diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.13.10.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.14_rc7.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.13.10.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.14_rc7.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.13.10.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.14_rc7.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.13.10.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.14_rc7.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.13 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.14 similarity index 98% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.13 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.14 index 15b3e792bb..1ecd12887a 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.13 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.14 @@ -22,8 +22,6 @@ CONFIG_MEM_SOFT_DIRTY=y CONFIG_X86_CHECK_BIOS_CORRUPTION=y # CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1 -CONFIG_LOCK_DOWN_KERNEL=y -CONFIG_EFI_SECURE_BOOT_LOCK_DOWN=y CONFIG_KEXEC=y CONFIG_KEXEC_FILE=y CONFIG_KEXEC_VERIFY_SIG=y diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.13 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.14 similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.13 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.14 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.13 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.14 similarity index 99% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.13 rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.14 index a961e2ea38..4d1eb9cd1b 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.13 +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.14 @@ -187,6 +187,7 @@ CONFIG_NFT_HASH=m CONFIG_NFT_FIB_INET=m CONFIG_NFT_DUP_NETDEV=m CONFIG_NFT_FWD_NETDEV=m +CONFIG_NFT_FIB_NETDEV=m CONFIG_NF_SOCKET_IPV4=m CONFIG_NF_TABLES_IPV4=m CONFIG_NFT_CHAIN_ROUTE_IPV4=m @@ -455,7 +456,6 @@ CONFIG_CONNECTOR=m CONFIG_MTD=m CONFIG_BLK_DEV_PCIESSD_MTIP32XX=m CONFIG_ZRAM=m -CONFIG_BLK_CPQ_CISS_DA=m CONFIG_BLK_DEV_DRBD=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=m @@ -706,6 +706,7 @@ CONFIG_HWMON=m CONFIG_WATCHDOG=y CONFIG_SOFT_WATCHDOG=m CONFIG_XEN_WDT=m +# CONFIG_RC_CORE is not set CONFIG_FB=y CONFIG_FB_EFI=y CONFIG_XEN_FBDEV_FRONTEND=m @@ -861,6 +862,7 @@ CONFIG_KPROBE_EVENTS=y CONFIG_BPF_EVENTS=y CONFIG_MEMTEST=y CONFIG_SLAB_FREELIST_RANDOM=y +CONFIG_SLAB_FREELIST_HARDENED=y CONFIG_STRICT_DEVMEM=y CONFIG_IO_STRICT_DEVMEM=y CONFIG_TRUSTED_KEYS=m diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index f4d15b4dbc..6fa56fcfb0 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,2 @@ DIST linux-4.13.tar.xz 100579888 SHA256 2db3d6066c3ad93eb25b973a3d2951e022a7e975ee2fa7cbe5bddf84d9a49a2c SHA512 a557c2f0303ae618910b7106ff63d9978afddf470f03cb72aa748213e099a0ecd5f3119aea6cbd7b61df30ca6ef3ec57044d524b7babbaabddf8b08b8bafa7d2 WHIRLPOOL d3d332e02cd3c5056c76c28cf1f81504c6f7b8f2caed7238e7dd7866747fb03154b88d8d7aec4d0eddf5760624bc7d6c5485fb52a3e32d098a2742eba96c0d05 -DIST patch-4.13.10.xz 212680 SHA256 b9efa9c6375f79f6a041a5f0666d4ced1a49bfe8c4662d26517a6b4cfd9bf2f6 SHA512 634d81ea509aac5555d8d11631babe9bb04ea771c873f084cea7067313a566d5cad291b0c311002ae8d1d6dd498a93a9a43517923aa449eebb405fb4c1e34753 WHIRLPOOL f033d0bd9e6b95cdcb356a69ee4ea3054b96f991973445e94aeba664f3e91dcadd46a6c0620ad4f044503ccfa28a6deb2ed20890ef0c65b34f27a83b1847b8b1 +DIST patch-4.14-rc7.patch 51715185 SHA256 35e1f2d42c383c5796331c08a9536e2bd1604ee284ce063a41c567fa3fc582e0 SHA512 4b33b60a223359936e546498f9651f7bad21528beac404ca580ba6fd725fe6637845a80ba1079fa0cf4c6f614768d4b361e1e1b04ce7edde6dde686e623f1ed1 WHIRLPOOL e266a98b221fc84d73a3073f934137cbb077224f784f029f65a5f25108dc4ffedd5b1a548cde6f5396dec32343bd74ec97c502207b74f5b99c5dd97c06b1d334 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.13.10.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.13.10.ebuild deleted file mode 100644 index c052bee923..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.13.10.ebuild +++ /dev/null @@ -1,59 +0,0 @@ -# Copyright 2014 CoreOS, Inc. -# Distributed under the terms of the GNU General Public License v2 - -EAPI="5" -ETYPE="sources" - -# -rc releases should be versioned L.M_rcN -# Final releases should be versioned L.M.N, even for n == 0 - -# Only needed for RCs -K_BASE_VER="4.13" - -inherit kernel-2 -detect_version - -DESCRIPTION="Full sources for the CoreOS Linux kernel" -HOMEPAGE="http://www.kernel.org" -if [[ "${PV%%_rc*}" != "${PV}" ]]; then - SRC_URI="https://git.kernel.org/torvalds/p/v${KV%-coreos}/v${OKV} -> patch-${KV%-coreos}.patch ${KERNEL_BASE_URI}/linux-${OKV}.tar.xz" - PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_PATCH}" -else - SRC_URI="${KERNEL_URI}" - PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" -fi - -KEYWORDS="amd64 arm64" -IUSE="" - -# XXX: Note we must prefix the patch filenames with "z" to ensure they are -# applied _after_ a potential patch-${KV}.patch file, present when building a -# patchlevel revision. We mustn't apply our patches first, it fails when the -# local patches overlap with the upstream patch. -UNIPATCH_LIST=" - ${PATCH_DIR}/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch \ - ${PATCH_DIR}/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch \ - ${PATCH_DIR}/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch \ - ${PATCH_DIR}/z0004-Enforce-module-signatures-if-the-kernel-is-locked-do.patch \ - ${PATCH_DIR}/z0005-Restrict-dev-mem-and-dev-kmem-when-the-kernel-is-loc.patch \ - ${PATCH_DIR}/z0006-kexec-Disable-at-runtime-if-the-kernel-is-locked-dow.patch \ - ${PATCH_DIR}/z0007-Copy-secure_boot-flag-in-boot-params-across-kexec-re.patch \ - ${PATCH_DIR}/z0008-kexec_file-Disable-at-runtime-if-securelevel-has-bee.patch \ - ${PATCH_DIR}/z0009-hibernate-Disable-when-the-kernel-is-locked-down.patch \ - ${PATCH_DIR}/z0010-uswsusp-Disable-when-the-kernel-is-locked-down.patch \ - ${PATCH_DIR}/z0011-PCI-Lock-down-BAR-access-when-the-kernel-is-locked-d.patch \ - ${PATCH_DIR}/z0012-x86-Lock-down-IO-port-access-when-the-kernel-is-lock.patch \ - ${PATCH_DIR}/z0013-x86-Restrict-MSR-access-when-the-kernel-is-locked-do.patch \ - ${PATCH_DIR}/z0014-asus-wmi-Restrict-debugfs-interface-when-the-kernel-.patch \ - ${PATCH_DIR}/z0015-ACPI-Limit-access-to-custom_method-when-the-kernel-i.patch \ - ${PATCH_DIR}/z0016-acpi-Ignore-acpi_rsdp-kernel-param-when-the-kernel-h.patch \ - ${PATCH_DIR}/z0017-acpi-Disable-ACPI-table-override-if-the-kernel-is-lo.patch \ - ${PATCH_DIR}/z0018-acpi-Disable-APEI-error-injection-if-the-kernel-is-l.patch \ - ${PATCH_DIR}/z0019-bpf-Restrict-kernel-image-access-functions-when-the-.patch \ - ${PATCH_DIR}/z0020-scsi-Lock-down-the-eata-driver.patch \ - ${PATCH_DIR}/z0021-Prohibit-PCMCIA-CIS-storage-when-the-kernel-is-locke.patch \ - ${PATCH_DIR}/z0022-Lock-down-TIOCSSERIAL.patch \ - ${PATCH_DIR}/z0023-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch \ - ${PATCH_DIR}/z0024-Add-arm64-coreos-verity-hash.patch \ - ${PATCH_DIR}/z0025-cifs-Select-all-required-crypto-modules.patch \ -" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.14_rc7.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.14_rc7.ebuild new file mode 100644 index 0000000000..4585ed4836 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-4.14_rc7.ebuild @@ -0,0 +1,39 @@ +# Copyright 2014 CoreOS, Inc. +# Distributed under the terms of the GNU General Public License v2 + +EAPI="5" +ETYPE="sources" + +# -rc releases should be versioned L.M_rcN +# Final releases should be versioned L.M.N, even for N == 0 + +# Only needed for RCs +K_BASE_VER="4.13" + +# Avoid failures when an -rc patch adds a file that replaces a symlink +K_FROM_GIT=1 + +inherit kernel-2 +detect_version + +DESCRIPTION="Full sources for the CoreOS Linux kernel" +HOMEPAGE="http://www.kernel.org" +if [[ "${PV%%_rc*}" != "${PV}" ]]; then + SRC_URI="https://git.kernel.org/torvalds/p/v${KV%-coreos}/v${OKV} -> patch-${KV%-coreos}.patch ${KERNEL_BASE_URI}/linux-${OKV}.tar.xz" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_PATCH}" +else + SRC_URI="${KERNEL_URI}" + PATCH_DIR="${FILESDIR}/${KV_MAJOR}.${KV_MINOR}" +fi + +KEYWORDS="amd64 arm64" +IUSE="" + +# XXX: Note we must prefix the patch filenames with "z" to ensure they are +# applied _after_ a potential patch-${KV}.patch file, present when building a +# patchlevel revision. We mustn't apply our patches first, it fails when the +# local patches overlap with the upstream patch. +UNIPATCH_LIST=" + ${PATCH_DIR}/z0001-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch \ + ${PATCH_DIR}/z0002-Add-arm64-coreos-verity-hash.patch \ +" diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch deleted file mode 100644 index 1c6c6b5b83..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0001-efi-Add-EFI_SECURE_BOOT-bit.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 10b38041f4d82de14cbc2183c86f96bfbbff0980 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Mon, 21 Nov 2016 23:55:55 +0000 -Subject: [PATCH 01/25] efi: Add EFI_SECURE_BOOT bit - -UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit -that can be passed to efi_enabled() to find out whether secure boot is -enabled. - -This will be used by the SysRq+x handler, registered by the x86 arch, to find -out whether secure boot mode is enabled so that it can be disabled. - -Signed-off-by: Josh Boyer -Signed-off-by: David Howells ---- - arch/x86/kernel/setup.c | 1 + - include/linux/efi.h | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 3486d0498800..319995f58345 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -1190,6 +1190,7 @@ void __init setup_arch(char **cmdline_p) - pr_info("Secure boot disabled\n"); - break; - case efi_secureboot_mode_enabled: -+ set_bit(EFI_SECURE_BOOT, &efi.flags); - pr_info("Secure boot enabled\n"); - break; - default: -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 8269bcb8ccf7..7952dd3ffa73 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -1081,6 +1081,7 @@ extern int __init efi_setup_pcdp_console(char *); - #define EFI_DBG 8 /* Print additional debug info at runtime */ - #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ - #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ -+#define EFI_SECURE_BOOT 11 /* Are we in Secure Boot mode? */ - - #ifdef CONFIG_EFI - /* --- -2.14.1 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch deleted file mode 100644 index 3df68ed420..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0002-Add-the-ability-to-lock-down-access-to-the-running-k.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 5a941458bb16c1c3c5e5f9bc1311a58d952d5c9f Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Mon, 21 Nov 2016 23:36:17 +0000 -Subject: [PATCH 02/25] Add the ability to lock down access to the running - kernel image - -Provide a single call to allow kernel code to determine whether the system -should be locked down, thereby disallowing various accesses that might -allow the running kernel image to be changed including the loading of -modules that aren't validly signed with a key we recognise, fiddling with -MSR registers and disallowing hibernation, - -Signed-off-by: David Howells ---- - include/linux/kernel.h | 9 +++++++++ - include/linux/security.h | 11 +++++++++++ - security/Kconfig | 15 +++++++++++++++ - security/Makefile | 3 +++ - security/lock_down.c | 40 ++++++++++++++++++++++++++++++++++++++++ - 5 files changed, 78 insertions(+) - create mode 100644 security/lock_down.c - -diff --git a/include/linux/kernel.h b/include/linux/kernel.h -index bd6d96cf80b1..65692c80aa1a 100644 ---- a/include/linux/kernel.h -+++ b/include/linux/kernel.h -@@ -277,6 +277,15 @@ extern int oops_may_print(void); - void do_exit(long error_code) __noreturn; - void complete_and_exit(struct completion *, long) __noreturn; - -+#ifdef CONFIG_LOCK_DOWN_KERNEL -+extern bool kernel_is_locked_down(void); -+#else -+static inline bool kernel_is_locked_down(void) -+{ -+ return false; -+} -+#endif -+ - /* Internal, do not use. */ - int __must_check _kstrtoul(const char *s, unsigned int base, unsigned long *res); - int __must_check _kstrtol(const char *s, unsigned int base, long *res); -diff --git a/include/linux/security.h b/include/linux/security.h -index b6ea1dc9cc9d..834b355fa298 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -1764,5 +1764,16 @@ static inline void free_secdata(void *secdata) - { } - #endif /* CONFIG_SECURITY */ - -+#ifdef CONFIG_LOCK_DOWN_KERNEL -+extern void lock_kernel_down(void); -+#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT -+extern void lift_kernel_lockdown(void); -+#endif -+#else -+static inline void lock_kernel_down(void) -+{ -+} -+#endif -+ - #endif /* ! __LINUX_SECURITY_H */ - -diff --git a/security/Kconfig b/security/Kconfig -index e8e449444e65..1a84ed33c09a 100644 ---- a/security/Kconfig -+++ b/security/Kconfig -@@ -205,6 +205,21 @@ config STATIC_USERMODEHELPER_PATH - If you wish for all usermode helper programs to be disabled, - specify an empty string here (i.e. ""). - -+config LOCK_DOWN_KERNEL -+ bool "Allow the kernel to be 'locked down'" -+ help -+ Allow the kernel to be locked down under certain circumstances, for -+ instance if UEFI secure boot is enabled. Locking down the kernel -+ turns off various features that might otherwise allow access to the -+ kernel image (eg. setting MSR registers). -+ -+config ALLOW_LOCKDOWN_LIFT -+ bool -+ help -+ Allow the lockdown on a kernel to be lifted, thereby restoring the -+ ability of userspace to access the kernel image (eg. by SysRq+x under -+ x86). -+ - source security/selinux/Kconfig - source security/smack/Kconfig - source security/tomoyo/Kconfig -diff --git a/security/Makefile b/security/Makefile -index f2d71cdb8e19..8c4a43e3d4e0 100644 ---- a/security/Makefile -+++ b/security/Makefile -@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_cgroup.o - # Object integrity file lists - subdir-$(CONFIG_INTEGRITY) += integrity - obj-$(CONFIG_INTEGRITY) += integrity/ -+ -+# Allow the kernel to be locked down -+obj-$(CONFIG_LOCK_DOWN_KERNEL) += lock_down.o -diff --git a/security/lock_down.c b/security/lock_down.c -new file mode 100644 -index 000000000000..5788c60ff4e1 ---- /dev/null -+++ b/security/lock_down.c -@@ -0,0 +1,40 @@ -+/* Lock down the kernel -+ * -+ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. -+ * Written by David Howells (dhowells@redhat.com) -+ * -+ * This program is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU General Public Licence -+ * as published by the Free Software Foundation; either version -+ * 2 of the Licence, or (at your option) any later version. -+ */ -+ -+#include -+#include -+ -+static __read_mostly bool kernel_locked_down; -+ -+/* -+ * Put the kernel into lock-down mode. -+ */ -+void lock_kernel_down(void) -+{ -+ kernel_locked_down = true; -+} -+ -+/* -+ * Take the kernel out of lockdown mode. -+ */ -+void lift_kernel_lockdown(void) -+{ -+ kernel_locked_down = false; -+} -+ -+/** -+ * kernel_is_locked_down - Find out if the kernel is locked down -+ */ -+bool kernel_is_locked_down(void) -+{ -+ return kernel_locked_down; -+} -+EXPORT_SYMBOL(kernel_is_locked_down); --- -2.14.1 - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch deleted file mode 100644 index d3e4b49f1f..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.13/z0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 56f553942d8b99fe5eff6e329cc6844cbb6ee4b7 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Mon, 21 Nov 2016 23:55:55 +0000 -Subject: [PATCH 03/25] efi: Lock down the kernel if booted in secure boot mode - -UEFI Secure Boot provides a mechanism for ensuring that the firmware will -only load signed bootloaders and kernels. Certain use cases may also -require that all kernel modules also be signed. Add a configuration option -that to lock down the kernel - which includes requiring validly signed -modules - if the kernel is secure-booted. - -Signed-off-by: David Howells ---- - arch/x86/Kconfig | 12 ++++++++++++ - arch/x86/kernel/setup.c | 8 +++++++- - 2 files changed, 19 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 323cb065be5e..8e41d54d6498 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1836,6 +1836,18 @@ config EFI_MIXED - - If unsure, say N. - -+config EFI_SECURE_BOOT_LOCK_DOWN -+ def_bool n -+ depends on EFI -+ prompt "Lock down the kernel when UEFI Secure Boot is enabled" -+ ---help--- -+ UEFI Secure Boot provides a mechanism for ensuring that the firmware -+ will only load signed bootloaders and kernels. Certain use cases may -+ also require that all kernel modules also be signed and that -+ userspace is prevented from directly changing the running kernel -+ image. Say Y here to automatically lock down the kernel when a -+ system boots with UEFI Secure Boot enabled. -+ - config SECCOMP - def_bool y - prompt "Enable seccomp to safely compute untrusted bytecode" -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 319995f58345..d0128aef43ce 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -69,6 +69,7 @@ - #include - #include - #include -+#include - - #include - #include