lkml.org 
[lkml]   [2017]   [Apr]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 07/24] kexec: Disable at runtime if the kernel is locked down
    On 04/05/17 at 09:15pm, David Howells wrote:
    > From: Matthew Garrett <matthew.garrett@nebula.com>
    >
    > kexec permits the loading and execution of arbitrary code in ring 0, which
    > is something that lock-down is meant to prevent. It makes sense to disable
    > kexec in this situation.
    >
    > This does not affect kexec_file_load() which can check for a signature on the
    > image to be booted.
    >
    > Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
    > Signed-off-by: David Howells <dhowells@redhat.com>
    > cc: kexec@lists.infradead.org
    > ---
    >
    > kernel/kexec.c | 7 +++++++
    > 1 file changed, 7 insertions(+)
    >
    > diff --git a/kernel/kexec.c b/kernel/kexec.c
    > index 980936a90ee6..46de8e6b42f4 100644
    > --- a/kernel/kexec.c
    > +++ b/kernel/kexec.c
    > @@ -194,6 +194,13 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
    > return -EPERM;
    >
    > /*
    > + * kexec can be used to circumvent module loading restrictions, so
    > + * prevent loading in that case
    > + */
    > + if (kernel_is_locked_down())
    > + return -EPERM;
    > +
    > + /*
    > * Verify we have a legal set of flags
    > * This leaves us room for future extensions.
    > */
    >
    >
    > _______________________________________________
    > kexec mailing list
    > kexec@lists.infradead.org
    > http://lists.infradead.org/mailman/listinfo/kexec

    Acked-by: Dave Young <dyoung@redhat.com>

    Thanks
    Dave

    \
     
     \ /
      Last update: 2017-04-07 05:07    [W:2.156 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site