lkml.org 
[lkml]   [2022]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 126/231] ima: force signature verification when CONFIG_KEXEC_SIG is configured
    Date
    From: Coiby Xu <coxu@redhat.com>

    [ Upstream commit af16df54b89dee72df253abc5e7b5e8a6d16c11c ]

    Currently, an unsigned kernel could be kexec'ed when IMA arch specific
    policy is configured unless lockdown is enabled. Enforce kernel
    signature verification check in the kexec_file_load syscall when IMA
    arch specific policy is configured.

    Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE")
    Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Coiby Xu <coxu@redhat.com>
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/linux/kexec.h | 6 ++++++
    kernel/kexec_file.c | 11 ++++++++++-
    security/integrity/ima/ima_efi.c | 2 ++
    3 files changed, 18 insertions(+), 1 deletion(-)

    diff --git a/include/linux/kexec.h b/include/linux/kexec.h
    index fcd5035209f1..8d573baaab29 100644
    --- a/include/linux/kexec.h
    +++ b/include/linux/kexec.h
    @@ -452,6 +452,12 @@ static inline int kexec_crash_loaded(void) { return 0; }
    #define kexec_in_progress false
    #endif /* CONFIG_KEXEC_CORE */

    +#ifdef CONFIG_KEXEC_SIG
    +void set_kexec_sig_enforced(void);
    +#else
    +static inline void set_kexec_sig_enforced(void) {}
    +#endif
    +
    #endif /* !defined(__ASSEBMLY__) */

    #endif /* LINUX_KEXEC_H */
    diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
    index c108a2a88754..bb0fb63f563c 100644
    --- a/kernel/kexec_file.c
    +++ b/kernel/kexec_file.c
    @@ -29,6 +29,15 @@
    #include <linux/vmalloc.h>
    #include "kexec_internal.h"

    +#ifdef CONFIG_KEXEC_SIG
    +static bool sig_enforce = IS_ENABLED(CONFIG_KEXEC_SIG_FORCE);
    +
    +void set_kexec_sig_enforced(void)
    +{
    + sig_enforce = true;
    +}
    +#endif
    +
    static int kexec_calculate_store_digests(struct kimage *image);

    /*
    @@ -159,7 +168,7 @@ kimage_validate_signature(struct kimage *image)
    image->kernel_buf_len);
    if (ret) {

    - if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
    + if (sig_enforce) {
    pr_notice("Enforced kernel signature verification failed (%d).\n", ret);
    return ret;
    }
    diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c
    index 71786d01946f..9db66fe310d4 100644
    --- a/security/integrity/ima/ima_efi.c
    +++ b/security/integrity/ima/ima_efi.c
    @@ -67,6 +67,8 @@ const char * const *arch_get_ima_policy(void)
    if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
    if (IS_ENABLED(CONFIG_MODULE_SIG))
    set_module_sig_enforced();
    + if (IS_ENABLED(CONFIG_KEXEC_SIG))
    + set_kexec_sig_enforced();
    return sb_arch_rules;
    }
    return NULL;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-07-19 15:01    [W:3.558 / U:0.308 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site