ima: force signature verification when CONFIG_KEXEC_SIG is configured

Currently, an unsigned kernel could be kexec'ed when IMA arch specific policy is configured unless lockdown is enabled. Enforce kernel signature verification check in the kexec_file_load syscall when IMA arch specific policy is configured.

Coiby Xu committed 4 years ago

Commit af16df51 parent d2ee2cf3 files · +18 −1Browse files

Unified · Split

3 files

include/linux/kexec.h +6 −0
kernel/kexec_file.c +10 −1
security/integrity/ima/ima_efi.c +2 −0

include/linux/kexec.h+6−0

@@ -452,6 +452,12 @@ static inline int kexec_crash_loaded(void) { return 0; } · 451 unmodified lines
452	452	#define kexec_in_progress false
453	453	#endif /* CONFIG_KEXEC_CORE */
454	454
	455	+#ifdef CONFIG_KEXEC_SIG
	456	+void set_kexec_sig_enforced(void);
	457	+#else
	458	+static inline void set_kexec_sig_enforced(void) {}
	459	+#endif
	460	+
455	461	#endif /* !defined(__ASSEBMLY__) */
456	462
457	463	#endif /* LINUX_KEXEC_H */

kernel/kexec_file.c+10−1

@@ -29,6 +29,15 @@ · 28 unmodified lines
29	29	#include <linux/vmalloc.h>
30	30	#include "kexec_internal.h"
31	31
	32	+#ifdef CONFIG_KEXEC_SIG
	33	+static bool sig_enforce = IS_ENABLED(CONFIG_KEXEC_SIG_FORCE);
	34	+
	35	+void set_kexec_sig_enforced(void)
	36	+{
	37	+ sig_enforce = true;
	38	+}
	39	+#endif
	40	+
32	41	static int kexec_calculate_store_digests(struct kimage *image);
33	42
34	43	/*
@@ -159,7 +168,7 @@ kimage_validate_signature(struct kimage *image) · 124 unmodified lines
159	168	image->kernel_buf_len);
160	169	if (ret) {
161	170
162		− if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
	171	+ if (sig_enforce) {
163	172	pr_notice("Enforced kernel signature verification failed (%d).\n", ret);
164	173	return ret;
165	174	}

security/integrity/ima/ima_efi.c+2−0

@@ -67,6 +67,8 @@ const char * const *arch_get_ima_policy(void) · 66 unmodified lines
67	67	if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
68	68	if (IS_ENABLED(CONFIG_MODULE_SIG))
69	69	set_module_sig_enforced();
	70	+ if (IS_ENABLED(CONFIG_KEXEC_SIG))
	71	+ set_kexec_sig_enforced();
70	72	return sb_arch_rules;
71	73	}
72	74	return NULL;