s390/kexec_file: Disable kexec_load when IPLed secure

A kernel loaded via kexec_load cannot be verified. Thus disable kexec_load
systemcall in kernels which where IPLed securely. Use the IMA mechanism to
do so.

Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index 1222db6d4ee9090a1280bb9f702b070cf0a203d8..d28acd7ba81e9f4df13c470bc37378b19981b205 100644 (file)
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -77,6 +77,8 @@ obj-$(CONFIG_JUMP_LABEL)      += jump_label.o
 obj-$(CONFIG_KEXEC_FILE)       += machine_kexec_file.o kexec_image.o
 obj-$(CONFIG_KEXEC_FILE)       += kexec_elf.o
 
+obj-$(CONFIG_IMA)              += ima_arch.o
+
 obj-$(CONFIG_PERF_EVENTS)      += perf_event.o perf_cpum_cf_common.o
 obj-$(CONFIG_PERF_EVENTS)      += perf_cpum_cf.o perf_cpum_sf.o
 obj-$(CONFIG_PERF_EVENTS)      += perf_cpum_cf_events.o perf_regs.o

diff --git a/arch/s390/kernel/ima_arch.c b/arch/s390/kernel/ima_arch.c
new file mode 100644 (file)
index 0000000..f3c3e6e
--- /dev/null
+++ b/arch/s390/kernel/ima_arch.c
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/ima.h>
+#include <asm/boot_data.h>
+
+bool arch_ima_get_secureboot(void)
+{
+       return ipl_secure_flag;
+}
+
+const char * const *arch_get_ima_policy(void)
+{
+       return NULL;
+}

diff --git a/include/linux/ima.h b/include/linux/ima.h
index dc12fbcf484cef7ac50c209fab24662c2d3ba32a..fd9f7cf4cdf51adf647ec359bb4fbac371a792f9 100644 (file)
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -31,7 +31,7 @@ extern void ima_post_path_mknod(struct dentry *dentry);
 extern void ima_add_kexec_buffer(struct kimage *image);
 #endif
 
-#if defined(CONFIG_X86) && defined(CONFIG_EFI)
+#if (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390)
 extern bool arch_ima_get_secureboot(void);
 extern const char * const *arch_get_ima_policy(void);
 #else