On Fri, 2017-04-07 at 14:19 +0800, Dave Young wrote: > On 04/06/17 at 11:49pm, Mimi Zohar wrote: > > On Fri, 2017-04-07 at 11:05 +0800, Dave Young wrote: > > > On 04/05/17 at 09:15pm, David Howells wrote: > > > > From: Chun-Yi Lee <joeyli.kernel@xxxxxxxxx> > > > > > > > > When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image > > > > through kexec_file systemcall if securelevel has been set. > > > > > > > > This code was showed in Matthew's patch but not in git: > > > > https://lkml.org/lkml/2015/3/13/778 I specifically checked to make sure that either kexec_file() signature verification was acceptable and would have commented then, if it had not been included. > > > > Cc: Matthew Garrett <mjg59@xxxxxxxxxxxxx> > > > > Signed-off-by: Chun-Yi Lee <jlee@xxxxxxxx> > > > > Signed-off-by: David Howells <dhowells@xxxxxxxxxx> > > > > cc: kexec@xxxxxxxxxxxxxxxxxxx > > > > --- > > > > > > > > kernel/kexec_file.c | 6 ++++++ > > > > 1 file changed, 6 insertions(+) > > > > > > > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c > > > > index b118735fea9d..f6937eecd1eb 100644 > > > > --- a/kernel/kexec_file.c > > > > +++ b/kernel/kexec_file.c > > > > @@ -268,6 +268,12 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, > > > > if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) > > > > return -EPERM; > > > > > > > > + /* Don't permit images to be loaded into trusted kernels if we're not > > > > + * going to verify the signature on them > > > > + */ > > > > + if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && kernel_is_locked_down()) > > > > + return -EPERM; > > > > + > > > > > > > > IMA can be used to verify file signatures too, based on the LSM hooks > > in kernel_read_file_from_fd(). CONFIG_KEXEC_VERIFY_SIG should not be > > required. > > Mimi, I remember we talked somthing before about the two signature > verification. One can change IMA policy in initramfs userspace, > also there are kernel cmdline param to disable IMA, so it can break the > lockdown? Suppose kexec boot with ima disabled cmdline param and then > kexec reboot again.. Right, we discussed that the same method of measuring the kexec image and initramfs, for extending trusted boot to the OS, could also be used for verifying the kexec image and initramfs signatures, for extending secure boot to the OS. The file hash would be calculated once for both. All of your concerns could be addressed with very minor changes to IMA. (Continued in response to David.) > > > > > /* Make sure we have a legal set of flags */ > > > > if (flags != (flags & KEXEC_FILE_FLAGS)) > > > > return -EINVAL; > > > > > > > > > > > > _______________________________________________ > > > > kexec mailing list > > > > kexec@xxxxxxxxxxxxxxxxxxx > > > > http://lists.infradead.org/mailman/listinfo/kexec > > > > > > Acked-by: Dave Young <dyoung@xxxxxxxxxx> > > > > > > Thanks > > > Dave > > > -- > > > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > > > the body of a message to majordomo@xxxxxxxxxxxxxxx > > > More majordomo info at http://vger.kernel.org/majordomo-info.html > > > > > > -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
