duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
885,232 Commits 2 Branches 0 Tags
5831de32812df6b16d5534a274cb3aaa37e83708
Commit Graph
3 Commits
Author SHA1 Message Date
Jeremy Cline ca96925dfb BACKPORT: lockdown: Allow unprivileged users to see lockdown status 
A number of userspace tools, such as systemtap, need a way to see the
current lockdown state so they can gracefully deal with the kernel being
locked down. The state is already exposed in
/sys/kernel/security/lockdown, but is only readable by root. Adjust the
permissions so unprivileged users can read the state.

Fixes: 000d388ed3bb ("security: Add a static lockdown policy LSM")
Cc: Frank Ch. Eigler <fche@redhat.com>
Change-Id: I9eb77e97933780ec1e5f1656e135c171deccd8e7
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
 2025-09-08 01:35:16 -04:00
David Howells 8a267657ef BACKPORT: bpf: Restrict bpf when kernel lockdown is in confidentiality mode 
bpf_read() and bpf_read_str() could potentially be abused to (eg) allow
private keys in kernel memory to be leaked. Disable them if the kernel
has been locked down in confidentiality mode.

Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Change-Id: Ie8ed3a29a9fb45408405d77af223e6d358ff0890
Signed-off-by: Matthew Garrett <mjg59@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
cc: netdev@vger.kernel.org
cc: Chun-Yi Lee <jlee@suse.com>
cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: James Morris <jmorris@namei.org>
 2025-09-08 01:35:13 -04:00
Matthew Garrett 93df2d6990 BACKPORT: security: Add a static lockdown policy LSM 
While existing LSMs can be extended to handle lockdown policy,
distributions generally want to be able to apply a straightforward
static policy. This patch adds a simple LSM that can be configured to
reject either integrity or all lockdown queries, and can be configured
at runtime (through securityfs), boot time (via a kernel parameter) or
build time (via a kconfig option). Based on initial code by David
Howells.

Change-Id: I8d5769f550ee98d0482202aca9b7f1ade0c0d5a4
Signed-off-by: Matthew Garrett <mjg59@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
 2025-08-28 03:29:03 +03:00