Re: linux-next: UEFI Secure boot lockdown patchset

[Stephen Rothwell <sfr@canb.auug.org.au>]

[-- Attachment #1: Type: text/plain, Size: 2490 bytes --]

Hi David,

On Thu, 01 Mar 2018 11:06:55 +0000 David Howells <dhowells@redhat.com> wrote:
>
> Can you pull the following branch into linux-next please?  It does three
> things:
> 
>  (1) It restricts various accesses userspace may make upon the kernel when the
>      kernel is locked down.
> 
>  (2) It engages the lockdown if UEFI Secure Boot mode is detected.
> 
>  (3) It passes the UEFI Secure Boot mode indication across kexec.
> 
> The restrictions include:
> 
>  - Enforcing the use of module signatures
>  - Enforcing the use of kexec image signatures
>  - Requring IMA to use secure boot rules
>  - Disabling:
>    - The kexec_load() syscall
>    - Use of /dev/{mem,kmem,port,kcore}
>    - Hibernation
>    - PCI BAR access
>    - Direct I/O port access
>  - Preventing direct port specification in drivers:
>    - SCSI EATA
>    - TIOCSSERIAL
>    - Module parameters
>  - Restricting:
>    - MSR access
>    - Certain ACPI features
>    - kprobes
>    - BPF
>    - Perf
>    - Debugfs
> 
> The aim of the restrictions is twofold:
> 
>   (1) Prevent userspace from altering the kernel image directly (eg. by
>       /dev/mem) or indirectly (eg. by manipulating a device to do DMA);
> 
>   (2) Prevent userspace from accessing crypto data stored in the kernel
>       (eg. filesystem keys).
> 
> A warning is logged if a restriction is triggered for which I've written a
> manpage that is referenced in the message (see attached).

Added from tomorrow.  I actually used this url:

  git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git#efi-lock-down

Thanks for adding your subsystem tree as a participant of linux-next.  As
you may know, this is not a judgement of your code.  The purpose of
linux-next is for integration testing and to lower the impact of
conflicts between subsystems in the next merge window. 

You will need to ensure that the patches/commits in your tree/series have
been:
     * submitted under GPL v2 (or later) and include the Contributor's
        Signed-off-by,
     * posted to the relevant mailing list,
     * reviewed by you (or another maintainer of your subsystem tree),
     * successfully unit tested, and 
     * destined for the current or next Linux merge window.

Basically, this should be just what you would send to Linus (or ask him
to fetch).  It is allowed to be rebased if you deem it necessary.

-- 
Cheers,
Stephen Rothwell 
sfr@canb.auug.org.au

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]