LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH 0/3] kexec: limit kexec_load syscall
@ 2018-04-12 22:41 Mimi Zohar
  2018-04-12 22:41 ` [PATCH 1/3] ima: based on the "secure_boot" policy limit syscalls Mimi Zohar
                   ` (3 more replies)
  0 siblings, 4 replies; 21+ messages in thread
From: Mimi Zohar @ 2018-04-12 22:41 UTC (permalink / raw)
  To: David Howells
  Cc: Matthew Garrett, Mimi Zohar, linux-integrity,
	linux-security-module, Eric Biederman, kexec, linux-kernel

In environments that require the kexec kernel image to be signed, prevent
using the kexec_load syscall.  In order for LSMs and IMA to differentiate
between kexec_load and kexec_file_load syscalls, this patch set adds a
call to security_kernel_read_file() in kexec_load_check().

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

Mimi Zohar (3):
  ima: based on the "secure_boot" policy limit syscalls
  kexec: call LSM hook for kexec_load syscall
  ima: based on policy require signed kexec kernel images

 kernel/kexec.c                      | 11 +++++++++++
 security/integrity/ima/ima.h        |  1 +
 security/integrity/ima/ima_main.c   |  9 +++++++++
 security/integrity/ima/ima_policy.c | 27 ++++++++++++++++++++-------
 4 files changed, 41 insertions(+), 7 deletions(-)

-- 
2.7.5

^ permalink raw reply	[flat|nested] 21+ messages in thread
* [PATCH 0/3] kexec: limit kexec_load syscall 
@ 2018-05-11  1:36 Mimi Zohar
  2018-05-11  1:36 ` [PATCH 3/3] ima: based on policy require signed kexec kernel images Mimi Zohar
  0 siblings, 1 reply; 21+ messages in thread
From: Mimi Zohar @ 2018-05-11  1:36 UTC (permalink / raw)
  To: linux-integrity
  Cc: Eric Biederman, David Howells, Mimi Zohar, linux-security-module,
	kexec, linux-kernel

IMA-appraisal is mostly being used in the embedded or single purpose
closed system environments.  In these environments, both the Kconfig
options and the userspace tools can be modified appropriately to limit
syscalls.  For stock kernels, userspace applications need to continue to
work with older kernels as well as with newer kernels.

In this environment, the customer needs the ability to define a system
wide IMA runtime policy, such as requiring all kexec'ed images (or
firmware) to be signed, without being dependent on either the Kconfig
options or the userspace tools.

This patch set allows the customer to define a policy which requires
kexec'ed kernels to be signed.

Mimi Zohar (3):
  ima: based on the "secure_boot" policy limit syscalls
  kexec: call LSM hook for kexec_load syscall
  ima: based on policy require signed kexec kernel images

 include/linux/security.h            |  6 ++++++
 kernel/kexec.c                      | 11 +++++++++++
 security/integrity/ima/ima.h        |  1 +
 security/integrity/ima/ima_main.c   |  9 +++++++++
 security/integrity/ima/ima_policy.c | 27 ++++++++++++++++++++-------
 security/security.c                 |  6 ++++++
 6 files changed, 53 insertions(+), 7 deletions(-)

-- 
2.7.5


^ permalink raw reply	[flat|nested] 21+ messages in thread

end of thread, other threads:[~2018-05-11  1:37 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-12 22:41 [PATCH 0/3] kexec: limit kexec_load syscall Mimi Zohar
2018-04-12 22:41 ` [PATCH 1/3] ima: based on the "secure_boot" policy limit syscalls Mimi Zohar
2018-04-12 22:41 ` [PATCH 2/3] kexec: call LSM hook for kexec_load syscall Mimi Zohar
2018-05-02 14:45   ` Eric W. Biederman
2018-05-02 15:45     ` Mimi Zohar
2018-05-03 15:51       ` Eric W. Biederman
2018-05-03 16:05         ` Casey Schaufler
2018-05-03 16:42           ` Eric W. Biederman
2018-05-03 21:06             ` Mimi Zohar
2018-05-03 21:36               ` Eric W. Biederman
2018-04-12 22:41 ` [PATCH 3/3] ima: based on policy require signed kexec kernel images Mimi Zohar
2018-05-03 20:13 ` [PATCH 0/3] kexec: limit kexec_load syscall Eric W. Biederman
2018-05-03 20:39   ` Matthew Garrett
2018-05-03 21:58     ` Eric W. Biederman
2018-05-03 22:51       ` Matthew Garrett
2018-05-03 21:31   ` Mimi Zohar
2018-05-03 21:38     ` Eric W. Biederman
2018-05-03 21:57       ` Mimi Zohar
2018-05-03 23:03         ` Eric W. Biederman
2018-05-04  2:29           ` Mimi Zohar
2018-05-11  1:36 Mimi Zohar
2018-05-11  1:36 ` [PATCH 3/3] ima: based on policy require signed kexec kernel images Mimi Zohar

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).