Re: [PATCH 09/24] kexec_file: Disable at runtime if securelevel has been set

From: Dave Young <dyoung@redhat.com>
To: David Howells <dhowells@redhat.com>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
	linux-kernel@vger.kernel.org,
	Matthew Garrett <mjg59@srcf.ucam.org>,
	linux-efi@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk,
	Chun-Yi Lee <jlee@suse.com>,
	gregkh@linuxfoundation.org, kexec@lists.infradead.org,
	linux-security-module@vger.kernel.org, keyrings@vger.kernel.org,
	matthew.garrett@nebula.com
Subject: Re: [PATCH 09/24] kexec_file: Disable at runtime if securelevel has been set
Date: Fri, 7 Apr 2017 15:41:59 +0800	[thread overview]
Message-ID: <20170407074159.GB10737@dhcp-128-65.nay.redhat.com> (raw)
In-Reply-To: <21418.1491548875@warthog.procyon.org.uk>

On 04/07/17 at 08:07am, David Howells wrote:
> Dave Young <dyoung@redhat.com> wrote:
> 
> > > > > +	/* Don't permit images to be loaded into trusted kernels if we're not
> > > > > +	 * going to verify the signature on them
> > > > > +	 */
> > > > > +	if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && kernel_is_locked_down())
> > > > > +		return -EPERM;
> > > > > +
> > > > >  
> > > 
> > > IMA can be used to verify file signatures too, based on the LSM hooks
> > > in  kernel_read_file_from_fd().  CONFIG_KEXEC_VERIFY_SIG should not be
> > > required.
> > 
> > Mimi, I remember we talked somthing before about the two signature 
> > verification. One can change IMA policy in initramfs userspace,
> > also there are kernel cmdline param to disable IMA, so it can break the
> > lockdown? Suppose kexec boot with ima disabled cmdline param and then
> > kexec reboot again..
> 
> I guess I should lock down the parameter to disable IMA too.

That is one thing, user can change IMA policy in initramfs userspace,
I'm not sure if IMA enforce the signed policy now, if no it will be also
a problem.

Thanks
Dave