[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190814072844.GB27836@zn.tnic>
Date: Wed, 14 Aug 2019 09:28:44 +0200
From: Borislav Petkov <bp@...en8.de>
To: Matthew Garrett <matthewgarrett@...gle.com>
Cc: jmorris@...ei.org, linux-security-module@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-api@...r.kernel.org,
Josh Boyer <jwboyer@...hat.com>,
David Howells <dhowells@...hat.com>,
Matthew Garrett <mjg59@...gle.com>,
Kees Cook <keescook@...omium.org>,
Dave Young <dyoung@...hat.com>, linux-acpi@...r.kernel.org,
x86-ml <x86@...nel.org>
Subject: Re: [PATCH V38 15/29] acpi: Ignore acpi_rsdp kernel param when the
kernel has been locked down
On Wed, Aug 07, 2019 at 05:07:07PM -0700, Matthew Garrett wrote:
> From: Josh Boyer <jwboyer@...hat.com>
>
> This option allows userspace to pass the RSDP address to the kernel, which
> makes it possible for a user to modify the workings of hardware. Reject
> the option when the kernel is locked down. This requires some reworking
> of the existing RSDP command line logic, since the early boot code also
> makes use of a command-line passed RSDP when locating the SRAT table
> before the lockdown code has been initialised. This is achieved by
> separating the command line RSDP path in the early boot code from the
> generic RSDP path, and then copying the command line RSDP into boot
> params in the kernel proper if lockdown is not enabled. If lockdown is
> enabled and an RSDP is provided on the command line, this will only be
> used when parsing SRAT (which shouldn't permit kernel code execution)
> and will be ignored in the rest of the kernel.
>
> (Modified by Matthew Garrett in order to handle the early boot RSDP
> environment)
>
> Signed-off-by: Josh Boyer <jwboyer@...hat.com>
> Signed-off-by: David Howells <dhowells@...hat.com>
> Signed-off-by: Matthew Garrett <mjg59@...gle.com>
> Reviewed-by: Kees Cook <keescook@...omium.org>
> cc: Dave Young <dyoung@...hat.com>
> cc: linux-acpi@...r.kernel.org
> ---
> arch/x86/boot/compressed/acpi.c | 19 +++++++++++++------
> arch/x86/include/asm/acpi.h | 9 +++++++++
> arch/x86/include/asm/x86_init.h | 2 ++
> arch/x86/kernel/acpi/boot.c | 5 +++++
> arch/x86/kernel/x86_init.c | 1 +
> drivers/acpi/osl.c | 14 +++++++++++++-
> include/linux/acpi.h | 6 ++++++
> 7 files changed, 49 insertions(+), 7 deletions(-)
Also, why isn't an x86 person CCed here? This clearly needs an x86
maintainer's ACK before it goes in?
Thx.
--
Regards/Gruss,
Boris.
Good mailing practices for 400: avoid top-posting and trim the reply.
Powered by blists - more mailing lists