lockdown: Prohibit PCMCIA CIS storage when the kernel is locked down

Prohibit replacement of the PCMCIA Card Information Structure when the
kernel is locked down.

Suggested-by: Dominik Brodowski <[email protected]>
Signed-off-by: David Howells <[email protected]>
Signed-off-by: Matthew Garrett <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Signed-off-by: James Morris <[email protected]>
This commit is contained in:
David Howells 2019-08-19 17:17:53 -07:00 • committed by James Morris
commit 3f19cad3fa
3 changed files with 7 additions and 0 deletions

View file

@ -21,6 +21,7 @@
#include <linux/pci.h>
#include <linux/ioport.h>
#include <linux/io.h>
#include <linux/security.h>
#include <asm/byteorder.h>
#include <asm/unaligned.h>
@ -1575,6 +1576,10 @@ static ssize_t pccard_store_cis(struct file *filp, struct kobject *kobj,
struct pcmcia_socket *s;
int error;
error = security_locked_down(LOCKDOWN_PCMCIA_CIS);
if (error)
return error;
s = to_socket(container_of(kobj, struct device, kobj));
if (off)