On Thu, Jun 20, 2019 at 11:43 PM Dave Young <[email protected]> wrote: > > On 03/26/19 at 11:27am, Matthew Garrett wrote: > > From: Jiri Bohac <[email protected]> > > > > When KEXEC_SIG is not enabled, kernel should not load images through > > kexec_file systemcall if the kernel is locked down. > > > > [Modified by David Howells to fit with modifications to the previous patch > > and to return -EPERM if the kernel is locked down for consistency with > > other lockdowns. Modified by Matthew Garrett to remove the IMA > > integration, which will be replaced by integrating with the IMA > > architecture policy patches.] > > > > Signed-off-by: Jiri Bohac <[email protected]> > > Signed-off-by: David Howells <[email protected]> > > Signed-off-by: Matthew Garrett <[email protected]> > > Reviewed-by: Jiri Bohac <[email protected]> > > cc: [email protected] > > --- > > kernel/kexec_file.c | 6 ++++++ > > 1 file changed, 6 insertions(+) > > > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c > > index 67f3a866eabe..a1cc37c8b43b 100644 > > --- a/kernel/kexec_file.c > > +++ b/kernel/kexec_file.c > > @@ -239,6 +239,12 @@ kimage_file_prepare_segments(struct kimage *image, int > > kernel_fd, int initrd_fd, > > } > > > > ret = 0; > > + > > + if (kernel_is_locked_down(reason, LOCKDOWN_INTEGRITY)) { > > + ret = -EPERM; > > + goto out; > > + } > > + > > Checking here is late, it would be good to move the check to earlier > code around below code: > /* We only trust the superuser with rebooting the system. */ > if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) > return -EPERM;
I don't think so - we want it to be possible to load images if they have a valid signature.
