Commit 268a7840 authored by Philipp Rudo's avatar Philipp Rudo Committed by Martin Schwidefsky
Browse files

s390/kexec_file: Disable kexec_load when IPLed secure 



A kernel loaded via kexec_load cannot be verified. Thus disable kexec_load
systemcall in kernels which where IPLed securely. Use the IMA mechanism to
do so.

Signed-off-by: default avatarPhilipp Rudo <prudo@linux.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 99feaa71

arch/s390/kernel/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -77,6 +77,8 @@ obj-$(CONFIG_JUMP_LABEL) += jump_label.o 
obj-$(CONFIG_KEXEC_FILE)	+= machine_kexec_file.o kexec_image.o

obj-$(CONFIG_KEXEC_FILE)	+= kexec_elf.o



obj-$(CONFIG_IMA)		+= ima_arch.o



obj-$(CONFIG_PERF_EVENTS)	+= perf_event.o perf_cpum_cf_common.o

obj-$(CONFIG_PERF_EVENTS)	+= perf_cpum_cf.o perf_cpum_sf.o

obj-$(CONFIG_PERF_EVENTS)	+= perf_cpum_cf_events.o perf_regs.o

arch/s390/kernel/ima_arch.c

0 → 100644
+14 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0



#include <linux/ima.h>

#include <asm/boot_data.h>



bool arch_ima_get_secureboot(void)

{

	return ipl_secure_flag;

}



const char * const *arch_get_ima_policy(void)

{

	return NULL;

}

include/linux/ima.h

+1 −1
Original line number Diff line number Diff line
@@ -31,7 +31,7 @@ extern void ima_post_path_mknod(struct dentry *dentry); 
extern void ima_add_kexec_buffer(struct kimage *image);

#endif



#if defined(CONFIG_X86) && defined(CONFIG_EFI)

#if (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390)

extern bool arch_ima_get_secureboot(void);

extern const char * const *arch_get_ima_policy(void);

#else

CRA Git | Maintained and supported by SUSTech CRA and CCSE