboot())

+		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);

+

 	/* Have one command line that is parsed and saved in /proc/cmdline */

 	/* boot_command_line has been already set up in early.c */

 	*cmdline_p = boot_command_line;

-- 

2.26.2