]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown"
authorTyler Hicks <tyhicks@canonical.com>
Fri, 7 Feb 2020 20:41:00 +0000 (21:41 +0100)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Fri, 14 Feb 2020 10:37:10 +0000 (11:37 +0100)
commitc456d0e9a4297b7b3b76e2f4c183addcedc9c31b
tree773dddf424034bd21735ddc27ec72402bc49a6ba
parent2ab0a3c2900ddf10436842ba5f31358b04a65038
Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown"

BugLink: https://bugs.launchpad.net/bugs/1861238
This reverts commit 531c25a35b2a93e025e72e04f16b0f3620ace581.

The original intent behind Lockdown's SysRq support was that the SysRq
command to lift Lockdown would only be honored if the command was
physically entered on a keyboard. Attempts to synthetically generate the
SysRq command, by a software program, were to be ignored since software,
even running as root, must not have the authorization to lift Lockdown.

Unfortunately, attempts to detect a synthetic SysRq command can be
thwarted by a privileged process that is able to set up a USB/IP
connection as the USB/IP connection could be used to lift Lockdown.

Remove the ability to lift Lockdown using SysRq.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Sultan Alsawaf <sultan.alsawaf@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
13 files changed:
arch/x86/include/asm/setup.h
debian.master/config/amd64/config.common.amd64
debian.master/config/annotations
debian.master/config/arm64/config.common.arm64
debian.master/config/armhf/config.common.armhf
debian.master/config/i386/config.common.i386
drivers/input/misc/uinput.c
drivers/tty/sysrq.c
include/linux/input.h
include/linux/sysrq.h
kernel/debug/kdb/kdb_main.c
security/Kconfig
security/lock_down.c