Commit 1957a85b authored Aug 19, 2019 by Matthew Garrett Committed by James Morris Aug 19, 2019

efi: Restrict efivar_ssdt_load when the kernel is locked down



efivar_ssdt_load allows the kernel to import arbitrary ACPI code from an
EFI variable, which gives arbitrary code execution in ring 0. Prevent
that when the kernel is locked down.

Signed-off-by: Matthew Garrett <mjg59@google.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: linux-efi@vger.kernel.org
Signed-off-by: James Morris <jmorris@namei.org>

parent ccbd54ff

drivers/firmware/efi/efi.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -30,6 +30,7 @@
		#include <linux/acpi.h>
		#include <linux/ucs2_string.h>
		#include <linux/memblock.h>
		#include <linux/security.h>

		#include <asm/early_ioremap.h>

		@@ -241,6 +242,11 @@ static void generic_ops_unregister(void)
		static char efivar_ssdt[EFIVAR_SSDT_NAME_MAX] __initdata;
		static int __init efivar_ssdt_setup(char *str)
		{
		int ret = security_locked_down(LOCKDOWN_ACPI_TABLES);

		if (ret)
		return ret;

		if (strlen(str) < sizeof(efivar_ssdt))
		memcpy(efivar_ssdt, str, strlen(str));
		else

Admin message