Messages in this thread Patch in this message | | | Date | Thu, 29 Aug 2013 14:14:55 -0400 (EDT) | From | Lenny Szubowicz <> | Subject | Re: [PATCH V2 08/10] kexec: Disable at runtime if the kernel enforces module loading restrictions |
| |
----- Original Message ----- > From: "Lenny Szubowicz" <lszubowi@redhat.com> > To: "Matthew Garrett" <matthew.garrett@nebula.com>, linux-kernel@vger.kernel.org > Cc: linux-efi@vger.kernel.org, jwboyer@redhat.com, keescook@chromium.org > Sent: Thursday, August 29, 2013 11:57:36 AM > Subject: Re: [PATCH V2 08/10] kexec: Disable at runtime if the kernel enforces module loading restrictions > > > > ----- Original Message ----- > > From: "Matthew Garrett" <matthew.garrett@nebula.com> > > To: linux-kernel@vger.kernel.org > > Cc: linux-efi@vger.kernel.org, jwboyer@redhat.com, keescook@chromium.org, > > "Matthew Garrett" > > <matthew.garrett@nebula.com> > > Sent: Monday, August 19, 2013 1:26:09 PM > > Subject: [PATCH V2 08/10] kexec: Disable at runtime if the kernel enforces > > module loading restrictions > > > > kexec permits the loading and execution of arbitrary code in ring 0, which > > is something that module signing enforcement is meant to prevent. It makes > > sense to disable kexec in this situation. > > > > Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> > > --- > > kernel/kexec.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/kernel/kexec.c b/kernel/kexec.c > > index 59f7b55..1a7690f 100644 > > --- a/kernel/kexec.c > > +++ b/kernel/kexec.c > > @@ -32,6 +32,7 @@ > > #include <linux/vmalloc.h> > > #include <linux/swap.h> > > #include <linux/syscore_ops.h> > > +#include <linux/module.h> > > > > #include <asm/page.h> > > #include <asm/uaccess.h> > > @@ -1645,6 +1646,9 @@ int kernel_kexec(void) > > goto Unlock; > > } > > > > + if (secure_modules()) > > + return -EPERM; > > + > > #ifdef CONFIG_KEXEC_JUMP > > if (kexec_image->preserve_context) { > > lock_system_sleep(); > > -- > > 1.8.3.1 > > > > -- > > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > > the body of a message to majordomo@vger.kernel.org > > More majordomo info at http://vger.kernel.org/majordomo-info.html > > Please read the FAQ at http://www.tux.org/lkml/ > > > > > Shouldn't that be: > > + if (secure_modules()) { > + error = -EPERM; > + goto Unlock; > + } > > -Lenny. > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ >
Also, in earlier incarnations you disallowed kexec load in secure mode. But now you allow the load. You then disallow the transfer of control to the loaded code via kernel_kexec in secure mode.
Even if there might be no risk by having untrusted code remain loaded, why not prevent it up front?
-Lenny.
| |