diff options
Diffstat (limited to 'drivers/acpi')
| -rw-r--r-- | drivers/acpi/custom_method.c | 6 | ||||
| -rw-r--r-- | drivers/acpi/osl.c | 14 | ||||
| -rw-r--r-- | drivers/acpi/tables.c | 6 |
3 files changed, 25 insertions, 1 deletions
diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c index fd66a736621c..b097ef209313 100644 --- a/drivers/acpi/custom_method.c +++ b/drivers/acpi/custom_method.c @@ -9,6 +9,7 @@ #include <linux/uaccess.h> #include <linux/debugfs.h> #include <linux/acpi.h> +#include <linux/security.h> #include "internal.h" @@ -29,6 +30,11 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, struct acpi_table_header table; acpi_status status; + int ret; + + ret = security_locked_down(LOCKDOWN_ACPI_TABLES); + if (ret) + return ret; if (!(*ppos)) { /* parse the table header to get the table length */ diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 2f9d0d20b836..a2e844a8e9ed 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -27,6 +27,7 @@ #include <linux/list.h> #include <linux/jiffies.h> #include <linux/semaphore.h> +#include <linux/security.h> #include <asm/io.h> #include <linux/uaccess.h> @@ -182,8 +183,19 @@ acpi_physical_address __init acpi_os_get_root_pointer(void) acpi_physical_address pa; #ifdef CONFIG_KEXEC - if (acpi_rsdp) + /* + * We may have been provided with an RSDP on the command line, + * but if a malicious user has done so they may be pointing us + * at modified ACPI tables that could alter kernel behaviour - + * so, we check the lockdown status before making use of + * it. If we trust it then also stash it in an architecture + * specific location (if appropriate) so it can be carried + * over further kexec()s. + */ + if (acpi_rsdp && !security_locked_down(LOCKDOWN_ACPI_TABLES)) { + acpi_arch_set_root_pointer(acpi_rsdp); return acpi_rsdp; + } #endif pa = acpi_arch_get_root_pointer(); if (pa) diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c index b32327759380..180ac4329763 100644 --- a/drivers/acpi/tables.c +++ b/drivers/acpi/tables.c @@ -20,6 +20,7 @@ #include <linux/memblock.h> #include <linux/earlycpio.h> #include <linux/initrd.h> +#include <linux/security.h> #include "internal.h" #ifdef CONFIG_ACPI_CUSTOM_DSDT @@ -578,6 +579,11 @@ void __init acpi_table_upgrade(void) if (table_nr == 0) return; + if (security_locked_down(LOCKDOWN_ACPI_TABLES)) { + pr_notice("kernel is locked down, ignoring table override\n"); + return; + } + acpi_tables_addr = memblock_find_in_range(0, ACPI_TABLE_UPGRADE_MAX_PHYS, all_tables_size, PAGE_SIZE); |