Currently, an unsigned kernel could be kexec'ed when IMA arch specific policy is configured unless lockdown is enabled. Enforce kernel signature verification check in the kexec_file_load syscall when IMA arch specific policy is configured.
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -452,6 +452,12 @@ static inline int kexec_crash_loaded(void) { return 0; } · 451 unmodified lines | |||
| 452 | #define kexec_in_progress false | 452 | #define kexec_in_progress false |
| 453 | #endif /* CONFIG_KEXEC_CORE */ | 453 | #endif /* CONFIG_KEXEC_CORE */ |
| 454 | 454 | ||
| 455 | #ifdef CONFIG_KEXEC_SIG | ||
| 456 | void set_kexec_sig_enforced(void); | ||
| 457 | #else | ||
| 458 | static inline void set_kexec_sig_enforced(void) {} | ||
| 459 | #endif | ||
| 460 | |||
| 455 | #endif /* !defined(__ASSEBMLY__) */ | 461 | #endif /* !defined(__ASSEBMLY__) */ |
| 456 | 462 | ||
| 457 | #endif /* LINUX_KEXEC_H */ | 463 | #endif /* LINUX_KEXEC_H */ |