Revision 5f56a74cc0a6d9b9f8ba89cea29cd7c4774cb2b1 authored by Ard Biesheuvel on 20 September 2022, 15:08:23 UTC, committed by Ard Biesheuvel on 22 September 2022, 08:15:44 UTC
We currently check the MokSBState variable to decide whether we should treat UEFI secure boot as being disabled, even if the firmware thinks otherwise. This is used by shim to indicate that it is not checking signatures on boot images. In the kernel, we use this to relax lockdown policies. However, in cases where shim is not even being used, we don't want this variable to interfere with lockdown, given that the variable may be non-volatile and therefore persist across a reboot. This means setting it once will persistently disable lockdown checks on a given system. So switch to the mirrored version of this variable, called MokSBStateRT, which is supposed to be volatile, and this is something we can check. Cc: <stable@vger.kernel.org> # v4.19+ Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Reviewed-by: Peter Jones <pjones@redhat.com>
1 parent 63bf28c
| File | Mode | Size |
|---|---|---|
| 842 | ||
| crypto | ||
| dim | ||
| fonts | ||
| kunit | ||
| livepatch | ||
| lz4 | ||
| lzo | ||
| math | ||
| mpi | ||
| pldmfw | ||
| raid6 | ||
| reed_solomon | ||
| test_fortify | ||
| vdso | ||
| xz | ||
| zlib_deflate | ||
| zlib_dfltcc | ||
| zlib_inflate | ||
| zstd | ||
| .gitignore | -rw-r--r-- | 174 bytes |
| Kconfig | -rw-r--r-- | 16.5 KB |
| Kconfig.debug | -rw-r--r-- | 87.8 KB |
| Kconfig.kasan | -rw-r--r-- | 6.6 KB |
| Kconfig.kcsan | -rw-r--r-- | 10.0 KB |
| Kconfig.kfence | -rw-r--r-- | 3.6 KB |
| Kconfig.kgdb | -rw-r--r-- | 5.6 KB |
| Kconfig.ubsan | -rw-r--r-- | 5.4 KB |
| Makefile | -rw-r--r-- | 14.0 KB |
| argv_split.c | -rw-r--r-- | 2.1 KB |
| ashldi3.c | -rw-r--r-- | 541 bytes |
| ashrdi3.c | -rw-r--r-- | 565 bytes |
| asn1_decoder.c | -rw-r--r-- | 13.2 KB |
| asn1_encoder.c | -rw-r--r-- | 10.3 KB |
| assoc_array.c | -rw-r--r-- | 51.9 KB |
| atomic64.c | -rw-r--r-- | 4.5 KB |
| atomic64_test.c | -rw-r--r-- | 6.4 KB |
| audit.c | -rw-r--r-- | 1.9 KB |
| base64.c | -rw-r--r-- | 2.4 KB |
| bcd.c | -rw-r--r-- | 297 bytes |
| bch.c | -rw-r--r-- | 38.3 KB |
| bitfield_kunit.c | -rw-r--r-- | 4.4 KB |
| bitmap.c | -rw-r--r-- | 47.0 KB |
| bitrev.c | -rw-r--r-- | 1.9 KB |
| bootconfig-data.S | -rw-r--r-- | 275 bytes |
| bootconfig.c | -rw-r--r-- | 21.5 KB |
| bsearch.c | -rw-r--r-- | 1.2 KB |
| btree.c | -rw-r--r-- | 19.2 KB |
| bucket_locks.c | -rw-r--r-- | 1.4 KB |
| bug.c | -rw-r--r-- | 5.9 KB |
| build_OID_registry | -rwxr-xr-x | 4.5 KB |
| buildid.c | -rw-r--r-- | 5.0 KB |
| bust_spinlocks.c | -rw-r--r-- | 676 bytes |
| check_signature.c | -rw-r--r-- | 635 bytes |
| checksum.c | -rw-r--r-- | 4.1 KB |
| clz_ctz.c | -rw-r--r-- | 1.2 KB |
| clz_tab.c | -rw-r--r-- | 891 bytes |
| cmdline.c | -rw-r--r-- | 5.8 KB |
| cmdline_kunit.c | -rw-r--r-- | 4.2 KB |
| cmpdi2.c | -rw-r--r-- | 501 bytes |
| compat_audit.c | -rw-r--r-- | 1002 bytes |
| cpu_rmap.c | -rw-r--r-- | 7.6 KB |
| cpumask.c | -rw-r--r-- | 5.0 KB |
| crc-ccitt.c | -rw-r--r-- | 5.6 KB |
| crc-itu-t.c | -rw-r--r-- | 2.7 KB |
| crc-t10dif.c | -rw-r--r-- | 3.2 KB |
| crc16.c | -rw-r--r-- | 2.7 KB |
| crc32.c | -rw-r--r-- | 9.3 KB |
| crc32defs.h | -rw-r--r-- | 1.6 KB |
| crc32test.c | -rw-r--r-- | 37.4 KB |
| crc4.c | -rw-r--r-- | 1003 bytes |
| crc64-rocksoft.c | -rw-r--r-- | 3.2 KB |
| crc64.c | -rw-r--r-- | 2.6 KB |
| crc7.c | -rw-r--r-- | 2.5 KB |
| crc8.c | -rw-r--r-- | 2.4 KB |
| ctype.c | -rw-r--r-- | 1.4 KB |
| debug_info.c | -rw-r--r-- | 782 bytes |
| debug_locks.c | -rw-r--r-- | 1.2 KB |
| debugobjects.c | -rw-r--r-- | 35.3 KB |
| dec_and_lock.c | -rw-r--r-- | 1.2 KB |
| decompress.c | -rw-r--r-- | 1.8 KB |
| decompress_bunzip2.c | -rw-r--r-- | 23.5 KB |
| decompress_inflate.c | -rw-r--r-- | 4.8 KB |
| decompress_unlz4.c | -rw-r--r-- | 4.2 KB |
| decompress_unlzma.c | -rw-r--r-- | 15.8 KB |
| decompress_unlzo.c | -rw-r--r-- | 6.4 KB |
| decompress_unxz.c | -rw-r--r-- | 10.9 KB |
| decompress_unzstd.c | -rw-r--r-- | 10.2 KB |
| devmem_is_allowed.c | -rw-r--r-- | 683 bytes |
| devres.c | -rw-r--r-- | 15.0 KB |
| digsig.c | -rw-r--r-- | 5.5 KB |
| dump_stack.c | -rw-r--r-- | 3.0 KB |
| dynamic_debug.c | -rw-r--r-- | 27.9 KB |
| dynamic_queue_limits.c | -rw-r--r-- | 4.3 KB |
| earlycpio.c | -rw-r--r-- | 3.6 KB |
| errname.c | -rw-r--r-- | 3.7 KB |
| error-inject.c | -rw-r--r-- | 5.3 KB |
| errseq.c | -rw-r--r-- | 6.6 KB |
| extable.c | -rw-r--r-- | 2.9 KB |
| fault-inject-usercopy.c | -rw-r--r-- | 823 bytes |
| fault-inject.c | -rw-r--r-- | 5.9 KB |
| fdt.c | -rw-r--r-- | 69 bytes |
| fdt_addresses.c | -rw-r--r-- | 79 bytes |
| fdt_empty_tree.c | -rw-r--r-- | 80 bytes |
| fdt_ro.c | -rw-r--r-- | 72 bytes |
| fdt_rw.c | -rw-r--r-- | 72 bytes |
| fdt_strerror.c | -rw-r--r-- | 78 bytes |
| fdt_sw.c | -rw-r--r-- | 72 bytes |
| fdt_wip.c | -rw-r--r-- | 73 bytes |
| find_bit.c | -rw-r--r-- | 3.7 KB |
| find_bit_benchmark.c | -rw-r--r-- | 4.5 KB |
| flex_proportions.c | -rw-r--r-- | 7.1 KB |
| gen_crc32table.c | -rw-r--r-- | 3.3 KB |
| gen_crc64table.c | -rw-r--r-- | 2.1 KB |
| genalloc.c | -rw-r--r-- | 26.4 KB |
| generic-radix-tree.c | -rw-r--r-- | 5.3 KB |
| glob.c | -rw-r--r-- | 3.5 KB |
| globtest.c | -rw-r--r-- | 4.2 KB |
| hexdump.c | -rw-r--r-- | 8.5 KB |
| hweight.c | -rw-r--r-- | 1.9 KB |
| idr.c | -rw-r--r-- | 17.5 KB |
| inflate.c | -rw-r--r-- | 38.7 KB |
| interval_tree.c | -rw-r--r-- | 540 bytes |
| interval_tree_test.c | -rw-r--r-- | 3.4 KB |
| iomap.c | -rw-r--r-- | 9.1 KB |
| iomap_copy.c | -rw-r--r-- | 2.2 KB |
| iommu-helper.c | -rw-r--r-- | 755 bytes |
| iov_iter.c | -rw-r--r-- | 45.9 KB |
| irq_poll.c | -rw-r--r-- | 5.6 KB |
| irq_regs.c | -rw-r--r-- | 394 bytes |
| is_single_threaded.c | -rw-r--r-- | 1.2 KB |
| kasprintf.c | -rw-r--r-- | 1.4 KB |
| kfifo.c | -rw-r--r-- | 12.1 KB |
| klist.c | -rw-r--r-- | 10.4 KB |
| kobject.c | -rw-r--r-- | 27.4 KB |
| kobject_uevent.c | -rw-r--r-- | 18.9 KB |
| kstrtox.c | -rw-r--r-- | 10.8 KB |
| kstrtox.h | -rw-r--r-- | 411 bytes |
| libcrc32c.c | -rw-r--r-- | 2.0 KB |
| linear_ranges.c | -rw-r--r-- | 8.1 KB |
| list-test.c | -rw-r--r-- | 28.0 KB |
| list_debug.c | -rw-r--r-- | 2.2 KB |
| list_sort.c | -rw-r--r-- | 8.2 KB |
| llist.c | -rw-r--r-- | 2.5 KB |
| locking-selftest-hardirq.h | -rw-r--r-- | 246 bytes |
| locking-selftest-mutex.h | -rw-r--r-- | 159 bytes |
| locking-selftest-rlock-hardirq.h | -rw-r--r-- | 74 bytes |
| locking-selftest-rlock-softirq.h | -rw-r--r-- | 74 bytes |
| locking-selftest-rlock.h | -rw-r--r-- | 197 bytes |
| locking-selftest-rsem.h | -rw-r--r-- | 202 bytes |
| locking-selftest-rtmutex.h | -rw-r--r-- | 162 bytes |
| locking-selftest-softirq.h | -rw-r--r-- | 246 bytes |
| locking-selftest-spin-hardirq.h | -rw-r--r-- | 73 bytes |
| locking-selftest-spin-softirq.h | -rw-r--r-- | 73 bytes |
| locking-selftest-spin.h | -rw-r--r-- | 157 bytes |
| locking-selftest-wlock-hardirq.h | -rw-r--r-- | 74 bytes |
| locking-selftest-wlock-softirq.h | -rw-r--r-- | 74 bytes |
| locking-selftest-wlock.h | -rw-r--r-- | 197 bytes |
| locking-selftest-wsem.h | -rw-r--r-- | 202 bytes |
| locking-selftest.c | -rw-r--r-- | 65.6 KB |
| lockref.c | -rw-r--r-- | 3.9 KB |
| logic_iomem.c | -rw-r--r-- | 7.2 KB |
| logic_pio.c | -rw-r--r-- | 8.5 KB |
| lru_cache.c | -rw-r--r-- | 18.8 KB |
| lshrdi3.c | -rw-r--r-- | 559 bytes |
| memcat_p.c | -rw-r--r-- | 753 bytes |
| memcpy_kunit.c | -rw-r--r-- | 8.0 KB |
| memneq.c | -rw-r--r-- | 6.4 KB |
| memory-notifier-error-inject.c | -rw-r--r-- | 1.1 KB |
| memregion.c | -rw-r--r-- | 429 bytes |
| memweight.c | -rw-r--r-- | 1.0 KB |
| muldi3.c | -rw-r--r-- | 1.7 KB |
| net_utils.c | -rw-r--r-- | 640 bytes |
| netdev-notifier-error-inject.c | -rw-r--r-- | 1.5 KB |
| nlattr.c | -rw-r--r-- | 26.9 KB |
| nmi_backtrace.c | -rw-r--r-- | 3.3 KB |
| notifier-error-inject.c | -rw-r--r-- | 2.5 KB |
| notifier-error-inject.h | -rw-r--r-- | 653 bytes |
| objagg.c | -rw-r--r-- | 28.2 KB |
| of-reconfig-notifier-error-inject.c | -rw-r--r-- | 1.3 KB |
| oid_registry.c | -rw-r--r-- | 4.4 KB |
| once.c | -rw-r--r-- | 1.5 KB |
| overflow_kunit.c | -rw-r--r-- | 25.2 KB |
| packing.c | -rw-r--r-- | 6.5 KB |
| parman.c | -rw-r--r-- | 10.6 KB |
| parser.c | -rw-r--r-- | 8.9 KB |
| pci_iomap.c | -rw-r--r-- | 5.7 KB |
| percpu-refcount.c | -rw-r--r-- | 15.3 KB |
| percpu_counter.c | -rw-r--r-- | 6.4 KB |
| percpu_test.c | -rw-r--r-- | 3.2 KB |
| plist.c | -rw-r--r-- | 5.9 KB |
| pm-notifier-error-inject.c | -rw-r--r-- | 1.2 KB |
| polynomial.c | -rw-r--r-- | 3.6 KB |
| radix-tree.c | -rw-r--r-- | 43.1 KB |
| random32.c | -rw-r--r-- | 9.1 KB |
| ratelimit.c | -rw-r--r-- | 1.6 KB |
| rbtree.c | -rw-r--r-- | 17.1 KB |
| rbtree_test.c | -rw-r--r-- | 9.4 KB |
| ref_tracker.c | -rw-r--r-- | 4.0 KB |
| refcount.c | -rw-r--r-- | 4.8 KB |
| rhashtable.c | -rw-r--r-- | 29.5 KB |
| sbitmap.c | -rw-r--r-- | 19.2 KB |
| scatterlist.c | -rw-r--r-- | 28.0 KB |
| seq_buf.c | -rw-r--r-- | 10.0 KB |
| sg_pool.c | -rw-r--r-- | 4.2 KB |
| sg_split.c | -rw-r--r-- | 5.0 KB |
| show_mem.c | -rw-r--r-- | 1.1 KB |
| siphash.c | -rw-r--r-- | 11.6 KB |
| slub_kunit.c | -rw-r--r-- | 3.4 KB |
| smp_processor_id.c | -rw-r--r-- | 1.4 KB |
| sort.c | -rw-r--r-- | 8.9 KB |
| stackdepot.c | -rw-r--r-- | 14.5 KB |
| stackinit_kunit.c | -rw-r--r-- | 13.9 KB |
| stmp_device.c | -rw-r--r-- | 1.9 KB |
| string.c | -rw-r--r-- | 20.8 KB |
| string_helpers.c | -rw-r--r-- | 23.0 KB |
| strncpy_from_user.c | -rw-r--r-- | 3.9 KB |
| strnlen_user.c | -rw-r--r-- | 3.4 KB |
| syscall.c | -rw-r--r-- | 2.7 KB |
| test-kstrtox.c | -rw-r--r-- | 17.3 KB |
| test-string_helpers.c | -rw-r--r-- | 14.9 KB |
| test_bitmap.c | -rw-r--r-- | 31.4 KB |
| test_bitops.c | -rw-r--r-- | 2.5 KB |
| test_bits.c | -rw-r--r-- | 1.8 KB |
| test_blackhole_dev.c | -rw-r--r-- | 2.5 KB |
| test_bpf.c | -rw-r--r-- | 356.3 KB |
| test_cpumask.c | -rw-r--r-- | 3.8 KB |
| test_debug_virtual.c | -rw-r--r-- | 981 bytes |
| test_firmware.c | -rw-r--r-- | 36.5 KB |
| test_fprobe.c | -rw-r--r-- | 4.2 KB |
| test_fpu.c | -rw-r--r-- | 2.0 KB |
| test_free_pages.c | -rw-r--r-- | 1003 bytes |
| test_hash.c | -rw-r--r-- | 6.5 KB |
| test_hexdump.c | -rw-r--r-- | 6.3 KB |
| test_hmm.c | -rw-r--r-- | 35.4 KB |
| test_hmm_uapi.h | -rw-r--r-- | 2.8 KB |
| test_ida.c | -rw-r--r-- | 4.3 KB |
| test_kasan.c | -rw-r--r-- | 37.5 KB |
| test_kasan_module.c | -rw-r--r-- | 3.3 KB |
| test_kmod.c | -rw-r--r-- | 29.9 KB |
| test_kprobes.c | -rw-r--r-- | 9.4 KB |
| test_linear_ranges.c | -rw-r--r-- | 7.5 KB |
| test_list_sort.c | -rw-r--r-- | 3.3 KB |
| test_lockup.c | -rw-r--r-- | 16.5 KB |
| test_memcat_p.c | -rw-r--r-- | 2.2 KB |
| test_meminit.c | -rw-r--r-- | 9.9 KB |
| test_min_heap.c | -rw-r--r-- | 4.3 KB |
| test_module.c | -rw-r--r-- | 794 bytes |
| test_objagg.c | -rw-r--r-- | 24.6 KB |
| test_parman.c | -rw-r--r-- | 11.2 KB |
| test_printf.c | -rw-r--r-- | 19.1 KB |
| test_ref_tracker.c | -rw-r--r-- | 3.1 KB |
| test_rhashtable.c | -rw-r--r-- | 20.0 KB |
| test_scanf.c | -rw-r--r-- | 28.9 KB |
| test_siphash.c | -rw-r--r-- | 7.5 KB |
| test_sort.c | -rw-r--r-- | 907 bytes |
| test_static_key_base.c | -rw-r--r-- | 1.6 KB |
| test_static_keys.c | -rw-r--r-- | 5.6 KB |
| test_string.c | -rw-r--r-- | 4.6 KB |
| test_strscpy.c | -rw-r--r-- | 4.0 KB |
| test_sysctl.c | -rw-r--r-- | 4.6 KB |
| test_ubsan.c | -rw-r--r-- | 2.4 KB |
| test_user_copy.c | -rw-r--r-- | 9.1 KB |
| test_uuid.c | -rw-r--r-- | 3.4 KB |
| test_vmalloc.c | -rw-r--r-- | 10.9 KB |
| test_xarray.c | -rw-r--r-- | 47.2 KB |
| textsearch.c | -rw-r--r-- | 9.3 KB |
| timerqueue.c | -rw-r--r-- | 2.3 KB |
| trace_readwrite.c | -rw-r--r-- | 1.3 KB |
| ts_bm.c | -rw-r--r-- | 5.1 KB |
| ts_fsm.c | -rw-r--r-- | 10.4 KB |
| ts_kmp.c | -rw-r--r-- | 4.1 KB |
| ubsan.c | -rw-r--r-- | 9.7 KB |
| ubsan.h | -rw-r--r-- | 1.8 KB |
| ucmpdi2.c | -rw-r--r-- | 568 bytes |
| ucs2_string.c | -rw-r--r-- | 2.5 KB |
| usercopy.c | -rw-r--r-- | 2.2 KB |
| uuid.c | -rw-r--r-- | 2.9 KB |
| vsprintf.c | -rw-r--r-- | 86.8 KB |
| win_minmax.c | -rw-r--r-- | 3.4 KB |
| xarray.c | -rw-r--r-- | 58.8 KB |
| xxhash.c | -rw-r--r-- | 12.7 KB |
Computing file changes ...
