Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1523871
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 12/16] ACPI: Limit access to custom_method when the kernel is locked down |
| Date | 2016-11-16 22:50 +0100 |
| Message-ID | <sEgfE-8mi-43@gated-at.bofh.it> (permalink) |
| References | <sEgfD-8mi-3@gated-at.bofh.it> |
| Organization | Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 |
From: Matthew Garrett <matthew.garrett@nebula.com>
custom_method effectively allows arbitrary access to system memory, making
it possible for an attacker to circumvent restrictions on module loading.
Disable it if the kernel is locked down.
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---
drivers/acpi/custom_method.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
index c68e72414a67..e4d721c330c0 100644
--- a/drivers/acpi/custom_method.c
+++ b/drivers/acpi/custom_method.c
@@ -29,6 +29,9 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
struct acpi_table_header table;
acpi_status status;
+ if (kernel_is_locked_down())
+ return -EPERM;
+
if (!(*ppos)) {
/* parse the table header to get the table length */
if (count <= sizeof(struct acpi_table_header))
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 00/16] Kernel lockdown David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 15/16] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-17 23:00 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Josh Boyer <jwboyer@fedoraproject.org> - 2016-11-18 13:00 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-18 13:20 +0100
Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells <dhowells@redhat.com> - 2016-11-18 18:30 +0100
[PATCH 07/16] kexec: Disable at runtime if the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 08/16] Copy secure_boot flag in boot params across kexec reboot David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 12/16] ACPI: Limit access to custom_method when the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
[PATCH 03/16] efi: Disable secure boot if shim is in insecure mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 04/16] efi: Lock down the kernel if booted in secure boot mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 11/16] x86: Lock down IO port access when the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
[PATCH 06/16] Add a sysrq option to exit secure boot mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
Re: [PATCH 00/16] Kernel lockdown One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-11-16 23:30 +0100
Re: [PATCH 00/16] Kernel lockdown Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-21 21:00 +0100
Re: [PATCH 00/16] Kernel lockdown Justin Forbes <jmforbes@linuxtx.org> - 2016-11-16 23:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-22 07:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-23 20:30 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-24 18:40 +0100
Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-24 21:30 +0100
csiph-web