path: root/security/lockdown/lockdown.c
diff options
authorJavier Martinez Canillas <>2019-10-29 18:37:55 +0100
committerIngo Molnar <>2019-10-31 09:40:21 +0100
commit359efcc2c910117d2faf704ce154e91fc976d37f (patch)
tree87dccc0f9be33f069c3edfc94f31eed8e4ab0129 /security/lockdown/lockdown.c
parent220dd7699c46d5940115bd797b01b2ab047c87b8 (diff)
efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN
The driver exposes EFI runtime services to user-space through an IOCTL interface, calling the EFI services function pointers directly without using the efivar API. Disallow access to the /dev/efi_test character device when the kernel is locked down to prevent arbitrary user-space to call EFI runtime services. Also require CAP_SYS_ADMIN to open the chardev to prevent unprivileged users to call the EFI runtime services, instead of just relying on the chardev file mode bits for this. The main user of this driver is the fwts [0] tool that already checks if the effective user ID is 0 and fails otherwise. So this change shouldn't cause any regression to this tool. [0]: Signed-off-by: Javier Martinez Canillas <> Signed-off-by: Ard Biesheuvel <> Acked-by: Laszlo Ersek <> Acked-by: Matthew Garrett <> Cc: Linus Torvalds <> Cc: Peter Zijlstra <> Cc: Thomas Gleixner <> Cc: Link: Signed-off-by: Ingo Molnar <>
Diffstat (limited to 'security/lockdown/lockdown.c')
1 files changed, 1 insertions, 0 deletions
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 8a10b43daf74..40b790536def 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -20,6 +20,7 @@ static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
[LOCKDOWN_NONE] = "none",
[LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",
[LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",
+ [LOCKDOWN_EFI_TEST] = "/dev/efi_test access",
[LOCKDOWN_KEXEC] = "kexec of unsigned images",
[LOCKDOWN_HIBERNATION] = "hibernation",
[LOCKDOWN_PCI_ACCESS] = "direct PCI access",