[PATCH 16/27] acpi: Disable ACPI table override if the kernel is locked down
flat view
From: jlee@suse.com (joeyli)
Date: 2017-10-20 06:46:27
Also in:
linux-efi, lkml
On Thu, Oct 19, 2017 at 03:52:34PM +0100, David Howells wrote:
From: Linn Crosetto <redacted>quoted
From the kernel documentation (initrd_table_override.txt):If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible to override nearly any ACPI table provided by the BIOS with an instrumented, modified one. When securelevel is set, the kernel should disallow any unauthenticated changes to kernel space. ACPI tables contain code invoked by the kernel, so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto <redacted> Signed-off-by: David Howells <dhowells@redhat.com>
I have reviewed this patch. Please feel free to add: Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> Thanks! Joey Lee
quoted hunk ↗ jump to hunk
cc: linux-acpi at vger.kernel.org --- drivers/acpi/tables.c | 5 +++++ 1 file changed, 5 insertions(+)diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c index 80ce2a7d224b..5cc13c42daf9 100644 --- a/drivers/acpi/tables.c +++ b/drivers/acpi/tables.c@@ -526,6 +526,11 @@ void __init acpi_table_upgrade(void) if (table_nr == 0) return; + if (kernel_is_locked_down("ACPI table override")) { + pr_notice("kernel is locked down, ignoring table override\n"); + return; + } + acpi_tables_addr = memblock_find_in_range(0, ACPI_TABLE_UPGRADE_MAX_PHYS, all_tables_size, PAGE_SIZE); --To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
-- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html