6 files changed, 96 insertions, 3 deletions

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index cd28f63bfbc7..dae64600ccbf 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -215,8 +215,13 @@
                         __start_lsm_info = .;                           \
                         KEEP(*(.lsm_info.init))                         \
                         __end_lsm_info = .;
+#define EARLY_LSM_TABLE()       . = ALIGN(8);                           \
+                        __start_early_lsm_info = .;                     \
+                        KEEP(*(.early_lsm_info.init))                   \
+                        __end_early_lsm_info = .;
 #else
 #define LSM_TABLE()
+#define EARLY_LSM_TABLE()
 #endif
 
 #define ___OF_TABLE(cfg, name)  _OF_TABLE_##cfg(name)
@@ -627,7 +632,8 @@
         ACPI_PROBE_TABLE(timer)                                         \
         THERMAL_TABLE(governor)                                         \
         EARLYCON_TABLE()                                                \
-        LSM_TABLE()
+        LSM_TABLE()                                                     \
+        EARLY_LSM_TABLE()
 
 #define INIT_TEXT                                                       \
         *(.init.text .init.text.*)                                      \
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 978cc239f23b..8b4e516bac00 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -643,6 +643,12 @@ bool acpi_gtdt_c3stop(int type);
 int acpi_arch_timer_mem_init(struct arch_timer_mem *timer_mem, int *timer_count);
 #endif
 
+#ifndef ACPI_HAVE_ARCH_SET_ROOT_POINTER
+static inline void acpi_arch_set_root_pointer(u64 addr)
+{
+}
+#endif
+
 #ifndef ACPI_HAVE_ARCH_GET_ROOT_POINTER
 static inline u64 acpi_arch_get_root_pointer(void)
 {
diff --git a/include/linux/ima.h b/include/linux/ima.h
index a20ad398d260..1c37f17f7203 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -131,4 +131,13 @@ static inline int ima_inode_removexattr(struct dentry *dentry,
         return 0;
 }
 #endif /* CONFIG_IMA_APPRAISE */
+
+#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)
+extern bool ima_appraise_signature(enum kernel_read_file_id func);
+#else
+static inline bool ima_appraise_signature(enum kernel_read_file_id func)
+{
+        return false;
+}
+#endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */
 #endif /* _LINUX_IMA_H */
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index cc162f3e6461..1776eb2e43a4 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -125,7 +125,7 @@ typedef void *(kexec_load_t)(struct kimage *image, char *kernel_buf,
                              unsigned long cmdline_len);
 typedef int (kexec_cleanup_t)(void *loader_data);
 
-#ifdef CONFIG_KEXEC_VERIFY_SIG
+#ifdef CONFIG_KEXEC_SIG
 typedef int (kexec_verify_sig_t)(const char *kernel_buf,
                                  unsigned long kernel_len);
 #endif
@@ -134,7 +134,7 @@ struct kexec_file_ops {
         kexec_probe_t *probe;
         kexec_load_t *load;
         kexec_cleanup_t *cleanup;
-#ifdef CONFIG_KEXEC_VERIFY_SIG
+#ifdef CONFIG_KEXEC_SIG
         kexec_verify_sig_t *verify_sig;
 #endif
 };
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 3fced5824aee..a3763247547c 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1449,6 +1449,11 @@
  * @bpf_prog_free_security:
  *      Clean up the security information stored inside bpf prog.
  *
+ * @locked_down
+ *     Determine whether a kernel feature that potentially enables arbitrary
+ *     code execution in kernel space should be permitted.
+ *
+ *     @what: kernel feature being accessed
  */
 union security_list_options {
         int (*binder_set_context_mgr)(struct task_struct *mgr);
@@ -1812,6 +1817,7 @@ union security_list_options {
         int (*bpf_prog_alloc_security)(struct bpf_prog_aux *aux);
         void (*bpf_prog_free_security)(struct bpf_prog_aux *aux);
 #endif /* CONFIG_BPF_SYSCALL */
+        int (*locked_down)(enum lockdown_reason what);
 };
 
 struct security_hook_heads {
@@ -2053,6 +2059,7 @@ struct security_hook_heads {
         struct hlist_head bpf_prog_alloc_security;
         struct hlist_head bpf_prog_free_security;
 #endif /* CONFIG_BPF_SYSCALL */
+        struct hlist_head locked_down;
 } __randomize_layout;
 
 /*
@@ -2111,12 +2118,18 @@ struct lsm_info {
 };
 
 extern struct lsm_info __start_lsm_info[], __end_lsm_info[];
+extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];
 
 #define DEFINE_LSM(lsm)                                                 \
         static struct lsm_info __lsm_##lsm                              \
                 __used __section(.lsm_info.init)                        \
                 __aligned(sizeof(unsigned long))
 
+#define DEFINE_EARLY_LSM(lsm)                                           \
+        static struct lsm_info __early_lsm_##lsm                        \
+                __used __section(.early_lsm_info.init)                  \
+                __aligned(sizeof(unsigned long))
+
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 /*
  * Assuring the safety of deleting a security module is up to
diff --git a/include/linux/security.h b/include/linux/security.h
index ace6fdb604f9..a8d59d612d27 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -77,6 +77,54 @@ enum lsm_event {
         LSM_POLICY_CHANGE,
 };
 
+/*
+ * These are reasons that can be passed to the security_locked_down()
+ * LSM hook. Lockdown reasons that protect kernel integrity (ie, the
+ * ability for userland to modify kernel code) are placed before
+ * LOCKDOWN_INTEGRITY_MAX.  Lockdown reasons that protect kernel
+ * confidentiality (ie, the ability for userland to extract
+ * information from the running kernel that would otherwise be
+ * restricted) are placed before LOCKDOWN_CONFIDENTIALITY_MAX.
+ *
+ * LSM authors should note that the semantics of any given lockdown
+ * reason are not guaranteed to be stable - the same reason may block
+ * one set of features in one kernel release, and a slightly different
+ * set of features in a later kernel release. LSMs that seek to expose
+ * lockdown policy at any level of granularity other than "none",
+ * "integrity" or "confidentiality" are responsible for either
+ * ensuring that they expose a consistent level of functionality to
+ * userland, or ensuring that userland is aware that this is
+ * potentially a moving target. It is easy to misuse this information
+ * in a way that could break userspace. Please be careful not to do
+ * so.
+ *
+ * If you add to this, remember to extend lockdown_reasons in
+ * security/lockdown/lockdown.c.
+ */
+enum lockdown_reason {
+        LOCKDOWN_NONE,
+        LOCKDOWN_MODULE_SIGNATURE,
+        LOCKDOWN_DEV_MEM,
+        LOCKDOWN_KEXEC,
+        LOCKDOWN_HIBERNATION,
+        LOCKDOWN_PCI_ACCESS,
+        LOCKDOWN_IOPORT,
+        LOCKDOWN_MSR,
+        LOCKDOWN_ACPI_TABLES,
+        LOCKDOWN_PCMCIA_CIS,
+        LOCKDOWN_TIOCSSERIAL,
+        LOCKDOWN_MODULE_PARAMETERS,
+        LOCKDOWN_MMIOTRACE,
+        LOCKDOWN_DEBUGFS,
+        LOCKDOWN_INTEGRITY_MAX,
+        LOCKDOWN_KCORE,
+        LOCKDOWN_KPROBES,
+        LOCKDOWN_BPF_READ,
+        LOCKDOWN_PERF,
+        LOCKDOWN_TRACEFS,
+        LOCKDOWN_CONFIDENTIALITY_MAX,
+};
+
 /* These functions are in security/commoncap.c */
 extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
                        int cap, unsigned int opts);
@@ -195,6 +243,7 @@ int unregister_blocking_lsm_notifier(struct notifier_block *nb);
 
 /* prototypes */
 extern int security_init(void);
+extern int early_security_init(void);
 
 /* Security operations */
 int security_binder_set_context_mgr(struct task_struct *mgr);
@@ -392,6 +441,7 @@ void security_inode_invalidate_secctx(struct inode *inode);
 int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
 int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
+int security_locked_down(enum lockdown_reason what);
 #else /* CONFIG_SECURITY */
 
 static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
@@ -423,6 +473,11 @@ static inline int security_init(void)
         return 0;
 }
 
+static inline int early_security_init(void)
+{
+        return 0;
+}
+
 static inline int security_binder_set_context_mgr(struct task_struct *mgr)
 {
         return 0;
@@ -1210,6 +1265,10 @@ static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32
 {
         return -EOPNOTSUPP;
 }
+static inline int security_locked_down(enum lockdown_reason what)
+{
+        return 0;
+}
 #endif  /* CONFIG_SECURITY */
 
 #ifdef CONFIG_SECURITY_NETWORK