Re: [PATCH v2 2/6] powerpc/kexec_file: Add KEXEC_SIG support.
From: Nayna <hidden>
Date: 2021-12-13 00:48:00
Also in:
kexec, keyrings, linux-crypto, linux-s390, linux-security-module, linuxppc-dev, lkml
On 11/25/21 13:02, Michal Suchanek wrote:
quoted hunk ↗ jump to hunk
Copy the code from s390x Signed-off-by: Michal Suchanek <redacted> --- arch/powerpc/Kconfig | 11 +++++++++++ arch/powerpc/kexec/elf_64.c | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+)diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index ac0c515552fd..ecc1227a77f1 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig@@ -561,6 +561,17 @@ config KEXEC_FILE config ARCH_HAS_KEXEC_PURGATORY def_bool KEXEC_FILE +config KEXEC_SIG + bool "Verify kernel signature during kexec_file_load() syscall" + depends on KEXEC_FILE && MODULE_SIG_FORMAT + help + This option makes kernel signature verification mandatory for + the kexec_file_load() syscall. +
Resending my last response as looks like it didn't go through mailing list because of some wrong formatting. My apologies to those who are receiving it twice. Since powerpc also supports IMA_ARCH_POLICY for kernel image signature verification, please include the following: "An alternative implementation for the powerpc arch is IMA_ARCH_POLICY. It verifies the appended kernel image signature and additionally includes both the signed and unsigned file hashes in the IMA measurement list, extends the IMA PCR in the TPM, and prevents blacklisted binary kernel images from being kexec'd." Thanks & Regards, - Nayna