Eric Snowberg 5df276cf79 lockdown: Fix kexec lockdown bypass with ima policy ... commit 543ce63b66 upstream. The lockdown LSM is primarily used in conjunction with UEFI Secure Boot. This LSM may also be used on machines without UEFI. It can also be enabled when UEFI Secure Boot is disabled. One of lockdown's features is to prevent kexec from loading untrusted kernels. Lockdown can be enabled through a bootparam or after the kernel has booted through securityfs. If IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. To defeat lockdown, boot without Secure Boot and add ima_appraise=log to the kernel command line; then: $ echo "integrity" > /sys/kernel/security/lockdown $ echo "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig" > \ /sys/kernel/security/ima/policy $ kexec -ls unsigned-kernel Add a call to verify ima appraisal is set to "enforce" whenever lockdown is enabled. This fixes CVE-2022-21505. Cc: stable@vger.kernel.org Fixes: 29d3c1c8df ("kexec: Allow kexec_file() with appropriate IMA policy when locked down") Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> Acked-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: John Haxby <john.haxby@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Tao Wu <tallwu@tencent.com> Reviewed-by: Alex Shi <alexsshi@tencent.com>		2024-06-11 20:41:41 +08:00
..
evm	ock: sync codes to ock 5.4.119-20.0009.21	2024-06-11 20:27:38 +08:00
ima	lockdown: Fix kexec lockdown bypass with ima policy	2024-06-11 20:41:41 +08:00
platform_certs	tkernel: add base tlinux kernel interfaces	2024-06-11 20:09:33 +08:00
Kconfig	integrity: Select CONFIG_KEYS instead of depending on it	2019-08-05 18:40:20 -04:00
Makefile	integrity: remove pointless subdir-$(CONFIG_...)	2019-10-05 15:29:49 +09:00
digsig.c	ima: Implement support for module-style appended signatures	2019-08-05 18:40:23 -04:00
digsig_asymmetric.c	Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs"	2019-07-10 18:43:43 -07:00
iint.c	ock: sync codes to ock 5.4.119-20.0009.21	2024-06-11 20:27:38 +08:00
integrity.h	ima: Implement support for module-style appended signatures	2019-08-05 18:40:23 -04:00
integrity_audit.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00