Hello,

On Sun, Dec 12, 2021 at 07:46:53PM -0500, Nayna wrote:

On 11/25/21 13:02, Michal Suchanek wrote:

quoted

Copy the code from s390x

Signed-off-by: Michal Suchanek <redacted>
---
  arch/powerpc/Kconfig        | 11 +++++++++++
  arch/powerpc/kexec/elf_64.c | 36 ++++++++++++++++++++++++++++++++++++
  2 files changed, 47 insertions(+)

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index ac0c515552fd..ecc1227a77f1 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig

@@ -561,6 +561,17 @@ config KEXEC_FILE
  config ARCH_HAS_KEXEC_PURGATORY
  	def_bool KEXEC_FILE

+config KEXEC_SIG
+	bool "Verify kernel signature during kexec_file_load() syscall"
+	depends on KEXEC_FILE && MODULE_SIG_FORMAT
+	help
+	  This option makes kernel signature verification mandatory for
+	  the kexec_file_load() syscall.
+

Resending my last response as looks like it didn't go through mailing list
because of some wrong formatting. My apologies to those who are receiving it
twice.

Since powerpc also supports IMA_ARCH_POLICY for kernel image signature
verification, please include the following:

"An alternative implementation for the powerpc arch is IMA_ARCH_POLICY. It
verifies the appended kernel image signature and additionally includes both
the signed and unsigned file hashes in the IMA measurement list, extends the
IMA PCR in the TPM, and prevents blacklisted binary kernel images from being
kexec'd."

It also does blacklist based on the file hash?

There is a downstream patch that adds the support for the module
signatures, and when the code is reused for KEXEC_SIG the blacklist
also applies to it.

Which kind of shows that people really want to use the IMA features but
with no support on some major architectures it's not going to work.

Thanks

Michal