diff options
author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2018-07-13 14:05:58 -0400 |
---|---|---|
committer | James Morris <james.morris@microsoft.com> | 2018-07-16 12:31:57 -0700 |
commit | 16c267aac86b463b1fcccd43c89f4c8e5c5c86fa (patch) | |
tree | 550e6fcb00d732a3c018b3258302f8ffd61a4379 /include/linux/ima.h | |
parent | a210fd32a46bae6d05b43860fe3b47732501d63b (diff) | |
download | lwn-16c267aac86b463b1fcccd43c89f4c8e5c5c86fa.tar.gz lwn-16c267aac86b463b1fcccd43c89f4c8e5c5c86fa.zip |
ima: based on policy require signed kexec kernel images
The original kexec_load syscall can not verify file signatures, nor can
the kexec image be measured. Based on policy, deny the kexec_load
syscall.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.morris@microsoft.com>
Diffstat (limited to 'include/linux/ima.h')
-rw-r--r-- | include/linux/ima.h | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/include/linux/ima.h b/include/linux/ima.h index 0e4647e0eb60..84806b54b50a 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -11,6 +11,7 @@ #define _LINUX_IMA_H #include <linux/fs.h> +#include <linux/security.h> #include <linux/kexec.h> struct linux_binprm; @@ -19,6 +20,7 @@ extern int ima_bprm_check(struct linux_binprm *bprm); extern int ima_file_check(struct file *file, int mask, int opened); extern void ima_file_free(struct file *file); extern int ima_file_mmap(struct file *file, unsigned long prot); +extern int ima_load_data(enum kernel_load_data_id id); extern int ima_read_file(struct file *file, enum kernel_read_file_id id); extern int ima_post_read_file(struct file *file, void *buf, loff_t size, enum kernel_read_file_id id); @@ -49,6 +51,11 @@ static inline int ima_file_mmap(struct file *file, unsigned long prot) return 0; } +static inline int ima_load_data(enum kernel_load_data_id id) +{ + return 0; +} + static inline int ima_read_file(struct file *file, enum kernel_read_file_id id) { return 0; |