hc
2023-12-11 d2ccde1c8e90d38cee87a1b0309ad2827f3fd30d
kernel/kernel/kexec.c
....@@ -1,9 +1,7 @@
1
+// SPDX-License-Identifier: GPL-2.0-only
12 /*
23 * kexec.c - kexec_load system call
34 * Copyright (C) 2002-2004 Eric Biederman <ebiederm@xmission.com>
4
- *
5
- * This source code is licensed under the GNU General Public License,
6
- * Version 2. See the file COPYING for more details.
75 */
86
97 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
....@@ -161,6 +159,10 @@
161159
162160 kimage_terminate(image);
163161
162
+ ret = machine_kexec_post_load(image);
163
+ if (ret)
164
+ goto out;
165
+
164166 /* Install the new kernel and uninstall the old */
165167 image = xchg(dest_image, image);
166168
....@@ -203,11 +205,19 @@
203205 return -EPERM;
204206
205207 /* Permit LSMs and IMA to fail the kexec */
206
- result = security_kernel_load_data(LOADING_KEXEC_IMAGE);
208
+ result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false);
207209 if (result < 0)
208210 return result;
209211
210212 /*
213
+ * kexec can be used to circumvent module loading restrictions, so
214
+ * prevent loading in that case
215
+ */
216
+ result = security_locked_down(LOCKDOWN_KEXEC);
217
+ if (result)
218
+ return result;
219
+
220
+ /*
211221 * Verify we have a legal set of flags
212222 * This leaves us room for future extensions.
213223 */