Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f19cad3 authored by David Howells's avatar David Howells Committed by James Morris
Browse files

lockdown: Prohibit PCMCIA CIS storage when the kernel is locked down 



Prohibit replacement of the PCMCIA Card Information Structure when the
kernel is locked down.

Suggested-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarMatthew Garrett <mjg59@google.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 6ea0e815

drivers/pcmcia/cistpl.c

+5 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
#include <linux/pci.h>

#include <linux/ioport.h>

#include <linux/io.h>

#include <linux/security.h>

#include <asm/byteorder.h>

#include <asm/unaligned.h>
@@ -1575,6 +1576,10 @@ static ssize_t pccard_store_cis(struct file *filp, struct kobject *kobj, 
	struct pcmcia_socket *s;

	int error;



	error = security_locked_down(LOCKDOWN_PCMCIA_CIS);

	if (error)

		return error;



	s = to_socket(container_of(kobj, struct device, kobj));



	if (off)

include/linux/security.h

+1 −0
Original line number Diff line number Diff line
@@ -111,6 +111,7 @@ enum lockdown_reason { 
	LOCKDOWN_IOPORT,

	LOCKDOWN_MSR,

	LOCKDOWN_ACPI_TABLES,

	LOCKDOWN_PCMCIA_CIS,

	LOCKDOWN_INTEGRITY_MAX,

	LOCKDOWN_CONFIDENTIALITY_MAX,

};

security/lockdown/lockdown.c

+1 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { 
	[LOCKDOWN_IOPORT] = "raw io port access",

	[LOCKDOWN_MSR] = "raw MSR access",

	[LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables",

	[LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage",

	[LOCKDOWN_INTEGRITY_MAX] = "integrity",

	[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",

};