kexec: Disable at runtime if securelevel has been set.

kexec permits the loading and execution of arbitrary code in ring 0, which
permits the modification of the running kernel. Prevent this if securelevel
has been set.

Signed-off-by: Matthew Garrett <mjg59@srcf.ucam.org>
Gbp-Pq: Topic features/all/securelevel
Gbp-Pq: Name kexec-disable-at-runtime-if-securelevel-has-been-set.patch

diff --git a/kernel/kexec.c b/kernel/kexec.c
index 980936a90ee6ea0a9f83c195277a7c0705a8bbaa..6f645e51c77e40419e49c9d10f197d921e4202d4 100644 (file)
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -17,6 +17,7 @@
 #include <linux/syscalls.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/security.h>
 
 #include "kexec_internal.h"
 
@@ -193,6 +194,9 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
        if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)
                return -EPERM;
 
+       if (get_securelevel() > 0)
+               return -EPERM;
+
        /*
         * Verify we have a legal set of flags
         * This leaves us room for future extensions.