lkml.org 
[lkml]   [2018]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH 0/3] kexec: limit kexec_load syscall
Date
In environments that require the kexec kernel image to be signed, prevent
using the kexec_load syscall. In order for LSMs and IMA to differentiate
between kexec_load and kexec_file_load syscalls, this patch set adds a
call to security_kernel_read_file() in kexec_load_check().

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

Mimi Zohar (3):
ima: based on the "secure_boot" policy limit syscalls
kexec: call LSM hook for kexec_load syscall
ima: based on policy require signed kexec kernel images

kernel/kexec.c | 11 +++++++++++
security/integrity/ima/ima.h | 1 +
security/integrity/ima/ima_main.c | 9 +++++++++
security/integrity/ima/ima_policy.c | 27 ++++++++++++++++++++-------
4 files changed, 41 insertions(+), 7 deletions(-)

--
2.7.5

\
 
 \ /
  Last update: 2018-04-13 00:42    [W:0.155 / U:0.704 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site