.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
---|
1 | 2 | /* |
---|
2 | 3 | * kexec.c - kexec_load system call |
---|
3 | 4 | * Copyright (C) 2002-2004 Eric Biederman <ebiederm@xmission.com> |
---|
4 | | - * |
---|
5 | | - * This source code is licensed under the GNU General Public License, |
---|
6 | | - * Version 2. See the file COPYING for more details. |
---|
7 | 5 | */ |
---|
8 | 6 | |
---|
9 | 7 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
---|
.. | .. |
---|
161 | 159 | |
---|
162 | 160 | kimage_terminate(image); |
---|
163 | 161 | |
---|
| 162 | + ret = machine_kexec_post_load(image); |
---|
| 163 | + if (ret) |
---|
| 164 | + goto out; |
---|
| 165 | + |
---|
164 | 166 | /* Install the new kernel and uninstall the old */ |
---|
165 | 167 | image = xchg(dest_image, image); |
---|
166 | 168 | |
---|
.. | .. |
---|
203 | 205 | return -EPERM; |
---|
204 | 206 | |
---|
205 | 207 | /* Permit LSMs and IMA to fail the kexec */ |
---|
206 | | - result = security_kernel_load_data(LOADING_KEXEC_IMAGE); |
---|
| 208 | + result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false); |
---|
207 | 209 | if (result < 0) |
---|
208 | 210 | return result; |
---|
209 | 211 | |
---|
210 | 212 | /* |
---|
| 213 | + * kexec can be used to circumvent module loading restrictions, so |
---|
| 214 | + * prevent loading in that case |
---|
| 215 | + */ |
---|
| 216 | + result = security_locked_down(LOCKDOWN_KEXEC); |
---|
| 217 | + if (result) |
---|
| 218 | + return result; |
---|
| 219 | + |
---|
| 220 | + /* |
---|
211 | 221 | * Verify we have a legal set of flags |
---|
212 | 222 | * This leaves us room for future extensions. |
---|
213 | 223 | */ |
---|