mbox series

[v2,0/2] powerpc/pseries: restrict error injection and DT changes when locked down

Message ID 20220926131643.146502-1-nathanl@linux.ibm.com (mailing list archive)
Headers show
Series powerpc/pseries: restrict error injection and DT changes when locked down | expand

Message

Nathan Lynch Sept. 26, 2022, 1:16 p.m. UTC 
Add two new lockdown reasons for use in powerpc's pseries platform
code.

The pseries platform allows hardware-level error injection via certain
calls to the RTAS (Run Time Abstraction Services) firmware. ACPI-based
error injection is already restricted in lockdown; this facility
should be restricted for the same reasons.

pseries also allows nearly arbitrary device tree changes via
/proc/powerpc/ofdt. Just as overriding ACPI tables is not allowed
while locked down, so should this facility be restricted.

Changes since v1:
* Move LOCKDOWN_DEVICE_TREE next to LOCKDOWN_ACPI_TABLES.

Nathan Lynch (2):
  powerpc/pseries: block untrusted device tree changes when locked down
  powerpc/rtas: block error injection when locked down

 arch/powerpc/kernel/rtas.c                | 25 ++++++++++++++++++++++-
 arch/powerpc/platforms/pseries/reconfig.c |  5 +++++
 include/linux/security.h                  |  2 ++
 security/security.c                       |  2 ++
 4 files changed, 33 insertions(+), 1 deletion(-)

Comments

Michael Ellerman Oct. 4, 2022, 1:25 p.m. UTC | #1 
On Mon, 26 Sep 2022 08:16:41 -0500, Nathan Lynch wrote:
> Add two new lockdown reasons for use in powerpc's pseries platform
> code.
> 
> The pseries platform allows hardware-level error injection via certain
> calls to the RTAS (Run Time Abstraction Services) firmware. ACPI-based
> error injection is already restricted in lockdown; this facility
> should be restricted for the same reasons.
> 
> [...]

Applied to powerpc/next.

[1/2] powerpc/pseries: block untrusted device tree changes when locked down
      https://git.kernel.org/powerpc/c/99df7a2810b6d24651d4887ab61a142e042fb235
[2/2] powerpc/rtas: block error injection when locked down
      https://git.kernel.org/powerpc/c/b8f3e48834fe8c86b4f21739c6effd160e2c2c19

cheers