[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20200527101618.jgbxbk5ooiaett43@dwarf.suse.cz>
Date: Wed, 27 May 2020 12:16:18 +0200
From: Jiri Bohac <jbohac@...e.cz>
To: lijiang <lijiang@...hat.com>
Cc: linux-kernel@...r.kernel.org, kexec@...ts.infradead.org,
ebiederm@...ssion.com, jmorris@...ei.org, mjg59@...gle.com,
dyoung@...hat.com, bhe@...hat.com
Subject: Re: [PATCH] kexec: Do not verify the signature without the lockdown
or mandatory signature
On Wed, May 27, 2020 at 12:08:12PM +0800, lijiang wrote:
> Or the following change looks better? What's your opinion?
>
> static int
> kimage_validate_signature(struct kimage *image)
> {
> int ret;
>
> ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
> image->kernel_buf_len);
> if (ret) {
>
> if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
> pr_notice("Enforced kernel signature verification failed (%d).\n", ret);
> return ret;
> }
>
> /*
> * If IMA is guaranteed to appraise a signature on the kexec
> * image, permit it even if the kernel is otherwise locked
> * down.
> */
> if (!ima_appraise_signature(READING_KEXEC_IMAGE) &&
> security_locked_down(LOCKDOWN_KEXEC))
> return -EPERM;
>
> pr_debug("kernel signature verification failed (%d).\n", ret);
> }
>
> return 0;
> }
Looks good to me, thanks!
--
Jiri Bohac <jbohac@...e.cz>
SUSE Labs, Prague, Czechia
Powered by blists - more mailing lists