lkml.org 
[lkml]   [2022]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 04/87] lockdown: Fix kexec lockdown bypass with ima policy
    Date
    From: Eric Snowberg <eric.snowberg@oracle.com>

    commit 543ce63b664e2c2f9533d089a4664b559c3e6b5b upstream.

    The lockdown LSM is primarily used in conjunction with UEFI Secure Boot.
    This LSM may also be used on machines without UEFI. It can also be
    enabled when UEFI Secure Boot is disabled. One of lockdown's features
    is to prevent kexec from loading untrusted kernels. Lockdown can be
    enabled through a bootparam or after the kernel has booted through
    securityfs.

    If IMA appraisal is used with the "ima_appraise=log" boot param,
    lockdown can be defeated with kexec on any machine when Secure Boot is
    disabled or unavailable. IMA prevents setting "ima_appraise=log" from
    the boot param when Secure Boot is enabled, but this does not cover
    cases where lockdown is used without Secure Boot.

    To defeat lockdown, boot without Secure Boot and add ima_appraise=log to
    the kernel command line; then:

    $ echo "integrity" > /sys/kernel/security/lockdown
    $ echo "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig" > \
    /sys/kernel/security/ima/policy
    $ kexec -ls unsigned-kernel

    Add a call to verify ima appraisal is set to "enforce" whenever lockdown
    is enabled. This fixes CVE-2022-21505.

    Cc: stable@vger.kernel.org
    Fixes: 29d3c1c8dfe7 ("kexec: Allow kexec_file() with appropriate IMA policy when locked down")
    Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
    Acked-by: Mimi Zohar <zohar@linux.ibm.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    security/integrity/ima/ima_policy.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/security/integrity/ima/ima_policy.c
    +++ b/security/integrity/ima/ima_policy.c
    @@ -1542,6 +1542,10 @@ bool ima_appraise_signature(enum kernel_
    if (id >= READING_MAX_ID)
    return false;

    + if (id == READING_KEXEC_IMAGE && !(ima_appraise & IMA_APPRAISE_ENFORCE)
    + && security_locked_down(LOCKDOWN_KEXEC))
    + return false;
    +
    func = read_idmap[id] ?: FILE_CHECK;

    rcu_read_lock();

    \
     
     \ /
      Last update: 2022-07-27 18:39    [W:4.085 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site