From 1cdab98f596e12775b8e689c8963080af61319cd Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Mon, 30 Sep 2019 21:22:47 +0000 Subject: [PATCH] UBUNTU: SAUCE: (lockdown) security: lockdown: expose a hook to lock the kernel down In order to automatically lock down kernels running on UEFI machines booted in Secure Boot mode, expose the lock_kernel_down() hook. Upstream Status: RHEL only Signed-off-by: Jeremy Cline (cherry picked from commit 72223fd1241cc5c70b96a491db14d54c83beadd8 from https://gitlab.com/cki-project/kernel-ark) Signed-off-by: Paolo Pisati [ arighi: context adjustments for 6.4-rc1 ] Signed-off-by: Andrea Righi --- include/linux/lsm_hook_defs.h | 2 ++ include/linux/security.h | 5 +++++ security/lockdown/lockdown.c | 1 + security/security.c | 6 ++++++ 4 files changed, 14 insertions(+) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 76458b6d53da..b80d5835be72 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -411,6 +411,8 @@ LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free_security, struct bpf_prog_aux *aux) #endif /* CONFIG_BPF_SYSCALL */ LSM_HOOK(int, 0, locked_down, enum lockdown_reason what) +LSM_HOOK(int, 0, lock_kernel_down, const char *where, enum lockdown_reason level) + #ifdef CONFIG_PERF_EVENTS LSM_HOOK(int, 0, perf_event_open, struct perf_event_attr *attr, int type) diff --git a/include/linux/security.h b/include/linux/security.h index d0eb20f90b26..a99c045730e9 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -494,6 +494,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); int security_locked_down(enum lockdown_reason what); +int security_lock_kernel_down(const char *where, enum lockdown_reason level); int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, size_t *uctx_len, void *val, size_t val_len, u64 id, u64 flags); #else /* CONFIG_SECURITY */ @@ -1433,6 +1434,10 @@ static inline int security_locked_down(enum lockdown_reason what) { return 0; } +static inline int security_lock_kernel_down(const char *where, enum lockdown_reason level) +{ + return 0; +} static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, size_t *uctx_len, void *val, size_t val_len, u64 id, u64 flags) diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index cd84d8ea1dfb..e4c70a0312bc 100644 --- a/security/lockdown/lockdown.c +++ b/security/lockdown/lockdown.c @@ -74,6 +74,7 @@ static int lockdown_is_locked_down(enum lockdown_reason what) static struct security_hook_list lockdown_hooks[] __ro_after_init = { LSM_HOOK_INIT(locked_down, lockdown_is_locked_down), + LSM_HOOK_INIT(lock_kernel_down, lock_kernel_down), }; const struct lsm_id lockdown_lsmid = { diff --git a/security/security.c b/security/security.c index 2a299b03fdcd..b192d12f715c 100644 --- a/security/security.c +++ b/security/security.c @@ -5515,6 +5515,12 @@ int security_locked_down(enum lockdown_reason what) } EXPORT_SYMBOL(security_locked_down); +int security_lock_kernel_down(const char *where, enum lockdown_reason level) +{ + return call_int_hook(lock_kernel_down, 0, where, level); +} +EXPORT_SYMBOL(security_lock_kernel_down); + #ifdef CONFIG_PERF_EVENTS /** * security_perf_event_open() - Check if a perf event open is allowed