From: Matthew Garrett <matthew.garrett@nebula.com>
To: linux-kernel@vger.kernel.org
Cc: linux-efi@vger.kernel.org, jwboyer@redhat.com, keescook@chromium.org
Subject: [PATCH 07/10] acpi: Ignore acpi_rsdp kernel parameter when module loading is restricted
Date: Mon, 19 Aug 2013 12:10:16 -0400 [thread overview]
Message-ID: <1376928619-3775-7-git-send-email-matthew.garrett@nebula.com> (raw)
In-Reply-To: <1376928619-3775-1-git-send-email-matthew.garrett@nebula.com>
From: Josh Boyer <jwboyer@redhat.com>
This option allows userspace to pass the RSDP address to the kernel, which
makes it possible for a user to circumvent any restrictions imposed on
loading modules. Disable it in that case.
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
---
drivers/acpi/osl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 6ab2c35..e4c4410 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -45,6 +45,7 @@
#include <linux/list.h>
#include <linux/jiffies.h>
#include <linux/semaphore.h>
+#include <linux/module.h>
#include <asm/io.h>
#include <asm/uaccess.h>
@@ -245,7 +246,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp);
acpi_physical_address __init acpi_os_get_root_pointer(void)
{
#ifdef CONFIG_KEXEC
- if (acpi_rsdp)
+ if (acpi_rsdp && !secure_modules())
return acpi_rsdp;
#endif
--
1.8.3.1
next prev parent reply other threads:[~2013-08-19 16:12 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-19 16:10 [PATCH 01/10] Add secure_modules() call Matthew Garrett
2013-08-19 16:10 ` [PATCH 02/10] PCI: Lock down BAR access when module security is enabled Matthew Garrett
2013-08-19 16:10 ` [PATCH 03/10] x86: Lock down IO port " Matthew Garrett
2013-08-19 16:10 ` [PATCH 04/10] ACPI: Limit access to custom_method Matthew Garrett
2013-08-29 17:58 ` Lenny Szubowicz
2013-08-19 16:10 ` [PATCH 05/10] asus-wmi: Restrict debugfs interface when module loading is restricted Matthew Garrett
2013-08-19 16:20 ` Kees Cook
2013-08-19 17:15 ` Matthew Garrett
2013-08-29 18:22 ` H. Peter Anvin
2013-08-29 18:35 ` Matthew Garrett
2013-08-29 18:46 ` H. Peter Anvin
2013-08-29 18:49 ` Matthew Garrett
2013-08-29 19:05 ` H. Peter Anvin
2013-08-29 19:07 ` Matthew Garrett
2013-08-29 19:28 ` Josh Boyer
2013-08-19 16:10 ` [PATCH 06/10] Restrict /dev/mem and /dev/kmem " Matthew Garrett
2013-08-19 16:10 ` Matthew Garrett [this message]
2013-08-19 16:10 ` [PATCH 08/10] kexec: Disable at runtime if the kernel enforces module loading restrictions Matthew Garrett
2013-09-01 8:52 ` Geert Uytterhoeven
2013-08-19 16:10 ` [PATCH 09/10] x86: Restrict MSR access when module loading is restricted Matthew Garrett
2013-08-19 16:10 ` [PATCH 10/10] Add option to automatically enforce module signatures when in Secure Boot mode Matthew Garrett
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1376928619-3775-7-git-send-email-matthew.garrett@nebula.com \
--to=matthew.garrett@nebula.com \
--cc=jwboyer@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome