test_kexec_file_load.sh

#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
#
# Loading a kernel image via the kexec_file_load syscall can verify either
# the IMA signature stored in the security.ima xattr or the PE signature,
# both signatures depending on the IMA policy, or none.
#
# To determine whether the kernel image is signed, this test depends
# on pesign and getfattr.  This test also requires the kernel to be
# built with CONFIG_IKCONFIG enabled and either CONFIG_IKCONFIG_PROC
# enabled or access to the extract-ikconfig script.

TEST="KEXEC_FILE_LOAD"
. ./kexec_common_lib.sh

trap "{ rm -f $IKCONFIG ; }" EXIT

# Some of the IMA builtin policies may require the kexec kernel image to
# be signed, but these policy rules may be replaced with a custom
# policy.  Only CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS persists after
# loading a custom policy.  Check if it is enabled, before reading the
# IMA runtime sysfs policy file.
# Return 1 for IMA signature required and 0 for not required.
is_ima_sig_required()
{
	local ret=0

	kconfig_enabled "CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS=y" \
		"IMA kernel image signature required"
	if [ $? -eq 1 ]; then
		log_info "IMA signature required"
		return 1
	fi

	# The architecture specific or a custom policy may require the
	# kexec kernel image be signed.  Policy rules are walked
	# sequentially.  As a result, a policy rule may be defined, but
	# might not necessarily be used.  This test assumes if a policy
	# rule is specified, that is the intent.

	# First check for appended signature (modsig), then xattr
	if [ $ima_read_policy -eq 1 ]; then
		check_ima_policy "appraise" "func=KEXEC_KERNEL_CHECK" \
			"appraise_type=imasig|modsig"
		ret=$?
		if [ $ret -eq 1 ]; then
			log_info "IMA or appended(modsig) signature required"
		else
			check_ima_policy "appraise" "func=KEXEC_KERNEL_CHECK" \
				"appraise_type=imasig"
			ret=$?
			[ $ret -eq 1 ] && log_info "IMA signature required";
		fi
	fi
	return $ret
}

# The kexec_file_load_test() is complicated enough, require pesign.
# Return 1 for PE signature found and 0 for not found.
check_for_pesig()
{
	which pesign > /dev/null 2>&1 || log_skip "pesign not found"

	pesign -i $KERNEL_IMAGE --show-signature | grep -q "No signatures"
	local ret=$?
	if [ $ret -eq 1 ]; then
		log_info "kexec kernel image PE signed"
	else
		log_info "kexec kernel image not PE signed"
	fi
	return $ret
}

# The kexec_file_load_test() is complicated enough, require getfattr.
# Return 1 for IMA signature found and 0 for not found.
check_for_imasig()
{
	local ret=0

	which getfattr > /dev/null 2>&1
	if [ $?	-eq 1 ]; then
		log_skip "getfattr not found"
	fi

	line=$(getfattr -n security.ima -e hex --absolute-names $KERNEL_IMAGE 2>&1)
	echo $line | grep -q "security.ima=0x03"
	if [ $? -eq 0 ]; then
		ret=1
		log_info "kexec kernel image IMA signed"
	else
		log_info "kexec kernel image not IMA signed"
	fi
	return $ret
}

# Return 1 for appended signature (modsig) found and 0 for not found.
check_for_modsig()
{
	local module_sig_string="~Module signature appended~"
	local ret=0

	tail --bytes $((${#module_sig_string} + 1)) $KERNEL_IMAGE | \
		grep -q "$module_sig_string"
	if [ $? -eq 0 ]; then
		ret=1
		log_info "kexec kernel image modsig signed"
	else
		log_info "kexec kernel image not modsig signed"
	fi
	return $ret
}

kexec_file_load_test()
{
	local succeed_msg="kexec_file_load succeeded"
	local failed_msg="kexec_file_load failed"
	local key_msg="try enabling the CONFIG_INTEGRITY_PLATFORM_KEYRING"

	line=$(kexec --load --kexec-file-syscall $KERNEL_IMAGE 2>&1)

	if [ $? -eq 0 ]; then
		kexec --unload --kexec-file-syscall

		# In secureboot mode with an architecture  specific
		# policy, make sure either an IMA or PE signature exists.
		if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ] && \
			[ $ima_signed -eq 0 ] && [ $pe_signed -eq 0 ] \
			  && [ $ima_modsig -eq 0 ]; then
			log_fail "$succeed_msg (missing sig)"
		fi

		if [ $kexec_sig_required -eq 1 -o $pe_sig_required -eq 1 ] \
		     && [ $pe_signed -eq 0 ]; then
			log_fail "$succeed_msg (missing PE sig)"
		fi

		if [ $ima_sig_required -eq 1 ] && [ $ima_signed -eq 0 ] \
		     && [ $ima_modsig -eq 0 ]; then
			log_fail "$succeed_msg (missing IMA sig)"
		fi

		if [ $pe_sig_required -eq 0 ] && [ $ima_appraise -eq 1 ] \
		    && [ $ima_sig_required -eq 0 ] && [ $ima_signed -eq 0 ] \
	            && [ $ima_read_policy -eq 0 ]; then
			log_fail "$succeed_msg (possibly missing IMA sig)"
		fi

		if [ $pe_sig_required -eq 0 ] && [ $ima_appraise -eq 0 ]; then
			log_info "No signature verification required"
		elif [ $pe_sig_required -eq 0 ] && [ $ima_appraise -eq 1 ] \
		    && [ $ima_sig_required -eq 0 ] && [ $ima_signed -eq 0 ] \
	            && [ $ima_read_policy -eq 1 ]; then
			log_info "No signature verification required"
		fi

		log_pass "$succeed_msg"
	fi

	# Check the reason for the kexec_file_load failure
	echo $line | grep -q "Required key not available"
	if [ $? -eq 0 ]; then
		if [ $platform_keyring -eq 0 ]; then
			log_pass "$failed_msg (-ENOKEY), $key_msg"
		else
			log_pass "$failed_msg (-ENOKEY)"
		fi
	fi

	if [ $kexec_sig_required -eq 1 -o $pe_sig_required -eq 1 ] \
	     && [ $pe_signed -eq 0 ]; then
		log_pass "$failed_msg (missing PE sig)"
	fi

	if [ $ima_sig_required -eq 1 ] && [ $ima_signed -eq 0 ]; then
		log_pass "$failed_msg (missing IMA sig)"
	fi

	if [ $pe_sig_required -eq 0 ] && [ $ima_appraise -eq 1 ] \
	    && [ $ima_sig_required -eq 0 ] && [ $ima_read_policy -eq 0 ] \
	    && [ $ima_signed -eq 0 ]; then
		log_pass "$failed_msg (possibly missing IMA sig)"
	fi

	log_pass "$failed_msg"
	return 0
}

# kexec requires root privileges
require_root_privileges

# get the kernel config
get_kconfig

kconfig_enabled "CONFIG_KEXEC_FILE=y" "kexec_file_load is enabled"
if [ $? -eq 0 ]; then
	log_skip "kexec_file_load is not enabled"
fi

# Determine which kernel config options are enabled
kconfig_enabled "CONFIG_IMA_APPRAISE=y" "IMA enabled"
ima_appraise=$?

kconfig_enabled "CONFIG_IMA_ARCH_POLICY=y" \
	"architecture specific policy enabled"
arch_policy=$?

kconfig_enabled "CONFIG_INTEGRITY_PLATFORM_KEYRING=y" \
	"platform keyring enabled"
platform_keyring=$?

kconfig_enabled "CONFIG_IMA_READ_POLICY=y" "reading IMA policy permitted"
ima_read_policy=$?

kconfig_enabled "CONFIG_KEXEC_SIG_FORCE=y" \
	"kexec signed kernel image required"
kexec_sig_required=$?

kconfig_enabled "CONFIG_KEXEC_BZIMAGE_VERIFY_SIG=y" \
	"PE signed kernel image required"
pe_sig_required=$?

is_ima_sig_required
ima_sig_required=$?

get_secureboot_mode
secureboot=$?

# Are there pe and ima signatures
if [ "$(get_arch)" == 'ppc64le' ]; then
	pe_signed=0
else
	check_for_pesig
	pe_signed=$?
fi

check_for_imasig
ima_signed=$?

check_for_modsig
ima_modsig=$?

# Test loading the kernel image via kexec_file_load syscall
kexec_file_load_test