linux_dsm_epyc7002/drivers/firmware
Javier Martinez Canillas 359efcc2c9 efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN
The driver exposes EFI runtime services to user-space through an IOCTL
interface, calling the EFI services function pointers directly without
using the efivar API.

Disallow access to the /dev/efi_test character device when the kernel is
locked down to prevent arbitrary user-space to call EFI runtime services.

Also require CAP_SYS_ADMIN to open the chardev to prevent unprivileged
users to call the EFI runtime services, instead of just relying on the
chardev file mode bits for this.

The main user of this driver is the fwts [0] tool that already checks if
the effective user ID is 0 and fails otherwise. So this change shouldn't
cause any regression to this tool.

[0]: https://wiki.ubuntu.com/FirmwareTestSuite/Reference/uefivarinfo

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Acked-by: Matthew Garrett <mjg59@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: https://lkml.kernel.org/r/20191029173755.27149-7-ardb@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2019-10-31 09:40:21 +01:00
..
arm_scmi
broadcom firmware: bcm47xx_nvram: _really_ correct size_t printf format 2019-09-22 11:31:15 -07:00
efi efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN 2019-10-31 09:40:21 +01:00
google firmware: google: increment VPD key_len properly 2019-10-11 08:41:34 +02:00
imx
meson
psci
tegra
xilinx
arm_scpi.c
arm_sdei.c
dmi_scan.c firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices 2019-10-14 21:41:24 +02:00
dmi-id.c
dmi-sysfs.c
edd.c
iscsi_ibft_find.c
iscsi_ibft.c
Kconfig
Makefile
memmap.c
pcdp.c
pcdp.h
qcom_scm-32.c
qcom_scm-64.c
qcom_scm.c
qcom_scm.h
qemu_fw_cfg.c
raspberrypi.c
scpi_pm_domain.c
stratix10-rsu.c
stratix10-svc.c
ti_sci.c
ti_sci.h
trusted_foundations.c
turris-mox-rwtm.c