Re: [RFC PATCH v4 7/8] ima: based on policy prevent loading firmware (pre-allocated buffer)

2018-06-05 Thread Ard Biesheuvel
On 6 June 2018 at 00:37, Kees Cook wrote: > On Fri, Jun 1, 2018 at 12:25 PM, Luis R. Rodriguez wrote: >> On Fri, Jun 01, 2018 at 09:15:45PM +0200, Luis R. Rodriguez wrote: >>> On Tue, May 29, 2018 at 02:01:59PM -0400, Mimi Zohar wrote: >>> > Some systems are memory constrained but they need to lo

Re: panic kexec broken on ARM64?

2018-06-05 Thread Bhupesh Sharma
Hello Petr, On Tue, Jun 5, 2018 at 1:31 PM, Petr Tesarik wrote: > Hi all, > > I have observed hangs after crash on a Raspberry Pi 3 Model B+ board > when a panic kernel is loaded. I attached a hardware debugger and found > out that all CPU cores were stopped except one which was stuck in the > id

Re: [PATCH v4a 8/8] module: replace the existing LSM hook in init_module

2018-06-05 Thread Mimi Zohar
On Tue, 2018-06-05 at 15:26 -0700, Kees Cook wrote: > On Tue, Jun 5, 2018 at 2:35 PM, Mimi Zohar wrote: > > On Tue, 2018-06-05 at 12:45 -0700, Kees Cook wrote: > > > >> And if you must have a separate enum, please change this to fail > >> closed instead of open (and mark the fall-through): > >> >

Re: [RFC PATCH v4 7/8] ima: based on policy prevent loading firmware (pre-allocated buffer)

2018-06-05 Thread Kees Cook
On Fri, Jun 1, 2018 at 12:25 PM, Luis R. Rodriguez wrote: > On Fri, Jun 01, 2018 at 09:15:45PM +0200, Luis R. Rodriguez wrote: >> On Tue, May 29, 2018 at 02:01:59PM -0400, Mimi Zohar wrote: >> > Some systems are memory constrained but they need to load very large >> > firmwares. The firmware subs

Re: [PATCH v4a 8/8] module: replace the existing LSM hook in init_module

2018-06-05 Thread Kees Cook
On Tue, Jun 5, 2018 at 2:35 PM, Mimi Zohar wrote: > On Tue, 2018-06-05 at 12:45 -0700, Kees Cook wrote: > >> And if you must have a separate enum, please change this to fail >> closed instead of open (and mark the fall-through): >> >> int rc = -EPERM; >> >> switch (id) { >> case LOADING_MODULE: >>

Re: [PATCH v4a 8/8] module: replace the existing LSM hook in init_module

2018-06-05 Thread Mimi Zohar
On Tue, 2018-06-05 at 12:45 -0700, Kees Cook wrote: > And if you must have a separate enum, please change this to fail > closed instead of open (and mark the fall-through): > > int rc = -EPERM; > > switch (id) { > case LOADING_MODULE: > rc = loadpin_read_file(NULL, READING_MODULE); > /*

Re: [PATCH v4a 8/8] module: replace the existing LSM hook in init_module

2018-06-05 Thread Kees Cook
On Thu, May 31, 2018 at 8:23 AM, Mimi Zohar wrote: > diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c > index 5fa191252c8f..a9c07bfbc338 100644 > --- a/security/loadpin/loadpin.c > +++ b/security/loadpin/loadpin.c > @@ -173,9 +173,24 @@ static int loadpin_read_file(struct file

Re: panic kexec broken on ARM64?

2018-06-05 Thread James Morse
Hi Petr, (CC: +Akashi, Marc) On 05/06/18 09:01, Petr Tesarik wrote: > I have observed hangs after crash on a Raspberry Pi 3 Model B+ board > when a panic kernel is loaded. kdump is a best-effort thing, it looks like this is a case where the crashed-kernel can't tear itself down. Do you have the

Re: [PATCH v4 0/8] kexec/firmware: support system wide policy requiring signatures

2018-06-05 Thread Mimi Zohar
On Tue, 2018-06-05 at 06:43 -0700, Kees Cook wrote: > On Tue, Jun 5, 2018 at 6:25 AM, Serge E. Hallyn wrote: > > Quoting Kees Cook (keesc...@chromium.org): > >> On Mon, Jun 4, 2018 at 9:09 PM, Serge E. Hallyn wrote: > >> > Personally I agree with Eric and prefer a new hook. I don't feel > >> >

Re: [PATCH v4 0/8] kexec/firmware: support system wide policy requiring signatures

2018-06-05 Thread Kees Cook
On Tue, Jun 5, 2018 at 6:25 AM, Serge E. Hallyn wrote: > Quoting Kees Cook (keesc...@chromium.org): >> On Mon, Jun 4, 2018 at 9:09 PM, Serge E. Hallyn wrote: >> > Personally I agree with Eric and prefer a new hook. I don't feel strongly >> > enough about it to keep bikeshedding, but since this s

Re: [PATCH v4 0/8] kexec/firmware: support system wide policy requiring signatures

2018-06-05 Thread Serge E. Hallyn
Quoting Kees Cook (keesc...@chromium.org): > On Mon, Jun 4, 2018 at 9:09 PM, Serge E. Hallyn wrote: > > Personally I agree with Eric and prefer a new hook. I don't feel strongly > > enough about it to keep bikeshedding, but since this set already exists, > > it seems like the way to go. > > And

Re: [PATCH v4 0/8] kexec/firmware: support system wide policy requiring signatures

2018-06-05 Thread Kees Cook
On Mon, Jun 4, 2018 at 9:09 PM, Serge E. Hallyn wrote: > Personally I agree with Eric and prefer a new hook. I don't feel strongly > enough about it to keep bikeshedding, but since this set already exists, > it seems like the way to go. And the new hook is "load stuff without a file descriptor"?

panic kexec broken on ARM64?

2018-06-05 Thread Petr Tesarik
Hi all, I have observed hangs after crash on a Raspberry Pi 3 Model B+ board when a panic kernel is loaded. I attached a hardware debugger and found out that all CPU cores were stopped except one which was stuck in the idle thread. It seems that irq_set_irqchip_state() may sleep, which is definite