Revert "UBUNTU: SAUCE: (efi-lockdown) Add a SysRq option to lift kernel lockdown"

BugLink: https://bugs.launchpad.net/bugs/1861238
This reverts commit 3da3c68e510d1597f50e1b02f7fa2411ebbcf441.

The original intent behind Lockdown's SysRq support was that the SysRq
command to lift Lockdown would only be honored if the command was
physically entered on a keyboard. Attempts to synthetically generate the
SysRq command, by a software program, were to be ignored since software,
even running as root, must not have the authorization to lift Lockdown.

Unfortunately, attempts to detect a synthetic SysRq command can be
thwarted by a privileged process that is able to set up a USB/IP
connection as the USB/IP connection could be used to lift Lockdown.

Remove the ability to lift Lockdown using SysRq.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Sultan Alsawaf <sultan.alsawaf@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
index 8daf633a5347ea84de2ad858d6b8122da8db421c..ed8ec011a9fdc6d3af834b67ed63d5a30d8f0adb 100644 (file)
--- a/arch/x86/include/asm/setup.h
+++ b/arch/x86/include/asm/setup.h
@@ -9,8 +9,6 @@
 #include <linux/linkage.h>
 #include <asm/page_types.h>
 
-#define LOCKDOWN_LIFT_KEY 'x'
-
 #ifdef __i386__
 
 #include <linux/pfn.h>

diff --git a/debian.master/config/annotations b/debian.master/config/annotations
index 5daaac920896eb83975007fd631a8e51544e6791..334580378de635419c4dbe2e29ffa6187108560f 100644 (file)
--- a/debian.master/config/annotations
+++ b/debian.master/config/annotations
@@ -12641,7 +12641,6 @@ CONFIG_FORTIFY_SOURCE                           policy<{'amd64': 'y', 'arm64': '
 CONFIG_STATIC_USERMODEHELPER                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'i386': 'n', 'ppc64el': 'n', 's390x': 'n'}>
 CONFIG_LOCK_DOWN_KERNEL                         policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'n', 's390x': 'y'}>
 CONFIG_LOCK_DOWN_KERNEL_FORCE                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'i386': 'n', 's390x': 'n'}>
-CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ             policy<{'amd64': 'y', 'i386': 'y'}>
 CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y'}>
 CONFIG_LSM                                      policy<{'amd64': '"yama,integrity,apparmor"', 'arm64': '"yama,integrity,apparmor"', 'armhf': '"yama,integrity,apparmor"', 'i386': '"yama,integrity,apparmor"', 'ppc64el': '"yama,integrity,apparmor"', 's390x': '"yama,integrity,apparmor"'}>
 #

diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index 7e2bbb5f5d5a5d22b806643b2722e6508228e5f8..74792aa89f4964af01efd2d7a89a429ee4f119c6 100644 (file)
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -250,7 +250,6 @@ CONFIG_ALIGNMENT_TRAP=y
 CONFIG_ALIM1535_WDT=m
 CONFIG_ALIX=y
 CONFIG_ALLOW_DEV_COREDUMP=y
-CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ=y
 CONFIG_ALPINE_MSI=y
 CONFIG_ALTERA_FREEZE_BRIDGE=m
 CONFIG_ALTERA_MBOX=m

diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 5a50e13be4e27fb4c41d84319b7bd192ef3c6e70..002654ec704040608e001fb9d453a189c276ddce 100644 (file)
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -357,7 +357,6 @@ static int uinput_create_device(struct uinput_device *udev)
                dev->flush = uinput_dev_flush;
        }
 
-       dev->flags |= INPUTDEV_FLAGS_SYNTHETIC;
        dev->event = uinput_dev_event;
 
        input_set_drvdata(udev->dev, udev);

diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index 99082faafc444ff6dcc53ea46df9c70fbaa9c70b..573b2055173c177c9def565967027da99a341237 100644 (file)
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -480,7 +480,6 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
        /* x: May be registered on mips for TLB dump */
        /* x: May be registered on ppc/powerpc for xmon */
        /* x: May be registered on sparc64 for global PMU dump */
-       /* x: May be registered on x86_64 for disabling secure boot */
        NULL,                           /* x */
        /* y: May be registered on sparc64 for global register dump */
        NULL,                           /* y */
@@ -524,7 +523,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p)
                 sysrq_key_table[i] = op_p;
 }
 
-void __handle_sysrq(int key, unsigned int from)
+void __handle_sysrq(int key, bool check_mask)
 {
        struct sysrq_key_op *op_p;
        int orig_log_level;
@@ -547,15 +546,11 @@ void __handle_sysrq(int key, unsigned int from)
 
         op_p = __sysrq_get_key_op(key);
         if (op_p) {
-               /* Ban synthetic events from some sysrq functionality */
-               if ((from == SYSRQ_FROM_PROC || from == SYSRQ_FROM_SYNTHETIC) &&
-                   op_p->enable_mask & SYSRQ_DISABLE_USERSPACE) {
-                       printk("This sysrq operation is disabled from userspace.\n");
-               } else if (from == SYSRQ_FROM_KERNEL || sysrq_on_mask(op_p->enable_mask)) {
-                       /*
-                        * Should we check for enabled operations (/proc/sysrq-trigger
-                        * should not) and is the invoked operation enabled?
-                        */
+               /*
+                * Should we check for enabled operations (/proc/sysrq-trigger
+                * should not) and is the invoked operation enabled?
+                */
+               if (!check_mask || sysrq_on_mask(op_p->enable_mask)) {
                        pr_info("%s\n", op_p->action_msg);
                        console_loglevel = orig_log_level;
                        op_p->handler(key);
@@ -590,7 +585,7 @@ void __handle_sysrq(int key, unsigned int from)
 void handle_sysrq(int key)
 {
        if (sysrq_on())
-               __handle_sysrq(key, SYSRQ_FROM_KERNEL);
+               __handle_sysrq(key, true);
 }
 EXPORT_SYMBOL(handle_sysrq);
 
@@ -670,7 +665,7 @@ static void sysrq_do_reset(struct timer_list *t)
 static void sysrq_handle_reset_request(struct sysrq_state *state)
 {
        if (state->reset_requested)
-               __handle_sysrq(sysrq_xlate[KEY_B], SYSRQ_FROM_KERNEL);
+               __handle_sysrq(sysrq_xlate[KEY_B], false);
 
        if (sysrq_reset_downtime_ms)
                mod_timer(&state->keyreset_timer,
@@ -823,10 +818,8 @@ static bool sysrq_handle_keypress(struct sysrq_state *sysrq,
 
        default:
                if (sysrq->active && value && value != 2) {
-                       int from = sysrq->handle.dev->flags & INPUTDEV_FLAGS_SYNTHETIC ?
-                                       SYSRQ_FROM_SYNTHETIC : 0;
                        sysrq->need_reinject = false;
-                       __handle_sysrq(sysrq_xlate[code], from);
+                       __handle_sysrq(sysrq_xlate[code], true);
                }
                break;
        }
@@ -1109,7 +1102,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
 
                if (get_user(c, buf))
                        return -EFAULT;
-               __handle_sysrq(c, SYSRQ_FROM_PROC);
+               __handle_sysrq(c, false);
        }
 
        return count;

diff --git a/include/linux/input.h b/include/linux/input.h
index 7e7065b2f58a458f6da51e5e181fc723be745d60..510e78558c106379368d6a90af5974260be43f72 100644 (file)
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -39,7 +39,6 @@ struct input_value {
  * @phys: physical path to the device in the system hierarchy
  * @uniq: unique identification code for the device (if device has it)
  * @id: id of the device (struct input_id)
- * @flags: input device flags (SYNTHETIC, etc.)
  * @propbit: bitmap of device properties and quirks
  * @evbit: bitmap of types of events supported by the device (EV_KEY,
  *     EV_REL, etc.)
@@ -122,8 +121,6 @@ struct input_dev {
        const char *uniq;
        struct input_id id;
 
-       unsigned int flags;
-
        unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)];
 
        unsigned long evbit[BITS_TO_LONGS(EV_CNT)];
@@ -190,8 +187,6 @@ struct input_dev {
 };
 #define to_input_dev(d) container_of(d, struct input_dev, dev)
 
-#define        INPUTDEV_FLAGS_SYNTHETIC        0x000000001
-
 /*
  * Verify that we are in sync with input_device_id mod_devicetable.h #defines
  */

diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
index 7de1f08b60a913dc1cf06fe86c3132982c6db8a8..8c71874e84852b5cefb9b9bf0a06a877457eaf86 100644 (file)
--- a/include/linux/sysrq.h
+++ b/include/linux/sysrq.h
@@ -29,8 +29,6 @@
 #define SYSRQ_ENABLE_BOOT      0x0080
 #define SYSRQ_ENABLE_RTNICE    0x0100
 
-#define SYSRQ_DISABLE_USERSPACE        0x00010000
-
 struct sysrq_key_op {
        void (*handler)(int);
        char *help_msg;
@@ -45,12 +43,8 @@ struct sysrq_key_op {
  * are available -- else NULL's).
  */
 
-#define SYSRQ_FROM_KERNEL      0x0001
-#define SYSRQ_FROM_PROC                0x0002
-#define SYSRQ_FROM_SYNTHETIC   0x0004
-
 void handle_sysrq(int key);
-void __handle_sysrq(int key, unsigned int from);
+void __handle_sysrq(int key, bool check_mask);
 int register_sysrq_key(int key, struct sysrq_key_op *op);
 int unregister_sysrq_key(int key, struct sysrq_key_op *op);
 struct sysrq_key_op *__sysrq_get_key_op(int key);

diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 902b7785d7dcad7c81b1a55923eef05df33777b5..9ecfa37c7fbfc2ba52d79c62d8e1991b0d28538a 100644 (file)
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -1981,7 +1981,7 @@ static int kdb_sr(int argc, const char **argv)
                return KDB_ARGCOUNT;
 
        kdb_trap_printk++;
-       __handle_sysrq(*argv[1], check_mask ? SYSRQ_FROM_KERNEL : 0);
+       __handle_sysrq(*argv[1], check_mask);
        kdb_trap_printk--;
 
        return 0;

diff --git a/security/Kconfig b/security/Kconfig
index faf959c611e8abb6ad23799b2c0d653f9ab01c78..a2e3ef395743aac4312c4d685c3c043722795475 100644 (file)
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -254,16 +254,6 @@ config LOCK_DOWN_KERNEL_FORCE
         help
           Enable the kernel lock down functionality automatically at boot.
 
-config ALLOW_LOCKDOWN_LIFT_BY_SYSRQ
-        bool "Allow the kernel lockdown to be lifted by SysRq"
-        depends on LOCK_DOWN_KERNEL
-        depends on !LOCK_DOWN_KERNEL_FORCE
-        depends on MAGIC_SYSRQ
-        depends on X86
-        help
-          Allow the lockdown on a kernel to be lifted, by pressing a SysRq key
-          combination on a wired keyboard.  On x86, this is SysRq+x.
-
 config LOCK_DOWN_IN_EFI_SECURE_BOOT
        bool "Lock down the kernel in EFI Secure Boot mode"
        default n

diff --git a/security/lock_down.c b/security/lock_down.c
index 973118384a0c15619f52fc4fed384474f58cc560..db7645c7a7efe8c23bcabdb8ad7df9b0f920e715 100644 (file)
--- a/security/lock_down.c
+++ b/security/lock_down.c
@@ -13,17 +13,11 @@
 #include <linux/security.h>
 #include <linux/export.h>
 #include <linux/efi.h>
-#include <linux/sysrq.h>
-#include <asm/setup.h>
 #ifdef CONFIG_S390
 #include <asm/ipl.h>
 #endif
 
-#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ
-static __read_mostly bool kernel_locked_down;
-#else
 static __ro_after_init bool kernel_locked_down;
-#endif
 
 /*
  * Put the kernel into lock-down mode.
@@ -76,44 +70,3 @@ bool __kernel_is_locked_down(const char *what, bool first)
        return kernel_locked_down;
 }
 EXPORT_SYMBOL(__kernel_is_locked_down);
-
-#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ
-
-/*
- * Take the kernel out of lockdown mode.
- */
-static void lift_kernel_lockdown(void)
-{
-       pr_notice("Lifting lockdown\n");
-       kernel_locked_down = false;
-}
-
-/*
- * Allow lockdown to be lifted by pressing something like SysRq+x (and not by
- * echoing the appropriate letter into the sysrq-trigger file).
- */
-static void sysrq_handle_lockdown_lift(int key)
-{
-       if (kernel_locked_down)
-               lift_kernel_lockdown();
-}
-
-static struct sysrq_key_op lockdown_lift_sysrq_op = {
-       .handler        = sysrq_handle_lockdown_lift,
-       .help_msg       = "unSB(x)",
-       .action_msg     = "Disabling Secure Boot restrictions",
-       .enable_mask    = SYSRQ_DISABLE_USERSPACE,
-};
-
-static int __init lockdown_lift_sysrq(void)
-{
-       if (kernel_locked_down) {
-               lockdown_lift_sysrq_op.help_msg[5] = LOCKDOWN_LIFT_KEY;
-               register_sysrq_key(LOCKDOWN_LIFT_KEY, &lockdown_lift_sysrq_op);
-       }
-       return 0;
-}
-
-late_initcall(lockdown_lift_sysrq);
-
-#endif /* CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ */