[CIQ 6.12.y] additional SecureBoot Lockdown patches

[PlaidCat]

Per the request here: rhboot/shim-review#455 (comment)
For the kernel.org Mainline / LongTerm kernels you need either CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y OR these patches currently carried by Debian: https://salsa.debian.org/kernel-team/linux/-/tree/debian/latest/debian/patches/features/all/lockdown?ref_type=heads

Since CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y Impacts non-secureboot users we opted for the patches from Debian and not carried in the usptream kernel.

This built and ran but I don't think I can test it fully until we have stuff setup for secureboot so these may not be the final forms of these patches and may require others (that we're currently unaware of)

Note the current SHA's are a little different from logs shown due to adding in a CIQ header to make sure we trace back to the original patch locations that we're aware of.

Patch application

The Debian patches come from here: https://salsa.debian.org/kernel-team/linux/-/tree/78c8af872660c31779951583b6f1ebf283d95985/debian/patches/features/all/lockdown
Since this is for the 6.12.y kernel the HEAD at time of writing needed debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch updated to 6.13-rc1 to get the next oldest version I looked at the history of the path and saw that the last modified content for the directory was for 6.12-rc2 so I used 78c8af872660c31779951583b6f1ebf283d95985 as the commit sha in the CIQ header for the kernel entry. Everywhere else this corresponds to a git commit but this commit is a normal drop/refresh commit if you manage patches outside of the tree.

So to apply these I just checked out the sha listed above and in the commits of the patches in this PR and did a normal git am --signoff for all the patches in that directory. They applied cleanly and did not require fixing.

$ git am --signoff ../debian-kernel/debian/patches/features/all/lockdown/*

$ pushd ../debian-kernel/debian/patches/features/all/lockdown/
~/workspace/ciq_kernel/debian-kernel/debian/patches/features/all/lockdown ~/workspace/ciq_kernel/kernel-src-tree
$ git branch
* (HEAD detached at 78c8af8726)
  debian/latest

Future 6.12.y updates

CIQ plans on rebasing our kernel on top of the latest stable v6.12.y kernel on regular intervals thus we will encounter merge issues when a problem arises and will require that to be fixed in place so these commits for the Debain patches will only ever be once but they may diverge from upstream (the Debian SHA). When this occurs we'll include a method of documenting the merge conflicts and resolutions.

Update

We investigated the fedora kernel-ark lockdown changes and found that some of them are very similar to Debian specifically these efi,lockdown: fix kernel lockdown on Secure Boot && security: lockdown: expose a hook to lock the kernel down
However since these were not pointed out NOR as easily referenced as Debians Changes we're going to stick with the Debain patches here. Fedora is not carrying the ARM patches either so that leads us to want to use Debians.

However the EFI error changes looked helpful so we're pulling those in from fedora as well.

Update 2

Added config changes for aarch64 based on Debians settings after their LockDown Patches
https://salsa.debian.org/kernel-team/linux/-/blob/debian/latest/debian/config/config?ref_type=heads#L7762
Validated by extracting their configs here:
https://packages.debian.org/sid/amd64/linux-config-6.12/download

[jmaple@devbox linux-config-6.12]$ find . | xargs grep LOCK_DOWN 2>/dev/null
./config.amd64_none_amd64:CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
./config.amd64_none_amd64:# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
./config.amd64_none_amd64:# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
./config.amd64_none_amd64:CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
./config.amd64_none_cloud-amd64:CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
./config.amd64_none_cloud-amd64:# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
./config.amd64_none_cloud-amd64:# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
./config.amd64_none_cloud-amd64:CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
./config.amd64_rt_amd64:CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
./config.amd64_rt_amd64:# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
./config.amd64_rt_amd64:# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
./config.amd64_rt_amd64:CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y

Build

/mnt/code/kernel-src-tree
  CLEAN   scripts/basic
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated .config .config.old
[TIMER]{MRPROPER}: 5s
x86_64 architecture detected, copying config
'ciq/configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-_jmaple__sb_ciq-6.12.y-27daed599f82"
Making olddefconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  HOSTCC  scripts/kconfig/confdata.o
  HOSTCC  scripts/kconfig/expr.o
  LEX     scripts/kconfig/lexer.lex.c
  YACC    scripts/kconfig/parser.tab.[ch]
  HOSTCC  scripts/kconfig/lexer.lex.o
  HOSTCC  scripts/kconfig/menu.o
  HOSTCC  scripts/kconfig/parser.tab.o
  HOSTCC  scripts/kconfig/preprocess.o
  HOSTCC  scripts/kconfig/symbol.o
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  GEN     arch/x86/include/generated/asm/orc_hash.h
  WRAP    arch/x86/include/generated/uapi/asm/errno.h
  
[SNIP]

  BTF [M] net/hsr/hsr.ko
  BTF [M] net/qrtr/qrtr-mhi.ko
[TIMER]{BUILD}: 1921s
Making Modules
  SYMLINK /lib/modules/6.12.15-_jmaple__sb_ciq-6.12.y-27daed599f82+/build
  INSTALL /lib/modules/6.12.15-_jmaple__sb_ciq-6.12.y-27daed599f82+/modules.order

[SNIP]

  INSTALL /lib/modules/6.12.15-_jmaple__sb_ciq-6.12.y-27daed599f82+/kernel/net/qrtr/qrtr-mhi.ko
  STRIP   /lib/modules/6.12.15-_jmaple__sb_ciq-6.12.y-27daed599f82+/kernel/net/qrtr/qrtr-mhi.ko
  SIGN    /lib/modules/6.12.15-_jmaple__sb_ciq-6.12.y-27daed599f82+/kernel/net/qrtr/qrtr-mhi.ko
  DEPMOD  /lib/modules/6.12.15-_jmaple__sb_ciq-6.12.y-27daed599f82+
[TIMER]{MODULES}: 36s
Making Install
  INSTALL /boot
[TIMER]{INSTALL}: 23s
Setting Default Kernel to /boot/vmlinuz-6.12.15-_jmaple__sb_ciq-6.12.y-4e5411d06b62+ and Index to 3
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 5s
[TIMER]{BUILD}: 1921s
[TIMER]{MODULES}: 36s
[TIMER]{INSTALL}: 23s
[TIMER]{TOTAL} 1992s
Rebooting in 10 seconds

Kselftest

Previous
$ grep '^ok ' 6.12.15-_jmaple__ciq-6.12.y-b3fa7c3036f6+.kselftest.log | wc -l
522

Current
$ grep '^ok ' 6.12.15-_jmaple__sb_ciq-6.12.y-4e5411d06b62+.kselftest.log | wc -l
522

6.12.15-_jmaple__ciq-6.12.y-b3fa7c3036f6+.kselftest.log

6.12.15-_jmaple__sb_ciq-6.12.y-4e5411d06b62+.kselftest.log

[bmastbergen]

🥌

[elguero]

Changes LGTM and look sane. A second approval from @jason-rodri would be good before merging.