Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1523865
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 00/16] Kernel lockdown |
| Date | 2016-11-16 22:50 +0100 |
| Message-ID | <sEgfD-8mi-3@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
These patches provide a facility by which a variety of avenues by which
userspace can feasibly modify the running kernel image can be locked down.
These include:
(*) No unsigned modules and no modules for which can't validate the
signature.
(*) No use of ioperm(), iopl() and no writing to /dev/port.
(*) No writing to /dev/mem or /dev/kmem.
(*) No hibernation.
(*) Restrict PCI BAR access.
(*) Restrict MSR access.
(*) No kexec_load().
(*) Certain ACPI restrictions.
(*) Restrict debugfs interface to ASUS WMI.
The lock-down can be configured to be triggered by the EFI secure boot
status, provided the shim isn't insecure. The lock-down can be lifted by
typing SysRq+x on a keyboard attached to the system.
The patches can be found here also:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-lockdown
They are dependent for some EFI definitions on the keys-uefi branch.
David
---
Dave Young (1):
Copy secure_boot flag in boot params across kexec reboot
David Howells (3):
Add the ability to lock down access to the running kernel image
efi: Get the secure boot status
efi: Lock down the kernel if booted in secure boot mode
Josh Boyer (4):
efi: Disable secure boot if shim is in insecure mode
efi: Add EFI_SECURE_BOOT bit
hibernate: Disable when the kernel is locked down
acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down
Kyle McMartin (1):
Add a sysrq option to exit secure boot mode
Matthew Garrett (7):
kexec: Disable at runtime if the kernel is locked down
PCI: Lock down BAR access when the kernel is locked down
x86: Lock down IO port access when the kernel is locked down
ACPI: Limit access to custom_method when the kernel is locked down
asus-wmi: Restrict debugfs interface when the kernel is locked down
Restrict /dev/mem and /dev/kmem when the kernel is locked down
x86: Restrict MSR access when the kernel is locked down
Documentation/x86/zero-page.txt | 2 +
arch/x86/Kconfig | 22 ++++++++++++++
arch/x86/boot/compressed/eboot.c | 53 +++++++++++++++++++++++++++++++++
arch/x86/include/uapi/asm/bootparam.h | 3 +-
arch/x86/kernel/ioport.c | 5 ++-
arch/x86/kernel/kexec-bzimage64.c | 1 +
arch/x86/kernel/msr.c | 8 +++++
arch/x86/kernel/setup.c | 39 ++++++++++++++++++++++++
drivers/acpi/custom_method.c | 3 ++
drivers/acpi/osl.c | 3 +-
drivers/char/mem.c | 10 ++++++
drivers/input/misc/uinput.c | 1 +
drivers/pci/pci-sysfs.c | 10 ++++++
drivers/pci/proc.c | 9 +++++-
drivers/pci/syscall.c | 3 +-
drivers/platform/x86/asus-wmi.c | 9 ++++++
drivers/tty/sysrq.c | 19 ++++++++----
include/linux/efi.h | 1 +
include/linux/input.h | 5 +++
include/linux/security.h | 16 ++++++++++
include/linux/sysrq.h | 8 ++++-
kernel/debug/kdb/kdb_main.c | 2 +
kernel/kexec.c | 8 +++++
kernel/module.c | 2 +
kernel/power/hibernate.c | 3 +-
security/Kconfig | 16 +++++++++-
security/Makefile | 3 ++
security/lock_down.c | 40 +++++++++++++++++++++++++
28 files changed, 287 insertions(+), 17 deletions(-)
create mode 100644 security/lock_down.c
Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread
[PATCH 00/16] Kernel lockdown David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 15/16] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-17 23:00 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Josh Boyer <jwboyer@fedoraproject.org> - 2016-11-18 13:00 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-18 13:20 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells <dhowells@redhat.com> - 2016-11-18 18:30 +0100
[PATCH 07/16] kexec: Disable at runtime if the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 08/16] Copy secure_boot flag in boot params across kexec reboot David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 12/16] ACPI: Limit access to custom_method when the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 03/16] efi: Disable secure boot if shim is in insecure mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 04/16] efi: Lock down the kernel if booted in secure boot mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 11/16] x86: Lock down IO port access when the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 06/16] Add a sysrq option to exit secure boot mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
Re: [PATCH 00/16] Kernel lockdown One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-11-16 23:30 +0100
Re: [PATCH 00/16] Kernel lockdown Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-21 21:00 +0100
Re: [PATCH 00/16] Kernel lockdown Justin Forbes <jmforbes@linuxtx.org> - 2016-11-16 23:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-22 07:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-23 20:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-24 18:40 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-24 21:30 +0100
csiph-web