From 3575303f1e84e0e7ef9685ce981c96b1f2916cd9 Mon Sep 17 00:00:00 2001 From: Linn Crosetto Date: Tue, 30 Aug 2016 11:54:38 -0600 Subject: [PATCH] arm64: add kernel config option to lock down when in Secure Boot mode Add a kernel configuration option to lock down the kernel, to restrict userspace's ability to modify the running kernel when UEFI Secure Boot is enabled. Based on the x86 patch by Matthew Garrett. Determine the state of Secure Boot in the EFI stub and pass this to the kernel using the FDT. Signed-off-by: Linn Crosetto [bwh: Forward-ported to 4.10: adjust context] [Lukas Wunner: Forward-ported to 4.11: drop parts applied upstream] [bwh: Forward-ported to 4.15 and lockdown patch set: - Pass result of efi_get_secureboot() in stub through to efi_set_secure_boot() in main kernel - Use lockdown API and naming] [bwh: Forward-ported to 4.19.3: adjust context in update_fdt()] [dannf: Moved init_lockdown() call after uefi_init(), fixing SB detection] Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name arm64-add-kernel-config-option-to-lock-down-when.patch --- drivers/firmware/efi/arm-init.c | 4 ++++ drivers/firmware/efi/efi.c | 3 ++- drivers/firmware/efi/libstub/fdt.c | 6 ++++++ include/linux/efi.h | 1 + 4 files changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c index 1a6a77df8a5..04d9e8fa9a0 100644 --- a/drivers/firmware/efi/arm-init.c +++ b/drivers/firmware/efi/arm-init.c @@ -21,6 +21,7 @@ #include #include #include +#include #include @@ -257,6 +258,9 @@ void __init efi_init(void) return; } + efi_set_secure_boot(params.secure_boot); + init_lockdown(); + reserve_regions(); efi_esrt_init(); diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 2a29dd9c986..7bebfa7ab83 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -657,7 +657,8 @@ static __initdata struct params fdt_params[] = { UEFI_PARAM("MemMap Address", "linux,uefi-mmap-start", mmap), UEFI_PARAM("MemMap Size", "linux,uefi-mmap-size", mmap_size), UEFI_PARAM("MemMap Desc. Size", "linux,uefi-mmap-desc-size", desc_size), - UEFI_PARAM("MemMap Desc. Version", "linux,uefi-mmap-desc-ver", desc_ver) + UEFI_PARAM("MemMap Desc. Version", "linux,uefi-mmap-desc-ver", desc_ver), + UEFI_PARAM("Secure Boot Enabled", "linux,uefi-secure-boot", secure_boot) }; static __initdata struct params xen_fdt_params[] = { diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c index dba296a44f4..7da77b31f8c 100644 --- a/drivers/firmware/efi/libstub/fdt.c +++ b/drivers/firmware/efi/libstub/fdt.c @@ -159,6 +159,12 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt, } } + fdt_val32 = cpu_to_fdt32(efi_get_secureboot(sys_table)); + status = fdt_setprop(fdt, node, "linux,uefi-secure-boot", + &fdt_val32, sizeof(fdt_val32)); + if (status) + goto fdt_set_fail; + /* shrink the FDT back to its minimum size */ fdt_pack(fdt); diff --git a/include/linux/efi.h b/include/linux/efi.h index a2f5498775f..11cdbdd9c47 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -786,6 +786,7 @@ struct efi_fdt_params { u32 mmap_size; u32 desc_size; u32 desc_ver; + u32 secure_boot; }; typedef struct { -- 2.30.2