From c5fe8f96488ec3ad2da21e5c0480cbb2de0f562e Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Mar 20 2020 22:02:59 +0000 Subject: Switch Secure Boot to lock down in integrity mode (rhbz 1815571) --- diff --git a/efi-secureboot.patch b/efi-secureboot.patch index cda57a4..227805e 100644 --- a/efi-secureboot.patch +++ b/efi-secureboot.patch @@ -303,7 +303,7 @@ index 77ea96b794bd..a119e1bc9623 100644 + +#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT + if (efi_enabled(EFI_SECURE_BOOT)) -+ security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_CONFIDENTIALITY_MAX); ++ security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX); +#endif + dmi_setup(); diff --git a/kernel.spec b/kernel.spec index ed71529..ef52871 100644 --- a/kernel.spec +++ b/kernel.spec @@ -2899,6 +2899,9 @@ fi # # %changelog +* Fri Mar 20 2020 Jeremy Cline +- Switch Secure Boot to lock down to integrity mode (rhbz 1815571) + * Fri Mar 20 2020 Justin M. Forbes - Fix CVE-2019-19769 (rhbz 1786174 1786175) diff --git a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch b/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch index 0779418..70e3f76 100644 --- a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch +++ b/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch @@ -3,7 +3,7 @@ From: Jeremy Cline Date: Wed, 30 Oct 2019 14:37:49 +0000 Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set -Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if +Automatically lock down the kernel to LOCKDOWN_INTEGRITY_MAX if the IPL secure flag is set. Suggested-by: Philipp Rudo @@ -56,7 +56,7 @@ index 9cbf490fd162..0510ecdfc3f6 100644 log_component_list(); + if (ipl_get_secureboot()) -+ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_CONFIDENTIALITY_MAX); ++ security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX); + /* Have one command line that is parsed and saved in /proc/cmdline */ /* boot_command_line has been already set up in early.c */