Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1523866
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 15/16] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down |
| Date | 2016-11-16 22:50 +0100 |
| Message-ID | <sEgfE-8mi-41@gated-at.bofh.it> (permalink) |
| References | <sEgfD-8mi-3@gated-at.bofh.it> |
| Organization | Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 |
From: Josh Boyer <jwboyer@redhat.com>
This option allows userspace to pass the RSDP address to the kernel, which
makes it possible for a user to circumvent any restrictions imposed on
loading modules. Ignore the option when the kernel is locked down.
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---
drivers/acpi/osl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 416953a42510..fb1dc79a7f1b 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -40,6 +40,7 @@
#include <linux/list.h>
#include <linux/jiffies.h>
#include <linux/semaphore.h>
+#include <linux/security.h>
#include <asm/io.h>
#include <asm/uaccess.h>
@@ -191,7 +192,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp);
acpi_physical_address __init acpi_os_get_root_pointer(void)
{
#ifdef CONFIG_KEXEC
- if (acpi_rsdp)
+ if (acpi_rsdp && !kernel_is_locked_down())
return acpi_rsdp;
#endif
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 00/16] Kernel lockdown David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 15/16] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-17 23:00 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Josh Boyer <jwboyer@fedoraproject.org> - 2016-11-18 13:00 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-18 13:20 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells <dhowells@redhat.com> - 2016-11-18 18:30 +0100
[PATCH 07/16] kexec: Disable at runtime if the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 08/16] Copy secure_boot flag in boot params across kexec reboot David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 12/16] ACPI: Limit access to custom_method when the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 03/16] efi: Disable secure boot if shim is in insecure mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 04/16] efi: Lock down the kernel if booted in secure boot mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 11/16] x86: Lock down IO port access when the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 06/16] Add a sysrq option to exit secure boot mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
Re: [PATCH 00/16] Kernel lockdown One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-11-16 23:30 +0100
Re: [PATCH 00/16] Kernel lockdown Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-21 21:00 +0100
Re: [PATCH 00/16] Kernel lockdown Justin Forbes <jmforbes@linuxtx.org> - 2016-11-16 23:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-22 07:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-23 20:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-24 18:40 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-24 21:30 +0100
csiph-web