| From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| From: Jeremy Cline <jcline@redhat.com> |
| Date: Wed, 30 Oct 2019 14:37:49 +0000 |
| Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set |
| |
| Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if |
| the IPL secure flag is set. |
| |
| Upstream Status: RHEL only |
| Suggested-by: Philipp Rudo <prudo@redhat.com> |
| Signed-off-by: Jeremy Cline <jcline@redhat.com> |
| |
| arch/s390/include/asm/ipl.h | 1 + |
| arch/s390/kernel/ipl.c | 5 +++++ |
| arch/s390/kernel/setup.c | 4 ++++ |
| 3 files changed, 10 insertions(+) |
| |
| diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h |
| index 7d5cfdda5277..be66ee5d0437 100644 |
| |
| |
| @@ -120,6 +120,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf, |
| unsigned char flags, unsigned short cert); |
| int ipl_report_add_certificate(struct ipl_report *report, void *key, |
| unsigned long addr, unsigned long len); |
| +bool ipl_get_secureboot(void); |
| |
| /* |
| * DIAG 308 support |
| diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c |
| index 90a2a17239b0..be3b72c53656 100644 |
| |
| |
| @@ -2110,3 +2110,8 @@ int ipl_report_free(struct ipl_report *report) |
| } |
| |
| #endif |
| + |
| +bool ipl_get_secureboot(void) |
| +{ |
| + return !!ipl_secure_flag; |
| +} |
| diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c |
| index e600f6953d7c..4264e01824b3 100644 |
| |
| |
| @@ -49,6 +49,7 @@ |
| #include <linux/memory.h> |
| #include <linux/compat.h> |
| #include <linux/start_kernel.h> |
| +#include <linux/security.h> |
| |
| #include <asm/boot_data.h> |
| #include <asm/ipl.h> |
| @@ -1085,6 +1086,9 @@ void __init setup_arch(char **cmdline_p) |
| |
| log_component_list(); |
| |
| + if (ipl_get_secureboot()) |
| + security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX); |
| + |
| /* Have one command line that is parsed and saved in /proc/cmdline */ |
| /* boot_command_line has been already set up in early.c */ |
| *cmdline_p = boot_command_line; |
| -- |
| 2.28.0 |
| |