From: Greg Kroah-Hartman Date: Mon, 15 Aug 2022 12:04:52 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.15.61~65 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=83fdf0f0ffcbe757df3e7745c5d3bcbf82b30732;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch --- diff --git a/queue-5.10/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch b/queue-5.10/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch new file mode 100644 index 00000000000..11042431c12 --- /dev/null +++ b/queue-5.10/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch @@ -0,0 +1,68 @@ +From 0d519cadf75184a24313568e7f489a7fc9b1be3b Mon Sep 17 00:00:00 2001 +From: Coiby Xu +Date: Thu, 14 Jul 2022 21:40:26 +0800 +Subject: arm64: kexec_file: use more system keyrings to verify kernel image signature + +From: Coiby Xu + +commit 0d519cadf75184a24313568e7f489a7fc9b1be3b upstream. + +Currently, when loading a kernel image via the kexec_file_load() system +call, arm64 can only use the .builtin_trusted_keys keyring to verify +a signature whereas x86 can use three more keyrings i.e. +.secondary_trusted_keys, .machine and .platform keyrings. For example, +one resulting problem is kexec'ing a kernel image would be rejected +with the error "Lockdown: kexec: kexec of unsigned images is restricted; +see man kernel_lockdown.7". + +This patch set enables arm64 to make use of the same keyrings as x86 to +verify the signature kexec'ed kernel image. + +Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support") +Cc: stable@vger.kernel.org # 105e10e2cf1c: kexec_file: drop weak attribute from functions +Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig +Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic +Acked-by: Baoquan He +Cc: kexec@lists.infradead.org +Cc: keyrings@vger.kernel.org +Cc: linux-security-module@vger.kernel.org +Co-developed-by: Michal Suchanek +Signed-off-by: Michal Suchanek +Acked-by: Will Deacon +Signed-off-by: Coiby Xu +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/kexec_image.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/arch/arm64/kernel/kexec_image.c ++++ b/arch/arm64/kernel/kexec_image.c +@@ -14,7 +14,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -130,18 +129,10 @@ static void *image_load(struct kimage *i + return NULL; + } + +-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +-static int image_verify_sig(const char *kernel, unsigned long kernel_len) +-{ +- return verify_pefile_signature(kernel, kernel_len, NULL, +- VERIFYING_KEXEC_PE_SIGNATURE); +-} +-#endif +- + const struct kexec_file_ops kexec_image_ops = { + .probe = image_probe, + .load = image_load, + #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +- .verify_sig = image_verify_sig, ++ .verify_sig = kexec_kernel_verify_pe_sig, + #endif + }; diff --git a/queue-5.10/series b/queue-5.10/series index f3bba68b9b3..e80b477fd26 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -533,3 +533,4 @@ ext4-correct-the-misjudgment-in-ext4_iget_extra_inode.patch dm-raid-fix-address-sanitizer-warning-in-raid_resume.patch dm-raid-fix-address-sanitizer-warning-in-raid_status.patch net_sched-cls_route-remove-from-list-when-handle-is-0.patch +arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch