From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Garrett Subject: [PATCH V31 16/25] Prohibit PCMCIA CIS storage when the kernel is locked down Date: Tue, 26 Mar 2019 11:27:32 -0700 Message-ID: <20190326182742.16950-17-matthewgarrett@google.com> References: <20190326182742.16950-1-matthewgarrett@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: In-Reply-To: <20190326182742.16950-1-matthewgarrett@google.com> Sender: linux-kernel-owner@vger.kernel.org To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dhowells@redhat.com, linux-api@vger.kernel.org, luto@kernel.org, Dominik Brodowski , Matthew Garrett List-Id: linux-api@vger.kernel.org From: David Howells Prohibit replacement of the PCMCIA Card Information Structure when the kernel is locked down. Suggested-by: Dominik Brodowski Signed-off-by: David Howells Signed-off-by: Matthew Garrett --- drivers/pcmcia/cistpl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c index ac0672b8dfca..9e23300a55e5 100644 --- a/drivers/pcmcia/cistpl.c +++ b/drivers/pcmcia/cistpl.c @@ -1578,6 +1578,10 @@ static ssize_t pccard_store_cis(struct file *filp, struct kobject *kobj, struct pcmcia_socket *s; int error; + if (kernel_is_locked_down("Direct PCMCIA CIS storage", + LOCKDOWN_INTEGRITY)) + return -EPERM; + s = to_socket(container_of(kobj, struct device, kobj)); if (off) -- 2.21.0.392.gf8f6787159e-goog