Commit af16df54 authored by Coiby Xu's avatar Coiby Xu Committed by Mimi Zohar
Browse files

ima: force signature verification when CONFIG_KEXEC_SIG is configured 



Currently, an unsigned kernel could be kexec'ed when IMA arch specific
policy is configured unless lockdown is enabled. Enforce kernel
signature verification check in the kexec_file_load syscall when IMA
arch specific policy is configured.

Fixes: 99d5cadf ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE")
Reported-and-suggested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarCoiby Xu <coxu@redhat.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent d2ee2cfc

include/linux/kexec.h

+6 −0
Original line number Diff line number Diff line
@@ -452,6 +452,12 @@ static inline int kexec_crash_loaded(void) { return 0; } 
#define kexec_in_progress false

#endif /* CONFIG_KEXEC_CORE */



#ifdef CONFIG_KEXEC_SIG

void set_kexec_sig_enforced(void);

#else

static inline void set_kexec_sig_enforced(void) {}

#endif



#endif /* !defined(__ASSEBMLY__) */



#endif /* LINUX_KEXEC_H */

kernel/kexec_file.c

+10 −1
Original line number Diff line number Diff line
@@ -29,6 +29,15 @@ 
#include <linux/vmalloc.h>

#include "kexec_internal.h"



#ifdef CONFIG_KEXEC_SIG

static bool sig_enforce = IS_ENABLED(CONFIG_KEXEC_SIG_FORCE);



void set_kexec_sig_enforced(void)

{

	sig_enforce = true;

}

#endif



static int kexec_calculate_store_digests(struct kimage *image);



/*
@@ -159,7 +168,7 @@ kimage_validate_signature(struct kimage *image) 
					   image->kernel_buf_len);

	if (ret) {



		if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {

		if (sig_enforce) {

			pr_notice("Enforced kernel signature verification failed (%d).\n", ret);

			return ret;

		}

security/integrity/ima/ima_efi.c

+2 −0
Original line number Diff line number Diff line
@@ -67,6 +67,8 @@ const char * const *arch_get_ima_policy(void) 
	if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {

		if (IS_ENABLED(CONFIG_MODULE_SIG))

			set_module_sig_enforced();

		if (IS_ENABLED(CONFIG_KEXEC_SIG))

			set_kexec_sig_enforced();

		return sb_arch_rules;

	}

	return NULL;