From: Matthew Garrett <matthew.garrett@nebula.com>
To: linux-kernel@vger.kernel.org
Cc: linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
Josh Boyer <jwboyer@redhat.com>
Subject: [PATCH 10/15] acpi: Ignore acpi_rsdp kernel parameter in a secure boot environment
Date: Mon, 28 Jan 2013 11:42:34 -0500 [thread overview]
Message-ID: <1359391359-25783-11-git-send-email-matthew.garrett@nebula.com> (raw)
In-Reply-To: <1359391359-25783-1-git-send-email-matthew.garrett@nebula.com>
From: Josh Boyer <jwboyer@redhat.com>
This option allows userspace to pass the RSDP address to the kernel. This
could potentially be used to circumvent the secure boot trust model.
We ignore the setting if we don't have the CAP_COMPROMISE_KERNEL capability.
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
---
drivers/acpi/osl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index bd22f86..88251d2 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -246,7 +246,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp);
acpi_physical_address __init acpi_os_get_root_pointer(void)
{
#ifdef CONFIG_KEXEC
- if (acpi_rsdp)
+ if (acpi_rsdp && capable(CAP_COMPROMISE_KERNEL))
return acpi_rsdp;
#endif
--
1.8.0.2
next prev parent reply other threads:[~2013-01-28 16:42 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-28 16:42 [PATCH 00/15] Secure boot policy support Matthew Garrett
2013-01-28 16:42 ` [PATCH 01/15] Secure boot: Add new capability Matthew Garrett
2013-01-28 16:42 ` [PATCH 02/15] SELinux: define mapping for new Secure Boot capability Matthew Garrett
[not found] ` <1359391359-25783-1-git-send-email-matthew.garrett-05XSO3Yj/JvQT0dZR+AlfA@public.gmane.org>
2013-01-28 16:42 ` [PATCH 03/15] Secure boot: Add a dummy kernel parameter that will switch on Secure Boot mode Matthew Garrett
2013-01-28 16:42 ` [PATCH 04/15] efi: Enable secure boot lockdown automatically when enabled in firmware Matthew Garrett
2013-01-28 16:42 ` [PATCH 06/15] x86: Lock down IO port access in secure boot environments Matthew Garrett
2013-01-28 16:42 ` [PATCH 14/15] MODSIGN: Import certificates from UEFI Secure Boot Matthew Garrett
2013-01-28 16:42 ` [PATCH 15/15] MODSIGN: Always enforce module signing in a Secure Boot environment Matthew Garrett
2013-02-17 19:19 ` [PATCH 00/15] Secure boot policy support Yves-Alexis Perez
2013-01-28 16:42 ` [PATCH 05/15] PCI: Lock down BAR access in secure boot environments Matthew Garrett
2013-01-28 16:42 ` [PATCH 07/15] ACPI: Limit access to custom_method Matthew Garrett
2013-01-28 16:42 ` [PATCH 08/15] asus-wmi: Restrict debugfs interface Matthew Garrett
2013-01-28 16:42 ` [PATCH 09/15] Restrict /dev/mem and /dev/kmem in secure boot setups Matthew Garrett
2013-01-28 16:42 ` Matthew Garrett [this message]
2013-02-17 9:00 ` [PATCH 10/15] acpi: Ignore acpi_rsdp kernel parameter in a secure boot environment Dave Young
[not found] ` <CABqxG0cJGp7UEREvMW49QA0BfDXPsyEbAuMMLZwcHPdUAKT+Dw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2013-02-20 13:39 ` Josh Boyer
2013-01-28 16:42 ` [PATCH 11/15] Add EFI signature data types Matthew Garrett
2013-01-28 16:42 ` [PATCH 12/15] Add an EFI signature blob parser and key loader Matthew Garrett
2013-01-28 16:42 ` [PATCH 13/15] MODSIGN: Add module certificate blacklist keyring Matthew Garrett
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1359391359-25783-11-git-send-email-matthew.garrett@nebula.com \
--to=matthew.garrett@nebula.com \
--cc=jwboyer@redhat.com \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox