diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.10.12.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.11.0.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.10.12.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.11.0.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.10.12.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.11.0.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.10.12.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.11.0.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.10 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.11 similarity index 97% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.10 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.11 index 256c42c1f2..1713677d24 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.10 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.11 @@ -21,7 +21,8 @@ CONFIG_MEMORY_FAILURE=y CONFIG_X86_CHECK_BIOS_CORRUPTION=y # CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1 -CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y +CONFIG_LOCK_DOWN_KERNEL=y +CONFIG_EFI_SECURE_BOOT_LOCK_DOWN=y CONFIG_KEXEC=y CONFIG_KEXEC_FILE=y CONFIG_KEXEC_VERIFY_SIG=y @@ -149,7 +150,7 @@ CONFIG_SCHED_TRACER=y CONFIG_FTRACE_SYSCALLS=y CONFIG_STACK_TRACER=y CONFIG_BLK_DEV_IO_TRACE=y -CONFIG_UPROBE_EVENT=y +CONFIG_UPROBE_EVENTS=y CONFIG_FUNCTION_PROFILER=y CONFIG_DEBUG_BOOT_PARAMS=y CONFIG_OPTIMIZE_INLINING=y @@ -164,3 +165,4 @@ CONFIG_OPTPROBES=y CONFIG_KPROBES_ON_FTRACE=y CONFIG_FCOE_FNIC=m CONFIG_ISCSI_IBFT_FIND=y +CONFIG_VMXNET3=m diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.10 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.11 similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.10 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.11 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.10 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.11 similarity index 99% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.10 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.11 index cda47f4d32..a2a0bec2b0 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.10 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.11 @@ -74,7 +74,6 @@ CONFIG_EFIVAR_FS=y CONFIG_BINFMT_MISC=m CONFIG_CPU_FREQ=y CONFIG_CPU_FREQ_STAT=y -CONFIG_CPU_FREQ_STAT_DETAILS=y CONFIG_CPU_FREQ_GOV_POWERSAVE=m CONFIG_CPU_FREQ_GOV_USERSPACE=m CONFIG_CPU_FREQ_GOV_ONDEMAND=m @@ -612,7 +611,6 @@ CONFIG_USB_NET_AX8817X=m # CONFIG_WLAN is not set CONFIG_XEN_NETDEV_FRONTEND=m CONFIG_XEN_NETDEV_BACKEND=m -CONFIG_VMXNET3=m CONFIG_INPUT_MOUSEDEV=m # CONFIG_INPUT_MOUSEDEV_PSAUX is not set CONFIG_MOUSE_PS2=m @@ -811,15 +809,13 @@ CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y CONFIG_PANIC_ON_OOPS=y CONFIG_PANIC_TIMEOUT=60 CONFIG_SCHED_STACK_END_CHECK=y -CONFIG_TIMER_STATS=y CONFIG_DEBUG_CREDENTIALS=y CONFIG_RCU_CPU_STALL_TIMEOUT=60 CONFIG_LATENCYTOP=y -CONFIG_KPROBE_EVENT=y +CONFIG_KPROBE_EVENTS=y CONFIG_BPF_EVENTS=y CONFIG_MEMTEST=y CONFIG_STRICT_DEVMEM=y -CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_TRUSTED_KEYS=m CONFIG_ENCRYPTED_KEYS=m CONFIG_SECURITY=y diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index 5801556685..520300bf00 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1 @@ -DIST linux-4.10.tar.xz 94231404 SHA256 3c95d9f049bd085e5c346d2c77f063b8425f191460fcd3ae9fe7e94e0477dc4b SHA512 c3690125a8402df638095bd98a613fcf1a257b81de7611c84711d315cd11e2634ab4636302b3742aedf1e3ba9ce0fea53fe8c7d48e37865d8ee5db3565220d90 WHIRLPOOL 86d021bae2dbfc4ef80c22d9e886bed4fbd9476473a2851d7beaf8ed0c7f7fbc1fa0da230eb9e763eb231b7c164c17b2a73fd336ab233543f57be280d6173738 -DIST patch-4.10.12.xz 264376 SHA256 ed919b49178bbda14b341058a92362322cbb09e9028229e860e6927553c8d037 SHA512 39dacec6f9ed28a3bf3339d98c9f0cc86b977252c8d2cabf5d39572cc1dff078bf8f52afdd7e6bc3213d00f7b42474d9c6a4ba641497d091b122e748a48ff0f9 WHIRLPOOL e1f9b96761e60da761d78bb8a2ddd91d9659b2c254766ba61c4ea5c72b9088aa8953e4e0fe567fae3e225693218f7995e81c4b6f92b2ce879668849b0df80496 +DIST linux-4.11.tar.xz 95447768 SHA256 b67ecafd0a42b3383bf4d82f0850cbff92a7e72a215a6d02f42ddbafcf42a7d6 SHA512 6610eed97ffb7207c71771198c36179b8244ace7222bebb109507720e26c5f17d918079a56d5febdd8605844d67fb2df0ebe910fa2f2f53690daf6e2a8ad09c3 WHIRLPOOL f577b7c5c209cb8dfef2f1d56d77314fbd53323743a34b900e2559ab0049b7c2d6262bda136dd3d005bc0527788106e0484e46558448a8720dac389a969e5886 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.10.12.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.10.12.ebuild deleted file mode 100644 index d34ba81d76..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.10.12.ebuild +++ /dev/null @@ -1,39 +0,0 @@ -# Copyright 2014 CoreOS, Inc. -# Distributed under the terms of the GNU General Public License v2 - -EAPI="5" -ETYPE="sources" -inherit kernel-2 -detect_version - -DESCRIPTION="Full sources for the CoreOS Linux kernel" -HOMEPAGE="http://www.kernel.org" -SRC_URI="${KERNEL_URI}" - -KEYWORDS="amd64 arm64" -IUSE="" - -PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" - -# XXX: Note we must prefix the patch filenames with "z" to ensure they are -# applied _after_ a potential patch-${KV}.patch file, present when building a -# patchlevel revision. We mustn't apply our patches first, it fails when the -# local patches overlap with the upstream patch. -UNIPATCH_LIST=" - ${PATCH_DIR}/z0001-Add-secure_modules-call.patch \ - ${PATCH_DIR}/z0002-PCI-Lock-down-BAR-access-when-module-security-is-ena.patch \ - ${PATCH_DIR}/z0003-x86-Lock-down-IO-port-access-when-module-security-is.patch \ - ${PATCH_DIR}/z0004-ACPI-Limit-access-to-custom_method.patch \ - ${PATCH_DIR}/z0005-asus-wmi-Restrict-debugfs-interface-when-module-load.patch \ - ${PATCH_DIR}/z0006-Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch \ - ${PATCH_DIR}/z0007-acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch \ - ${PATCH_DIR}/z0008-kexec-Disable-at-runtime-if-the-kernel-enforces-modu.patch \ - ${PATCH_DIR}/z0009-x86-Restrict-MSR-access-when-module-loading-is-restr.patch \ - ${PATCH_DIR}/z0010-Add-option-to-automatically-enforce-module-signature.patch \ - ${PATCH_DIR}/z0011-efi-Make-EFI_SECURE_BOOT_SIG_ENFORCE-depend-on-EFI.patch \ - ${PATCH_DIR}/z0012-efi-Add-EFI_SECURE_BOOT-bit.patch \ - ${PATCH_DIR}/z0013-hibernate-Disable-in-a-signed-modules-environment.patch \ - ${PATCH_DIR}/z0014-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch \ - ${PATCH_DIR}/z0015-Add-arm64-coreos-verity-hash.patch \ - ${PATCH_DIR}/z0016-selinux-allow-context-mounts-on-tmpfs-ramfs-devpts-w.patch \ -" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.11.0.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.11.0.ebuild new file mode 100644 index 0000000000..8e306611f2 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.11.0.ebuild @@ -0,0 +1,47 @@ +# Copyright 2014 CoreOS, Inc. +# Distributed under the terms of the GNU General Public License v2 + +EAPI="5" +ETYPE="sources" +inherit kernel-2 +detect_version + +DESCRIPTION="Full sources for the CoreOS Linux kernel" +HOMEPAGE="http://www.kernel.org" +SRC_URI="${KERNEL_URI}" + +KEYWORDS="amd64 arm64" +IUSE="" + +PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" + +# XXX: Note we must prefix the patch filenames with "z" to ensure they are +# applied _after_ a potential patch-${KV}.patch file, present when building a +# patchlevel revision. We mustn't apply our patches first, it fails when the +# local patches overlap with the upstream patch. +UNIPATCH_LIST=" + ${PATCH_DIR}/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch \ + ${PATCH_DIR}/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch \ + ${PATCH_DIR}/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \ + ${PATCH_DIR}/z0004-Enforce-module-signatures-if-the-kernel-is-locked-do.patch \ + ${PATCH_DIR}/z0005-Restrict-dev-mem-and-dev-kmem-when-the-kernel-is-loc.patch \ + ${PATCH_DIR}/z0006-kexec-Disable-at-runtime-if-the-kernel-is-locked-dow.patch \ + ${PATCH_DIR}/z0007-Copy-secure_boot-flag-in-boot-params-across-kexec-re.patch \ + ${PATCH_DIR}/z0008-kexec_file-Disable-at-runtime-if-securelevel-has-bee.patch \ + ${PATCH_DIR}/z0009-hibernate-Disable-when-the-kernel-is-locked-down.patch \ + ${PATCH_DIR}/z0010-uswsusp-Disable-when-the-kernel-is-locked-down.patch \ + ${PATCH_DIR}/z0011-PCI-Lock-down-BAR-access-when-the-kernel-is-locked-d.patch \ + ${PATCH_DIR}/z0012-x86-Lock-down-IO-port-access-when-the-kernel-is-lock.patch \ + ${PATCH_DIR}/z0013-x86-Restrict-MSR-access-when-the-kernel-is-locked-do.patch \ + ${PATCH_DIR}/z0014-asus-wmi-Restrict-debugfs-interface-when-the-kernel-.patch \ + ${PATCH_DIR}/z0015-ACPI-Limit-access-to-custom_method-when-the-kernel-i.patch \ + ${PATCH_DIR}/z0016-acpi-Ignore-acpi_rsdp-kernel-param-when-the-kernel-h.patch \ + ${PATCH_DIR}/z0017-acpi-Disable-ACPI-table-override-if-the-kernel-is-lo.patch \ + ${PATCH_DIR}/z0018-acpi-Disable-APEI-error-injection-if-the-kernel-is-l.patch \ + ${PATCH_DIR}/z0019-bpf-Restrict-kernel-image-access-functions-when-the-.patch \ + ${PATCH_DIR}/z0020-scsi-Lock-down-the-eata-driver.patch \ + ${PATCH_DIR}/z0021-Prohibit-PCMCIA-CIS-storage-when-the-kernel-is-locke.patch \ + ${PATCH_DIR}/z0022-Lock-down-TIOCSSERIAL.patch \ + ${PATCH_DIR}/z0023-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch \ + ${PATCH_DIR}/z0024-Add-arm64-coreos-verity-hash.patch \ +" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0001-Add-secure_modules-call.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0001-Add-secure_modules-call.patch deleted file mode 100644 index 9636177fce..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0001-Add-secure_modules-call.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 56ce70f57c13296973ef0a14b7a2695d804abae8 Mon Sep 17 00:00:00 2001 -From: Matthew Garrett -Date: Fri, 9 Aug 2013 17:58:15 -0400 -Subject: [PATCH 01/16] Add secure_modules() call - -Provide a single call to allow kernel code to determine whether the system -has been configured to either disable module loading entirely or to load -only modules signed with a trusted key. - -Bugzilla: N/A -Upstream-status: Fedora mustard. Replaced by securelevels, but that was nak'd - -Signed-off-by: Matthew Garrett ---- - include/linux/module.h | 6 ++++++ - kernel/module.c | 10 ++++++++++ - 2 files changed, 16 insertions(+) - -diff --git a/include/linux/module.h b/include/linux/module.h -index cc7cba2..da4bd57 100644 ---- a/include/linux/module.h -+++ b/include/linux/module.h -@@ -629,6 +629,8 @@ static inline bool module_requested_async_probing(struct module *module) - return module && module->async_probe_requested; - } - -+extern bool secure_modules(void); -+ - #ifdef CONFIG_LIVEPATCH - static inline bool is_livepatch_module(struct module *mod) - { -@@ -750,6 +752,10 @@ static inline bool module_requested_async_probing(struct module *module) - return false; - } - -+static inline bool secure_modules(void) -+{ -+ return false; -+} - #endif /* CONFIG_MODULES */ - - #ifdef CONFIG_SYSFS -diff --git a/kernel/module.c b/kernel/module.c -index 1cd2bf3..3161532 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -4300,3 +4300,13 @@ void module_layout(struct module *mod, - } - EXPORT_SYMBOL(module_layout); - #endif -+ -+bool secure_modules(void) -+{ -+#ifdef CONFIG_MODULE_SIG -+ return (sig_enforce || modules_disabled); -+#else -+ return modules_disabled; -+#endif -+} -+EXPORT_SYMBOL(secure_modules); --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0003-x86-Lock-down-IO-port-access-when-module-security-is.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0003-x86-Lock-down-IO-port-access-when-module-security-is.patch deleted file mode 100644 index 4483bb1d3f..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0003-x86-Lock-down-IO-port-access-when-module-security-is.patch +++ /dev/null @@ -1,72 +0,0 @@ -From e86746ca84516a0f983fcb917d8c7f1e537c3898 Mon Sep 17 00:00:00 2001 -From: Matthew Garrett -Date: Thu, 8 Mar 2012 10:35:59 -0500 -Subject: [PATCH 03/16] x86: Lock down IO port access when module security is - enabled - -IO port access would permit users to gain access to PCI configuration -registers, which in turn (on a lot of hardware) give access to MMIO register -space. This would potentially permit root to trigger arbitrary DMA, so lock -it down by default. - -Signed-off-by: Matthew Garrett ---- - arch/x86/kernel/ioport.c | 5 +++-- - drivers/char/mem.c | 4 ++++ - 2 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c -index 589b319..ab83724 100644 ---- a/arch/x86/kernel/ioport.c -+++ b/arch/x86/kernel/ioport.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - - /* -@@ -28,7 +29,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on) - - if ((from + num <= from) || (from + num > IO_BITMAP_BITS)) - return -EINVAL; -- if (turn_on && !capable(CAP_SYS_RAWIO)) -+ if (turn_on && (!capable(CAP_SYS_RAWIO) || secure_modules())) - return -EPERM; - - /* -@@ -108,7 +109,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) - return -EINVAL; - /* Trying to gain more privileges? */ - if (level > old) { -- if (!capable(CAP_SYS_RAWIO)) -+ if (!capable(CAP_SYS_RAWIO) || secure_modules()) - return -EPERM; - } - regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | -diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index 7e4a9d1..83cca9f 100644 ---- a/drivers/char/mem.c -+++ b/drivers/char/mem.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - - #include - -@@ -600,6 +601,9 @@ static ssize_t write_port(struct file *file, const char __user *buf, - unsigned long i = *ppos; - const char __user *tmp = buf; - -+ if (secure_modules()) -+ return -EPERM; -+ - if (!access_ok(VERIFY_READ, buf, count)) - return -EFAULT; - while (count-- > 0 && i < 65536) { --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0007-acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0007-acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch deleted file mode 100644 index 16c7c903da..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0007-acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch +++ /dev/null @@ -1,39 +0,0 @@ -From acabe733bc7120d1557bb283dd4e00d55e4282a4 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Mon, 25 Jun 2012 19:57:30 -0400 -Subject: [PATCH 07/16] acpi: Ignore acpi_rsdp kernel parameter when module - loading is restricted - -This option allows userspace to pass the RSDP address to the kernel, which -makes it possible for a user to circumvent any restrictions imposed on -loading modules. Disable it in that case. - -Signed-off-by: Josh Boyer ---- - drivers/acpi/osl.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c -index 57fb5f4..9174461 100644 ---- a/drivers/acpi/osl.c -+++ b/drivers/acpi/osl.c -@@ -40,6 +40,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -192,7 +193,7 @@ acpi_physical_address __init acpi_os_get_root_pointer(void) - acpi_physical_address pa = 0; - - #ifdef CONFIG_KEXEC -- if (acpi_rsdp) -+ if (acpi_rsdp && !secure_modules()) - return acpi_rsdp; - #endif - --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0008-kexec-Disable-at-runtime-if-the-kernel-enforces-modu.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0008-kexec-Disable-at-runtime-if-the-kernel-enforces-modu.patch deleted file mode 100644 index c376ec1dd6..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0008-kexec-Disable-at-runtime-if-the-kernel-enforces-modu.patch +++ /dev/null @@ -1,39 +0,0 @@ -From a135df64b344fc57ddaef49fcb729e0111551ba3 Mon Sep 17 00:00:00 2001 -From: Matthew Garrett -Date: Thu, 19 Nov 2015 18:55:53 -0800 -Subject: [PATCH 08/16] kexec: Disable at runtime if the kernel enforces module - loading restrictions - -kexec permits the loading and execution of arbitrary code in ring 0, which -is something that module signing enforcement is meant to prevent. It makes -sense to disable kexec in this situation. - -Signed-off-by: Matthew Garrett ---- - kernel/kexec.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/kernel/kexec.c b/kernel/kexec.c -index 980936a..a0e4cb3 100644 ---- a/kernel/kexec.c -+++ b/kernel/kexec.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - #include "kexec_internal.h" - -@@ -190,7 +191,7 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, - int result; - - /* We only trust the superuser with rebooting the system. */ -- if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) -+ if (!capable(CAP_SYS_BOOT) || kexec_load_disabled || secure_modules()) - return -EPERM; - - /* --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0010-Add-option-to-automatically-enforce-module-signature.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0010-Add-option-to-automatically-enforce-module-signature.patch deleted file mode 100644 index b8f56aa27f..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0010-Add-option-to-automatically-enforce-module-signature.patch +++ /dev/null @@ -1,185 +0,0 @@ -From 3e73063b8cec1c30f9937f784de14e37606b1e9d Mon Sep 17 00:00:00 2001 -From: Matthew Garrett -Date: Fri, 9 Aug 2013 18:36:30 -0400 -Subject: [PATCH 10/16] Add option to automatically enforce module signatures - when in Secure Boot mode - -UEFI Secure Boot provides a mechanism for ensuring that the firmware will -only load signed bootloaders and kernels. Certain use cases may also -require that all kernel modules also be signed. Add a configuration option -that enforces this automatically when enabled. - -Signed-off-by: Matthew Garrett ---- - Documentation/x86/zero-page.txt | 2 ++ - arch/x86/Kconfig | 10 ++++++++++ - arch/x86/boot/compressed/eboot.c | 35 +++++++++++++++++++++++++++++++++++ - arch/x86/include/uapi/asm/bootparam.h | 3 ++- - arch/x86/kernel/setup.c | 6 ++++++ - include/linux/module.h | 6 ++++++ - kernel/module.c | 7 +++++++ - 7 files changed, 68 insertions(+), 1 deletion(-) - -diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt -index 95a4d34..b8527c6 100644 ---- a/Documentation/x86/zero-page.txt -+++ b/Documentation/x86/zero-page.txt -@@ -31,6 +31,8 @@ Offset Proto Name Meaning - 1E9/001 ALL eddbuf_entries Number of entries in eddbuf (below) - 1EA/001 ALL edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer - (below) -+1EB/001 ALL kbd_status Numlock is enabled -+1EC/001 ALL secure_boot Secure boot is enabled in the firmware - 1EF/001 ALL sentinel Used to detect broken bootloaders - 290/040 ALL edd_mbr_sig_buffer EDD MBR signatures - 2D0/A00 ALL e820_map E820 memory map table -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index e487493..5be38b4 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1815,6 +1815,16 @@ config EFI_MIXED - - If unsure, say N. - -+config EFI_SECURE_BOOT_SIG_ENFORCE -+ def_bool n -+ prompt "Force module signing when UEFI Secure Boot is enabled" -+ ---help--- -+ UEFI Secure Boot provides a mechanism for ensuring that the -+ firmware will only load signed bootloaders and kernels. Certain -+ use cases may also require that all kernel modules also be signed. -+ Say Y here to automatically enable module signature enforcement -+ when a system boots with UEFI Secure Boot enabled. -+ - config SECCOMP - def_bool y - prompt "Enable seccomp to safely compute untrusted bytecode" -diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index ff01c8f..3e9e29a 100644 ---- a/arch/x86/boot/compressed/eboot.c -+++ b/arch/x86/boot/compressed/eboot.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #include "../string.h" - #include "eboot.h" -@@ -600,6 +601,36 @@ static void setup_quirks(struct boot_params *boot_params) - } - } - -+static int get_secure_boot(void) -+{ -+ u8 sb, setup; -+ unsigned long datasize = sizeof(sb); -+ efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID; -+ efi_status_t status; -+ -+ status = efi_early->call((unsigned long)sys_table->runtime->get_variable, -+ L"SecureBoot", &var_guid, NULL, &datasize, &sb); -+ -+ if (status != EFI_SUCCESS) -+ return 0; -+ -+ if (sb == 0) -+ return 0; -+ -+ -+ status = efi_early->call((unsigned long)sys_table->runtime->get_variable, -+ L"SetupMode", &var_guid, NULL, &datasize, -+ &setup); -+ -+ if (status != EFI_SUCCESS) -+ return 0; -+ -+ if (setup == 1) -+ return 0; -+ -+ return 1; -+} -+ - static efi_status_t - setup_uga32(void **uga_handle, unsigned long size, u32 *width, u32 *height) - { -@@ -1157,6 +1188,10 @@ struct boot_params *efi_main(struct efi_config *c, - else - setup_boot_services32(efi_early); - -+ sanitize_boot_params(boot_params); -+ -+ boot_params->secure_boot = get_secure_boot(); -+ - setup_graphics(boot_params); - - setup_efi_pci(boot_params); -diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h -index b10bf31..5138dac 100644 ---- a/arch/x86/include/uapi/asm/bootparam.h -+++ b/arch/x86/include/uapi/asm/bootparam.h -@@ -135,7 +135,8 @@ struct boot_params { - __u8 eddbuf_entries; /* 0x1e9 */ - __u8 edd_mbr_sig_buf_entries; /* 0x1ea */ - __u8 kbd_status; /* 0x1eb */ -- __u8 _pad5[3]; /* 0x1ec */ -+ __u8 secure_boot; /* 0x1ec */ -+ __u8 _pad5[2]; /* 0x1ed */ - /* - * The sentinel is set to a nonzero value (0xff) in header.S. - * -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 4cfba94..7c4295c 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -1184,6 +1184,12 @@ void __init setup_arch(char **cmdline_p) - - io_delay_init(); - -+#ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE -+ if (boot_params.secure_boot) { -+ enforce_signed_modules(); -+ } -+#endif -+ - /* - * Parse the ACPI tables for possible boot-time SMP configuration. - */ -diff --git a/include/linux/module.h b/include/linux/module.h -index da4bd57..25d88bb 100644 ---- a/include/linux/module.h -+++ b/include/linux/module.h -@@ -260,6 +260,12 @@ extern const typeof(name) __mod_##type##__##name##_device_table \ - - struct notifier_block; - -+#ifdef CONFIG_MODULE_SIG -+extern void enforce_signed_modules(void); -+#else -+static inline void enforce_signed_modules(void) {}; -+#endif -+ - #ifdef CONFIG_MODULES - - extern int modules_disabled; /* for sysctl */ -diff --git a/kernel/module.c b/kernel/module.c -index 3161532..19fe883 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -4301,6 +4301,13 @@ void module_layout(struct module *mod, - EXPORT_SYMBOL(module_layout); - #endif - -+#ifdef CONFIG_MODULE_SIG -+void enforce_signed_modules(void) -+{ -+ sig_enforce = true; -+} -+#endif -+ - bool secure_modules(void) - { - #ifdef CONFIG_MODULE_SIG --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0011-efi-Make-EFI_SECURE_BOOT_SIG_ENFORCE-depend-on-EFI.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0011-efi-Make-EFI_SECURE_BOOT_SIG_ENFORCE-depend-on-EFI.patch deleted file mode 100644 index fc80a34543..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0011-efi-Make-EFI_SECURE_BOOT_SIG_ENFORCE-depend-on-EFI.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 73f341d91ad94d23b610a87a1813004ce34a315b Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Tue, 27 Aug 2013 13:28:43 -0400 -Subject: [PATCH 11/16] efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI - -The functionality of the config option is dependent upon the platform being -UEFI based. Reflect this in the config deps. - -Signed-off-by: Josh Boyer ---- - arch/x86/Kconfig | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 5be38b4..efe6b42 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1816,7 +1816,8 @@ config EFI_MIXED - If unsure, say N. - - config EFI_SECURE_BOOT_SIG_ENFORCE -- def_bool n -+ def_bool n -+ depends on EFI - prompt "Force module signing when UEFI Secure Boot is enabled" - ---help--- - UEFI Secure Boot provides a mechanism for ensuring that the --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0012-efi-Add-EFI_SECURE_BOOT-bit.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0012-efi-Add-EFI_SECURE_BOOT-bit.patch deleted file mode 100644 index 1bef76c087..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0012-efi-Add-EFI_SECURE_BOOT-bit.patch +++ /dev/null @@ -1,43 +0,0 @@ -From fef19ea533f24b316a9fbba0e41a654428556721 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Tue, 27 Aug 2013 13:33:03 -0400 -Subject: [PATCH 12/16] efi: Add EFI_SECURE_BOOT bit - -UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit -for use with efi_enabled. - -Signed-off-by: Josh Boyer ---- - arch/x86/kernel/setup.c | 2 ++ - include/linux/efi.h | 1 + - 2 files changed, 3 insertions(+) - -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 7c4295c..c5c88bc 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -1186,7 +1186,9 @@ void __init setup_arch(char **cmdline_p) - - #ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE - if (boot_params.secure_boot) { -+ set_bit(EFI_SECURE_BOOT, &efi.flags); - enforce_signed_modules(); -+ pr_info("Secure boot enabled\n"); - } - #endif - -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 5b1af30..1b12c29 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -1065,6 +1065,7 @@ extern int __init efi_setup_pcdp_console(char *); - #define EFI_ARCH_1 7 /* First arch-specific bit */ - #define EFI_DBG 8 /* Print additional debug info at runtime */ - #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ -+#define EFI_SECURE_BOOT 10 /* Are we in Secure Boot mode? */ - - #ifdef CONFIG_EFI - /* --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0013-hibernate-Disable-in-a-signed-modules-environment.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0013-hibernate-Disable-in-a-signed-modules-environment.patch deleted file mode 100644 index 21919300b6..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0013-hibernate-Disable-in-a-signed-modules-environment.patch +++ /dev/null @@ -1,39 +0,0 @@ -From f88379d39f564008627fb41ee4880eff9c410a58 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Fri, 20 Jun 2014 08:53:24 -0400 -Subject: [PATCH 13/16] hibernate: Disable in a signed modules environment - -There is currently no way to verify the resume image when returning -from hibernate. This might compromise the signed modules trust model, -so until we can work with signed hibernate images we disable it in -a secure modules environment. - -Signed-off-by: Josh Boyer ---- - kernel/power/hibernate.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index b26dbc4..ab187ad 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - - #include "power.h" -@@ -67,7 +68,7 @@ static const struct platform_hibernation_ops *hibernation_ops; - - bool hibernation_available(void) - { -- return (nohibernate == 0); -+ return ((nohibernate == 0) && !secure_modules()); - } - - /** --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0016-selinux-allow-context-mounts-on-tmpfs-ramfs-devpts-w.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0016-selinux-allow-context-mounts-on-tmpfs-ramfs-devpts-w.patch deleted file mode 100644 index 3fd9510d0a..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.10/z0016-selinux-allow-context-mounts-on-tmpfs-ramfs-devpts-w.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 85f70950f243ac7477d80053dd9ae8807cf36b08 Mon Sep 17 00:00:00 2001 -From: Stephen Smalley -Date: Mon, 9 Jan 2017 10:07:31 -0500 -Subject: [PATCH 16/16] selinux: allow context mounts on tmpfs, ramfs, devpts - within user namespaces - -commit aad82892af261b9903cc11c55be3ecf5f0b0b4f8 ("selinux: Add support for -unprivileged mounts from user namespaces") prohibited any use of context -mount options within non-init user namespaces. However, this breaks -use of context mount options for tmpfs mounts within user namespaces, -which are being used by Docker/runc. There is no reason to block such -usage for tmpfs, ramfs or devpts. Exempt these filesystem types -from this restriction. - -Before: -sh$ userns_child_exec -p -m -U -M '0 1000 1' -G '0 1000 1' bash -sh# mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0:c13 none /tmp -mount: tmpfs is write-protected, mounting read-only -mount: cannot mount tmpfs read-only - -After: -sh$ userns_child_exec -p -m -U -M '0 1000 1' -G '0 1000 1' bash -sh# mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0:c13 none /tmp -sh# ls -Zd /tmp -unconfined_u:object_r:user_tmp_t:s0:c13 /tmp - -Signed-off-by: Stephen Smalley -Signed-off-by: Paul Moore ---- - security/selinux/hooks.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index d98550a..fbf2d6d 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -833,10 +833,14 @@ static int selinux_set_mnt_opts(struct super_block *sb, - } - - /* -- * If this is a user namespace mount, no contexts are allowed -- * on the command line and security labels must be ignored. -+ * If this is a user namespace mount and the filesystem type is not -+ * explicitly whitelisted, then no contexts are allowed on the command -+ * line and security labels must be ignored. - */ -- if (sb->s_user_ns != &init_user_ns) { -+ if (sb->s_user_ns != &init_user_ns && -+ strcmp(sb->s_type->name, "tmpfs") && -+ strcmp(sb->s_type->name, "ramfs") && -+ strcmp(sb->s_type->name, "devpts")) { - if (context_sid || fscontext_sid || rootcontext_sid || - defcontext_sid) { - rc = -EACCES; --- -2.9.3 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch new file mode 100644 index 0000000000..18c9001d0a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch @@ -0,0 +1,46 @@ +From 8d2a3c8d17cbc09d163fb636fd06684ed4c287d6 Mon Sep 17 00:00:00 2001 +From: Josh Boyer +Date: Mon, 21 Nov 2016 23:55:55 +0000 +Subject: [PATCH 01/24] efi: Add EFI_SECURE_BOOT bit + +UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit +that can be passed to efi_enabled() to find out whether secure boot is +enabled. + +This will be used by the SysRq+x handler, registered by the x86 arch, to find +out whether secure boot mode is enabled so that it can be disabled. + +Signed-off-by: Josh Boyer +Signed-off-by: David Howells +--- + arch/x86/kernel/setup.c | 1 + + include/linux/efi.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 4bf0c89..396285b 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1184,6 +1184,7 @@ void __init setup_arch(char **cmdline_p) + pr_info("Secure boot disabled\n"); + break; + case efi_secureboot_mode_enabled: ++ set_bit(EFI_SECURE_BOOT, &efi.flags); + pr_info("Secure boot enabled\n"); + break; + default: +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 94d34e0..6049600 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *); + #define EFI_DBG 8 /* Print additional debug info at runtime */ + #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ + #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ ++#define EFI_SECURE_BOOT 11 /* Are we in Secure Boot mode? */ + + #ifdef CONFIG_EFI + /* +-- +2.9.3 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch new file mode 100644 index 0000000000..cc95ed5f32 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch @@ -0,0 +1,149 @@ +From d23f58628946d89a63b5c31c52ca3eb8569d9480 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Mon, 21 Nov 2016 23:36:17 +0000 +Subject: [PATCH 02/24] Add the ability to lock down access to the running + kernel image + +Provide a single call to allow kernel code to determine whether the system +should be locked down, thereby disallowing various accesses that might +allow the running kernel image to be changed including the loading of +modules that aren't validly signed with a key we recognise, fiddling with +MSR registers and disallowing hibernation, + +Signed-off-by: David Howells +--- + include/linux/kernel.h | 9 +++++++++ + include/linux/security.h | 11 +++++++++++ + security/Kconfig | 15 +++++++++++++++ + security/Makefile | 3 +++ + security/lock_down.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 5 files changed, 78 insertions(+) + create mode 100644 security/lock_down.c + +diff --git a/include/linux/kernel.h b/include/linux/kernel.h +index 4c26dc3..b820a80 100644 +--- a/include/linux/kernel.h ++++ b/include/linux/kernel.h +@@ -275,6 +275,15 @@ extern int oops_may_print(void); + void do_exit(long error_code) __noreturn; + void complete_and_exit(struct completion *, long) __noreturn; + ++#ifdef CONFIG_LOCK_DOWN_KERNEL ++extern bool kernel_is_locked_down(void); ++#else ++static inline bool kernel_is_locked_down(void) ++{ ++ return false; ++} ++#endif ++ + /* Internal, do not use. */ + int __must_check _kstrtoul(const char *s, unsigned int base, unsigned long *res); + int __must_check _kstrtol(const char *s, unsigned int base, long *res); +diff --git a/include/linux/security.h b/include/linux/security.h +index 96899fa..5808570 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -1678,5 +1678,16 @@ static inline void free_secdata(void *secdata) + { } + #endif /* CONFIG_SECURITY */ + ++#ifdef CONFIG_LOCK_DOWN_KERNEL ++extern void lock_kernel_down(void); ++#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT ++extern void lift_kernel_lockdown(void); ++#endif ++#else ++static inline void lock_kernel_down(void) ++{ ++} ++#endif ++ + #endif /* ! __LINUX_SECURITY_H */ + +diff --git a/security/Kconfig b/security/Kconfig +index d900f47..d9b391d 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -193,6 +193,21 @@ config STATIC_USERMODEHELPER_PATH + If you wish for all usermode helper programs to be disabled, + specify an empty string here (i.e. ""). + ++config LOCK_DOWN_KERNEL ++ bool "Allow the kernel to be 'locked down'" ++ help ++ Allow the kernel to be locked down under certain circumstances, for ++ instance if UEFI secure boot is enabled. Locking down the kernel ++ turns off various features that might otherwise allow access to the ++ kernel image (eg. setting MSR registers). ++ ++config ALLOW_LOCKDOWN_LIFT ++ bool ++ help ++ Allow the lockdown on a kernel to be lifted, thereby restoring the ++ ability of userspace to access the kernel image (eg. by SysRq+x under ++ x86). ++ + source security/selinux/Kconfig + source security/smack/Kconfig + source security/tomoyo/Kconfig +diff --git a/security/Makefile b/security/Makefile +index f2d71cd..8c4a43e 100644 +--- a/security/Makefile ++++ b/security/Makefile +@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_cgroup.o + # Object integrity file lists + subdir-$(CONFIG_INTEGRITY) += integrity + obj-$(CONFIG_INTEGRITY) += integrity/ ++ ++# Allow the kernel to be locked down ++obj-$(CONFIG_LOCK_DOWN_KERNEL) += lock_down.o +diff --git a/security/lock_down.c b/security/lock_down.c +new file mode 100644 +index 0000000..5788c60 +--- /dev/null ++++ b/security/lock_down.c +@@ -0,0 +1,40 @@ ++/* Lock down the kernel ++ * ++ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#include ++#include ++ ++static __read_mostly bool kernel_locked_down; ++ ++/* ++ * Put the kernel into lock-down mode. ++ */ ++void lock_kernel_down(void) ++{ ++ kernel_locked_down = true; ++} ++ ++/* ++ * Take the kernel out of lockdown mode. ++ */ ++void lift_kernel_lockdown(void) ++{ ++ kernel_locked_down = false; ++} ++ ++/** ++ * kernel_is_locked_down - Find out if the kernel is locked down ++ */ ++bool kernel_is_locked_down(void) ++{ ++ return kernel_locked_down; ++} ++EXPORT_SYMBOL(kernel_is_locked_down); +-- +2.9.3 + diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch new file mode 100644 index 0000000000..a05b8d6121 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.11/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch @@ -0,0 +1,69 @@ +From 60416b718069a800e830593fdfb852abad37862b Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Mon, 21 Nov 2016 23:55:55 +0000 +Subject: [PATCH 03/24] efi: Lock down the kernel if booted in secure boot mode + +UEFI Secure Boot provides a mechanism for ensuring that the firmware will +only load signed bootloaders and kernels. Certain use cases may also +require that all kernel modules also be signed. Add a configuration option +that to lock down the kernel - which includes requiring validly signed +modules - if the kernel is secure-booted. + +Signed-off-by: David Howells +--- + arch/x86/Kconfig | 12 ++++++++++++ + arch/x86/kernel/setup.c | 8 +++++++- + 2 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index cc98d5a..21f3985 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1817,6 +1817,18 @@ config EFI_MIXED + + If unsure, say N. + ++config EFI_SECURE_BOOT_LOCK_DOWN ++ def_bool n ++ depends on EFI ++ prompt "Lock down the kernel when UEFI Secure Boot is enabled" ++ ---help--- ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Certain use cases may ++ also require that all kernel modules also be signed and that ++ userspace is prevented from directly changing the running kernel ++ image. Say Y here to automatically lock down the kernel when a ++ system boots with UEFI Secure Boot enabled. ++ + config SECCOMP + def_bool y + prompt "Enable seccomp to safely compute untrusted bytecode" +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 396285b..85dfa74 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -69,6 +69,7 @@ + #include + #include + #include ++#include + + #include