• Kees Cook's avatar
    kexec: add sysctl to disable kexec_load · 7984754b
    Kees Cook authored
    For general-purpose (i.e.  distro) kernel builds it makes sense to build
    with CONFIG_KEXEC to allow end users to choose what kind of things they
    want to do with kexec.  However, in the face of trying to lock down a
    system with such a kernel, there needs to be a way to disable kexec_load
    (much like module loading can be disabled).  Without this, it is too easy
    for the root user to modify kernel memory even when CONFIG_STRICT_DEVMEM
    and modules_disabled are set.  With this change, it is still possible to
    load an image for use later, then disable kexec_load so the image (or lack
    of image) can't be altered.
    
    The intention is for using this in environments where "perfect"
    enforcement is hard.  Without a verified boot, along with verified
    modules, and along with verified kexec, this is trying to give a system a
    better chance to defend itself (or at least grow the window of
    discoverability) against attack in the face of a privilege escalation.
    
    In my mind, I consider several boot scenarios:
    
    1) Verified boot of read-only verified root fs loading fd-based
       verification of kexec images.
    2) Secure boot of writable root fs loading signed kexec images.
    3) Regular boot loading kexec (e.g. kcrash) image early and locking it.
    4) Regular boot with no control of kexec image at all.
    
    1 and 2 don't exist yet, but will soon once the verified kexec series has
    landed.  4 is the state of things now.  The gap between 2 and 4 is too
    large, so this change creates scenario 3, a middle-ground above 4 when 2
    and 1 are not possible for a system.
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Acked-by: default avatarRik van Riel <riel@redhat.com>
    Cc: Vivek Goyal <vgoyal@redhat.com>
    Cc: Eric Biederman <ebiederm@xmission.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    7984754b
kexec.h 6.62 KB