ignatenkobrain / rpms / kernel

Forked from rpms/kernel 3 years ago
Clone
e336be
From b96ff1fd9e94772fde7b58fd69969d1a1c87eb6d Mon Sep 17 00:00:00 2001
e336be
From: Dave Young <dyoung@redhat.com>
e336be
Date: Tue, 27 Feb 2018 10:04:51 +0000
e336be
Subject: [PATCH 07/31] Copy secure_boot flag in boot params across kexec
e336be
 reboot
e336be
e336be
Kexec reboot in case secure boot being enabled does not keep the secure
e336be
boot mode in new kernel, so later one can load unsigned kernel via legacy
e336be
kexec_load.  In this state, the system is missing the protections provided
e336be
by secure boot.
e336be
e336be
Adding a patch to fix this by retain the secure_boot flag in original
e336be
kernel.
e336be
e336be
secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the
e336be
stub.  Fixing this issue by copying secure_boot flag across kexec reboot.
e336be
e336be
Signed-off-by: Dave Young <dyoung@redhat.com>
e336be
Signed-off-by: David Howells <dhowells@redhat.com>
e336be
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
e336be
cc: kexec@lists.infradead.org
e336be
---
e336be
 arch/x86/kernel/kexec-bzimage64.c | 1 +
e336be
 1 file changed, 1 insertion(+)
e336be
e336be
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
e336be
index fb095ba0c02f..7d0fac5bcbbe 100644
e336be
--- a/arch/x86/kernel/kexec-bzimage64.c
e336be
+++ b/arch/x86/kernel/kexec-bzimage64.c
e336be
@@ -179,6 +179,7 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
e336be
 	if (efi_enabled(EFI_OLD_MEMMAP))
e336be
 		return 0;
e336be
e336be
+	params->secure_boot = boot_params.secure_boot;
e336be
 	ei->efi_loader_signature = current_ei->efi_loader_signature;
e336be
 	ei->efi_systab = current_ei->efi_systab;
e336be
 	ei->efi_systab_hi = current_ei->efi_systab_hi;
e336be
-- 
e336be
2.14.3
e336be
e336be
From 42b2c81c12a8e8139fc7252cf91151c37b5a0966 Mon Sep 17 00:00:00 2001
e336be
From: David Howells <dhowells@redhat.com>
e336be
Date: Tue, 27 Feb 2018 10:04:55 +0000
e336be
Subject: [PATCH 29/31] efi: Add an EFI_SECURE_BOOT flag to indicate secure
e336be
 boot mode
e336be
e336be
UEFI machines can be booted in Secure Boot mode.  Add an EFI_SECURE_BOOT
e336be
flag that can be passed to efi_enabled() to find out whether secure boot is
e336be
enabled.
e336be
e336be
Move the switch-statement in x86's setup_arch() that inteprets the
e336be
secure_boot boot parameter to generic code and set the bit there.
e336be
e336be
Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
e336be
Signed-off-by: David Howells <dhowells@redhat.com>
e336be
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
e336be
cc: linux-efi@vger.kernel.org
e336be
---
e336be
 arch/x86/kernel/setup.c           | 14 +-------------
e336be
 drivers/firmware/efi/Makefile     |  1 +
e336be
 drivers/firmware/efi/secureboot.c | 38 ++++++++++++++++++++++++++++++++++++++
e336be
 include/linux/efi.h               | 16 ++++++++++------
e336be
 4 files changed, 50 insertions(+), 19 deletions(-)
e336be
 create mode 100644 drivers/firmware/efi/secureboot.c
e336be
e336be
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
e336be
index 1ae67e982af7..a7c240f00d78 100644
e336be
--- a/arch/x86/kernel/setup.c
e336be
+++ b/arch/x86/kernel/setup.c
e336be
@@ -1150,19 +1150,7 @@ void __init setup_arch(char **cmdline_p)
e336be
 	/* Allocate bigger log buffer */
e336be
 	setup_log_buf(1);
e336be
e336be
-	if (efi_enabled(EFI_BOOT)) {
e336be
-		switch (boot_params.secure_boot) {
e336be
-		case efi_secureboot_mode_disabled:
e336be
-			pr_info("Secure boot disabled\n");
e336be
-			break;
e336be
-		case efi_secureboot_mode_enabled:
e336be
-			pr_info("Secure boot enabled\n");
e336be
-			break;
e336be
-		default:
e336be
-			pr_info("Secure boot could not be determined\n");
e336be
-			break;
e336be
-		}
e336be
-	}
e336be
+	efi_set_secure_boot(boot_params.secure_boot);
e336be
e336be
 	reserve_initrd();
e336be
e336be
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
e336be
index cb805374f4bc..da2b3e37b9f0 100644
e336be
--- a/drivers/firmware/efi/Makefile
e336be
+++ b/drivers/firmware/efi/Makefile
e336be
@@ -24,6 +24,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP)		+= fake_mem.o
e336be
 obj-$(CONFIG_EFI_BOOTLOADER_CONTROL)	+= efibc.o
e336be
 obj-$(CONFIG_EFI_TEST)			+= test/
e336be
 obj-$(CONFIG_EFI_DEV_PATH_PARSER)	+= dev-path-parser.o
e336be
+obj-$(CONFIG_EFI)			+= secureboot.o
e336be
 obj-$(CONFIG_APPLE_PROPERTIES)		+= apple-properties.o
e336be
e336be
 arm-obj-$(CONFIG_EFI)			:= arm-init.o arm-runtime.o
e336be
diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c
e336be
new file mode 100644
e336be
index 000000000000..9070055de0a1
e336be
--- /dev/null
e336be
+++ b/drivers/firmware/efi/secureboot.c
e336be
@@ -0,0 +1,38 @@
e336be
+/* Core kernel secure boot support.
e336be
+ *
e336be
+ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
e336be
+ * Written by David Howells (dhowells@redhat.com)
e336be
+ *
e336be
+ * This program is free software; you can redistribute it and/or
e336be
+ * modify it under the terms of the GNU General Public Licence
e336be
+ * as published by the Free Software Foundation; either version
e336be
+ * 2 of the Licence, or (at your option) any later version.
e336be
+ */
e336be
+
e336be
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
e336be
+
e336be
+#include <linux/efi.h>
e336be
+#include <linux/kernel.h>
e336be
+#include <linux/printk.h>
e336be
+
e336be
+/*
e336be
+ * Decide what to do when UEFI secure boot mode is enabled.
e336be
+ */
e336be
+void __init efi_set_secure_boot(enum efi_secureboot_mode mode)
e336be
+{
e336be
+	if (efi_enabled(EFI_BOOT)) {
e336be
+		switch (mode) {
e336be
+		case efi_secureboot_mode_disabled:
e336be
+			pr_info("Secure boot disabled\n");
e336be
+			break;
e336be
+		case efi_secureboot_mode_enabled:
e336be
+			set_bit(EFI_SECURE_BOOT, &efi.flags);
e336be
+			pr_info("Secure boot enabled\n");
e336be
+			break;
e336be
+		default:
e336be
+			pr_warning("Secure boot could not be determined (mode %u)\n",
e336be
+				   mode);
e336be
+			break;
e336be
+		}
e336be
+	}
e336be
+}
e336be
diff --git a/include/linux/efi.h b/include/linux/efi.h
e336be
index f5083aa72eae..79da76d14ca3 100644
e336be
--- a/include/linux/efi.h
e336be
+++ b/include/linux/efi.h
e336be
@@ -1142,6 +1142,14 @@ extern int __init efi_setup_pcdp_console(char *);
e336be
 #define EFI_DBG			8	/* Print additional debug info at runtime */
e336be
 #define EFI_NX_PE_DATA		9	/* Can runtime data regions be mapped non-executable? */
e336be
 #define EFI_MEM_ATTR		10	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
e336be
+#define EFI_SECURE_BOOT		11	/* Are we in Secure Boot mode? */
e336be
+
e336be
+enum efi_secureboot_mode {
e336be
+	efi_secureboot_mode_unset,
e336be
+	efi_secureboot_mode_unknown,
e336be
+	efi_secureboot_mode_disabled,
e336be
+	efi_secureboot_mode_enabled,
e336be
+};
e336be
e336be
 #ifdef CONFIG_EFI
e336be
 /*
e336be
@@ -1154,6 +1162,7 @@ static inline bool efi_enabled(int feature)
e336be
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
e336be
e336be
 extern bool efi_is_table_address(unsigned long phys_addr);
e336be
+extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode);
e336be
 #else
e336be
 static inline bool efi_enabled(int feature)
e336be
 {
e336be
@@ -1172,6 +1181,7 @@ static inline bool efi_is_table_address(unsigned long phys_addr)
e336be
 {
e336be
 	return false;
e336be
 }
e336be
+static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {}
e336be
 #endif
e336be
e336be
 extern int efi_status_to_err(efi_status_t status);
e336be
@@ -1557,12 +1567,6 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg,
e336be
 bool efi_runtime_disabled(void);
e336be
 extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
e336be
e336be
-enum efi_secureboot_mode {
e336be
-	efi_secureboot_mode_unset,
e336be
-	efi_secureboot_mode_unknown,
e336be
-	efi_secureboot_mode_disabled,
e336be
-	efi_secureboot_mode_enabled,
e336be
-};
e336be
 enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table);
e336be
e336be
 #ifdef CONFIG_RESET_ATTACK_MITIGATION
e336be
-- 
e336be
2.14.3
e336be
e336be
From d78bf678059f83e22bec8ada1a448e22b9b90203 Mon Sep 17 00:00:00 2001
e336be
From: David Howells <dhowells@redhat.com>
e336be
Date: Tue, 27 Feb 2018 10:04:55 +0000
e336be
Subject: [PATCH 30/31] efi: Lock down the kernel if booted in secure boot mode
e336be
e336be
UEFI Secure Boot provides a mechanism for ensuring that the firmware will
e336be
only load signed bootloaders and kernels.  Certain use cases may also
e336be
require that all kernel modules also be signed.  Add a configuration option
e336be
that to lock down the kernel - which includes requiring validly signed
e336be
modules - if the kernel is secure-booted.
e336be
e336be
Signed-off-by: David Howells <dhowells@redhat.com>
e336be
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
e336be
cc: linux-efi@vger.kernel.org
e336be
---
e336be
 arch/x86/kernel/setup.c |  6 ++++--
e336be
 fs/debugfs/inode.c      |  2 +-
e336be
 security/Kconfig        | 14 ++++++++++++++
e336be
 security/lock_down.c    |  5 +++++
e336be
 4 files changed, 20 insertions(+), 3 deletions(-)
e336be
e336be
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
e336be
index a7c240f00d78..1277d1857c5c 100644
e336be
--- a/arch/x86/kernel/setup.c
e336be
+++ b/arch/x86/kernel/setup.c
e336be
@@ -64,6 +64,7 @@
e336be
 #include <linux/dma-mapping.h>
e336be
 #include <linux/ctype.h>
e336be
 #include <linux/uaccess.h>
e336be
+#include <linux/security.h>
e336be
e336be
 #include <linux/percpu.h>
e336be
 #include <linux/crash_dump.h>
e336be
@@ -997,6 +998,8 @@ void __init setup_arch(char **cmdline_p)
e336be
 	if (efi_enabled(EFI_BOOT))
e336be
 		efi_init();
e336be
e336be
+	efi_set_secure_boot(boot_params.secure_boot);
e336be
+
e336be
 	init_lockdown();
e336be
e336be
 	dmi_scan_machine();
e336be
@@ -1150,8 +1154,6 @@ void __init setup_arch(char **cmdline_p)
e336be
 	/* Allocate bigger log buffer */
e336be
 	setup_log_buf(1);
e336be
e336be
-	efi_set_secure_boot(boot_params.secure_boot);
e336be
-
e336be
 	reserve_initrd();
e336be
e336be
 	acpi_table_upgrade();
e336be
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
e336be
index ce261e1765ff..7aff55b309a6 100644
e336be
--- a/fs/debugfs/inode.c
e336be
+++ b/fs/debugfs/inode.c
e336be
@@ -40,7 +40,7 @@ static bool debugfs_registered;
e336be
 static int debugfs_setattr(struct dentry *dentry, struct iattr *ia)
e336be
 {
e336be
 	if ((ia->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)) &&
e336be
-	    kernel_is_locked_down("debugfs"))
e336be
+	    kernel_is_locked_down("changing perms in debugfs"))
e336be
 		return -EPERM;
e336be
 	return simple_setattr(dentry, ia);
e336be
 }
e336be
diff --git a/security/Kconfig b/security/Kconfig
e336be
index 461d5acc3616..13fdada1ffc2 100644
e336be
--- a/security/Kconfig
e336be
+++ b/security/Kconfig
e336be
@@ -248,6 +248,20 @@ config ALLOW_LOCKDOWN_LIFT_BY_SYSRQ
e336be
 	  Allow the lockdown on a kernel to be lifted, by pressing a SysRq key
e336be
 	  combination on a wired keyboard.  On x86, this is SysRq+x.
e336be
e336be
+config LOCK_DOWN_IN_EFI_SECURE_BOOT
e336be
+	bool "Lock down the kernel in EFI Secure Boot mode"
e336be
+	default n
e336be
+	select LOCK_DOWN_KERNEL
e336be
+	depends on EFI
e336be
+	help
e336be
+	  UEFI Secure Boot provides a mechanism for ensuring that the firmware
e336be
+	  will only load signed bootloaders and kernels.  Secure boot mode may
e336be
+	  be determined from EFI variables provided by the system firmware if
e336be
+	  not indicated by the boot parameters.
e336be
+
e336be
+	  Enabling this option turns on results in kernel lockdown being
e336be
+	  triggered if EFI Secure Boot is set.
e336be
+
e336be
e336be
 source security/selinux/Kconfig
e336be
 source security/smack/Kconfig
e336be
diff --git a/security/lock_down.c b/security/lock_down.c
e336be
index 2c6b00f0c229..527f7e51dc8d 100644
e336be
--- a/security/lock_down.c
e336be
+++ b/security/lock_down.c
e336be
@@ -12,6 +12,7 @@
e336be
 #include <linux/export.h>
e336be
 #include <linux/sched.h>
e336be
 #include <linux/sysrq.h>
e336be
+#include <linux/efi.h>
e336be
 #include <asm/setup.h>
e336be
e336be
 #ifndef CONFIG_LOCK_DOWN_MANDATORY
e336be
@@ -55,6 +55,10 @@ void __init init_lockdown(void)
e336be
 #ifdef CONFIG_LOCK_DOWN_MANDATORY
e336be
 	pr_notice("Kernel is locked down from config; see man kernel_lockdown.7\n");
e336be
 #endif
e336be
+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
e336be
+	if (efi_enabled(EFI_SECURE_BOOT))
e336be
+		lock_kernel_down("EFI secure boot");
e336be
+#endif
e336be
 }
e336be
e336be
 /**
e336be
-- 
e336be
2.14.3