kexec: restore functionality to preserve fd xattrs for uncompressed kernel images

Since commit 714fa115 xattrs attached to a kernel image file (such as
IMA signatures) are not being preserved, do_kexec_file_load() was
modified to use memfd_create() which now passes an anonymous file
descriptor to kexec_file_load(). This change eliminated the filesystem
inode identity of the original kernel file, hence attributes are no
longer visible to the kernel IMA appraisal handler during
kexec_file_load, causing IMA policy enforcement to fail even for validly
signed kernel images.

This patch attempts to restore such behavior although, only does it for
uncompressed kernel images. To do this, we first figure out if the image
file is compressed or not and call each method accordingly.

Compressed images continue to use memfd and cannot carry forward the
original fd security attributes, since their decompressed bytes do not
match the signed artifact. Proper handling of compressed images with IMA
would require either signing the decompressed artifact or kernel-side
support for decompression within the kexec_file_load path.

Signed-off-by: Alejandro Hernandez Samaniego <alhe@linux.microsoft.com>
Signed-off-by: Simon Horman <horms@kernel.org>
1 file changed