[PATCH] ima: Use KEXEC_SIG_FORCE for rejecting unsigned kexec images
Chi Wang <[email protected]>
| Newsgroups | org.kernel.vger.linux-integrity,org.kernel.vger.linux-kernel,org.kernel.vger.linux-security-module |
|---|---|
| Message-ID | <[email protected]> |
From: Chi Wang <[email protected]> Following the split of KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE, only KEXEC_SIG_FORCE indicates that unsigned kernel images must be rejected. KEXEC_SIG alone enables signature verification but permits unsigned images, so it should not trigger the IMA appraisal denial for kexec_load. Update the condition in ima_load_data() to check for KEXEC_SIG_FORCE instead of KEXEC_SIG. Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE") Signed-off-by: Chi Wang <[email protected]> --- security/integrity/ima/ima_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 1d6229b156fb..ec70e78ab8cd 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -953,7 +953,7 @@ static int ima_load_data(enum kernel_load_data_id id, bool contents) switch (id) { case LOADING_KEXEC_IMAGE: - if (IS_ENABLED(CONFIG_KEXEC_SIG) + if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE) && arch_ima_get_secureboot()) { pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n"); return -EACCES; -- 2.25.1