lkml.org 
[lkml]   [2022]   [Sep]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 1/2] powerpc/pseries: block untrusted device tree changes when locked down
Date
Paul Moore <paul@paul-moore.com> writes:
>> diff --git a/include/linux/security.h b/include/linux/security.h
>> index 7bd0c490703d..1ca8dbacd3cc 100644
>> --- a/include/linux/security.h
>> +++ b/include/linux/security.h
>> @@ -122,6 +122,7 @@ enum lockdown_reason {
>> LOCKDOWN_XMON_WR,
>> LOCKDOWN_BPF_WRITE_USER,
>> LOCKDOWN_DBG_WRITE_KERNEL,
>> + LOCKDOWN_DEVICE_TREE,
>
> I would suggest moving LOCKDOWN_DEVICE_TREE to be next to
> LOCKDOWN_ACPI_TABLES. It's not a hard requirement, but it seems like
> a nice idea to group similar things when we can.
>
>> LOCKDOWN_INTEGRITY_MAX,
>> LOCKDOWN_KCORE,
>> LOCKDOWN_KPROBES,
>> diff --git a/security/security.c b/security/security.c
>> index 4b95de24bc8d..2863fc31eec6 100644
>> --- a/security/security.c
>> +++ b/security/security.c
>> @@ -60,6 +60,7 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
>> [LOCKDOWN_XMON_WR] = "xmon write access",
>> [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",
>> [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",
>> + [LOCKDOWN_DEVICE_TREE] = "modifying device tree contents",
>
> Might as well move this one too.

Yes, I can do that for v2. Thanks.

\
 
 \ /
  Last update: 2022-09-23 18:01    [W:0.113 / U:0.752 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site