[07/27] kexec_file: Disable at runtime if securelevel has been set

Commit Message

joeyli Oct. 26, 2017, 7:42 a.m. UTC

Hi Mimi,

Thank you for reviewing.

On Mon, Oct 23, 2017 at 11:54:43AM -0400, Mimi Zohar wrote:
> On Thu, 2017-10-19 at 15:51 +0100, David Howells wrote:
> > From: Chun-Yi Lee <[e-mail]>
> > 
> > When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image
> > through kexec_file systemcall if securelevel has been set.
> 
> The patch title and description needs to be updated to refer to
> lockdown, not securelevel.
> 
> As previously mentioned the last time these patches were posted, this
> leaves out testing to see if the integrity subsystem is enabled.
> 
> Commit 503ceaef8e2e "ima: define a set of appraisal rules requiring
> file signatures" was upstreamed.  An additional patch could force
> these rules to be added to the custom policy, if lockdown is enabled.
>  This and other patches in this series could then check to see if
> is_ima_appraise_enabled() is true.
> 
> Mimi
>

I have updated the patch title and description, and I also added
is_ima_appraise_enabled() as the following. Is it good to you?

On the other hand, I am not good on IMA. I have traced the code path
in kimage_file_prepare_segments(). Looks that the READING_KEXEC_IMAGE
doesn't show in selinux_kernel_read_file(). Where is the exact code
in IMA for checking the signature when loading crash kernel file? 

Thanks a lot!
Joey Lee
---

From 274a2125132ba5aff49e4ccd167f52982732361f Mon Sep 17 00:00:00 2001
From: "Lee, Chun-Yi" <[e-mail]>
Date: Thu, 26 Oct 2017 15:24:50 +0800
Subject: [PATCH] kexec_file: The integrity must be checked when the kernel is
 locked down

When KEXEC_VERIFY_SIG and IMA appraise are not enabled, kernel should
not allow that the image to be loaded by kexec_file systemcall when the
kernel is locked down.

The original code was showed in Matthew's patch but not in the later
patch set:
    https://lkml.org/lkml/2015/3/13/778

Signed-off-by: "Lee, Chun-Yi" <[e-mail]>
---
 kernel/kexec_file.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Mimi Zohar Oct. 26, 2017, 2:17 p.m. UTC | #1

On Thu, 2017-10-26 at 15:42 +0800, joeyli wrote:
> Hi Mimi,
> 
> Thank you for reviewing.
> 
> On Mon, Oct 23, 2017 at 11:54:43AM -0400, Mimi Zohar wrote:
> > On Thu, 2017-10-19 at 15:51 +0100, David Howells wrote:
> > > From: Chun-Yi Lee <[e-mail]>
> > > 
> > > When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image
> > > through kexec_file systemcall if securelevel has been set.
> > 
> > The patch title and description needs to be updated to refer to
> > lockdown, not securelevel.
> > 
> > As previously mentioned the last time these patches were posted, this
> > leaves out testing to see if the integrity subsystem is enabled.
> > 
> > Commit 503ceaef8e2e "ima: define a set of appraisal rules requiring
> > file signatures" was upstreamed.  An additional patch could force
> > these rules to be added to the custom policy, if lockdown is enabled.
> >  This and other patches in this series could then check to see if
> > is_ima_appraise_enabled() is true.
> > 
> > Mimi
> >
> 
> I have updated the patch title and description, and I also added
> is_ima_appraise_enabled() as the following. Is it good to you?

Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is
dependent on the "ima: require secure_boot rules in lockdown mode"
patch - http://kernsec.org/pipermail/linux-security-module-archive/201
7-October/003910.html.

The IMA "secure_boot" policy can be specified on the boot command line
as ima_policy="secure_boot".  It requires kernel modules, firmware,
kexec kernel image and the IMA custom policy to be signed.  In
lockdown mode, these rules are enabled by default and added to the
custom policy.

> On the other hand, I am not good on IMA. I have traced the code path
> in kimage_file_prepare_segments(). Looks that the READING_KEXEC_IMAGE
> doesn't show in selinux_kernel_read_file(). Where is the exact code
> in IMA for checking the signature when loading crash kernel file?

kernel_read_file_from_fd() calls the security_kernel_read_file() and
security_kernel_post_read_file() hooks, which call ima_read_file() and
ima_post_read_file() respectively.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

David Howells Oct. 26, 2017, 3:02 p.m. UTC | #2

joeyli <[e-mail]> wrote:

> +	if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) &&
> +	    !is_ima_appraise_enabled() &&
> +	    kernel_is_locked_down("kexec of unsigned images"))

This doesn't seem right.  It seems that you can then kexec unsigned images
into a locked-down kernel if IMA appraise is enabled.

I think the commit message needs expansion as to why it's okay.  Can you also
do it as an additional patch rather than altering the original IMA-less patch
7?

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Mimi Zohar Oct. 26, 2017, 3:46 p.m. UTC | #3

[Cc'ing Matthew Garrett]

On Thu, 2017-10-26 at 16:02 +0100, David Howells wrote:
> joeyli <[e-mail]> wrote:
> 
> > +	if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) &&
> > +	    !is_ima_appraise_enabled() &&
> > +	    kernel_is_locked_down("kexec of unsigned images"))
> 
> This doesn't seem right.  It seems that you can then kexec unsigned images
> into a locked-down kernel if IMA appraise is enabled.

Huh?!  With the "secure_boot" policy enabled on the boot command line,
IMA-appraisal would verify the kexec kernel image, firmware, kernel
modules, and custom IMA policy signatures.  With the "ima: require
secure_boot rules in lockdown mode" patch, the "lockdown" mode would
enable IMA-appraisal's secure_boot policy, without requiring the boot
command line option.  It would also add the secure_boot rules to the
custom policy, so that if the builtin policy is replaced with a custom
policy, the "secure_boot" policy would still be enforced.

Other patches in this patch series need to be updated as well to check
if IMA-appraisal is enabled.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Mimi Zohar Oct. 27, 2017, 7:30 p.m. UTC | #4

On Thu, 2017-10-26 at 10:17 -0400, Mimi Zohar wrote:
> On Thu, 2017-10-26 at 15:42 +0800, joeyli wrote:
> > Hi Mimi,
> > 
> > Thank you for reviewing.
> > 
> > On Mon, Oct 23, 2017 at 11:54:43AM -0400, Mimi Zohar wrote:
> > > On Thu, 2017-10-19 at 15:51 +0100, David Howells wrote:
> > > > From: Chun-Yi Lee <[e-mail]>
> > > > 
> > > > When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image
> > > > through kexec_file systemcall if securelevel has been set.
> > > 
> > > The patch title and description needs to be updated to refer to
> > > lockdown, not securelevel.
> > > 
> > > As previously mentioned the last time these patches were posted, this
> > > leaves out testing to see if the integrity subsystem is enabled.
> > > 
> > > Commit 503ceaef8e2e "ima: define a set of appraisal rules requiring
> > > file signatures" was upstreamed.  An additional patch could force
> > > these rules to be added to the custom policy, if lockdown is enabled.
> > >  This and other patches in this series could then check to see if
> > > is_ima_appraise_enabled() is true.
> > > 
> > > Mimi
> > >
> > 
> > I have updated the patch title and description, and I also added
> > is_ima_appraise_enabled() as the following. Is it good to you?
> 
> Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is
> dependent on the "ima: require secure_boot rules in lockdown mode"
> patch - http://kernsec.org/pipermail/linux-security-module-archive/201
> 7-October/003910.html.
> 
> The IMA "secure_boot" policy can be specified on the boot command line
> as ima_policy="secure_boot".  It requires kernel modules, firmware,
> kexec kernel image and the IMA custom policy to be signed.  In
> lockdown mode, these rules are enabled by default and added to the
> custom policy.
> 
> > On the other hand, I am not good on IMA. I have traced the code path
> > in kimage_file_prepare_segments(). Looks that the READING_KEXEC_IMAGE
> > doesn't show in selinux_kernel_read_file(). Where is the exact code
> > in IMA for checking the signature when loading crash kernel file?
> 
> kernel_read_file_from_fd() calls the security_kernel_read_file() and
> security_kernel_post_read_file() hooks, which call ima_read_file() and
> ima_post_read_file() respectively.

Hm, with "lockdown" enabled on the boot command line, I'm now able to
do the kexec load, but not the unload.  :/   After the kexec load with
the "--reuse-cmdline" option, the system reboots, but isn't in
"lockdown" mode.

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Mimi Zohar Oct. 27, 2017, 7:32 p.m. UTC | #5

On Thu, 2017-10-26 at 10:17 -0400, Mimi Zohar wrote:
> On Thu, 2017-10-26 at 15:42 +0800, joeyli wrote:
> > Hi Mimi,
> > 
> > Thank you for reviewing.
> > 
> > On Mon, Oct 23, 2017 at 11:54:43AM -0400, Mimi Zohar wrote:
> > > On Thu, 2017-10-19 at 15:51 +0100, David Howells wrote:
> > > > From: Chun-Yi Lee <[e-mail]>
> > > > 
> > > > When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image
> > > > through kexec_file systemcall if securelevel has been set.
> > > 
> > > The patch title and description needs to be updated to refer to
> > > lockdown, not securelevel.
> > > 
> > > As previously mentioned the last time these patches were posted, this
> > > leaves out testing to see if the integrity subsystem is enabled.
> > > 
> > > Commit 503ceaef8e2e "ima: define a set of appraisal rules requiring
> > > file signatures" was upstreamed.  An additional patch could force
> > > these rules to be added to the custom policy, if lockdown is enabled.
> > >  This and other patches in this series could then check to see if
> > > is_ima_appraise_enabled() is true.
> > > 
> > > Mimi
> > >
> > 
> > I have updated the patch title and description, and I also added
> > is_ima_appraise_enabled() as the following. Is it good to you?
> 
> Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is
> dependent on the "ima: require secure_boot rules in lockdown mode"
> patch - http://kernsec.org/pipermail/linux-security-module-archive/201
> 7-October/003910.html.
> 
> The IMA "secure_boot" policy can be specified on the boot command line
> as ima_policy="secure_boot".  It requires kernel modules, firmware,
> kexec kernel image and the IMA custom policy to be signed.  In
> lockdown mode, these rules are enabled by default and added to the
> custom policy.
> 
> > On the other hand, I am not good on IMA. I have traced the code path
> > in kimage_file_prepare_segments(). Looks that the READING_KEXEC_IMAGE
> > doesn't show in selinux_kernel_read_file(). Where is the exact code
> > in IMA for checking the signature when loading crash kernel file?
> 
> kernel_read_file_from_fd() calls the security_kernel_read_file() and
> security_kernel_post_read_file() hooks, which call ima_read_file() and
> ima_post_read_file() respectively.

Hm, with "lockdown" enabled on the boot command line, I'm now able to
do the kexec load, but not the unload.  :/   After the kexec load with
the "--reuse-cmdline" option, the system reboots, but isn't in
"lockdown" mode.

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

joeyli Oct. 28, 2017, 8:34 a.m. UTC | #6

On Fri, Oct 27, 2017 at 03:32:26PM -0400, Mimi Zohar wrote:
> On Thu, 2017-10-26 at 10:17 -0400, Mimi Zohar wrote:
> > On Thu, 2017-10-26 at 15:42 +0800, joeyli wrote:
> > > Hi Mimi,
> > > 
> > > Thank you for reviewing.
> > > 
> > > On Mon, Oct 23, 2017 at 11:54:43AM -0400, Mimi Zohar wrote:
> > > > On Thu, 2017-10-19 at 15:51 +0100, David Howells wrote:
> > > > > From: Chun-Yi Lee <[e-mail]>
> > > > > 
> > > > > When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image
> > > > > through kexec_file systemcall if securelevel has been set.
> > > > 
> > > > The patch title and description needs to be updated to refer to
> > > > lockdown, not securelevel.
> > > > 
> > > > As previously mentioned the last time these patches were posted, this
> > > > leaves out testing to see if the integrity subsystem is enabled.
> > > > 
> > > > Commit 503ceaef8e2e "ima: define a set of appraisal rules requiring
> > > > file signatures" was upstreamed.  An additional patch could force
> > > > these rules to be added to the custom policy, if lockdown is enabled.
> > > >  This and other patches in this series could then check to see if
> > > > is_ima_appraise_enabled() is true.
> > > > 
> > > > Mimi
> > > >
> > > 
> > > I have updated the patch title and description, and I also added
> > > is_ima_appraise_enabled() as the following. Is it good to you?
> > 
> > Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is
> > dependent on the "ima: require secure_boot rules in lockdown mode"
> > patch - http://kernsec.org/pipermail/linux-security-module-archive/201
> > 7-October/003910.html.
> > 
> > The IMA "secure_boot" policy can be specified on the boot command line
> > as ima_policy="secure_boot".  It requires kernel modules, firmware,
> > kexec kernel image and the IMA custom policy to be signed.  In
> > lockdown mode, these rules are enabled by default and added to the
> > custom policy.
> > 
> > > On the other hand, I am not good on IMA. I have traced the code path
> > > in kimage_file_prepare_segments(). Looks that the READING_KEXEC_IMAGE
> > > doesn't show in selinux_kernel_read_file(). Where is the exact code
> > > in IMA for checking the signature when loading crash kernel file?
> > 
> > kernel_read_file_from_fd() calls the security_kernel_read_file() and
> > security_kernel_post_read_file() hooks, which call ima_read_file() and
> > ima_post_read_file() respectively.
> 
> Hm, with "lockdown" enabled on the boot command line, I'm now able to
> do the kexec load, but not the unload.  :/   After the kexec load with

I have tried on Qemu with OVMF, I can load and unload second kernel by
kexec tool (on openSUSE is in kexec-tools RPM):  

# kexec -u -s

I add -s for using kexec-load-file, and I signed kernel by pesign.

> the "--reuse-cmdline" option, the system reboots, but isn't in
> "lockdown" mode.
>

Either enabling secure boot in EFI firmware or using _lockdown_ kernel
parameter, the second kernel can be locked down on my OVMF VM.

I used following commands:

# kexec -s -l /boot/vmlinuz-4.14.0-rc2-default+ --append="$(cat /proc/cmdline)" --initrd=/boot/initrd-4.14.0-rc2-default+
# umount -a; mount -o remount,ro /
# kexec -e

The kernel source is from David's linux-fs git with lockdown-20171026 tag.
The kernel is also signed by pesign.

Regards
Joey Lee 
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Mimi Zohar Oct. 29, 2017, 10:26 p.m. UTC | #7

On Sat, 2017-10-28 at 16:34 +0800, joeyli wrote:
> On Fri, Oct 27, 2017 at 03:32:26PM -0400, Mimi Zohar wrote:
> > On Thu, 2017-10-26 at 10:17 -0400, Mimi Zohar wrote:
> > > On Thu, 2017-10-26 at 15:42 +0800, joeyli wrote:
> > > > Hi Mimi,
> > > > 
> > > > Thank you for reviewing.
> > > > 
> > > > On Mon, Oct 23, 2017 at 11:54:43AM -0400, Mimi Zohar wrote:
> > > > > On Thu, 2017-10-19 at 15:51 +0100, David Howells wrote:
> > > > > > From: Chun-Yi Lee <[e-mail]>
> > > > > > 
> > > > > > When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image
> > > > > > through kexec_file systemcall if securelevel has been set.
> > > > > 
> > > > > The patch title and description needs to be updated to refer to
> > > > > lockdown, not securelevel.
> > > > > 
> > > > > As previously mentioned the last time these patches were posted, this
> > > > > leaves out testing to see if the integrity subsystem is enabled.
> > > > > 
> > > > > Commit 503ceaef8e2e "ima: define a set of appraisal rules requiring
> > > > > file signatures" was upstreamed.  An additional patch could force
> > > > > these rules to be added to the custom policy, if lockdown is enabled.
> > > > >  This and other patches in this series could then check to see if
> > > > > is_ima_appraise_enabled() is true.
> > > > > 
> > > > > Mimi
> > > > >
> > > > 
> > > > I have updated the patch title and description, and I also added
> > > > is_ima_appraise_enabled() as the following. Is it good to you?
> > > 
> > > Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is
> > > dependent on the "ima: require secure_boot rules in lockdown mode"
> > > patch - http://kernsec.org/pipermail/linux-security-module-archive/201
> > > 7-October/003910.html.
> > > 
> > > The IMA "secure_boot" policy can be specified on the boot command line
> > > as ima_policy="secure_boot".  It requires kernel modules, firmware,
> > > kexec kernel image and the IMA custom policy to be signed.  In
> > > lockdown mode, these rules are enabled by default and added to the
> > > custom policy.
> > > 
> > > > On the other hand, I am not good on IMA. I have traced the code path
> > > > in kimage_file_prepare_segments(). Looks that the READING_KEXEC_IMAGE
> > > > doesn't show in selinux_kernel_read_file(). Where is the exact code
> > > > in IMA for checking the signature when loading crash kernel file?
> > > 
> > > kernel_read_file_from_fd() calls the security_kernel_read_file() and
> > > security_kernel_post_read_file() hooks, which call ima_read_file() and
> > > ima_post_read_file() respectively.
> > 
> > Hm, with "lockdown" enabled on the boot command line, I'm now able to
> > do the kexec load, but not the unload.  :/   After the kexec load with
> 
> I have tried on Qemu with OVMF, I can load and unload second kernel by
> kexec tool (on openSUSE is in kexec-tools RPM):  
> 
> # kexec -u -s

Thanks, I left off the "-s" option, causing it to fail.  This is the
correct behavior.  So both with/without the "-s" option are working
properly.

> I add -s for using kexec-load-file, and I signed kernel by pesign.
> 
> > the "--reuse-cmdline" option, the system reboots, but isn't in
> > "lockdown" mode.
> >
> 
> Either enabling secure boot in EFI firmware or using _lockdown_ kernel
> parameter, the second kernel can be locked down on my OVMF VM.
> 
> I used following commands:
> 
> # kexec -s -l /boot/vmlinuz-4.14.0-rc2-default+ --append="$(cat /proc/cmdline)" --initrd=/boot/initrd-4.14.0-rc2-default+
> # umount -a; mount -o remount,ro /I'
> # kexec -e
> 
> The kernel source is from David's linux-fs git with lockdown-20171026 tag.
> The kernel is also signed by pesign.

Yes, based on the patches in David's tree, "lockdown" is being carried
to the target OS properly.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

David Howells Oct. 30, 2017, 9 a.m. UTC | #8

Mimi Zohar <[e-mail]> wrote:

> Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is
> dependent on the "ima: require secure_boot rules in lockdown mode"
> patch - http://kernsec.org/pipermail/linux-security-module-archive/201
> 7-October/003910.html.

What happens if the file in question is being accessed from a filesystem that
doesn't have xattrs and doesn't provide support for appraisal?  Is it rejected
outright or just permitted?

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Mimi Zohar Oct. 30, 2017, 12:01 p.m. UTC | #9

On Mon, 2017-10-30 at 09:00 +0000, David Howells wrote:
> Mimi Zohar <[e-mail]> wrote:
> 
> > Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is
> > dependent on the "ima: require secure_boot rules in lockdown mode"
> > patch - http://kernsec.org/pipermail/linux-security-module-archive/201
> > 7-October/003910.html.
> 
> What happens if the file in question is being accessed from a filesystem that
> doesn't have xattrs and doesn't provide support for appraisal?  Is it rejected
> outright or just permitted?

IMA-appraisal returns -EACCES for any error, including lack of xattr
support.

Thiago Bauermann posted the "Appended signatures support for IMA
appraisal" patch set.  This patch set allows the current kernel module
appended signature format to be used for verifying the kernel image.
 Once that patch set is upstreamed, we'll be able to update the IMA
"secure_boot" policy to permit appended signatures.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

David Howells Oct. 30, 2017, 3:49 p.m. UTC | #10

Mimi Zohar <[e-mail]> wrote:

> Huh?!  With the "secure_boot" policy enabled on the boot command line,
> IMA-appraisal would verify the kexec kernel image, firmware, kernel
> modules, and custom IMA policy signatures.

What happens if the "secure_boot" policy isn't enabled on the boot command
line?  Can you sum up both cases in a paragraph I can add to the patch
description?

> Other patches in this patch series need to be updated as well to check
> if IMA-appraisal is enabled.

Which exactly?  I've added your "!is_ima_appraise_enabled() &&" line to
kexec_file() and module_sig_check().  Anything else?

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Mimi Zohar Oct. 30, 2017, 4:43 p.m. UTC | #11

On Mon, 2017-10-30 at 15:49 +0000, David Howells wrote:
> Mimi Zohar <[e-mail]> wrote:
> 
> > Huh?!  With the "secure_boot" policy enabled on the boot command line,
> > IMA-appraisal would verify the kexec kernel image, firmware, kernel
> > modules, and custom IMA policy signatures.
> 
> What happens if the "secure_boot" policy isn't enabled on the boot command
> line?  Can you sum up both cases in a paragraph I can add to the patch
> description?

The other patch automatically enables "secure_boot" for lockdown mode.
So there is no need to specify "secure_boot" on the boot command line.
 Reordering the patches so that the other patch comes before any call
to is_ima_appraise_enabled() will simplify this patch description.

> > Other patches in this patch series need to be updated as well to check
> > if IMA-appraisal is enabled.
> 
> Which exactly?  I've added your "!is_ima_appraise_enabled() &&" line to
> kexec_file() and module_sig_check().  Anything else?

load_module(), which calls module_sig_check(), is called by both the
old and new kernel module syscalls.  IMA is only on the new syscall.
 Did you differentiate between the kernel module syscalls?

There doesn't seem to be any other patches affected.  That said, the
IMA "secure_boot" policy is more stringent than what you have without
it.  For example, with the "secure_boot" policy enabled, firwmware
needs to be signed as well.  At some point, we'll want to also require
the initramfs be signed as well.

Both methods work independently of each other, but there needs to be
better coordination for when both methods are enabled at the same time
(eg. are both signatures required?).

For testing purposes, you can use the same certs/signing_key to sign
the kexec image, kernel modules and firmware, by loading the
signing_key on the .ima keyring.  Using evmctl, sign the files
(eg. evmctl ima_sign -a sha256 -k certs/signing_key.pem  --imasig
/boot/<vmlinuz>).

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

David Howells Nov. 2, 2017, 5 p.m. UTC | #12

Mimi Zohar <[e-mail]> wrote:

> At some point, we'll want to also require the initramfs be signed as well.

That could be tricky.  In Fedora, at least, that's assembled on the fly to
include just the drivers you need to be able to mount your root fs and find
the rest of your modules.  (Unless you mean just for the installer)

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 9f48f44..b6dc218 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -255,6 +255,14 @@  SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
 	if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)
 		return -EPERM;
 
+	/* Don't permit images to be loaded into trusted kernels if we're not
+	 * going to check the integrity on them
+	 */
+	if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) &&
+	    !is_ima_appraise_enabled() &&
+	    kernel_is_locked_down("kexec of unsigned images"))
+		return -EPERM;
+
 	/* Make sure we have a legal set of flags */
 	if (flags != (flags & KEXEC_FILE_FLAGS))
 		return -EINVAL;