security/lock_down.c

   1 /* Lock down the kernel
   2  *
   3  * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public Licence
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the Licence, or (at your option) any later version.
  10  */
  11
  12 #include <linux/security.h>
  13 #include <linux/export.h>
  14 #include <linux/efi.h>
  15
  16 static __ro_after_init bool kernel_locked_down;
  17
  18 /*
  19  * Put the kernel into lock-down mode.
  20  */
  21 static void __init lock_kernel_down(const char *where)
  22 {
  23         if (!kernel_locked_down) {
  24                 kernel_locked_down = true;
  25                 pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n",
  26                           where);
  27         }
  28 }
  29
  30 static int __init lockdown_param(char *ignored)
  31 {
  32         lock_kernel_down("command line");
  33         return 0;
  34 }
  35
  36 early_param("lockdown", lockdown_param);
  37
  38 /*
  39  * Lock the kernel down from very early in the arch setup.  This must happen
  40  * prior to things like ACPI being initialised.
  41  */
  42 void __init init_lockdown(void)
  43 {
  44 #ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
  45         if (efi_enabled(EFI_SECURE_BOOT))
  46                 lock_kernel_down("EFI secure boot");
  47 #endif
  48 }
  49
  50 /**
  51  * kernel_is_locked_down - Find out if the kernel is locked down
  52  * @what: Tag to use in notice generated if lockdown is in effect
  53  */
  54 bool __kernel_is_locked_down(const char *what, bool first)
  55 {
  56         if (what && first && kernel_locked_down)
  57                 pr_notice("Lockdown: %s is restricted; see man kernel_lockdown.7\n",
  58                           what);
  59         return kernel_locked_down;
  60 }
  61 EXPORT_SYMBOL(__kernel_is_locked_down);