fs/kernel_read_file: Remove FIRMWARE_EFI_EMBEDDED enum (06e67b84) · Commits · 戴 / test

The "FIRMWARE_EFI_EMBEDDED" enum is a "where", not a "what". It should not be distinguished separately from just "FIRMWARE", as this confuses the LSMs about what is being loaded. Additionally, there was no actual validation of the firmware contents happening. Fixes: ("firmware: Add new platform fallback mechanism and firmware_request_platform()") Signed-off-by:

Kees Cook <keescook@chromium.org> Reviewed-by:

Luis Chamberlain <mcgrof@kernel.org> Acked-by:

Scott Branden <scott.branden@broadcom.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20201002173828.2099543-3-keescook@chromium.org Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/base/firmware_loader/fallback_platform.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -17,7 +17,7 @@ int firmware_fallback_platform(struct fw_priv *fw_priv, u32 opt_flags)
		if (!(opt_flags & FW_OPT_FALLBACK_PLATFORM))
		return -ENOENT;

		rc = security_kernel_load_data(LOADING_FIRMWARE_EFI_EMBEDDED);
		rc = security_kernel_load_data(LOADING_FIRMWARE);
		if (rc)
		return rc;

include/linux/fs.h

+1 −2

Original line number	Diff line number	Diff line
		@@ -2858,11 +2858,10 @@ static inline void i_readcount_inc(struct inode *inode)
		#endif
		extern int do_pipe_flags(int *, int);

		/* This is a list of what is being read, not how. */
		/* This is a list of what is being read, not how nor where. */
		#define __kernel_read_file_id(id) \
		id(UNKNOWN, unknown) \
		id(FIRMWARE, firmware) \
		id(FIRMWARE_EFI_EMBEDDED, firmware) \
		id(MODULE, kernel-module) \
		id(KEXEC_IMAGE, kexec-image) \
		id(KEXEC_INITRAMFS, kexec-initramfs) \

Admin message