Systems in lockdown mode should block the kexec of untrusted kernels. For x86 and ARM we can ensure that a kernel is trustworthy by validating a PE signature, but this isn't possible on other architectures. On those platforms we can use IMA digital signatures instead. Add a function to determine whether IMA has or will verify signatures for a given event type, and if so permit kexec_file() even if the kernel is otherwise locked down. This is restricted to cases where CONFIG_INTEGRITY_TRUSTED_KEYRING is set in order to prevent an attacker from loading additional keys at runtime.
Showing the changes to include/linux (1 of 5 files). Show all
Unified · Split
| @@ -129,4 +129,13 @@ static inline int ima_inode_removexattr(struct dentry *dentry, · 128 unmodified lines | ||
| 129 | 129 | return 0; |
| 130 | 130 | } |
| 131 | 131 | #endif /* CONFIG_IMA_APPRAISE */ |
| 132 | + | |
| 133 | +#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING) | |
| 134 | +extern bool ima_appraise_signature(enum kernel_read_file_id func); | |
| 135 | +#else | |
| 136 | +static inline bool ima_appraise_signature(enum kernel_read_file_id func) | |
| 137 | +{ | |
| 138 | + return false; | |
| 139 | +} | |
| 140 | +#endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */ | |
| 132 | 141 | #endif /* _LINUX_IMA_H */ |