Currently, an unsigned kernel could be kexec'ed when IMA arch specific policy is configured unless lockdown is enabled. Enforce kernel signature verification check in the kexec_file_load syscall when IMA arch specific policy is configured.
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -452,6 +452,12 @@ static inline int kexec_crash_loaded(void) { return 0; } · 451 unmodified lines | ||
| 452 | 452 | #define kexec_in_progress false |
| 453 | 453 | #endif /* CONFIG_KEXEC_CORE */ |
| 454 | 454 | |
| 455 | +#ifdef CONFIG_KEXEC_SIG | |
| 456 | +void set_kexec_sig_enforced(void); | |
| 457 | +#else | |
| 458 | +static inline void set_kexec_sig_enforced(void) {} | |
| 459 | +#endif | |
| 460 | + | |
| 455 | 461 | #endif /* !defined(__ASSEBMLY__) */ |
| 456 | 462 | |
| 457 | 463 | #endif /* LINUX_KEXEC_H */ |