From patchwork Tue Sep 10 10:03:17 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 11139141 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A96301395 for ; Tue, 10 Sep 2019 10:03:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8724520863 for ; Tue, 10 Sep 2019 10:03:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="H9a4A105" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405583AbfIJKDe (ORCPT ); Tue, 10 Sep 2019 06:03:34 -0400 Received: from mail-pg1-f201.google.com ([209.85.215.201]:46006 "EHLO mail-pg1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405459AbfIJKD0 (ORCPT ); Tue, 10 Sep 2019 06:03:26 -0400 Received: by mail-pg1-f201.google.com with SMTP id i12so10335401pgm.12 for ; Tue, 10 Sep 2019 03:03:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=sGqYubR5Lthr7yxzMgwTRpMO66aeWf2qCN8tGk0FHOg=; b=H9a4A105QMmIT8qtxtAQb/NY2MEr1GOUe/9IKXYp1yvFWHSfAlO7CBzcQZRfYWqncZ ZxjG2BQdBexz3OJ4rQ18i+Tdc3DAR0KN3k1p2m17MRcZgGQGgZz5/r8Hh6ucuKYTFsIi fkb8CbJOBYh5MchJNUxddQmx01y0IRBgwhn9w7/i/8qNC3CBTrlV1D1ve6Q/DDPIurib yxPmoPvNIBTWUXkW4bGU99MVYfLii9je1nMATSauAG/U7ocCXMNyfCM+zbtllmDkLzGg do7yLqBRV4AxHkpxALJqAc8OwbG2kROF+aQt44aAwQhK2tgyyCAquB/tOVTRHxvF3hM2 vuCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=sGqYubR5Lthr7yxzMgwTRpMO66aeWf2qCN8tGk0FHOg=; b=Pu5UHTsPCaJ7p4sDrP62HP+mkm89DQ/AJTz0NM5IPKwvcFHHe1dhjieh/jZ9DFkoMH ZAeixaRiHS3qH3/g9dcmymBi7p+Oalv7IZ6XvXwz1Bo6RjJv7zRvEV7lXFDIYmLPSj6u adE4n1qfAEY1cvCaC+7HBp+/ly8mWQTsykKsWzj4cAM0I1hyN1bmz+6xMBEpisRU2ubq 5YkbrnLCAKSwquc0wJmD4hVhMeIoSNUnE9Vhg7UF0NSYbh/Wk6rvaFDdpnOhtOLHm1Ys ZXCRmbKHFIngo2uF1QOkvzQnwPWFj5qAWGArbtJXzYyfxI5+Ms5OADnoa2JPV8IUjkDs ZMVA== X-Gm-Message-State: APjAAAUOS/ULRhi50ztDmU7lYEh+FpvWW8xdFZqrGthS2sHEC5V87sZl Jt/gnm95ZAmULRvtr7JvVpdWLC3KjVT3xyUCAabI3g== X-Google-Smtp-Source: APXvYqzM05C6SE3TotMj3/meUIyoGC4bBZZMU7jv39OiAWQEeQWjMdLKgYPvcwQT8uU2wIK6u/jlz3kmMv7mFo/bmMBTvg== X-Received: by 2002:a65:6850:: with SMTP id q16mr27663278pgt.423.1568109805751; Tue, 10 Sep 2019 03:03:25 -0700 (PDT) Date: Tue, 10 Sep 2019 03:03:17 -0700 In-Reply-To: <20190910100318.204420-1-matthewgarrett@google.com> Message-Id: <20190910100318.204420-2-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190910100318.204420-1-matthewgarrett@google.com> X-Mailer: git-send-email 2.23.0.162.g0b9fbb3734-goog Subject: [PATCH 1/2] security: constify some arrays in lockdown LSM From: Matthew Garrett To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Matthew Garrett , Matthew Garrett , David Howells Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: No reason for these not to be const. Signed-off-by: Matthew Garrett Suggested-by: David Howells --- security/lockdown/lockdown.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index 0068cec77c05..8a10b43daf74 100644 --- a/security/lockdown/lockdown.c +++ b/security/lockdown/lockdown.c @@ -16,7 +16,7 @@ static enum lockdown_reason kernel_locked_down; -static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { +static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_NONE] = "none", [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", @@ -40,7 +40,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", }; -static enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, +static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_CONFIDENTIALITY_MAX}; From patchwork Tue Sep 10 10:03:18 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 11139139 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9FDA976 for ; Tue, 10 Sep 2019 10:03:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7E0F22067B for ; Tue, 10 Sep 2019 10:03:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="VS1WLrah" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405552AbfIJKD3 (ORCPT ); Tue, 10 Sep 2019 06:03:29 -0400 Received: from mail-pl1-f202.google.com ([209.85.214.202]:52844 "EHLO mail-pl1-f202.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405546AbfIJKD3 (ORCPT ); Tue, 10 Sep 2019 06:03:29 -0400 Received: by mail-pl1-f202.google.com with SMTP id v22so9524498ply.19 for ; Tue, 10 Sep 2019 03:03:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=bv5qoXxIm9QGTQUTxQOHCsSBy/Qj7ow+gIETe7B67Bk=; b=VS1WLrahvCRQTVPhrnh5NGtHefwOtMvCg1ehhBF6kQbjUks8gmIIHPTZiKlEzV5kxf GSILG6mOciwN7+TJw5Co4LVGFi5qK0QFAnE2m94COxwsfWZir8BcWl7qnooghwCvC2KW OrHCyqdAdw5Xn2p41aI6DRFF9qEKIfxrrip4grVq+YprBXZRDHq1v+BZhFfNqQZtGSU+ MkTlOeSBfr1cmhliquwIJ1pSR72yuSao+a+Zeq7PDymvA1puCgUON+MjGbsFRIL7AKOB E2iQY+CsmctLt4DRgLWOU7nbzJNZo8Bprv0UoMEbGpfMu7q4jsa5cwb+eRL9UwxhaoQe RThg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=bv5qoXxIm9QGTQUTxQOHCsSBy/Qj7ow+gIETe7B67Bk=; b=XJx8kHfjhyIhHNrefE5s41xUY9MjUFJGXoIl3pF7saJrRql9xtcR2LykfB+9AfpaA6 ZecUB8kxKoaVwToPOn3v5elS5IFqDvaDse52hSkRkGXOmAcKB7CB8eZ+d2wKa9VZllVz YJ+BNB4PMfpA1PIDs74n07NaYEvWJV2fHmnRFdvPaQrYWn59z1u4rWRFEpGTo8ePs07N xKDYFAISqpRWUd0J0D7nIRA0yjUpZ9S+zgo3nCsAFBJ02WDdKwWORM+cT2GZgz1l7yrw +0acZ8y/kPNLzMRLv/ivKDUmWvX3GcJGNOkIaoO+W1WlhX1a2tYxPxpT4xwKTMMhJOau TASQ== X-Gm-Message-State: APjAAAULEyliDyr++Oi1KedIhpNBM7xWNstUstLgnEYs2k5x0Z1l3Kaf sY9/2NjUmUrwAu1Dc4HAxYvwTL94BpL9y7KkVNciww== X-Google-Smtp-Source: APXvYqx8cHOYdn1JFbj+lJuVOsHB+4rC9cO4yzh0N7mo38wEIqxIpOO3PrkduWZWmrxebAtj1X8l6jj829HaWpjFrxVRmg== X-Received: by 2002:a63:394:: with SMTP id 142mr27066827pgd.43.1568109808362; Tue, 10 Sep 2019 03:03:28 -0700 (PDT) Date: Tue, 10 Sep 2019 03:03:18 -0700 In-Reply-To: <20190910100318.204420-1-matthewgarrett@google.com> Message-Id: <20190910100318.204420-3-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190910100318.204420-1-matthewgarrett@google.com> X-Mailer: git-send-email 2.23.0.162.g0b9fbb3734-goog Subject: [PATCH 2/2] kexec: Fix file verification on S390 From: Matthew Garrett To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, Matthew Garrett , Matthew Garrett , Philipp Rudo Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: I accidentally typoed this #ifdef, so verification would always be disabled. Signed-off-by: Matthew Garrett Reported-by: Philipp Rudo --- arch/s390/kernel/kexec_elf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kernel/kexec_elf.c b/arch/s390/kernel/kexec_elf.c index 9b4f37a4edf1..9da6fa30c447 100644 --- a/arch/s390/kernel/kexec_elf.c +++ b/arch/s390/kernel/kexec_elf.c @@ -130,7 +130,7 @@ static int s390_elf_probe(const char *buf, unsigned long len) const struct kexec_file_ops s390_kexec_elf_ops = { .probe = s390_elf_probe, .load = s390_elf_load, -#ifdef CONFIG_KEXEC__SIG +#ifdef CONFIG_KEXEC_SIG .verify_sig = s390_verify_sig, #endif /* CONFIG_KEXEC_SIG */ };