kexec_load(2) bypasses signature verification

[Vivek Goyal]

On Thu, Jun 18, 2015 at 10:02:09AM +0800, Dave Young wrote:

[..]
> > Or simply add a new config option KEXEC_VERIFY_SIG_FORCE, so we can return
> > error in kexec_load and print some error message.
> 
> Just like below, does this work for you, Ted?
> 
> ---
>  arch/x86/Kconfig |    7 +++++++
>  kernel/kexec.c   |    9 ++++++++-
>  2 files changed, 15 insertions(+), 1 deletion(-)
> 
> --- linux.orig/arch/x86/Kconfig
> +++ linux/arch/x86/Kconfig
> @@ -1755,6 +1755,13 @@ config KEXEC_VERIFY_SIG
>  	  verification for the corresponding kernel image type being
>  	  loaded in order for this to work.
>  
> +config KEXEC_VERIFY_SIG_FORCE
> +	bool "Enforce kexec signature verifying"
> +	depends on KEXEC_VERIFY_SIG
> +	---help---
> +	  This option disable kexec_load() syscall, only kexec_file_load
> + 	  can be used.
> +


Hi Dave,

I think we might not need a new config option. A new config option makes
it little confusing. KEXEC_VERIFY_SIG already implies KEXEC_VERIFY_SIG_FORCE
(for new syscall). Now extending it to also mean that it should disable old
syscall is confusing.

We already have a sysctl knob to disable kexec kernel loading. But that
knob disables it on both the syscalls.

May be we can just introduce another command line option say
"kexec_verify_sig_force" and this will work across both the syscalls and
will deny loading a unsigned kernel in following two cases.

- Using old syscall
- Using new syscall if kernel was compiled with KEXEC_VERIFY_SIG=n.

This should be simple and get us going in short term.

If we want to disable unsigned kernel loading at compile time, then we
really need to work on decoupling CONFIG_KEXEC and CONFIG_FILE_KEXEC.
Introducing another config option is not the way forward, IMHO.

Thanks
Vivek


>  config KEXEC_BZIMAGE_VERIFY_SIG
>  	bool "Enable bzImage signature verification support"
>  	depends on KEXEC_VERIFY_SIG
> --- linux.orig/kernel/kexec.c
> +++ linux/kernel/kexec.c
> @@ -45,6 +45,12 @@
>  #include <crypto/hash.h>
>  #include <crypto/sha.h>
>  
> +#ifdef CONFIG_KEXEC_VERIFY_SIG_FORCE
> +static bool kexec_verify_sig_force = true;
> +#else
> +static bool kexec_verify_sig_force;
> +#endif
> +
>  /* Per cpu memory for storing cpu states in case of system crash. */
>  note_buf_t __percpu *crash_notes;
>  
> @@ -1243,7 +1249,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
>  	int result;
>  
>  	/* We only trust the superuser with rebooting the system. */
> -	if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)
> +	if (!capable(CAP_SYS_BOOT) || kexec_load_disabled
> +	    || kexec_verify_sig_force)
>  		return -EPERM;
>  
>  	/*