When IMA has verified the signature of the kernel image, kexec'ing this
kernel should be allowed.
Fixes: af16df54b89d ("ima: force signature verification when CONFIG_KEXEC_SIG is configured")
Signed-off-by: Coiby Xu <coxu@xxxxxxxxxx>
---
kernel/kexec_file.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 881ba0d1714c..96fce001fbc0 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -162,6 +162,13 @@ kimage_validate_signature(struct kimage *image)
ret = kexec_image_verify_sig(image, image->kernel_buf,
image->kernel_buf_len);
if (ret) {
+ /*
+ * If the kernel image already has its IMA signature verified, permit it.
+ */
+ if (ima_appraise_signature(READING_KEXEC_IMAGE)) {
+ pr_notice("The kernel image already has its IMA signature verified.\n");
+ return 0;
+ }
if (sig_enforce) {
pr_notice("Enforced kernel signature verification failed (%d).\n", ret);
@@ -169,12 +176,9 @@ kimage_validate_signature(struct kimage *image)
}
/*
- * If IMA is guaranteed to appraise a signature on the kexec
- * image, permit it even if the kernel is otherwise locked
- * down.
+ * When both IMA and KEXEC_SIG fail in lockdown mode, reject it.
*/
- if (!ima_appraise_signature(READING_KEXEC_IMAGE) &&
- security_locked_down(LOCKDOWN_KEXEC))
+ if (security_locked_down(LOCKDOWN_KEXEC))
return -EPERM;
pr_debug("kernel signature verification failed (%d).\n", ret);
--
2.41.0
