History

ima: force signature verification when CONFIG_KEXEC_SIG is configured

Currently, an unsigned kernel could be kexec'ed when IMA arch specific policy is configured unless lockdown is enabled. Enforce kernel signature verification check in the kexec_file_load syscall when IMA arch specific policy is configured.

Coiby Xu committed 4 years ago

Commit af16df51 parent d2ee2cf3 files · +18 −1Browse files

Unified · Split

3 files
  1. include/linux/kexec.h +6 −0
  2. kernel/kexec_file.c +10 −1
  3. security/integrity/ima/ima_efi.c +2 −0
include/linux/kexec.h+6−0
@@ -452,6 +452,12 @@ static inline int kexec_crash_loaded(void) { return 0; } · 451 unmodified lines
452#define kexec_in_progress false452#define kexec_in_progress false
453#endif /* CONFIG_KEXEC_CORE */453#endif /* CONFIG_KEXEC_CORE */
454 454
455#ifdef CONFIG_KEXEC_SIG
456void set_kexec_sig_enforced(void);
457#else
458static inline void set_kexec_sig_enforced(void) {}
459#endif
460
455#endif /* !defined(__ASSEBMLY__) */461#endif /* !defined(__ASSEBMLY__) */
456 462
457#endif /* LINUX_KEXEC_H */463#endif /* LINUX_KEXEC_H */
kernel/kexec_file.c+10−1
@@ -29,6 +29,15 @@ · 28 unmodified lines
29#include <linux/vmalloc.h>29#include <linux/vmalloc.h>
30#include "kexec_internal.h"30#include "kexec_internal.h"
31 31
32#ifdef CONFIG_KEXEC_SIG
33static bool sig_enforce = IS_ENABLED(CONFIG_KEXEC_SIG_FORCE);
34
35void set_kexec_sig_enforced(void)
36{
37 sig_enforce = true;
38}
39#endif
40
32static int kexec_calculate_store_digests(struct kimage *image);41static int kexec_calculate_store_digests(struct kimage *image);
33 42
34/*43/*
@@ -159,7 +168,7 @@ kimage_validate_signature(struct kimage *image) · 124 unmodified lines
159 image->kernel_buf_len);168 image->kernel_buf_len);
160 if (ret) {169 if (ret) {
161 170
162 if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {171 if (sig_enforce) {
163 pr_notice("Enforced kernel signature verification failed (%d).\n", ret);172 pr_notice("Enforced kernel signature verification failed (%d).\n", ret);
164 return ret;173 return ret;
165 }174 }
security/integrity/ima/ima_efi.c+2−0
@@ -67,6 +67,8 @@ const char * const *arch_get_ima_policy(void) · 66 unmodified lines
67 if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {67 if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
68 if (IS_ENABLED(CONFIG_MODULE_SIG))68 if (IS_ENABLED(CONFIG_MODULE_SIG))
69 set_module_sig_enforced();69 set_module_sig_enforced();
70 if (IS_ENABLED(CONFIG_KEXEC_SIG))
71 set_kexec_sig_enforced();
70 return sb_arch_rules;72 return sb_arch_rules;
71 }73 }
72 return NULL;74 return NULL;