ima: force signature verification when CONFIG_KEXEC_SIG is configured

2022-07-13T14:13:41Z

Currently, an unsigned kernel could be kexec'ed when IMA arch specific policy is configured unless lockdown is enabled. Enforce kernel signature verification check in the kexec_file_load syscall when IMA arch specific policy is configured. Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE") Reported-and-suggested-by: Mimi Zohar Signed-off-by: Coiby Xu Signed-off-by: Mimi Zohar

ima: generalize x86/EFI arch glue for other EFI architectures

2020-11-06T06:40:42Z

Move the x86 IMA arch code into security/integrity/ima/ima_efi.c, so that we will be able to wire it up for arm64 in a future patch. Co-developed-by: Chester Lin Signed-off-by: Chester Lin Acked-by: Mimi Zohar Signed-off-by: Ard Biesheuvel

kernel/security/integrity/ima/ima_efi.c, branch linux-6.2.y

ima: force signature verification when CONFIG_KEXEC_SIG is configured

ima: generalize x86/EFI arch glue for other EFI architectures