linux-kernel - Re: [PATCH] kexec: Disable at runtime if the kernel enforces module signing

Open Source and information security mailing list archives

Message-ID: <20130809110200.GA9631@redhat.com>
Date:	Fri, 9 Aug 2013 07:02:00 -0400
From:	Vivek Goyal <vgoyal@...hat.com>
To:	Matthew Garrett <matthew.garrett@...ula.com>
Cc:	ebiederm@...ssion.com, kexec@...ts.infradead.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kexec: Disable at runtime if the kernel enforces module
 signing

On Fri, Aug 09, 2013 at 03:36:37AM -0400, Matthew Garrett wrote:
> kexec permits the loading and execution of arbitrary code in ring 0, which
> is something that module signing enforcement is meant to prevent. It makes
> sense to disable kexec in this situation.
> 

But in the process we wipe out running kernel's context and boot into a new
kernel. So how different it is than root booting a new kernel through BIOS
which does not enforce module signing.

Also it would be nice if we introduce new features, then we make other
features work with those new features instead of disabling existing
features and leave it to other people to make them work.

Thanks
Vivek

> Signed-off-by: Matthew Garrett <matthew.garrett@...ula.com>
> ---
>  include/linux/module.h |  4 ++++
>  kernel/kexec.c         | 10 ++++++++++
>  kernel/module.c        |  4 ++--
>  3 files changed, 16 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/module.h b/include/linux/module.h
> index 46f1ea0..2871ab2 100644
> --- a/include/linux/module.h
> +++ b/include/linux/module.h
> @@ -29,6 +29,10 @@
>  
>  #define MODULE_NAME_LEN MAX_PARAM_PREFIX_LEN
>  
> +#ifdef CONFIG_MODULE_SIG
> +extern bool sig_enforce;
> +#endif
> +
>  struct modversion_info
>  {
>  	unsigned long crc;
> diff --git a/kernel/kexec.c b/kernel/kexec.c
> index 59f7b55..297a268a 100644
> --- a/kernel/kexec.c
> +++ b/kernel/kexec.c
> @@ -32,6 +32,7 @@
>  #include <linux/vmalloc.h>
>  #include <linux/swap.h>
>  #include <linux/syscore_ops.h>
> +#include <linux/module.h>
>  
>  #include <asm/page.h>
>  #include <asm/uaccess.h>
> @@ -1645,6 +1646,15 @@ int kernel_kexec(void)
>  		goto Unlock;
>  	}
>  
> +#ifdef CONFIG_MODULE_SIG
> +	/*
> +	 * Kexec makes it trivial to evade module signing, so forbid it when
> +	 * the kernel requires signatures
> +	 */
> +	if (sig_enforce)
> +		return -EPERM;
> +#endif
> +
>  #ifdef CONFIG_KEXEC_JUMP
>  	if (kexec_image->preserve_context) {
>  		lock_system_sleep();
> diff --git a/kernel/module.c b/kernel/module.c
> index 2069158..58f6e21 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -109,9 +109,9 @@ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */
>  
>  #ifdef CONFIG_MODULE_SIG
>  #ifdef CONFIG_MODULE_SIG_FORCE
> -static bool sig_enforce = true;
> +bool sig_enforce = true;
>  #else
> -static bool sig_enforce = false;
> +bool sig_enforce = false;
>  
>  static int param_set_bool_enable_only(const char *val,
>  				      const struct kernel_param *kp)
> -- 
> 1.8.3.1
> 
> 
> _______________________________________________
> kexec mailing list
> kexec@...ts.infradead.org
> http://lists.infradead.org/mailman/listinfo/kexec
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives