From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mimi Zohar Subject: Re: [PATCH V31 07/25] kexec_file: Restrict at runtime if the kernel is locked down Date: Mon, 24 Jun 2019 17:27:37 -0400 Message-ID: <1561411657.4340.70.camel@linux.ibm.com> References: <20190326182742.16950-1-matthewgarrett@google.com> <20190326182742.16950-8-matthewgarrett@google.com> <20190621064340.GB4528@localhost.localdomain> <20190624015206.GB2976@dhcp-128-65.nay.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Matthew Garrett , Dave Young Cc: James Morris , Jiri Bohac , Linux API , kexec@lists.infradead.org, Linux Kernel Mailing List , David Howells , LSM List , Andy Lutomirski List-Id: linux-api@vger.kernel.org Hi Matthew, On Mon, 2019-06-24 at 14:06 -0700, Matthew Garrett wrote: > On Sun, Jun 23, 2019 at 6:52 PM Dave Young wrote: > > > > On 06/21/19 at 01:18pm, Matthew Garrett wrote: > > > I don't think so - we want it to be possible to load images if they > > > have a valid signature. > > > > I know it works like this way because of the previous patch. But from > > the patch log "When KEXEC_SIG is not enabled, kernel should not load > > images", it is simple to check it early for !IS_ENABLED(CONFIG_KEXEC_SIG) && > > kernel_is_locked_down(reason, LOCKDOWN_INTEGRITY) instead of depending > > on the late code to verify signature. In that way, easier to > > understand the logic, no? > > But that combination doesn't enforce signature validation? We can't > depend on !IS_ENABLED(CONFIG_KEXEC_SIG_FORCE) because then it'll > enforce signature validation even if lockdown is disabled. I agree with Dave.  There should be a stub lockdown function to prevent enforcing lockdown when it isn't enabled. Mimi