From: Mimi Zohar <zohar@linux.ibm.com>
Date: Fri, 16 Nov 2018 02:02:54 +0000 (-0500)
Subject: ima: add error mesage to kexec_load
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=080fbb905ab278465ec8b9187b50453f0d669f3f;p=users%2Fwilly%2Flinux.git

ima: add error mesage to kexec_load

Reject the kexec_load syscall with some indication of the problem.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 41e4771980d5..df0b2ee49fa2 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -513,8 +513,10 @@ int ima_load_data(enum kernel_load_data_id id)
 	switch (id) {
 	case LOADING_KEXEC_IMAGE:
 		if (IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG)
-		    && arch_ima_get_secureboot())
+		    && arch_ima_get_secureboot()) {
+			pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
 			return -EACCES;
+		}
 
 		if (ima_enforce && (ima_appraise & IMA_APPRAISE_KEXEC)) {
 			pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");