summaryrefslogtreecommitdiff
path: root/include/linux/security.h
diff options
context:
space:
mode:
authorNathan Lynch <nathanl@linux.ibm.com>2022-09-26 16:16:43 +0300
committerMichael Ellerman <mpe@ellerman.id.au>2022-09-28 12:22:14 +0300
commitb8f3e48834fe8c86b4f21739c6effd160e2c2c19 (patch)
tree6658e486f3a3a23d2a418f48986029a54977326f /include/linux/security.h
parent99df7a2810b6d24651d4887ab61a142e042fb235 (diff)
downloadlinux-b8f3e48834fe8c86b4f21739c6effd160e2c2c19.tar.xz
powerpc/rtas: block error injection when locked down
The error injection facility on pseries VMs allows corruption of arbitrary guest memory, potentially enabling a sufficiently privileged user to disable lockdown or perform other modifications of the running kernel via the rtas syscall. Block the PAPR error injection facility from being opened or called when locked down. Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com> Acked-by: Paul Moore <paul@paul-moore.com> (LSM) Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20220926131643.146502-3-nathanl@linux.ibm.com
Diffstat (limited to 'include/linux/security.h')
-rw-r--r--include/linux/security.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/security.h b/include/linux/security.h
index 7da801ceb5a4..a6d67600759e 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -123,6 +123,7 @@ enum lockdown_reason {
LOCKDOWN_XMON_WR,
LOCKDOWN_BPF_WRITE_USER,
LOCKDOWN_DBG_WRITE_KERNEL,
+ LOCKDOWN_RTAS_ERROR_INJECTION,
LOCKDOWN_INTEGRITY_MAX,
LOCKDOWN_KCORE,
LOCKDOWN_KPROBES,