[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5b966f1b0a0f191c7d79b1609c122c16a65d3bfc

["Peter Müller" <git@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 3568 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  5b966f1b0a0f191c7d79b1609c122c16a65d3bfc (commit)
      from  1a4e1bc3205d04fb94878696a3eadddf9a3a0ab6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5b966f1b0a0f191c7d79b1609c122c16a65d3bfc
Author: Peter Müller <peter.mueller(a)ipfire.org>
Date:   Tue Apr 19 13:57:35 2022 +0000

    linux: Disable LSM for /dev/io port access
    
    flashrom needs access to /dev/io ports for flashing firmware, a
    functionality we cannot cease to support. Therefore, LSM constraints are
    disabled for ioport.c, hopefully permitting us to keep it enabled.
    
    Reported-by: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org>
    Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 lfs/linux                                          |  3 +++
 ...nux-5.15.32-disable_lsm_for_ioport_access.patch | 30 ++++++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 src/patches/linux/linux-5.15.32-disable_lsm_for_ioport_access.patch

Difference in files:
diff --git a/lfs/linux b/lfs/linux
index 91bba123b..0deef74f2 100644
--- a/lfs/linux
+++ b/lfs/linux
@@ -143,6 +143,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	# https://bugzilla.ipfire.org/show_bug.cgi?id=12760
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15-NFQUEUE-Hold-RCU-read-lock-while-calling-nf_reinject.patch
 
+	# Unfortunately, /dev/io access is needed for firmware flashing; patch out LSM part in ioport.c
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15.32-disable_lsm_for_ioport_access.patch
+
 ifeq "$(BUILD_ARCH)" "armv6l"
 	# Apply Arm-multiarch kernel patches.
 	cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1
diff --git a/src/patches/linux/linux-5.15.32-disable_lsm_for_ioport_access.patch b/src/patches/linux/linux-5.15.32-disable_lsm_for_ioport_access.patch
new file mode 100644
index 000000000..df7521d3b
--- /dev/null
+++ b/src/patches/linux/linux-5.15.32-disable_lsm_for_ioport_access.patch
@@ -0,0 +1,30 @@
+--- linux-5.15.32.orig/arch/x86/kernel/ioport.c	2022-04-19 12:54:46.468477540 +0000
++++ linux-5.15.32/arch/x86/kernel/ioport.c	2022-04-19 12:56:21.423185714 +0000
+@@ -4,7 +4,6 @@
+  * by Linus. 32/64 bits code unification by Miguel Botón.
+  */
+ #include <linux/capability.h>
+-#include <linux/security.h>
+ #include <linux/syscalls.h>
+ #include <linux/bitmap.h>
+ #include <linux/ioport.h>
+@@ -70,8 +69,7 @@
+ 
+ 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
+ 		return -EINVAL;
+-	if (turn_on && (!capable(CAP_SYS_RAWIO) ||
+-			security_locked_down(LOCKDOWN_IOPORT)))
++	if (turn_on && (!capable(CAP_SYS_RAWIO)))
+ 		return -EPERM;
+ 
+ 	/*
+@@ -186,8 +184,7 @@
+ 
+ 	/* Trying to gain more privileges? */
+ 	if (level > old) {
+-		if (!capable(CAP_SYS_RAWIO) ||
+-		    security_locked_down(LOCKDOWN_IOPORT))
++		if (!capable(CAP_SYS_RAWIO))
+ 			return -EPERM;
+ 	}
+ 


hooks/post-receive
--
IPFire 2.x development tree