summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--include/linux/security.h1
-rw-r--r--kernel/kexec.c8
-rw-r--r--security/lockdown/lockdown.c1
3 files changed, 10 insertions, 0 deletions
diff --git a/include/linux/security.h b/include/linux/security.h
index e5dd446ef35b..b607a8ac97fe 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -105,6 +105,7 @@ enum lockdown_reason {
105 LOCKDOWN_NONE, 105 LOCKDOWN_NONE,
106 LOCKDOWN_MODULE_SIGNATURE, 106 LOCKDOWN_MODULE_SIGNATURE,
107 LOCKDOWN_DEV_MEM, 107 LOCKDOWN_DEV_MEM,
108 LOCKDOWN_KEXEC,
108 LOCKDOWN_INTEGRITY_MAX, 109 LOCKDOWN_INTEGRITY_MAX,
109 LOCKDOWN_CONFIDENTIALITY_MAX, 110 LOCKDOWN_CONFIDENTIALITY_MAX,
110}; 111};
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 1b018f1a6e0d..bc933c0db9bf 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -206,6 +206,14 @@ static inline int kexec_load_check(unsigned long nr_segments,
206 return result; 206 return result;
207 207
208 /* 208 /*
209 * kexec can be used to circumvent module loading restrictions, so
210 * prevent loading in that case
211 */
212 result = security_locked_down(LOCKDOWN_KEXEC);
213 if (result)
214 return result;
215
216 /*
209 * Verify we have a legal set of flags 217 * Verify we have a legal set of flags
210 * This leaves us room for future extensions. 218 * This leaves us room for future extensions.
211 */ 219 */
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 240ecaa10a1d..aaf30ad351f9 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -20,6 +20,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
20 [LOCKDOWN_NONE] = "none", 20 [LOCKDOWN_NONE] = "none",
21 [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", 21 [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",
22 [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", 22 [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",
23 [LOCKDOWN_KEXEC] = "kexec of unsigned images",
23 [LOCKDOWN_INTEGRITY_MAX] = "integrity", 24 [LOCKDOWN_INTEGRITY_MAX] = "integrity",
24 [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", 25 [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
25}; 26};