|
 |
742215b |
From eaa12998810bd9db85dec71f0da55fd5aae73d0f Mon Sep 17 00:00:00 2001
|
|
|
742215b |
From: Jeremy Cline <jcline@redhat.com>
|
|
|
742215b |
Date: Wed, 30 Oct 2019 14:37:49 +0000
|
|
|
742215b |
Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set
|
|
|
742215b |
|
|
Jeremy Cline |
c5fe8f9 |
Automatically lock down the kernel to LOCKDOWN_INTEGRITY_MAX if
|
|
|
742215b |
the IPL secure flag is set.
|
|
|
742215b |
|
|
|
742215b |
Suggested-by: Philipp Rudo <prudo@redhat.com>
|
|
|
742215b |
Signed-off-by: Jeremy Cline <jcline@redhat.com>
|
|
|
742215b |
---
|
|
|
742215b |
arch/s390/include/asm/ipl.h | 1 +
|
|
|
742215b |
arch/s390/kernel/ipl.c | 5 +++++
|
|
|
742215b |
arch/s390/kernel/setup.c | 4 ++++
|
|
|
742215b |
3 files changed, 10 insertions(+)
|
|
|
742215b |
|
|
|
742215b |
diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
|
|
|
742215b |
index 084e71b7272a..1d1b5ec7357b 100644
|
|
|
742215b |
--- a/arch/s390/include/asm/ipl.h
|
|
|
742215b |
+++ b/arch/s390/include/asm/ipl.h
|
|
|
742215b |
@@ -109,6 +109,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
|
|
|
742215b |
unsigned char flags, unsigned short cert);
|
|
|
742215b |
int ipl_report_add_certificate(struct ipl_report *report, void *key,
|
|
|
742215b |
unsigned long addr, unsigned long len);
|
|
|
742215b |
+bool ipl_get_secureboot(void);
|
|
|
742215b |
|
|
|
742215b |
/*
|
|
|
742215b |
* DIAG 308 support
|
|
|
742215b |
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
|
|
|
742215b |
index 6837affc19e8..2d3f3d00e05c 100644
|
|
|
742215b |
--- a/arch/s390/kernel/ipl.c
|
|
|
742215b |
+++ b/arch/s390/kernel/ipl.c
|
|
|
742215b |
@@ -1842,3 +1842,8 @@ int ipl_report_free(struct ipl_report *report)
|
|
|
742215b |
}
|
|
|
742215b |
|
|
|
742215b |
#endif
|
|
|
742215b |
+
|
|
|
742215b |
+bool ipl_get_secureboot(void)
|
|
|
742215b |
+{
|
|
|
742215b |
+ return !!ipl_secure_flag;
|
|
|
742215b |
+}
|
|
|
742215b |
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
|
|
|
742215b |
index 9cbf490fd162..0510ecdfc3f6 100644
|
|
|
742215b |
--- a/arch/s390/kernel/setup.c
|
|
|
742215b |
+++ b/arch/s390/kernel/setup.c
|
|
|
742215b |
@@ -49,6 +49,7 @@
|
|
|
742215b |
#include <linux/memory.h>
|
|
|
742215b |
#include <linux/compat.h>
|
|
|
742215b |
#include <linux/start_kernel.h>
|
|
|
742215b |
+#include <linux/security.h>
|
|
|
742215b |
|
|
|
742215b |
#include <asm/boot_data.h>
|
|
|
742215b |
#include <asm/ipl.h>
|
|
|
742215b |
@@ -1096,6 +1097,9 @@ void __init setup_arch(char **cmdline_p)
|
|
|
742215b |
|
|
|
742215b |
log_component_list();
|
|
|
742215b |
|
|
|
742215b |
+ if (ipl_get_secureboot())
|
|
Jeremy Cline |
c5fe8f9 |
+ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
|
|
|
742215b |
+
|
|
|
742215b |
/* Have one command line that is parsed and saved in /proc/cmdline */
|
|
|
742215b |
/* boot_command_line has been already set up in early.c */
|
|
|
742215b |
*cmdline_p = boot_command_line;
|
|
|
742215b |
--
|
|
|
742215b |
2.24.1
|
|
|
742215b |
|