Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755456AbbFRNay (ORCPT ); Thu, 18 Jun 2015 09:30:54 -0400 Received: from mx1.redhat.com ([209.132.183.28]:57523 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754870AbbFRNap (ORCPT ); Thu, 18 Jun 2015 09:30:45 -0400 Date: Thu, 18 Jun 2015 09:30:44 -0400 From: Vivek Goyal To: Dave Young Cc: "Eric W. Biederman" , Josh Boyer , "Theodore Ts'o" , Petr Tesarik , kexec , "Linux-Kernel@Vger. Kernel. Org" , David Howells Subject: Re: kexec_load(2) bypasses signature verification Message-ID: <20150618133044.GA1040@redhat.com> References: <20150615131728.GK15793@thunk.org> <20150615200115.GG5003@thunk.org> <87zj3zigug.fsf@x220.int.ebiederm.org> <20150616202757.GB14943@redhat.com> <87y4jjglvu.fsf@x220.int.ebiederm.org> <20150617014737.GB30214@redhat.com> <20150618011629.GA8718@dhcp-128-32.nay.redhat.com> <20150618020209.GA8390@dhcp-128-32.nay.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150618020209.GA8390@dhcp-128-32.nay.redhat.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2852 Lines: 88 On Thu, Jun 18, 2015 at 10:02:09AM +0800, Dave Young wrote: [..] > > Or simply add a new config option KEXEC_VERIFY_SIG_FORCE, so we can return > > error in kexec_load and print some error message. > > Just like below, does this work for you, Ted? > > --- > arch/x86/Kconfig | 7 +++++++ > kernel/kexec.c | 9 ++++++++- > 2 files changed, 15 insertions(+), 1 deletion(-) > > --- linux.orig/arch/x86/Kconfig > +++ linux/arch/x86/Kconfig > @@ -1755,6 +1755,13 @@ config KEXEC_VERIFY_SIG > verification for the corresponding kernel image type being > loaded in order for this to work. > > +config KEXEC_VERIFY_SIG_FORCE > + bool "Enforce kexec signature verifying" > + depends on KEXEC_VERIFY_SIG > + ---help--- > + This option disable kexec_load() syscall, only kexec_file_load > + can be used. > + Hi Dave, I think we might not need a new config option. A new config option makes it little confusing. KEXEC_VERIFY_SIG already implies KEXEC_VERIFY_SIG_FORCE (for new syscall). Now extending it to also mean that it should disable old syscall is confusing. We already have a sysctl knob to disable kexec kernel loading. But that knob disables it on both the syscalls. May be we can just introduce another command line option say "kexec_verify_sig_force" and this will work across both the syscalls and will deny loading a unsigned kernel in following two cases. - Using old syscall - Using new syscall if kernel was compiled with KEXEC_VERIFY_SIG=n. This should be simple and get us going in short term. If we want to disable unsigned kernel loading at compile time, then we really need to work on decoupling CONFIG_KEXEC and CONFIG_FILE_KEXEC. Introducing another config option is not the way forward, IMHO. Thanks Vivek > config KEXEC_BZIMAGE_VERIFY_SIG > bool "Enable bzImage signature verification support" > depends on KEXEC_VERIFY_SIG > --- linux.orig/kernel/kexec.c > +++ linux/kernel/kexec.c > @@ -45,6 +45,12 @@ > #include > #include > > +#ifdef CONFIG_KEXEC_VERIFY_SIG_FORCE > +static bool kexec_verify_sig_force = true; > +#else > +static bool kexec_verify_sig_force; > +#endif > + > /* Per cpu memory for storing cpu states in case of system crash. */ > note_buf_t __percpu *crash_notes; > > @@ -1243,7 +1249,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon > int result; > > /* We only trust the superuser with rebooting the system. */ > - if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) > + if (!capable(CAP_SYS_BOOT) || kexec_load_disabled > + || kexec_verify_sig_force) > return -EPERM; > > /* -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/