5 files changed, 72 insertions, 0 deletions

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9558b9fcafbf..4aafd322e21e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1599,6 +1599,28 @@ config KEXEC
           interface is strongly in flux, so no good recommendation can be
           made.
 
+config KEXEC_VERIFY_SIG
+        bool "Verify kernel signature during kexec_file_load() syscall"
+        depends on KEXEC
+        ---help---
+          This option makes kernel signature verification mandatory for
+          kexec_file_load() syscall. If kernel is signature can not be
+          verified, kexec_file_load() will fail.
+
+          This option enforces signature verification at generic level.
+          One needs to enable signature verification for type of kernel
+          image being loaded to make sure it works. For example, enable
+          bzImage signature verification option to be able to load and
+          verify signatures of bzImage. Otherwise kernel loading will fail.
+
+config KEXEC_BZIMAGE_VERIFY_SIG
+        bool "Enable bzImage signature verification support"
+        depends on KEXEC_VERIFY_SIG
+        depends on SIGNED_PE_FILE_VERIFICATION
+        select SYSTEM_TRUSTED_KEYRING
+        ---help---
+          Enable bzImage signature verification support.
+
 config CRASH_DUMP
         bool "kernel crash dumps"
         depends on X86_64 || (X86_32 && HIGHMEM)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 623e6c58081f..9642b9b33655 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -19,6 +19,8 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/efi.h>
+#include <linux/verify_pefile.h>
+#include <keys/system_keyring.h>
 
 #include <asm/bootparam.h>
 #include <asm/setup.h>
@@ -525,8 +527,27 @@ int bzImage64_cleanup(void *loader_data)
         return 0;
 }
 
+#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
+int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
+{
+        bool trusted;
+        int ret;
+
+        ret = verify_pefile_signature(kernel, kernel_len,
+                                      system_trusted_keyring, &trusted);
+        if (ret < 0)
+                return ret;
+        if (!trusted)
+                return -EKEYREJECTED;
+        return 0;
+}
+#endif
+
 struct kexec_file_ops kexec_bzImage64_ops = {
         .probe = bzImage64_probe,
         .load = bzImage64_load,
         .cleanup = bzImage64_cleanup,
+#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
+        .verify_sig = bzImage64_verify_sig,
+#endif
 };
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 9330434da777..8b04018e5d1f 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -372,6 +372,17 @@ int arch_kimage_file_post_load_cleanup(struct kimage *image)
         return image->fops->cleanup(image->image_loader_data);
 }
 
+int arch_kexec_kernel_verify_sig(struct kimage *image, void *kernel,
+                                 unsigned long kernel_len)
+{
+        if (!image->fops || !image->fops->verify_sig) {
+                pr_debug("kernel loader does not support signature verification.");
+                return -EKEYREJECTED;
+        }
+
+        return image->fops->verify_sig(kernel, kernel_len);
+}
+
 /*
  * Apply purgatory relocations.
  *
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 9481703b0e7a..4b2a0e11cc5b 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -191,11 +191,14 @@ typedef void *(kexec_load_t)(struct kimage *image, char *kernel_buf,
                              unsigned long initrd_len, char *cmdline,
                              unsigned long cmdline_len);
 typedef int (kexec_cleanup_t)(void *loader_data);
+typedef int (kexec_verify_sig_t)(const char *kernel_buf,
+                                 unsigned long kernel_len);
 
 struct kexec_file_ops {
         kexec_probe_t *probe;
         kexec_load_t *load;
         kexec_cleanup_t *cleanup;
+        kexec_verify_sig_t *verify_sig;
 };
 
 /* kexec interface functions */
diff --git a/kernel/kexec.c b/kernel/kexec.c
index f18c780f9716..0b49a0a58102 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -416,6 +416,12 @@ void __weak arch_kimage_file_post_load_cleanup(struct kimage *image)
 {
 }
 
+int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
+                                        unsigned long buf_len)
+{
+        return -EKEYREJECTED;
+}
+
 /* Apply relocations of type RELA */
 int __weak
 arch_kexec_apply_relocations_add(const Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
@@ -494,6 +500,15 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd,
         if (ret)
                 goto out;
 
+#ifdef CONFIG_KEXEC_VERIFY_SIG
+        ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
+                                           image->kernel_buf_len);
+        if (ret) {
+                pr_debug("kernel signature verification failed.\n");
+                goto out;
+        }
+        pr_debug("kernel signature verification successful.\n");
+#endif
         /* It is possible that there no initramfs is being loaded */
         if (!(flags & KEXEC_FILE_NO_INITRAMFS)) {
                 ret = copy_file_from_fd(initrd_fd, &image->initrd_buf,