Greg Kroah-Hartman
598cf27219
Link: https://lore.kernel.org/r/20260217200002.683975158@linuxfoundation.org Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Salvatore Bonaccorso <carnil@debian.org> Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Mark Brown <broonie@kernel.org> Tested-by: Luna Jernberg <droidbittin@gmail.com> Tested-by: Ronald Warsow <rwarsow@gmx.de> Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
48 lines
1.2 KiB
Bash
Executable File
48 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Prevent loading a kernel image via the kexec_load syscall when
|
|
# signatures are required. (Dependent on CONFIG_IMA_ARCH_POLICY.)
|
|
|
|
TEST="$0"
|
|
. ./kexec_common_lib.sh
|
|
|
|
# kexec requires root privileges
|
|
require_root_privileges
|
|
|
|
# get the kernel config
|
|
get_kconfig
|
|
|
|
kconfig_enabled "CONFIG_KEXEC=y" "kexec_load is enabled"
|
|
if [ $? -eq 0 ]; then
|
|
log_skip "kexec_load is not enabled"
|
|
fi
|
|
|
|
kconfig_enabled "CONFIG_IMA_APPRAISE=y" "IMA enabled"
|
|
ima_appraise=$?
|
|
|
|
kconfig_enabled "CONFIG_IMA_ARCH_POLICY=y" \
|
|
"IMA architecture specific policy enabled"
|
|
arch_policy=$?
|
|
|
|
get_secureboot_mode
|
|
secureboot=$?
|
|
|
|
# kexec_load should fail in secure boot mode and CONFIG_IMA_ARCH_POLICY enabled
|
|
kexec --load $KERNEL_IMAGE > /dev/null 2>&1
|
|
if [ $? -eq 0 ]; then
|
|
kexec --unload
|
|
if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ]; then
|
|
log_fail "kexec_load succeeded"
|
|
elif [ $ima_appraise -eq 0 -o $arch_policy -eq 0 ]; then
|
|
log_info "Either IMA or the IMA arch policy is not enabled"
|
|
fi
|
|
log_pass "kexec_load succeeded"
|
|
else
|
|
if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ] ; then
|
|
log_pass "kexec_load failed"
|
|
else
|
|
log_fail "kexec_load failed"
|
|
fi
|
|
fi
|