Received: by 2002:a25:f815:0:0:0:0:0 with SMTP id u21csp3183167ybd; Mon, 24 Jun 2019 21:11:09 -0700 (PDT) X-Google-Smtp-Source: APXvYqzvIg4zxg7jxbLoVjyVW0Z2rdbnupWBm0m55HQfglL3aqAvfa/47ras9+Pv0YNYQZEwPcQE X-Received: by 2002:a17:90a:e38f:: with SMTP id b15mr29748004pjz.85.1561435869544; Mon, 24 Jun 2019 21:11:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561435869; cv=none; d=google.com; s=arc-20160816; b=weKYltdq0DTUgcrbwGwHuc2WYeE3iC0afqv0V9mnQXxzkuv8houN2iqQxpy+h3tEvq pOdFmLaNRkFFT29qb7TSnItLaxDkEKXUd9RVMsrUUyW6aJkV4d0pKidwXTVT4s/jDdFi cPZIOQnyZVNYQVEs/0C9qMAqqbiVQxktDcGSMKIeCvjP3qWjVZU/ub/aV1HgK1eGhfoz DCn86NSZZJDY8vBjdr2Aiq0I+JMS98Gh2Zs+fpOmAvvFN0hiY6wfNRRdzqJnbbwg0vfG nKywbMw1wzLbIZgPmogDKzitfiD+syZIpwZcKioXiW+6sP6LZEAj0y2sEwpxQUi1/wYP vesg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=QubQvg8hBpXezPjqCa6rKFIOsg4swgL7syrH7aWSnis=; b=ODGCNaHbEleodFlJAQYLqeuKHtnAB9c2nqXNGOE3wm+pW+M1ltP/sgC5hYCiA1jcmf QVqZ8SRTPNrvTxyMN3QM21Xr+JmUb+dBv7gg78/4YVyCaVXP6Rk6/N9bE4slBd7aiSh8 rcT/9DoazyF4XQn7ELeMqYDDEj5jjm/4bVY/zWfY6BSPD39+RrqYzN7FgVXBmMJFlgz8 faEmt5qC4F4DvIeN2Sijm4GToLOzfzGt7SkGgY5TzwuGPAQJAYOPMQo5SQ/KBJ6tDgef DcOeRc+kOLeCGK6Wyk7Z/w6ir/QNPQx7bplN0H0NqdJH4IkcSurGFxJvHV1eXRfVWZwx aQQw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 33si7041820pla.44.2019.06.24.21.10.54; Mon, 24 Jun 2019 21:11:09 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730649AbfFYCv4 (ORCPT + 99 others); Mon, 24 Jun 2019 22:51:56 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55820 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729502AbfFYCv4 (ORCPT ); Mon, 24 Jun 2019 22:51:56 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 93E3159473; Tue, 25 Jun 2019 02:51:55 +0000 (UTC) Received: from dhcp-128-65.nay.redhat.com (ovpn-12-89.pek2.redhat.com [10.72.12.89]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 298936085B; Tue, 25 Jun 2019 02:51:51 +0000 (UTC) Date: Tue, 25 Jun 2019 10:51:48 +0800 From: Dave Young To: Matthew Garrett Cc: James Morris , Jiri Bohac , Linux API , kexec@lists.infradead.org, Linux Kernel Mailing List , David Howells , LSM List , Andy Lutomirski Subject: Re: [PATCH V31 07/25] kexec_file: Restrict at runtime if the kernel is locked down Message-ID: <20190625025148.GA4024@dhcp-128-65.nay.redhat.com> References: <20190326182742.16950-1-matthewgarrett@google.com> <20190326182742.16950-8-matthewgarrett@google.com> <20190621064340.GB4528@localhost.localdomain> <20190624015206.GB2976@dhcp-128-65.nay.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.3 (2019-02-01) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 25 Jun 2019 02:51:55 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 06/24/19 at 02:06pm, Matthew Garrett wrote: > On Sun, Jun 23, 2019 at 6:52 PM Dave Young wrote: > > > > On 06/21/19 at 01:18pm, Matthew Garrett wrote: > > > I don't think so - we want it to be possible to load images if they > > > have a valid signature. > > > > I know it works like this way because of the previous patch. But from > > the patch log "When KEXEC_SIG is not enabled, kernel should not load > > images", it is simple to check it early for !IS_ENABLED(CONFIG_KEXEC_SIG) && > > kernel_is_locked_down(reason, LOCKDOWN_INTEGRITY) instead of depending > > on the late code to verify signature. In that way, easier to > > understand the logic, no? > > But that combination doesn't enforce signature validation? We can't > depend on !IS_ENABLED(CONFIG_KEXEC_SIG_FORCE) because then it'll > enforce signature validation even if lockdown is disabled. Ok, got your point. still something could be improved though, in the switch chunk, the errno, reason and IS_ENABLED(CONFIG_KEXEC_SIG_FORCE) etc is not necessary for this -EPERM case. /* add some comment to describe the behavior */ if (ret && security_is_locked_down(LOCKDOWN_KEXEC)) { ret = -EPERM; goto out; } Thanks Dave