From 5df0ea3771125c3921668a5d93e251ff8e7a7484 Mon Sep 17 00:00:00 2001 From: David Howells Date: Wed, 8 Nov 2017 15:11:37 +0000 Subject: [PATCH] efi: Lock down the kernel if booted in secure boot mode UEFI Secure Boot provides a mechanism for ensuring that the firmware will only load signed bootloaders and kernels. Certain use cases may also require that all kernel modules also be signed. Add a configuration option that to lock down the kernel - which includes requiring validly signed modules - if the kernel is secure-booted. Signed-off-by: David Howells Acked-by: Ard Biesheuvel cc: linux-efi@vger.kernel.org Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name 0029-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch --- arch/x86/kernel/setup.c | 6 ++++-- security/Kconfig | 14 ++++++++++++++ security/lock_down.c | 1 + 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index d8ce66035a7..02a9c0d2224 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -64,6 +64,7 @@ #include #include #include +#include #include #include @@ -998,6 +999,9 @@ void __init setup_arch(char **cmdline_p) if (efi_enabled(EFI_BOOT)) efi_init(); + efi_set_secure_boot(boot_params.secure_boot); + init_lockdown(); + dmi_scan_machine(); dmi_memdev_walk(); dmi_set_dump_stack_arch_desc(); @@ -1151,8 +1155,6 @@ void __init setup_arch(char **cmdline_p) /* Allocate bigger log buffer */ setup_log_buf(1); - efi_set_secure_boot(boot_params.secure_boot); - reserve_initrd(); acpi_table_upgrade(); diff --git a/security/Kconfig b/security/Kconfig index 4da599f3c6f..ba421881a06 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -242,6 +242,20 @@ config ALLOW_LOCKDOWN_LIFT_BY_SYSRQ Allow the lockdown on a kernel to be lifted, by pressing a SysRq key combination on a wired keyboard. +config LOCK_DOWN_IN_EFI_SECURE_BOOT + bool "Lock down the kernel in EFI Secure Boot mode" + default n + select LOCK_DOWN_KERNEL + depends on EFI + help + UEFI Secure Boot provides a mechanism for ensuring that the firmware + will only load signed bootloaders and kernels. Secure boot mode may + be determined from EFI variables provided by the system firmware if + not indicated by the boot parameters. + + Enabling this option turns on results in kernel lockdown being + triggered if EFI Secure Boot is set. + source security/selinux/Kconfig source security/smack/Kconfig diff --git a/security/lock_down.c b/security/lock_down.c index 2c6b00f0c22..527f7e51dc8 100644 --- a/security/lock_down.c +++ b/security/lock_down.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #ifdef CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ -- 2.30.2