Files
linux/include/linux
Ricardo Ribalda a42aaad2e4 kexec: introduce sysctl parameters kexec_load_limit_*
kexec allows replacing the current kernel with a different one.  This is
usually a source of concerns for sysadmins that want to harden a system.

Linux already provides a way to disable loading new kexec kernel via
kexec_load_disabled, but that control is very coard, it is all or nothing
and does not make distinction between a panic kexec and a normal kexec.

This patch introduces new sysctl parameters, with finer tuning to specify
how many times a kexec kernel can be loaded.  The sysadmin can set
different limits for kexec panic and kexec reboot kernels.  The value can
be modified at runtime via sysctl, but only with a stricter value.

With these new parameters on place, a system with loadpin and verity
enabled, using the following kernel parameters:
sysctl.kexec_load_limit_reboot=0 sysct.kexec_load_limit_panic=1 can have a
good warranty that if initrd tries to load a panic kernel, a malitious
user will have small chances to replace that kernel with a different one,
even if they can trigger timeouts on the disk where the panic kernel
lives.

Link: https://lkml.kernel.org/r/20221114-disable-kexec-reset-v6-3-6a8531a09b9a@chromium.org
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: Bagas Sanjaya <bagasdotme@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Guilherme G. Piccoli <gpiccoli@igalia.com> # Steam Deck
Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Philipp Rudo <prudo@redhat.com>
Cc: Ross Zwisler <zwisler@kernel.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2023-02-02 22:50:05 -08:00
..
2022-10-27 13:23:43 +02:00
2022-11-04 12:59:25 +02:00
2022-12-11 21:25:58 +01:00
2023-01-04 14:43:27 -07:00
2022-09-26 12:19:12 -07:00
2022-12-07 09:43:12 -07:00
2022-12-08 18:25:31 -08:00
2022-09-26 19:46:29 -07:00
2022-09-26 10:13:13 -07:00
2022-09-26 10:13:13 -07:00
2022-09-15 09:32:06 -07:00
2022-12-02 18:12:40 +08:00
2022-11-18 09:14:10 +01:00
2022-12-11 18:12:17 -08:00
2022-10-20 10:13:30 +02:00
2022-10-24 12:30:26 +03:00
2022-10-03 14:02:45 -07:00
2022-11-11 18:18:05 -08:00
2022-09-01 18:04:43 +02:00
2022-11-29 09:09:17 +11:00
2022-09-08 12:59:00 -06:00
2022-09-26 13:31:20 +02:00
2022-11-15 00:42:02 -08:00
2022-12-11 19:30:20 -08:00
2022-09-01 18:08:44 +02:00
2022-07-17 17:31:38 -07:00
2022-10-03 14:03:19 -07:00
2022-11-09 19:28:49 -08:00
2022-07-27 14:04:52 +02:00
2022-08-02 12:34:04 -04:00
2022-09-01 17:39:49 -04:00
2022-08-22 14:26:30 +01:00
2022-08-09 14:11:34 -04:00
2022-07-29 20:16:58 -04:00
2022-10-16 17:58:54 -05:00
2022-10-03 17:34:32 -07:00
2022-09-26 19:46:27 -07:00
2023-01-04 14:44:13 -07:00
2022-10-04 20:52:38 +02:00
2022-10-20 10:13:30 +02:00
2022-12-20 03:13:45 +01:00
2022-10-23 18:06:54 -04:00
2022-10-21 10:11:00 -07:00
2022-12-09 19:47:41 -08:00
2022-11-29 15:00:06 -08:00
2022-09-07 12:42:25 +01:00
2022-12-11 18:12:19 -08:00
2022-09-29 15:20:29 +02:00
2022-12-10 13:36:05 -05:00
2022-09-22 16:12:34 +02:00
2022-09-22 16:12:34 +02:00
2022-08-31 13:37:32 +02:00
2022-08-28 16:52:28 +01:00
2022-10-07 09:32:40 -04:00
2022-09-26 19:46:18 -07:00
2022-07-10 21:17:30 -04:00
2022-10-24 12:12:32 -07:00