diff options
| author |   Jiri Bohac <jbohac@suse.cz> | 2019-08-19 17:17:44 -0700 |
|---|---|---|
| committer |   James Morris <jmorris@namei.org> | 2019-08-19 21:54:15 -0700 |
| commit | 99d5cadfde2b1acb7650021df5abaa5ec447dd10 (patch) | |
| tree | 49af3ab9d60ad3191426f616750002f1720562cc /arch/s390/kernel/machine_kexec_file.c | |
| parent | lockdown: Copy secure_boot flag in boot params across kexec reboot (diff) | |
| download | linux-dev-99d5cadfde2b1acb7650021df5abaa5ec447dd10.tar.xz linux-dev-99d5cadfde2b1acb7650021df5abaa5ec447dd10.zip | |
kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE
This is a preparatory patch for kexec_file_load() lockdown. A locked down
kernel needs to prevent unsigned kernel images from being loaded with
kexec_file_load(). Currently, the only way to force the signature
verification is compiling with KEXEC_VERIFY_SIG. This prevents loading
usigned images even when the kernel is not locked down at runtime.
This patch splits KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE.
Analogous to the MODULE_SIG and MODULE_SIG_FORCE for modules, KEXEC_SIG
turns on the signature verification but allows unsigned images to be
loaded. KEXEC_SIG_FORCE disallows images without a valid signature.
Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Matthew Garrett <mjg59@google.com>
cc: kexec@lists.infradead.org
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'arch/s390/kernel/machine_kexec_file.c')
| -rw-r--r-- | arch/s390/kernel/machine_kexec_file.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c index fbdd3ea73667..c0f33ba49a9a 100644 --- a/arch/s390/kernel/machine_kexec_file.c +++ b/arch/s390/kernel/machine_kexec_file.c @@ -22,7 +22,7 @@ const struct kexec_file_ops * const kexec_file_loaders[] = { NULL, }; -#ifdef CONFIG_KEXEC_VERIFY_SIG +#ifdef CONFIG_KEXEC_SIG /* * Module signature information block. * @@ -90,7 +90,7 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len) VERIFYING_MODULE_SIGNATURE, NULL, NULL); } -#endif /* CONFIG_KEXEC_VERIFY_SIG */ +#endif /* CONFIG_KEXEC_SIG */ static int kexec_file_update_purgatory(struct kimage *image, struct s390_load_data *data) |