From: Jiri Bohac Date: Mon, 18 Feb 2019 12:44:58 +0000 (+0000) Subject: kexec_file: Restrict at runtime if the kernel is locked down X-Git-Tag: archive/raspbian/5.7.6-1+rpi1^2^2^2^2^2^2^2^2^2^2^2~99 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=2266c11c3104b1d997d23f6d0af2ac8dbda901bc;p=linux.git kexec_file: Restrict at runtime if the kernel is locked down When KEXEC_SIG is not enabled, kernel should not load images through kexec_file systemcall if the kernel is locked down unless IMA can be used to validate the image. [Modified by David Howells to fit with modifications to the previous patch and to return -EPERM if the kernel is locked down for consistency with other lockdowns] Signed-off-by: Jiri Bohac Signed-off-by: David Howells Reviewed-by: Jiri Bohac Cc: Matthew Garrett cc: Chun-Yi Lee cc: kexec@lists.infradead.org Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name 0009-kexec_file-Restrict-at-runtime-if-the-kernel-is-lock.patch --- diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 5036bde1e5b..eba9f2616c2 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -234,6 +234,14 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, } ret = 0; + if (is_ima_appraise_enabled()) + break; + + if (kernel_is_locked_down(reason)) { + ret = -EPERM; + goto out; + } + break; /* All other errors are fatal, including nomem, unparseable