2022-02-10 14:20:07

by Michal Suchánek

Subject: [PATCH] kexec: move KEXEC_SIG_FORCE from arch/x86 to arch

There is nothing x86-specific about KEXEC_SIG_FORCE

Signed-off-by: Michal Suchanek <[email protected]>
---
arch/Kconfig | 7 +++++++
arch/x86/Kconfig | 7 -------
2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/arch/Kconfig b/arch/Kconfig
index 678a80713b21..dc2446f01ac1 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -24,6 +24,13 @@ config KEXEC_ELF
config HAVE_IMA_KEXEC
bool

+config KEXEC_SIG_FORCE
+ bool "Require a valid signature in kexec_file_load() syscall"
+ depends on KEXEC_SIG
+ help
+ This option makes kernel signature verification mandatory for
+ the kexec_file_load() syscall.
+
config SET_FS
bool

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9f5bd41bf660..3ea648dad6b6 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2032,13 +2032,6 @@ config KEXEC_SIG
verification for the corresponding kernel image type being
loaded in order for this to work.

-config KEXEC_SIG_FORCE
- bool "Require a valid signature in kexec_file_load() syscall"
- depends on KEXEC_SIG
- help
- This option makes kernel signature verification mandatory for
- the kexec_file_load() syscall.
-
config KEXEC_BZIMAGE_VERIFY_SIG
bool "Enable bzImage signature verification support"
depends on KEXEC_SIG
--
2.31.1

2022-02-10 19:46:43

by Kees Cook

Subject: Re: [PATCH] kexec: move KEXEC_SIG_FORCE from arch/x86 to arch

On Thu, Feb 10, 2022 at 02:16:48PM +0100, Michal Suchanek wrote:
> There is nothing x86-specific about KEXEC_SIG_FORCE
>
> Signed-off-by: Michal Suchanek <[email protected]>
> ---
> arch/Kconfig | 7 +++++++
> arch/x86/Kconfig | 7 -------
> 2 files changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 678a80713b21..dc2446f01ac1 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -24,6 +24,13 @@ config KEXEC_ELF
> config HAVE_IMA_KEXEC
> bool
>
> +config KEXEC_SIG_FORCE
> + bool "Require a valid signature in kexec_file_load() syscall"
> + depends on KEXEC_SIG
> + help
> + This option makes kernel signature verification mandatory for
> + the kexec_file_load() syscall.
> +
> config SET_FS
> bool
>
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 9f5bd41bf660..3ea648dad6b6 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -2032,13 +2032,6 @@ config KEXEC_SIG
> verification for the corresponding kernel image type being
> loaded in order for this to work.
>
> -config KEXEC_SIG_FORCE
> - bool "Require a valid signature in kexec_file_load() syscall"
> - depends on KEXEC_SIG
> - help
> - This option makes kernel signature verification mandatory for
> - the kexec_file_load() syscall.
> -

This means it is no longer folded under KEXEC_SIG in menuconfig,
which makes it harder to find. I would prefer seeing KEXEC_SIG (and
KEXEC_SIG_FORCE) moved out of the per-arch Kconfig files into a common
location, and then arch Kconfig can add something like:

select ARCH_SUPPORTS_KEXEC

> config KEXEC_BZIMAGE_VERIFY_SIG
> bool "Enable bzImage signature verification support"
> depends on KEXEC_SIG
> --
> 2.31.1
>

--
Kees Cook