linux-stable/security
Orlando Chamberlain 16c0b849eb efi: Correct Macmini DMI match in uefi cert quirk
commit bab715bdaa upstream.

It turns out Apple doesn't capitalise the "mini" in "Macmini" in DMI, which
is inconsistent with other model line names.

Correct the capitalisation of Macmini in the quirk for skipping loading
platform certs on T2 Macs.

Currently users get:

------------[ cut here ]------------
[Firmware Bug]: Page fault caused by firmware at PA: 0xffffa30640054000
WARNING: CPU: 1 PID: 8 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x55/0xe0
Modules linked in:
CPU: 1 PID: 8 Comm: kworker/u12:0 Not tainted 5.18.14-arch1-2-t2 #1 4535eb3fc40fd08edab32a509fbf4c9bc52d111e
Hardware name: Apple Inc. Macmini8,1/Mac-7BA5B2DFE22DDD8C, BIOS 1731.120.10.0.0 (iBridge: 19.16.15071.0.0,0) 04/24/2022
Workqueue: efi_rts_wq efi_call_rts
...
---[ end trace 0000000000000000 ]---
efi: Froze efi_rts_wq and disabled EFI Runtime Services
integrity: Couldn't get size: 0x8000000000000015
integrity: MODSIGN: Couldn't get UEFI db list
efi: EFI Runtime Services are disabled!
integrity: Couldn't get size: 0x8000000000000015
integrity: Couldn't get UEFI dbx list

Fixes: 155ca952c7 ("efi: Do not import certificates from UEFI Secure Boot for T2 Macs")
Cc: stable@vger.kernel.org
Cc: Aditya Garg <gargaditya08@live.com>
Tested-by: Samuel Jiang <chyishian.jiang@gmail.com>
Signed-off-by: Orlando Chamberlain <redecorating@protonmail.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-15 08:02:55 +02:00
..
apparmor apparmor: correct config reference to intended one 2022-07-20 13:22:19 -07:00
bpf
integrity efi: Correct Macmini DMI match in uefi cert quirk 2022-10-15 08:02:55 +02:00
keys KEYS: trusted: tpm2: Fix migratable logic 2022-06-08 14:12:13 +03:00
landlock landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER 2022-09-02 15:29:08 +02:00
loadpin LoadPin: Return EFAULT on copy_from_user() failures 2022-08-16 12:17:18 -07:00
lockdown
safesetid LSM: SafeSetID: Add setgroups() security policy handling 2022-07-15 18:24:42 +00:00
selinux selinux: implement the security_uring_cmd() LSM hook 2022-08-26 11:19:43 -04:00
smack Smack: Provide read control for io_uring_cmd 2022-08-26 14:56:35 -04:00
tomoyo LSM: Remove double path_rename hook calls for RENAME_EXCHANGE 2022-05-23 13:27:58 +02:00
yama
commoncap.c fs: support mapped mounts of mapped filesystems 2021-12-05 10:28:57 +01:00
device_cgroup.c bpf: Make BPF_PROG_RUN_ARRAY return -err instead of allow boolean 2022-01-19 12:51:30 -08:00
inode.c
Kconfig x86/retbleed: Add fine grained Kconfig knobs 2022-06-29 17:43:41 +02:00
Kconfig.hardening hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero 2022-10-12 09:39:04 +02:00
lsm_audit.c selinux: log anon inode class name 2022-05-03 16:09:03 -04:00
Makefile security: remove unneeded subdir-$(CONFIG_...) 2021-09-03 08:17:20 +09:00
min_addr.c
security.c lsm,io_uring: add LSM hooks for the new uring_cmd file op 2022-08-26 11:19:43 -04:00