From 4ba8bea41f7820e3bb1e7297c33c6d3fd0fb4a18 Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Fri, 9 Aug 2013 03:33:56 -0400 Subject: [PATCH] kexec: Disable at runtime if securelevel has been set. kexec permits the loading and execution of arbitrary code in ring 0, which permits the modification of the running kernel. Prevent this if securelevel has been set. Signed-off-by: Matthew Garrett Gbp-Pq: Topic features/all/securelevel Gbp-Pq: Name kexec-disable-at-runtime-if-securelevel-has-been-set.patch --- kernel/kexec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/kexec.c b/kernel/kexec.c index 980936a90ee..6f645e51c77 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -17,6 +17,7 @@ #include #include #include +#include #include "kexec_internal.h" @@ -193,6 +194,9 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) return -EPERM; + if (get_securelevel() > 0) + return -EPERM; + /* * Verify we have a legal set of flags * This leaves us room for future extensions. -- 2.30.2