Systems in lockdown mode should block the kexec of untrusted kernels. For x86 and ARM we can ensure that a kernel is trustworthy by validating a PE signature, but this isn't possible on other architectures. On those platforms we can use IMA digital signatures instead. Add a function to determine whether IMA has or will verify signatures for a given event type, and if so permit kexec_file() even if the kernel is otherwise locked down. This is restricted to cases where CONFIG_INTEGRITY_TRUSTED_KEYRING is set in order to prevent an attacker from loading additional keys at runtime.
Showing the changes to include/linux (1 of 5 files). Show all
Unified · Split
| @@ -129,4 +129,13 @@ static inline int ima_inode_removexattr(struct dentry *dentry, · 128 unmodified lines | |||
| 129 | return 0; | 129 | return 0; |
| 130 | } | 130 | } |
| 131 | #endif /* CONFIG_IMA_APPRAISE */ | 131 | #endif /* CONFIG_IMA_APPRAISE */ |
| 132 | |||
| 133 | #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING) | ||
| 134 | extern bool ima_appraise_signature(enum kernel_read_file_id func); | ||
| 135 | #else | ||
| 136 | static inline bool ima_appraise_signature(enum kernel_read_file_id func) | ||
| 137 | { | ||
| 138 | return false; | ||
| 139 | } | ||
| 140 | #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */ | ||
| 132 | #endif /* _LINUX_IMA_H */ | 141 | #endif /* _LINUX_IMA_H */ |