Received: by 2002:a25:8b12:0:0:0:0:0 with SMTP id i18csp3354102ybl; Mon, 19 Aug 2019 17:20:41 -0700 (PDT) X-Google-Smtp-Source: APXvYqzu0tSiBe5ubltLcOYc7toUZfksi+b5rHc4n8qLKKVm2qcJaA9hwgFrWVjYWTPcBaoU+gAY X-Received: by 2002:a17:902:7c8a:: with SMTP id y10mr24907609pll.65.1566260441015; Mon, 19 Aug 2019 17:20:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1566260441; cv=none; d=google.com; s=arc-20160816; b=f5HQpnrjVtDbaNCrE3QBOr8dqTqWADfYeiBQ/j54VAwB4MW1qmQRqVJby+e7wBEqst /FIbSIe8yzgXltTVMq5jyJgA8cBC8FAhus8wSlYtGXeC/UV+nK2Z4lBetBb5Bo5iGpW0 MQt4taPTM+i4X2X0xHIFIM6I0RgTactr6PYm9fagdIp0a8bEbNmpvtXpcmE9c/OWUjVZ u/x4Ex6sR72/W0Z2B2UuyTCXqe3dPEFWpgoAr+TqVfnyEBDqnXm80dd3dz4O8mNB2OeW hMfHl7/QrNAgyZ3+dy+5quC2CVrGNHDVYh6bo6o3Pzfa8f0s/TI7IvHKncKSRKzhEhl4 +IIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:from:subject:references :mime-version:message-id:in-reply-to:date:dkim-signature; bh=r2xGnC0FtOlmxcR7U4lP7p0O5/wEeWW3Rzosx6HPL/8=; b=SnwgIQ0jiLkE/gG+Vr8CCidoSwOkN5vE6Ht3YY0VaqCHmO1XOpvoLfM7YB/HTGtyeJ 2Ykknj4BU6gfi5NnZAjBM6piRW72mKcA2L+ykgajzK7BxbmByWdtN418QGZ89/7tOHR2 2E7gIro0CKoi3dZhtkxR0JCBeil7Z98g7JBJUIpdgXEaVjwWQ0+4etjqWi8sUMbnkn00 dgnti5uhCpaJGkN/dDLgBqrpEhyP5NO0LvdCgTqBsXEqdBtH3qyI4S6ctgYdcZifRejD dSRkl6NVzeh9sglt8owy8uvjaTiOlEb7/vd0WL5PosfJm53T/qfbSuG1TdzlHUUEFiiA lB+g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=JXk7YvHu; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c11si11469515pfd.165.2019.08.19.17.20.26; Mon, 19 Aug 2019 17:20:41 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=JXk7YvHu; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729085AbfHTASy (ORCPT + 99 others); Mon, 19 Aug 2019 20:18:54 -0400 Received: from mail-pl1-f201.google.com ([209.85.214.201]:44182 "EHLO mail-pl1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729075AbfHTASw (ORCPT ); Mon, 19 Aug 2019 20:18:52 -0400 Received: by mail-pl1-f201.google.com with SMTP id t2so2936202plq.11 for ; Mon, 19 Aug 2019 17:18:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=r2xGnC0FtOlmxcR7U4lP7p0O5/wEeWW3Rzosx6HPL/8=; b=JXk7YvHu8uy9Vx2jXXzyKER+S/SWTrnD/83LRDR4ElsTuqbjh18fiB1AgcrqZ1ZtIF dMLq3zzoXUE6dXGuKvPut+6ATWyGRbKYpJQIWJjwFu6Tktlm4+khhBMdXLh/0OqWlkJD h3VT2eyE0HfHclqvuDTTYe++NSkz3ZXZS/oEfZAVPh9H+VGFEqFJWQTLj/AGb6qRW153 dVTBXGCk+4jZcyzl7B6lYmE2JFLT24V4zbxfcymtMySEfGel9M+ifHbgb0XkoBrbcMve Smv1XxFiTFUE/g7rS3PzrYA0UBMXXLGMKnG7YB3ziODgQiU6yzj6lIxTEPV4wJpLoQRH +Brg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=r2xGnC0FtOlmxcR7U4lP7p0O5/wEeWW3Rzosx6HPL/8=; b=Pr8r2Vi9L5nBTj8oQreyCJIbCFKlJUqzUtv1OIg7x8HBHp0G7hy9i53LgZJ3ObKdn+ fBJVqVZT0uksWqzyHY9zOrV3zIY/n0QM7ALhwtFOEMLeDa4Ouh3SrDeOqBVWV7dqW4+y V+0GfnGvIaODcu8OwY2/MfnmtslghE/DORVqYcTFkaPbawOO+dKe0ojEwd/+fuSDvQFh KEbi+vMI8+SH1gboJSiFvmrnwORCJp+mQlL0IyYW562RLGOHNLoaQVh759xebGNEcK+T mxtpmGlg2i3MQcyhRyPJFPX588L7Wam/nEWv/fON7YfIDIoRqGNJy2Q3EMwmkpNVUJQK ptEQ== X-Gm-Message-State: APjAAAXmm+uX8PJaVwXPbNEdw6CYF89LiE/ZwmZJWe/nZGmxqHJYjvpl h+H8bEMUOkAa6XJxPw5BwhC/DCUZd+aWso1hrimRZg== X-Received: by 2002:a65:56c1:: with SMTP id w1mr21932176pgs.395.1566260331657; Mon, 19 Aug 2019 17:18:51 -0700 (PDT) Date: Mon, 19 Aug 2019 17:17:52 -0700 In-Reply-To: <20190820001805.241928-1-matthewgarrett@google.com> Message-Id: <20190820001805.241928-17-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190820001805.241928-1-matthewgarrett@google.com> X-Mailer: git-send-email 2.23.0.rc1.153.gdeed80330f-goog Subject: [PATCH V40 16/29] acpi: Disable ACPI table override if the kernel is locked down From: Matthew Garrett To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Linn Crosetto , David Howells , Matthew Garrett , Kees Cook , linux-acpi@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linn Crosetto >From the kernel documentation (initrd_table_override.txt): If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible to override nearly any ACPI table provided by the BIOS with an instrumented, modified one. When lockdown is enabled, the kernel should disallow any unauthenticated changes to kernel space. ACPI tables contain code invoked by the kernel, so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook cc: linux-acpi@vger.kernel.org Signed-off-by: James Morris --- drivers/acpi/tables.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c index de974322a197..b7c29a11c0c1 100644 --- a/drivers/acpi/tables.c +++ b/drivers/acpi/tables.c @@ -20,6 +20,7 @@ #include #include #include +#include #include "internal.h" #ifdef CONFIG_ACPI_CUSTOM_DSDT @@ -577,6 +578,11 @@ void __init acpi_table_upgrade(void) if (table_nr == 0) return; + if (security_locked_down(LOCKDOWN_ACPI_TABLES)) { + pr_notice("kernel is locked down, ignoring table override\n"); + return; + } + acpi_tables_addr = memblock_find_in_range(0, ACPI_TABLE_UPGRADE_MAX_PHYS, all_tables_size, PAGE_SIZE); -- 2.23.0.rc1.153.gdeed80330f-goog