Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 162CAC433EF for ; Mon, 13 Dec 2021 18:18:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241790AbhLMSSU (ORCPT ); Mon, 13 Dec 2021 13:18:20 -0500 Received: from smtp-out1.suse.de ([195.135.220.28]:43556 "EHLO smtp-out1.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240751AbhLMSSR (ORCPT ); Mon, 13 Dec 2021 13:18:17 -0500 Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out1.suse.de (Postfix) with ESMTP id 9378921124; Mon, 13 Dec 2021 18:18:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1639419495; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=NtQ8d+/Axp3K9ITeu3xtcjul+fARTB+MWAgeAY7ES8g=; b=G8llMkyqtSY82FpwvCQhlAcn6w1eeAAzzCKiQLREiDT2DKkX36QGiKHbeCLl6yCnTKa74+ 4lQeQOCNZD5bqLp+6OIHyhhSwqsZXESV9Q9YVUccz5RJEvIQeiFzWTuARjxhMlXYuom92/ v7Yz16k3di3NxyYQAscDXqh84O6payY= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1639419495; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=NtQ8d+/Axp3K9ITeu3xtcjul+fARTB+MWAgeAY7ES8g=; b=l+gO/DX1Vu/uXhALY45OHtc0N8cE8PsYdcruiRw0rzhYjtSwLhfrkPFCn441EcotXQWX7y 9OnYaR8zUFBuliCg== Received: from kunlun.suse.cz (unknown [10.100.128.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by relay2.suse.de (Postfix) with ESMTPS id D3257A3B83; Mon, 13 Dec 2021 18:18:14 +0000 (UTC) Date: Mon, 13 Dec 2021 19:18:13 +0100 From: Michal =?iso-8859-1?Q?Such=E1nek?= To: Nayna Cc: keyrings@vger.kernel.org, kexec@lists.infradead.org, Philipp Rudo , Mimi Zohar , Rob Herring , linux-s390@vger.kernel.org, Vasily Gorbik , Lakshmi Ramasubramanian , Heiko Carstens , Jessica Yu , linux-kernel@vger.kernel.org, David Howells , Christian Borntraeger , Luis Chamberlain , Paul Mackerras , Hari Bathini , Alexander Gordeev , linuxppc-dev@lists.ozlabs.org, Frank van der Linden , Thiago Jung Bauermann , Daniel Axtens , buendgen@de.ibm.com, Michael Ellerman , Benjamin Herrenschmidt , Christian Borntraeger , Herbert Xu , "David S. Miller" , Dmitry Kasatkin , James Morris , "Serge E. Hallyn" , Sven Schnelle , Baoquan He , linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [PATCH v2 2/6] powerpc/kexec_file: Add KEXEC_SIG support. Message-ID: <20211213181813.GV117207@kunlun.suse.cz> References: <8b30a3c6a4e845eb77f276298424811897efdebf.1637862358.git.msuchanek@suse.de> <17153a1c-86c6-6ffd-35d6-5329829661df@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <17153a1c-86c6-6ffd-35d6-5329829661df@linux.vnet.ibm.com> User-Agent: Mutt/1.10.1 (2018-07-13) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On Sun, Dec 12, 2021 at 07:46:53PM -0500, Nayna wrote: > > On 11/25/21 13:02, Michal Suchanek wrote: > > Copy the code from s390x > > > > Signed-off-by: Michal Suchanek > > --- > > arch/powerpc/Kconfig | 11 +++++++++++ > > arch/powerpc/kexec/elf_64.c | 36 ++++++++++++++++++++++++++++++++++++ > > 2 files changed, 47 insertions(+) > > > > diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig > > index ac0c515552fd..ecc1227a77f1 100644 > > --- a/arch/powerpc/Kconfig > > +++ b/arch/powerpc/Kconfig > > @@ -561,6 +561,17 @@ config KEXEC_FILE > > config ARCH_HAS_KEXEC_PURGATORY > > def_bool KEXEC_FILE > > > > +config KEXEC_SIG > > + bool "Verify kernel signature during kexec_file_load() syscall" > > + depends on KEXEC_FILE && MODULE_SIG_FORMAT > > + help > > + This option makes kernel signature verification mandatory for > > + the kexec_file_load() syscall. > > + > > Resending my last response as looks like it didn't go through mailing list > because of some wrong formatting. My apologies to those who are receiving it > twice. > > Since powerpc also supports IMA_ARCH_POLICY for kernel image signature > verification, please include the following: > > "An alternative implementation for the powerpc arch is IMA_ARCH_POLICY. It > verifies the appended kernel image signature and additionally includes both > the signed and unsigned file hashes in the IMA measurement list, extends the > IMA PCR in the TPM, and prevents blacklisted binary kernel images from being > kexec'd." It also does blacklist based on the file hash? There is a downstream patch that adds the support for the module signatures, and when the code is reused for KEXEC_SIG the blacklist also applies to it. Which kind of shows that people really want to use the IMA features but with no support on some major architectures it's not going to work. Thanks Michal