mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-07-19 21:32:02 +00:00
4f2d99b06b
Now that security_post_load_data() is wired up, use it instead
of the NULL file argument style of security_post_read_file(),
and update the security_kernel_load_data() call to indicate that a
security_kernel_post_load_data() call is expected.
Wire up the IMA check to match earlier logic. Perhaps a generalized
change to ima_post_load_data() might look something like this:
return process_buffer_measurement(buf, size,
kernel_load_data_id_str(load_id),
read_idmap[load_id] ?: FILE_CHECK,
0, NULL);
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Link: https://lore.kernel.org/r/20201002173828.2099543-10-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
45 lines
967 B
C
45 lines
967 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
#include <linux/efi_embedded_fw.h>
|
|
#include <linux/property.h>
|
|
#include <linux/security.h>
|
|
#include <linux/vmalloc.h>
|
|
|
|
#include "fallback.h"
|
|
#include "firmware.h"
|
|
|
|
int firmware_fallback_platform(struct fw_priv *fw_priv, u32 opt_flags)
|
|
{
|
|
const u8 *data;
|
|
size_t size;
|
|
int rc;
|
|
|
|
if (!(opt_flags & FW_OPT_FALLBACK_PLATFORM))
|
|
return -ENOENT;
|
|
|
|
rc = security_kernel_load_data(LOADING_FIRMWARE, true);
|
|
if (rc)
|
|
return rc;
|
|
|
|
rc = efi_get_embedded_fw(fw_priv->fw_name, &data, &size);
|
|
if (rc)
|
|
return rc; /* rc == -ENOENT when the fw was not found */
|
|
|
|
if (fw_priv->data && size > fw_priv->allocated_size)
|
|
return -ENOMEM;
|
|
|
|
rc = security_kernel_post_load_data((u8 *)data, size, LOADING_FIRMWARE,
|
|
"platform");
|
|
if (rc)
|
|
return rc;
|
|
|
|
if (!fw_priv->data)
|
|
fw_priv->data = vmalloc(size);
|
|
if (!fw_priv->data)
|
|
return -ENOMEM;
|
|
|
|
memcpy(fw_priv->data, data, size);
|
|
fw_priv->size = size;
|
|
fw_state_done(fw_priv);
|
|
return 0;
|
|
}
|