[V40,00/29] Add kernel lockdown functionality

Message ID	20190820001805.241928-1-matthewgarrett@google.com (mailing list archive)
Headers	show Return-Path: <SRS0=y35J=WQ=vger.kernel.org=linux-security-module-owner@kernel.org> Date: Mon, 19 Aug 2019 17:17:36 -0700 Message-Id: <20190820001805.241928-1-matthewgarrett@google.com> Mime-Version: 1.0 Subject: [PATCH V40 00/29] Add kernel lockdown functionality From: Matthew Garrett <matthewgarrett@google.com> To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk
Series	Add kernel lockdown functionality \| expand [V40,00/29] Add kernel lockdown functionality [V40,01/29] security: Support early LSMs [V40,02/29] security: Add a "locked down" LSM hook [V40,03/29] security: Add a static lockdown policy LSM [V40,04/29] lockdown: Enforce module signatures if the kernel is locked down [V40,05/29] lockdown: Restrict /dev/{mem,kmem,port} when the kernel is locked down [V40,06/29] kexec_load: Disable at runtime if the kernel is locked down [V40,07/29] lockdown: Copy secure_boot flag in boot params across kexec reboot [V40,08/29] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE [V40,09/29] kexec_file: Restrict at runtime if the kernel is locked down [V40,10/29] hibernate: Disable when the kernel is locked down [V40,11/29] PCI: Lock down BAR access when the kernel is locked down [V40,12/29] x86: Lock down IO port access when the kernel is locked down [V40,13/29] x86/msr: Restrict MSR access when the kernel is locked down [V40,14/29] ACPI: Limit access to custom_method when the kernel is locked down [V40,15/29] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down [V40,16/29] acpi: Disable ACPI table override if the kernel is locked down [V40,17/29] lockdown: Prohibit PCMCIA CIS storage when the kernel is locked down [V40,18/29] lockdown: Lock down TIOCSSERIAL [V40,19/29] lockdown: Lock down module params that specify hardware parameters (eg. ioport) [V40,20/29] x86/mmiotrace: Lock down the testmmiotrace module [V40,21/29] lockdown: Lock down /proc/kcore [V40,22/29] lockdown: Lock down tracing and perf kprobes when in confidentiality mode [V40,23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode [V40,24/29] lockdown: Lock down perf when in confidentiality mode [V40,25/29] kexec: Allow kexec_file() with appropriate IMA policy when locked down [V40,26/29] debugfs: Restrict debugfs when the kernel is locked down [V40,27/29] tracefs: Restrict tracefs when the kernel is locked down [V40,28/29] efi: Restrict efivar_ssdt_load when the kernel is locked down [V40,29/29] lockdown: Print current->comm in restriction messages

Message ID

20190820001805.241928-1-matthewgarrett@google.com (mailing list archive)

Headers

Date: Mon, 19 Aug 2019 17:17:36 -0700
Message-Id: <20190820001805.241928-1-matthewgarrett@google.com>
Mime-Version: 1.0
Subject: [PATCH V40 00/29] Add kernel lockdown functionality
From: Matthew Garrett <matthewgarrett@google.com>
To: jmorris@namei.org
Cc: linux-security-module@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-api@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Sender: owner-linux-security-module@vger.kernel.org
Precedence: bulk

Series

Add kernel lockdown functionality | expand

Message

Matthew Garrett Aug. 20, 2019, 12:17 a.m. UTC

After chatting with James in person, I'm resending the full set with the
fixes merged in in order to avoid any bisect issues. There should be no
functional changes other than avoiding build failures with some configs,
and fixing the oops in tracefs.

Comments

James Morris Aug. 20, 2019, 6:45 a.m. UTC | #1

On Mon, 19 Aug 2019, Matthew Garrett wrote:

> After chatting with James in person, I'm resending the full set with the
> fixes merged in in order to avoid any bisect issues. There should be no
> functional changes other than avoiding build failures with some configs,
> and fixing the oops in tracefs.

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-lockdown
and next-testing

Thanks!