diff options
-rw-r--r-- | include/linux/security.h | 1 | ||||
-rw-r--r-- | kernel/kexec.c | 8 | ||||
-rw-r--r-- | security/lockdown/lockdown.c | 1 |
3 files changed, 10 insertions, 0 deletions
diff --git a/include/linux/security.h b/include/linux/security.h index e5dd446ef35b..b607a8ac97fe 100644 --- a/include/linux/security.h +++ b/include/linux/security.h | |||
@@ -105,6 +105,7 @@ enum lockdown_reason { | |||
105 | LOCKDOWN_NONE, | 105 | LOCKDOWN_NONE, |
106 | LOCKDOWN_MODULE_SIGNATURE, | 106 | LOCKDOWN_MODULE_SIGNATURE, |
107 | LOCKDOWN_DEV_MEM, | 107 | LOCKDOWN_DEV_MEM, |
108 | LOCKDOWN_KEXEC, | ||
108 | LOCKDOWN_INTEGRITY_MAX, | 109 | LOCKDOWN_INTEGRITY_MAX, |
109 | LOCKDOWN_CONFIDENTIALITY_MAX, | 110 | LOCKDOWN_CONFIDENTIALITY_MAX, |
110 | }; | 111 | }; |
diff --git a/kernel/kexec.c b/kernel/kexec.c index 1b018f1a6e0d..bc933c0db9bf 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c | |||
@@ -206,6 +206,14 @@ static inline int kexec_load_check(unsigned long nr_segments, | |||
206 | return result; | 206 | return result; |
207 | 207 | ||
208 | /* | 208 | /* |
209 | * kexec can be used to circumvent module loading restrictions, so | ||
210 | * prevent loading in that case | ||
211 | */ | ||
212 | result = security_locked_down(LOCKDOWN_KEXEC); | ||
213 | if (result) | ||
214 | return result; | ||
215 | |||
216 | /* | ||
209 | * Verify we have a legal set of flags | 217 | * Verify we have a legal set of flags |
210 | * This leaves us room for future extensions. | 218 | * This leaves us room for future extensions. |
211 | */ | 219 | */ |
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index 240ecaa10a1d..aaf30ad351f9 100644 --- a/security/lockdown/lockdown.c +++ b/security/lockdown/lockdown.c | |||
@@ -20,6 +20,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { | |||
20 | [LOCKDOWN_NONE] = "none", | 20 | [LOCKDOWN_NONE] = "none", |
21 | [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", | 21 | [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", |
22 | [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", | 22 | [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", |
23 | [LOCKDOWN_KEXEC] = "kexec of unsigned images", | ||
23 | [LOCKDOWN_INTEGRITY_MAX] = "integrity", | 24 | [LOCKDOWN_INTEGRITY_MAX] = "integrity", |
24 | [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", | 25 | [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", |
25 | }; | 26 | }; |