Messages in this thread | | | From | Nathan Lynch <> | Subject | Re: [PATCH 1/2] powerpc/pseries: block untrusted device tree changes when locked down | Date | Fri, 23 Sep 2022 10:58:33 -0500 |
| |
Paul Moore <paul@paul-moore.com> writes: >> diff --git a/include/linux/security.h b/include/linux/security.h >> index 7bd0c490703d..1ca8dbacd3cc 100644 >> --- a/include/linux/security.h >> +++ b/include/linux/security.h >> @@ -122,6 +122,7 @@ enum lockdown_reason { >> LOCKDOWN_XMON_WR, >> LOCKDOWN_BPF_WRITE_USER, >> LOCKDOWN_DBG_WRITE_KERNEL, >> + LOCKDOWN_DEVICE_TREE, > > I would suggest moving LOCKDOWN_DEVICE_TREE to be next to > LOCKDOWN_ACPI_TABLES. It's not a hard requirement, but it seems like > a nice idea to group similar things when we can. > >> LOCKDOWN_INTEGRITY_MAX, >> LOCKDOWN_KCORE, >> LOCKDOWN_KPROBES, >> diff --git a/security/security.c b/security/security.c >> index 4b95de24bc8d..2863fc31eec6 100644 >> --- a/security/security.c >> +++ b/security/security.c >> @@ -60,6 +60,7 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { >> [LOCKDOWN_XMON_WR] = "xmon write access", >> [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", >> [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", >> + [LOCKDOWN_DEVICE_TREE] = "modifying device tree contents", > > Might as well move this one too.
Yes, I can do that for v2. Thanks.
| |