From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Egor Ignatov To: devel-kernel@lists.altlinux.org Date: Wed, 6 May 2026 20:37:16 +0300 Message-ID: <20260506173722.1012394-1-egori@altlinux.org> X-Mailer: git-send-email 2.50.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [d-kernel] [PATCH 0/6] [7.0, 7.1] Lock down the kernel if booted in Secure Boot mode X-BeenThere: devel-kernel@lists.altlinux.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: ALT Linux kernel packages development List-Id: ALT Linux kernel packages development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 May 2026 17:37:32 -0000 Archived-At: List-Archive: List-Post: Данный набор патчей включает механизм kernel lockdown при загрузке системы в режиме Secure Boot. При обнаружении активного Secure Boot ядро автоматически переводится в режим lockdown. В основу серии положен изначальный патчсет "security, efi: Add kernel lockdown" за авторством David Howells. Использованы более актуальные варианты соответствующих патчей, поддерживаемые в ядрах Fedora и Debian. Серия предназначена для веток 7.0 и 7.1. Ben Hutchings (1): mtd: phram,slram: Disable when the kernel is locked down David Howells (2): efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode efi: Lock down the kernel if booted in secure boot mode Egor Ignatov (1): config: Enable LOCK_DOWN_IN_EFI_SECURE_BOOT Jeremy Cline (1): security: lockdown: expose security_lock_kernel_down function Linn Crosetto (1): efi: determine and pass Secure Boot state via FDT arch/x86/kernel/setup.c | 16 ++---------- config | 1 + drivers/firmware/efi/Makefile | 1 + drivers/firmware/efi/efi-init.c | 5 +++- drivers/firmware/efi/fdtparams.c | 12 ++++++++- drivers/firmware/efi/libstub/fdt.c | 6 +++++ drivers/firmware/efi/secureboot.c | 42 ++++++++++++++++++++++++++++++ drivers/mtd/devices/phram.c | 6 ++++- drivers/mtd/devices/slram.c | 9 ++++++- include/linux/efi.h | 22 ++++++++++------ include/linux/security.h | 9 +++++++ security/lockdown/Kconfig | 15 +++++++++++ security/lockdown/lockdown.c | 11 ++++++++ 13 files changed, 129 insertions(+), 26 deletions(-) create mode 100644 drivers/firmware/efi/secureboot.c -- 2.50.1