All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Coiby Xu <coxu@redhat.com>, linux-integrity@vger.kernel.org
Cc: kexec@lists.infradead.org, Baoquan He <bhe@redhat.com>,
	Eric Biederman <ebiederm@xmission.com>,
	Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
	James Morris <jmorris@namei.org>,
	"Serge E. Hallyn" <serge@hallyn.com>, Jiri Bohac <jbohac@suse.cz>,
	David Howells <dhowells@redhat.com>,
	Matthew Garrett <mjg59@google.com>,
	open list <linux-kernel@vger.kernel.org>,
	"open list:SECURITY SUBSYSTEM"
	<linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v2] ima: force signature verification when CONFIG_KEXEC_SIG is configured
Date: Wed, 13 Jul 2022 10:23:35 -0400	[thread overview]
Message-ID: <8bea9e61be96e0358a43e320f9b89b742e8ca992.camel@linux.ibm.com> (raw)
In-Reply-To: <20220713072111.230333-1-coxu@redhat.com>

On Wed, 2022-07-13 at 15:21 +0800, Coiby Xu wrote:
> Currently, an unsigned kernel could be kexec'ed when IMA arch specific
> policy is configured unless lockdown is enabled. Enforce kernel
> signature verification check in the kexec_file_load syscall when IMA
> arch specific policy is configured.
> 
> Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE")
> Reported-by: Mimi Zohar <zohar@linux.ibm.com>
> Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---
> v2
>  - don't include linux/kexec.h since it's already been included in
>    linux/ima.h
>  - fix build errors when KEXEC_FILE/KEXEC_CORE is disable as caught by
>    kernel test robot <lkp@intel.com>

Thanks, Coiby.  This version of the patch is now queued in next-
integrity/next-
integrity-testing.

Mimi


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com>
To: Coiby Xu <coxu@redhat.com>, linux-integrity@vger.kernel.org
Cc: kexec@lists.infradead.org, Baoquan He <bhe@redhat.com>,
	Eric Biederman <ebiederm@xmission.com>,
	Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
	James Morris <jmorris@namei.org>,
	"Serge E. Hallyn" <serge@hallyn.com>, Jiri Bohac <jbohac@suse.cz>,
	David Howells <dhowells@redhat.com>,
	Matthew Garrett <mjg59@google.com>,
	open list <linux-kernel@vger.kernel.org>,
	"open list:SECURITY SUBSYSTEM" 
	<linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v2] ima: force signature verification when CONFIG_KEXEC_SIG is configured
Date: Wed, 13 Jul 2022 10:23:35 -0400	[thread overview]
Message-ID: <8bea9e61be96e0358a43e320f9b89b742e8ca992.camel@linux.ibm.com> (raw)
In-Reply-To: <20220713072111.230333-1-coxu@redhat.com>

On Wed, 2022-07-13 at 15:21 +0800, Coiby Xu wrote:
> Currently, an unsigned kernel could be kexec'ed when IMA arch specific
> policy is configured unless lockdown is enabled. Enforce kernel
> signature verification check in the kexec_file_load syscall when IMA
> arch specific policy is configured.
> 
> Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE")
> Reported-by: Mimi Zohar <zohar@linux.ibm.com>
> Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---
> v2
>  - don't include linux/kexec.h since it's already been included in
>    linux/ima.h
>  - fix build errors when KEXEC_FILE/KEXEC_CORE is disable as caught by
>    kernel test robot <lkp@intel.com>

Thanks, Coiby.  This version of the patch is now queued in next-
integrity/next-
integrity-testing.

Mimi


  reply	other threads:[~2022-07-13 14:24 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-12  9:33 [PATCH] ima: force signature verification when CONFIG_KEXEC_SIG is configured Coiby Xu
2022-07-12  9:33 ` Coiby Xu
2022-07-12 11:40 ` Mimi Zohar
2022-07-12 11:40   ` Mimi Zohar
2022-07-13  7:21 ` [PATCH v2] " Coiby Xu
2022-07-13  7:21   ` Coiby Xu
2022-07-13 14:23   ` Mimi Zohar [this message]
2022-07-13 14:23     ` Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=8bea9e61be96e0358a43e320f9b89b742e8ca992.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=bhe@redhat.com \
    --cc=coxu@redhat.com \
    --cc=dhowells@redhat.com \
    --cc=dmitry.kasatkin@gmail.com \
    --cc=ebiederm@xmission.com \
    --cc=jbohac@suse.cz \
    --cc=jmorris@namei.org \
    --cc=kexec@lists.infradead.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mjg59@google.com \
    --cc=serge@hallyn.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.