Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752760AbdDGDGF (ORCPT ); Thu, 6 Apr 2017 23:06:05 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47136 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751884AbdDGDF5 (ORCPT ); Thu, 6 Apr 2017 23:05:57 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 1FE667AEAE Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=dyoung@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 1FE667AEAE Date: Fri, 7 Apr 2017 11:05:45 +0800 From: Dave Young To: David Howells Cc: linux-kernel@vger.kernel.org, Matthew Garrett , linux-efi@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, Chun-Yi Lee , gregkh@linuxfoundation.org, kexec@lists.infradead.org, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, matthew.garrett@nebula.com Subject: Re: [PATCH 09/24] kexec_file: Disable at runtime if securelevel has been set Message-ID: <20170407030545.GA4296@dhcp-128-65.nay.redhat.com> References: <149142326734.5101.4596394505987813763.stgit@warthog.procyon.org.uk> <149142335441.5101.2294976563846442575.stgit@warthog.procyon.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <149142335441.5101.2294976563846442575.stgit@warthog.procyon.org.uk> User-Agent: Mutt/1.7.1 (2016-10-04) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Fri, 07 Apr 2017 03:05:56 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1458 Lines: 46 On 04/05/17 at 09:15pm, David Howells wrote: > From: Chun-Yi Lee > > When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image > through kexec_file systemcall if securelevel has been set. > > This code was showed in Matthew's patch but not in git: > https://lkml.org/lkml/2015/3/13/778 > > Cc: Matthew Garrett > Signed-off-by: Chun-Yi Lee > Signed-off-by: David Howells > cc: kexec@lists.infradead.org > --- > > kernel/kexec_file.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c > index b118735fea9d..f6937eecd1eb 100644 > --- a/kernel/kexec_file.c > +++ b/kernel/kexec_file.c > @@ -268,6 +268,12 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, > if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) > return -EPERM; > > + /* Don't permit images to be loaded into trusted kernels if we're not > + * going to verify the signature on them > + */ > + if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && kernel_is_locked_down()) > + return -EPERM; > + > /* Make sure we have a legal set of flags */ > if (flags != (flags & KEXEC_FILE_FLAGS)) > return -EINVAL; > > > _______________________________________________ > kexec mailing list > kexec@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/kexec Acked-by: Dave Young Thanks Dave