lkml.org 
[lkml]   [2022]   [Nov]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2] lockdown: kexec_file: prevent unsigned kernel image when KEXEC_SIG not enabled
    Date
    A kernel builder may not enable KEXEC_SIG and some architectures like
    ppc64 simply don't have KEXEC_SIG. In these cases, unless both
    IMA_ARCH_POLICY and secure boot also enabled, lockdown doesn't prevent
    unsigned kernel image from being kexec'ed via the kexec_file_load
    syscall whereas it could prevent one via the kexec_load syscall. Mandate
    signature verification for those cases.

    Fixes: 155bdd30af17 ("kexec_file: Restrict at runtime if the kernel is locked down")
    Cc: Matthew Garrett <mjg59@srcf.ucam.org>
    Cc: Jiri Bohac <jbohac@suse.cz>
    Cc: David Howells <dhowells@redhat.com>
    Cc: kexec@lists.infradead.org
    Cc: linux-integrity@vger.kernel.org
    Signed-off-by: Coiby Xu <coxu@redhat.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    ---
    v2
    - collect reviewed-by tag from Mimi
    - s/mandate_signatute_verification/mandate_signature_verification [Mimi]
    - return the status of kexec_image_verify_sig correctly when signature
    verification is not mandated
    ---
    kernel/kexec_file.c | 26 +++++++++++++++++---------
    1 file changed, 17 insertions(+), 9 deletions(-)

    diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
    index 45637511e0de..dcde7a50fbeb 100644
    --- a/kernel/kexec_file.c
    +++ b/kernel/kexec_file.c
    @@ -125,6 +125,17 @@ void kimage_file_post_load_cleanup(struct kimage *image)
    image->image_loader_data = NULL;
    }

    +static bool mandate_signature_verification(void)
    +{
    + /*
    + * If IMA is guaranteed to appraise a signature on the kexec
    + * image, permit it even if the kernel is otherwise locked
    + * down.
    + */
    + return !ima_appraise_signature(READING_KEXEC_IMAGE) &&
    + security_locked_down(LOCKDOWN_KEXEC);
    +}
    +
    #ifdef CONFIG_KEXEC_SIG
    #ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION
    int kexec_kernel_verify_pe_sig(const char *kernel, unsigned long kernel_len)
    @@ -168,13 +179,7 @@ kimage_validate_signature(struct kimage *image)
    return ret;
    }

    - /*
    - * If IMA is guaranteed to appraise a signature on the kexec
    - * image, permit it even if the kernel is otherwise locked
    - * down.
    - */
    - if (!ima_appraise_signature(READING_KEXEC_IMAGE) &&
    - security_locked_down(LOCKDOWN_KEXEC))
    + if (mandate_signature_verification())
    return -EPERM;

    pr_debug("kernel signature verification failed (%d).\n", ret);
    @@ -211,10 +216,13 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd,

    #ifdef CONFIG_KEXEC_SIG
    ret = kimage_validate_signature(image);
    -
    +#else
    + if (mandate_signature_verification())
    + ret = -EPERM;
    +#endif
    if (ret)
    goto out;
    -#endif
    +
    /* It is possible that there no initramfs is being loaded */
    if (!(flags & KEXEC_FILE_NO_INITRAMFS)) {
    ret = kernel_read_file_from_fd(initrd_fd, 0, &image->initrd_buf,
    --
    2.38.1
    \
     
     \ /
      Last update: 2022-11-22 03:33    [W:2.467 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site