acpi: Disable ACPI table override if the kernel is locked down
authorLinn Crosetto <linn@hpe.com>
Mon, 18 Feb 2019 12:45:00 +0000 (12:45 +0000)
committerSalvatore Bonaccorso <carnil@debian.org>
Thu, 26 Sep 2019 12:19:06 +0000 (13:19 +0100)
commitc8fefbf41a90a24cf42b3465a35f8e6f0e8b8d06
tree4bc6dc5c04c7f32f361bd74f2a368f837a2f0aaa
parentf89b43d660f09e55d31d49a838ce61fa835d8f20
acpi: Disable ACPI table override if the kernel is locked down

From the kernel documentation (initrd_table_override.txt):

  If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible
  to override nearly any ACPI table provided by the BIOS with an
  instrumented, modified one.

When securelevel is set, the kernel should disallow any unauthenticated
changes to kernel space.  ACPI tables contain code invoked by the kernel,
so do not allow ACPI tables to be overridden if the kernel is locked down.

Signed-off-by: Linn Crosetto <linn@hpe.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
cc: linux-acpi@vger.kernel.org

Gbp-Pq: Topic features/all/lockdown
Gbp-Pq: Name 0017-acpi-Disable-ACPI-table-override-if-the-kernel-is-lo.patch
drivers/acpi/tables.c