From ed3ce1b0527bc2506469e60df38404c7ed8c522e Mon Sep 17 00:00:00 2001 From: Jiri Bohac Date: Mon, 18 Feb 2019 12:44:58 +0000 Subject: [PATCH] kexec_file: Restrict at runtime if the kernel is locked down When KEXEC_SIG is not enabled, kernel should not load images through kexec_file systemcall if the kernel is locked down unless IMA can be used to validate the image. [Modified by David Howells to fit with modifications to the previous patch and to return -EPERM if the kernel is locked down for consistency with other lockdowns] Signed-off-by: Jiri Bohac Signed-off-by: David Howells Reviewed-by: Jiri Bohac Cc: Matthew Garrett cc: Chun-Yi Lee cc: kexec@lists.infradead.org Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name 0009-kexec_file-Restrict-at-runtime-if-the-kernel-is-lock.patch --- kernel/kexec_file.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 0a06e120829..aa2f8d42d46 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -237,6 +237,14 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, } ret = 0; + if (is_ima_appraise_enabled()) + break; + + if (kernel_is_locked_down(reason)) { + ret = -EPERM; + goto out; + } + break; /* All other errors are fatal, including nomem, unparseable -- 2.30.2