From d7cbe17e14f763d8f7adc00533f6393e0d532d62 Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Wed, 31 Jul 2019 15:16:16 -0700 Subject: [PATCH] efi: Restrict efivar_ssdt_load when the kernel is locked down efivar_ssdt_load allows the kernel to import arbitrary ACPI code from an EFI variable, which gives arbitrary code execution in ring 0. Prevent that when the kernel is locked down. Signed-off-by: Matthew Garrett Acked-by: Ard Biesheuvel Reviewed-by: Kees Cook Cc: Ard Biesheuvel Cc: linux-efi@vger.kernel.org [bwh: Convert back to the non-LSM lockdown API] Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name 0032-efi-Restrict-efivar_ssdt_load-when-the-kernel-is-loc.patch --- drivers/firmware/efi/efi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 4b7cf7bc0de..8fc1c04a041 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -30,6 +30,7 @@ #include #include #include +#include #include @@ -241,6 +242,9 @@ static void generic_ops_unregister(void) static char efivar_ssdt[EFIVAR_SSDT_NAME_MAX] __initdata; static int __init efivar_ssdt_setup(char *str) { + if (kernel_is_locked_down("ACPI tables")) + return -EPERM; + if (strlen(str) < sizeof(efivar_ssdt)) memcpy(efivar_ssdt, str, strlen(str)); else -- 2.30.2