From 94924260d423ac836c1c0c01e56ebf725587c5c3 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 15 Aug 2022 14:04:45 +0200 Subject: [PATCH] 5.4-stable patches added patches: arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch --- ...ngs-to-verify-kernel-image-signature.patch | 68 +++++++++++++++++++ queue-5.4/series | 1 + 2 files changed, 69 insertions(+) create mode 100644 queue-5.4/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch diff --git a/queue-5.4/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch b/queue-5.4/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch new file mode 100644 index 00000000000..44b02f7ecf1 --- /dev/null +++ b/queue-5.4/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch @@ -0,0 +1,68 @@ +From 0d519cadf75184a24313568e7f489a7fc9b1be3b Mon Sep 17 00:00:00 2001 +From: Coiby Xu +Date: Thu, 14 Jul 2022 21:40:26 +0800 +Subject: arm64: kexec_file: use more system keyrings to verify kernel image signature + +From: Coiby Xu + +commit 0d519cadf75184a24313568e7f489a7fc9b1be3b upstream. + +Currently, when loading a kernel image via the kexec_file_load() system +call, arm64 can only use the .builtin_trusted_keys keyring to verify +a signature whereas x86 can use three more keyrings i.e. +.secondary_trusted_keys, .machine and .platform keyrings. For example, +one resulting problem is kexec'ing a kernel image would be rejected +with the error "Lockdown: kexec: kexec of unsigned images is restricted; +see man kernel_lockdown.7". + +This patch set enables arm64 to make use of the same keyrings as x86 to +verify the signature kexec'ed kernel image. + +Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support") +Cc: stable@vger.kernel.org # 105e10e2cf1c: kexec_file: drop weak attribute from functions +Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig +Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic +Acked-by: Baoquan He +Cc: kexec@lists.infradead.org +Cc: keyrings@vger.kernel.org +Cc: linux-security-module@vger.kernel.org +Co-developed-by: Michal Suchanek +Signed-off-by: Michal Suchanek +Acked-by: Will Deacon +Signed-off-by: Coiby Xu +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/kexec_image.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/arch/arm64/kernel/kexec_image.c ++++ b/arch/arm64/kernel/kexec_image.c +@@ -14,7 +14,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -113,18 +112,10 @@ static void *image_load(struct kimage *i + return ERR_PTR(ret); + } + +-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +-static int image_verify_sig(const char *kernel, unsigned long kernel_len) +-{ +- return verify_pefile_signature(kernel, kernel_len, NULL, +- VERIFYING_KEXEC_PE_SIGNATURE); +-} +-#endif +- + const struct kexec_file_ops kexec_image_ops = { + .probe = image_probe, + .load = image_load, + #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +- .verify_sig = image_verify_sig, ++ .verify_sig = kexec_kernel_verify_pe_sig, + #endif + }; diff --git a/queue-5.4/series b/queue-5.4/series index fbdba6a7d51..3523809f9a5 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -278,3 +278,4 @@ timekeeping-contribute-wall-clock-to-rng-on-time-change.patch firmware-arm_scpi-ensure-scpi_info-is-not-assigned-if-the-probe-fails.patch iommu-vt-d-avoid-invalid-memory-access-via-node_online-numa_no_node.patch net_sched-cls_route-remove-from-list-when-handle-is-0.patch +arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch -- 2.47.3