Describe the /sys/kernel/security/lockdown interface: the levels it reports, how the active level is marked, when the file is present, and the write semantics (escalation only, EPERM for the current or a lower level, EINVAL for an unknown level). Also add the new ABI file to the LOCKDOWN SECURITY MODULE entry in MAINTAINERS. Signed-off-by: Cai Xinchen --- Documentation/ABI/testing/securityfs-lockdown | 43 +++++++++++++++++++ MAINTAINERS | 1 + 2 files changed, 44 insertions(+) create mode 100644 Documentation/ABI/testing/securityfs-lockdown diff --git a/Documentation/ABI/testing/securityfs-lockdown b/Documentation/ABI/testing/securityfs-lockdown new file mode 100644 index 000000000000..2967a07df97c --- /dev/null +++ b/Documentation/ABI/testing/securityfs-lockdown @@ -0,0 +1,43 @@ +What: /sys/kernel/security/lockdown +Date: August 2019 +KernelVersion: 5.4 +Contact: linux-security-module@vger.kernel.org +Description: + The lockdown securityfs file reports and controls the + lockdown state of the running kernel. It is provided by + the lockdown LSM and is located at + /sys/kernel/security/lockdown. + + The file is present only when CONFIG_SECURITY_LOCKDOWN_LSM is + enabled and the lockdown LSM is active, either because + CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is set, or because it is + ordered in through CONFIG_LSM or the "lsm=" kernel + parameter. Otherwise the node is absent, and userspace must + handle its absence. + + Reading the file returns the supported lockdown levels, + with the currently active level enclosed in square + brackets. For example, when the kernel is not locked + down:: + + [none] integrity confidentiality + + and when the kernel is in integrity mode:: + + none [integrity] confidentiality + + The file may be written with the name of a level to lock + the kernel down further. Lockdown can only be escalated, + never relaxed, so writing the currently active level or a + lower level fails with EPERM. Writing an unrecognized + level fails with EINVAL. Successful writes return the + number of bytes written. + + The kernel can also be locked down at boot time with the + "lockdown=" kernel parameter, or at build time via + CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY or + CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY when the + lockdown LSM is active. + +Users: fwupd and other userspace tools that query or manage + kernel lockdown state diff --git a/MAINTAINERS b/MAINTAINERS index c57be10c8729..0ba942dfe4c0 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -15652,6 +15652,7 @@ M: Xiu Jianfeng L: linux-security-module@vger.kernel.org S: Maintained T: git https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm.git +F: Documentation/ABI/testing/securityfs-lockdown F: security/lockdown/ LOCKING PRIMITIVES -- 2.18.0.huawei.25