lkml.org 
[lkml]   [2023]   [Jul]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] kexec_file: ima: allow loading a kernel with its IMA signature verified
Date
When IMA has verified the signature of the kernel image, kexec'ing this
kernel should be allowed.

Fixes: af16df54b89d ("ima: force signature verification when CONFIG_KEXEC_SIG is configured")
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
kernel/kexec_file.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 881ba0d1714c..96fce001fbc0 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -162,6 +162,13 @@ kimage_validate_signature(struct kimage *image)
ret = kexec_image_verify_sig(image, image->kernel_buf,
image->kernel_buf_len);
if (ret) {
+ /*
+ * If the kernel image already has its IMA signature verified, permit it.
+ */
+ if (ima_appraise_signature(READING_KEXEC_IMAGE)) {
+ pr_notice("The kernel image already has its IMA signature verified.\n");
+ return 0;
+ }

if (sig_enforce) {
pr_notice("Enforced kernel signature verification failed (%d).\n", ret);
@@ -169,12 +176,9 @@ kimage_validate_signature(struct kimage *image)
}

/*
- * If IMA is guaranteed to appraise a signature on the kexec
- * image, permit it even if the kernel is otherwise locked
- * down.
+ * When both IMA and KEXEC_SIG fail in lockdown mode, reject it.
*/
- if (!ima_appraise_signature(READING_KEXEC_IMAGE) &&
- security_locked_down(LOCKDOWN_KEXEC))
+ if (security_locked_down(LOCKDOWN_KEXEC))
return -EPERM;

pr_debug("kernel signature verification failed (%d).\n", ret);
--
2.41.0
\
 
 \ /
  Last update: 2023-07-11 05:17    [W:0.104 / U:0.360 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site