From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757467Ab2IDQRJ (ORCPT ); Tue, 4 Sep 2012 12:17:09 -0400 Received: from mx1.redhat.com ([209.132.183.28]:25621 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757376Ab2IDQRF (ORCPT ); Tue, 4 Sep 2012 12:17:05 -0400 From: Matthew Garrett To: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org, Josh Boyer Subject: [PATCH 10/11] acpi: Ignore acpi_rsdp kernel parameter in a secure boot environment Date: Tue, 4 Sep 2012 11:55:16 -0400 Message-Id: <1346774117-2277-11-git-send-email-mjg@redhat.com> In-Reply-To: <1346774117-2277-1-git-send-email-mjg@redhat.com> References: <1346774117-2277-1-git-send-email-mjg@redhat.com> X-SA-Do-Not-Run: Yes X-SA-Exim-Connect-IP: 66.187.233.206 X-SA-Exim-Mail-From: mjg@redhat.com X-SA-Exim-Scanned: No (on cavan.codon.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Josh Boyer This option allows userspace to pass the RSDP address to the kernel. This could potentially be used to circumvent the secure boot trust model. We ignore the setting if we don't have the CAP_SECURE_FIRMWARE capability. Signed-off-by: Josh Boyer --- drivers/acpi/osl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c index 9eaf708..50c94e4 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -246,7 +246,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp); acpi_physical_address __init acpi_os_get_root_pointer(void) { #ifdef CONFIG_KEXEC - if (acpi_rsdp) + if (acpi_rsdp && capable(CAP_SECURE_FIRMWARE)) return acpi_rsdp; #endif -- 1.7.11.4