diff options
author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-12-06 09:50:08 +0000 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2018-03-03 15:51:46 +0000 |
commit | 9a9c97f48d8da029fde73eeeea9532aa12d36b4c (patch) | |
tree | 6b123d03d39ca18e5a902366db496c8505a807e2 /include | |
parent | 0b6433856a149885470f2ab3a138e99347c323a4 (diff) | |
download | linux-stable-9a9c97f48d8da029fde73eeeea9532aa12d36b4c.tar.gz linux-stable-9a9c97f48d8da029fde73eeeea9532aa12d36b4c.tar.bz2 linux-stable-9a9c97f48d8da029fde73eeeea9532aa12d36b4c.zip |
efi: Move some sysfs files to be read-only by root
commit af97a77bc01ce49a466f9d4c0125479e2e2230b6 upstream.
Thanks to the scripts/leaking_addresses.pl script, it was found that
some EFI values should not be readable by non-root users.
So make them root-only, and to do that, add a __ATTR_RO_MODE() macro to
make this easier, and use it in other places at the same time.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Dave Young <dyoung@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/20171206095010.24170-2-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.16: drop changes in esrt.c]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include')
-rw-r--r-- | include/linux/sysfs.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h index 8ce4e648efc1..39e31f407375 100644 --- a/include/linux/sysfs.h +++ b/include/linux/sysfs.h @@ -82,6 +82,12 @@ struct attribute_group { .show = _name##_show, \ } +#define __ATTR_RO_MODE(_name, _mode) { \ + .attr = { .name = __stringify(_name), \ + .mode = VERIFY_OCTAL_PERMISSIONS(_mode) }, \ + .show = _name##_show, \ +} + #define __ATTR_WO(_name) { \ .attr = { .name = __stringify(_name), .mode = S_IWUSR }, \ .store = _name##_store, \ |