acpi: Disable ACPI table override if the kernel is locked down
authorLinn Crosetto <linn@hpe.com>
Wed, 8 Nov 2017 15:11:34 +0000 (15:11 +0000)
committerBastian Blank <waldi@debian.org>
Mon, 13 Aug 2018 13:33:58 +0000 (14:33 +0100)
commitcc51d0b113a76a1592b8b47958397143a1a0bf59
tree9a20c8dcef00f38a2e9112ed0103129e0faf546e
parent39c80b7552d3f941633ecda8a01cc81d28cdfbb9
acpi: Disable ACPI table override if the kernel is locked down

From the kernel documentation (initrd_table_override.txt):

  If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible
  to override nearly any ACPI table provided by the BIOS with an
  instrumented, modified one.

When securelevel is set, the kernel should disallow any unauthenticated
changes to kernel space.  ACPI tables contain code invoked by the kernel,
so do not allow ACPI tables to be overridden if the kernel is locked down.

Signed-off-by: Linn Crosetto <linn@hpe.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
cc: linux-acpi@vger.kernel.org

Gbp-Pq: Topic features/all/lockdown
Gbp-Pq: Name 0017-acpi-Disable-ACPI-table-override-if-the-kernel-is-lo.patch
drivers/acpi/tables.c