summaryrefslogtreecommitdiffstats
path: root/modsign-uefi.patch
diff options
context:
space:
mode:
authorJosh Boyer <jwboyer@fedoraproject.org>2014-04-21 09:46:02 -0400
committerJosh Boyer <jwboyer@fedoraproject.org>2014-04-21 09:46:02 -0400
commit86439e5e88eebe6a5f03b6a26cd41ddaea07f08a (patch)
treed1712579efae2c044399f6cf1d22b38c1e482d09 /modsign-uefi.patch
parent4b35a8c2332344c9316a1a2fa76e56542bb14a3d (diff)
downloadkernel-86439e5e88eebe6a5f03b6a26cd41ddaea07f08a.tar.gz
kernel-86439e5e88eebe6a5f03b6a26cd41ddaea07f08a.tar.xz
kernel-86439e5e88eebe6a5f03b6a26cd41ddaea07f08a.zip
Linux v3.15-rc2
- Disable debugging options.
Diffstat (limited to 'modsign-uefi.patch')
-rw-r--r--modsign-uefi.patch80
1 files changed, 40 insertions, 40 deletions
diff --git a/modsign-uefi.patch b/modsign-uefi.patch
index d8e762cb..af6844d5 100644
--- a/modsign-uefi.patch
+++ b/modsign-uefi.patch
@@ -1,7 +1,7 @@
Bugzilla: N/A
Upstream-status: Fedora mustard for now
-From 2b668e069365b608e855cf1f5edcf8caed0aaa4d Mon Sep 17 00:00:00 2001
+From 779183da2955e33a221c3f7a622766cd53e06d45 Mon Sep 17 00:00:00 2001
From: Dave Howells <dhowells@redhat.com>
Date: Tue, 23 Oct 2012 09:30:54 -0400
Subject: [PATCH 1/5] Add EFI signature data types
@@ -15,10 +15,10 @@ Signed-off-by: David Howells <dhowells@redhat.com>
1 file changed, 20 insertions(+)
diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 0c1d367..de1faea 100644
+index 3a77a70fff27..4c7f7011ea19 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
-@@ -394,6 +394,12 @@ typedef efi_status_t efi_query_variable_store_t(u32 attributes, unsigned long si
+@@ -575,6 +575,12 @@ typedef efi_status_t efi_query_variable_store_t(u32 attributes, unsigned long si
#define EFI_FILE_SYSTEM_GUID \
EFI_GUID( 0x964e5b22, 0x6459, 0x11d2, 0x8e, 0x39, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b )
@@ -31,7 +31,7 @@ index 0c1d367..de1faea 100644
typedef struct {
efi_guid_t guid;
u64 table;
-@@ -541,6 +547,20 @@ typedef struct _efi_file_io_interface {
+@@ -782,6 +788,20 @@ typedef struct _efi_file_io_interface {
#define EFI_INVALID_TABLE_ADDR (~0UL)
@@ -53,10 +53,10 @@ index 0c1d367..de1faea 100644
* All runtime access to EFI goes through this structure:
*/
--
-1.8.4.2
+1.9.0
-From 42d75e3e3fe134cc274f765525031b764540a587 Mon Sep 17 00:00:00 2001
+From 8592d1f6a8cc8d901c94582b9d0b57d170a0940b Mon Sep 17 00:00:00 2001
From: Dave Howells <dhowells@redhat.com>
Date: Tue, 23 Oct 2012 09:36:28 -0400
Subject: [PATCH 2/5] Add an EFI signature blob parser and key loader.
@@ -74,7 +74,7 @@ Signed-off-by: David Howells <dhowells@redhat.com>
create mode 100644 crypto/asymmetric_keys/efi_parser.c
diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
-index 03a6eb9..6306ffc 100644
+index 03a6eb95ab50..6306ffc2a7fe 100644
--- a/crypto/asymmetric_keys/Kconfig
+++ b/crypto/asymmetric_keys/Kconfig
@@ -37,4 +37,12 @@ config X509_CERTIFICATE_PARSER
@@ -91,7 +91,7 @@ index 03a6eb9..6306ffc 100644
+
endif # ASYMMETRIC_KEY_TYPE
diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile
-index 0727204..cd8388e 100644
+index 0727204aab68..cd8388e5f2f1 100644
--- a/crypto/asymmetric_keys/Makefile
+++ b/crypto/asymmetric_keys/Makefile
@@ -8,6 +8,7 @@ asymmetric_keys-y := asymmetric_type.o signature.o
@@ -104,7 +104,7 @@ index 0727204..cd8388e 100644
# X.509 Certificate handling
diff --git a/crypto/asymmetric_keys/efi_parser.c b/crypto/asymmetric_keys/efi_parser.c
new file mode 100644
-index 0000000..424896a
+index 000000000000..424896a0b169
--- /dev/null
+++ b/crypto/asymmetric_keys/efi_parser.c
@@ -0,0 +1,109 @@
@@ -218,10 +218,10 @@ index 0000000..424896a
+ return 0;
+}
diff --git a/include/linux/efi.h b/include/linux/efi.h
-index de1faea..13e1425 100644
+index 4c7f7011ea19..96174a7f9e90 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
-@@ -641,6 +641,10 @@ extern int efi_set_rtc_mmss(const struct timespec *now);
+@@ -883,6 +883,10 @@ extern int efi_set_rtc_mmss(const struct timespec *now);
extern void efi_reserve_boot_services(void);
extern struct efi_memory_map memmap;
@@ -233,10 +233,10 @@ index de1faea..13e1425 100644
* efi_range_is_wc - check the WC bit on an address range
* @start: starting kvirt address
--
-1.8.4.2
+1.9.0
-From d750dbcdcb3a712a2ea4ec57b9c9729c6a26b41d Mon Sep 17 00:00:00 2001
+From a4da3547b2eb4e0c7111eee7e5d5043413142835 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@fedoraproject.org>
Date: Fri, 26 Oct 2012 12:36:24 -0400
Subject: [PATCH 3/5] KEYS: Add a system blacklist keyring
@@ -255,7 +255,7 @@ Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
4 files changed, 42 insertions(+)
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
-index 8dabc39..e466de1 100644
+index 8dabc399bd1d..e466de10ceec 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -18,6 +18,10 @@
@@ -270,10 +270,10 @@ index 8dabc39..e466de1 100644
#endif /* _KEYS_SYSTEM_KEYRING_H */
diff --git a/init/Kconfig b/init/Kconfig
-index 5236dc5..f59e6fe 100644
+index 9d3585bb2a7a..932f22f7cc40 100644
--- a/init/Kconfig
+++ b/init/Kconfig
-@@ -1673,6 +1673,15 @@ config SYSTEM_TRUSTED_KEYRING
+@@ -1658,6 +1658,15 @@ config SYSTEM_TRUSTED_KEYRING
Keys in this keyring are used by module signature checking.
@@ -281,16 +281,16 @@ index 5236dc5..f59e6fe 100644
+ bool "Provide system-wide ring of blacklisted keys"
+ depends on KEYS
+ help
-+ Provide a system keyring to which blacklisted keys can be added. Keys
-+ in the keyring are considered entirely untrusted. Keys in this keyring
-+ are used by the module signature checking to reject loading of modules
-+ signed with a blacklisted key.
-+
- menuconfig MODULES
- bool "Enable loadable module support"
- option modules
++ Provide a system keyring to which blacklisted keys can be added.
++ Keys in the keyring are considered entirely untrusted. Keys in this
++ keyring are used by the module signature checking to reject loading
++ of modules signed with a blacklisted key.
++
+ config PROFILING
+ bool "Profiling support"
+ help
diff --git a/kernel/module_signing.c b/kernel/module_signing.c
-index be5b8fa..fed815f 100644
+index be5b8fac4bd0..fed815fcdaf2 100644
--- a/kernel/module_signing.c
+++ b/kernel/module_signing.c
@@ -158,6 +158,18 @@ static struct key *request_asymmetric_key(const char *signer, size_t signer_len,
@@ -313,7 +313,7 @@ index be5b8fa..fed815f 100644
&key_type_asymmetric, id);
if (IS_ERR(key))
diff --git a/kernel/system_keyring.c b/kernel/system_keyring.c
-index 52ebc70..478c4f8 100644
+index 52ebc70263f4..478c4f8ec908 100644
--- a/kernel/system_keyring.c
+++ b/kernel/system_keyring.c
@@ -20,6 +20,9 @@
@@ -348,10 +348,10 @@ index 52ebc70..478c4f8 100644
}
--
-1.8.4.2
+1.9.0
-From c32beadd0d75fddcd75b700e4a75884d7a82e9bb Mon Sep 17 00:00:00 2001
+From 25adb4e43fb5c23723f33a806399ad484f8dcfa5 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@fedoraproject.org>
Date: Fri, 26 Oct 2012 12:42:16 -0400
Subject: [PATCH 4/5] MODSIGN: Import certificates from UEFI Secure Boot
@@ -379,10 +379,10 @@ Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
create mode 100644 kernel/modsign_uefi.c
diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 13e1425..a7175eb 100644
+index 96174a7f9e90..8f7466023105 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
-@@ -400,6 +400,12 @@ typedef efi_status_t efi_query_variable_store_t(u32 attributes, unsigned long si
+@@ -581,6 +581,12 @@ typedef efi_status_t efi_query_variable_store_t(u32 attributes, unsigned long si
#define EFI_CERT_X509_GUID \
EFI_GUID( 0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72 )
@@ -396,10 +396,10 @@ index 13e1425..a7175eb 100644
efi_guid_t guid;
u64 table;
diff --git a/init/Kconfig b/init/Kconfig
-index f59e6fe..90fa75f 100644
+index 932f22f7cc40..6023af12ef4f 100644
--- a/init/Kconfig
+++ b/init/Kconfig
-@@ -1792,6 +1792,15 @@ config MODULE_SIG_ALL
+@@ -1812,6 +1812,15 @@ config MODULE_SIG_ALL
comment "Do not forget to sign required modules with scripts/sign-file"
depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
@@ -416,10 +416,10 @@ index f59e6fe..90fa75f 100644
prompt "Which hash algorithm should modules be signed with?"
depends on MODULE_SIG
diff --git a/kernel/Makefile b/kernel/Makefile
-index bc010ee..bee938f 100644
+index f2a8b6246ce9..706e7952bde5 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
-@@ -44,6 +44,7 @@ obj-$(CONFIG_UID16) += uid16.o
+@@ -46,6 +46,7 @@ obj-$(CONFIG_UID16) += uid16.o
obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o
obj-$(CONFIG_MODULES) += module.o
obj-$(CONFIG_MODULE_SIG) += module_signing.o
@@ -427,7 +427,7 @@ index bc010ee..bee938f 100644
obj-$(CONFIG_KALLSYMS) += kallsyms.o
obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o
obj-$(CONFIG_KEXEC) += kexec.o
-@@ -96,6 +97,8 @@ obj-$(CONFIG_CONTEXT_TRACKING) += context_tracking.o
+@@ -99,6 +100,8 @@ obj-$(CONFIG_TORTURE_TEST) += torture.o
$(obj)/configs.o: $(obj)/config_data.h
@@ -438,7 +438,7 @@ index bc010ee..bee938f 100644
targets += config_data.gz
diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
new file mode 100644
-index 0000000..94b0eb3
+index 000000000000..94b0eb38a284
--- /dev/null
+++ b/kernel/modsign_uefi.c
@@ -0,0 +1,92 @@
@@ -535,10 +535,10 @@ index 0000000..94b0eb3
+}
+late_initcall(load_uefi_certs);
--
-1.8.4.2
+1.9.0
-From 5c86fc6c7e4d51286d75ee6d8ceedf983ae434fb Mon Sep 17 00:00:00 2001
+From 20b7de055a87e6f5555c27de8188b7c975e3e330 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@fedoraproject.org>
Date: Thu, 3 Oct 2013 10:14:23 -0400
Subject: [PATCH 5/5] MODSIGN: Support not importing certs from db
@@ -554,7 +554,7 @@ Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
1 file changed, 31 insertions(+), 9 deletions(-)
diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
-index 94b0eb3..ae28b97 100644
+index 94b0eb38a284..ae28b974d49a 100644
--- a/kernel/modsign_uefi.c
+++ b/kernel/modsign_uefi.c
@@ -8,6 +8,23 @@
@@ -620,5 +620,5 @@ index 94b0eb3..ae28b97 100644
mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
--
-1.8.4.2
+1.9.0