From a44d0b29e985f769540491f7f39b8ffe9ddc3768 Mon Sep 17 00:00:00 2001

From: "Lee, Chun-Yi" <jlee@suse.com>

Date: Tue, 26 Nov 2019 14:40:07 +0800

Subject: [PATCH] efi: Lock down the kernel at the integrity level if booted in

 secure boot mode

Patch-mainline: Never, SUSE specific tweak 

References: jsc#SLE-9870

The perf and bpf are restricted in confidentiality level, but those

functions are available on SLE. So we use integrity level here.

Signed-off-by: Lee, Chun-Yi <jlee@suse.com>

---

 arch/x86/kernel/setup.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c

index 303abf8..a94e2b0 100644

--- a/arch/x86/kernel/setup.c

+++ b/arch/x86/kernel/setup.c

@@ -1032,7 +1032,7 @@ void __init setup_arch(char **cmdline_p)

 #ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT

 	if (efi_enabled(EFI_SECURE_BOOT))

-		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_CONFIDENTIALITY_MAX);

+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);

 #endif

 	dmi_setup();

-- 

2.16.4