Messages in this thread | | | Date | Wed, 27 May 2020 12:16:18 +0200 | From | Jiri Bohac <> | Subject | Re: [PATCH] kexec: Do not verify the signature without the lockdown or mandatory signature |
| |
On Wed, May 27, 2020 at 12:08:12PM +0800, lijiang wrote: > Or the following change looks better? What's your opinion? > > static int > kimage_validate_signature(struct kimage *image) > { > int ret; > > ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf, > image->kernel_buf_len); > if (ret) { > > if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) { > pr_notice("Enforced kernel signature verification failed (%d).\n", ret); > return ret; > } > > /* > * If IMA is guaranteed to appraise a signature on the kexec > * image, permit it even if the kernel is otherwise locked > * down. > */ > if (!ima_appraise_signature(READING_KEXEC_IMAGE) && > security_locked_down(LOCKDOWN_KEXEC)) > return -EPERM; > > pr_debug("kernel signature verification failed (%d).\n", ret); > } > > return 0; > }
Looks good to me, thanks!
-- Jiri Bohac <jbohac@suse.cz> SUSE Labs, Prague, Czechia
| |