]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown"
authorTyler Hicks <tyhicks@canonical.com>
Fri, 7 Feb 2020 20:40:00 +0000 (21:40 +0100)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Fri, 14 Feb 2020 10:32:09 +0000 (11:32 +0100)
commit4a400dcc7640474a853a38f9e40e047e99e2fc92
tree2e1ecb441bfc447f74ea7e18b6d436dc8b67c374
parent6a34407b8a5c0f1f9ee15a5b7512c148be9d5c47
Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown"

BugLink: https://bugs.launchpad.net/bugs/1861238
This reverts commit 3da3c68e510d1597f50e1b02f7fa2411ebbcf441.

The original intent behind Lockdown's SysRq support was that the SysRq
command to lift Lockdown would only be honored if the command was
physically entered on a keyboard. Attempts to synthetically generate the
SysRq command, by a software program, were to be ignored since software,
even running as root, must not have the authorization to lift Lockdown.

Unfortunately, attempts to detect a synthetic SysRq command can be
thwarted by a privileged process that is able to set up a USB/IP
connection as the USB/IP connection could be used to lift Lockdown.

Remove the ability to lift Lockdown using SysRq.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Sultan Alsawaf <sultan.alsawaf@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
arch/x86/include/asm/setup.h
debian.master/config/annotations
debian.master/config/config.common.ubuntu
drivers/input/misc/uinput.c
drivers/tty/sysrq.c
include/linux/input.h
include/linux/sysrq.h
kernel/debug/kdb/kdb_main.c
security/Kconfig
security/lock_down.c