[PATCH V40 00/29] Add kernel lockdown functionality

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Subject: [PATCH V40 00/29] Add kernel lockdown functionality
From: Matthew Garrett <matthewgarrett@xxxxxxxxxx>
Date: Mon, 19 Aug 2019 17:17:36 -0700
Cc: linux-security-module@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-api@xxxxxxxxxxxxxxx

After chatting with James in person, I'm resending the full set with the
fixes merged in in order to avoid any bisect issues. There should be no
functional changes other than avoiding build failures with some configs,
and fixing the oops in tracefs.

Follow-Ups:
- Re: [PATCH V40 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode
  - From: David Howells
- Re: [PATCH V40 04/29] lockdown: Enforce module signatures if the kernel is locked down
  - From: David Howells
- Re: [PATCH V40 03/29] security: Add a static lockdown policy LSM
  - From: David Howells
- Re: [PATCH V40 00/29] Add kernel lockdown functionality
  - From: James Morris
- [PATCH V40 04/29] lockdown: Enforce module signatures if the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 06/29] kexec_load: Disable at runtime if the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 03/29] security: Add a static lockdown policy LSM
  - From: Matthew Garrett
- [PATCH V40 01/29] security: Support early LSMs
  - From: Matthew Garrett
- [PATCH V40 08/29] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE
  - From: Matthew Garrett
- [PATCH V40 10/29] hibernate: Disable when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 12/29] x86: Lock down IO port access when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 13/29] x86/msr: Restrict MSR access when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 14/29] ACPI: Limit access to custom_method when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 15/29] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down
  - From: Matthew Garrett
- [PATCH V40 11/29] PCI: Lock down BAR access when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 16/29] acpi: Disable ACPI table override if the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 20/29] x86/mmiotrace: Lock down the testmmiotrace module
  - From: Matthew Garrett
- [PATCH V40 22/29] lockdown: Lock down tracing and perf kprobes when in confidentiality mode
  - From: Matthew Garrett
- [PATCH V40 24/29] lockdown: Lock down perf when in confidentiality mode
  - From: Matthew Garrett
- [PATCH V40 26/29] debugfs: Restrict debugfs when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 18/29] lockdown: Lock down TIOCSSERIAL
  - From: Matthew Garrett
- [PATCH V40 27/29] tracefs: Restrict tracefs when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 28/29] efi: Restrict efivar_ssdt_load when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 29/29] lockdown: Print current->comm in restriction messages
  - From: Matthew Garrett
- [PATCH V40 25/29] kexec: Allow kexec_file() with appropriate IMA policy when locked down
  - From: Matthew Garrett
- [PATCH V40 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode
  - From: Matthew Garrett
- [PATCH V40 21/29] lockdown: Lock down /proc/kcore
  - From: Matthew Garrett
- [PATCH V40 19/29] lockdown: Lock down module params that specify hardware parameters (eg. ioport)
  - From: Matthew Garrett
- [PATCH V40 17/29] lockdown: Prohibit PCMCIA CIS storage when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 09/29] kexec_file: Restrict at runtime if the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 07/29] lockdown: Copy secure_boot flag in boot params across kexec reboot
  - From: Matthew Garrett
- [PATCH V40 05/29] lockdown: Restrict /dev/{mem,kmem,port} when the kernel is locked down
  - From: Matthew Garrett
- [PATCH V40 02/29] security: Add a "locked down" LSM hook
  - From: Matthew Garrett

Prev by Date: Re: [PATCH v5 1/6] mm/page_idle: Add per-pid idle page tracking using virtual index
Next by Date: [PATCH V40 02/29] security: Add a "locked down" LSM hook
Previous by thread: [PATCHv6 00/36] kernel: Introduce Time Namespace
Next by thread: [PATCH V40 02/29] security: Add a "locked down" LSM hook
Index(es):
- Date
- Thread

[Index of Archives] [Linux USB Devel] [Video for Linux] [Linux Audio Users] [Yosemite News] [Linux Kernel] [Linux SCSI]