[PATCH v2 01/57][B] acpi: Disable ACPI table override if the kernel is locked down

[Seth Forshee]

From: Linn Crosetto <lcrosetto at gmail.com>

BugLink: https://bugs.launchpad.net/bugs/1884159

>From the kernel documentation (initrd_table_override.txt):

  If the ACPI_INITRD_TABLE_OVERRIDE compile option is true, it is possible
  to override nearly any ACPI table provided by the BIOS with an
  instrumented, modified one.

When lockdown is enabled, the kernel should disallow any unauthenticated
changes to kernel space.  ACPI tables contain code invoked by the kernel,
so do not allow ACPI tables to be overridden if the kernel is locked down.

Signed-off-by: Linn Crosetto <lcrosetto at gmail.com>
Signed-off-by: David Howells <dhowells at redhat.com>
Signed-off-by: Matthew Garrett <mjg59 at google.com>
Reviewed-by: Kees Cook <keescook at chromium.org>
cc: linux-acpi at vger.kernel.org
Signed-off-by: James Morris <jmorris at namei.org>
(backported from commit 6ea0e815fc5e18597724169caa6e4d46dd8e693d)
Signed-off-by: Seth Forshee <seth.forshee at canonical.com>
---
 drivers/acpi/osl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 62a2a564a46e..3b6d3247a4c9 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -675,6 +675,11 @@ void __init acpi_initrd_override(void *data, size_t size)
 	if (table_nr == 0)
 		return;
 
+	if (secure_modules()) {
+		pr_notice("kernel is locked down, ignoring table override\n");
+		return;
+	}
+
 	acpi_tables_addr =
 		memblock_find_in_range(0, max_low_pfn_mapped << PAGE_SHIFT,
 				       all_tables_size, PAGE_SIZE);
-- 
2.27.0