1*7615b94bSDavid Woodhouse#!/bin/sh 2*7615b94bSDavid Woodhouse# SPDX-License-Identifier: GPL-2.0 3*7615b94bSDavid Woodhouse# 4*7615b94bSDavid Woodhouse# Prevent loading a kernel image via the kexec_load syscall when 5*7615b94bSDavid Woodhouse# signatures are required. (Dependent on CONFIG_IMA_ARCH_POLICY.) 6*7615b94bSDavid Woodhouse 7*7615b94bSDavid WoodhouseTEST="$0" 8*7615b94bSDavid Woodhouse. ./kexec_common_lib.sh 9*7615b94bSDavid Woodhouse 10*7615b94bSDavid Woodhouse# kexec requires root privileges 11*7615b94bSDavid Woodhouserequire_root_privileges 12*7615b94bSDavid Woodhouse 13*7615b94bSDavid Woodhouse# get the kernel config 14*7615b94bSDavid Woodhouseget_kconfig 15*7615b94bSDavid Woodhouse 16*7615b94bSDavid Woodhousekconfig_enabled "CONFIG_KEXEC_JUMP=y" "kexec_jump is enabled" 17*7615b94bSDavid Woodhouseif [ $? -eq 0 ]; then 18*7615b94bSDavid Woodhouse log_skip "kexec_jump is not enabled" 19*7615b94bSDavid Woodhousefi 20*7615b94bSDavid Woodhouse 21*7615b94bSDavid Woodhousekconfig_enabled "CONFIG_IMA_APPRAISE=y" "IMA enabled" 22*7615b94bSDavid Woodhouseima_appraise=$? 23*7615b94bSDavid Woodhouse 24*7615b94bSDavid Woodhousekconfig_enabled "CONFIG_IMA_ARCH_POLICY=y" \ 25*7615b94bSDavid Woodhouse "IMA architecture specific policy enabled" 26*7615b94bSDavid Woodhousearch_policy=$? 27*7615b94bSDavid Woodhouse 28*7615b94bSDavid Woodhouseget_secureboot_mode 29*7615b94bSDavid Woodhousesecureboot=$? 30*7615b94bSDavid Woodhouse 31*7615b94bSDavid Woodhouseif [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ]; then 32*7615b94bSDavid Woodhouse log_skip "Secure boot and CONFIG_IMA_ARCH_POLICY are enabled" 33*7615b94bSDavid Woodhousefi 34*7615b94bSDavid Woodhouse 35*7615b94bSDavid Woodhouse./test_kexec_jump 36*7615b94bSDavid Woodhouseif [ $? -eq 0 ]; then 37*7615b94bSDavid Woodhouse log_pass "kexec_jump succeeded" 38*7615b94bSDavid Woodhouseelse 39*7615b94bSDavid Woodhouse # The more likely failure mode if anything went wrong is that the 40*7615b94bSDavid Woodhouse # kernel just crashes. But if we get back here, sure, whine anyway. 41*7615b94bSDavid Woodhouse log_fail "kexec_jump failed" 42*7615b94bSDavid Woodhousefi 43