On Thu, May 07, 2026 at 09:54:17PM +0000, Alejandro Hernandez wrote:
> Since commit 714fa115 xattrs attached to a kernel image file (such as IMA
> signatures) are not being preserved, do_kexec_file_load() was modified to use
> memfd_create() which now passes an anonymous file descriptor to
> kexec_file_load(). This change eliminated the filesystem inode identity of the
> original kernel file, hence attributes are no longer visible to the kernel IMA
> appraisal handler during kexec_file_load, causing IMA policy enforcement to
> fail
> even for validly signed kernel images.
>
> This patch attempts to restore such behavior although, only does it for
> uncompressed kernel images. To do this, we first figure out if the image file
> is
> compressed or not and call each method accordingly.
>
> Compressed images continue to use memfd and cannot carry forward the original
> fd
> security attributes, since their decompressed bytes do not match the signed
> artifact. Proper handling of compressed images with IMA would require either
> signing the decompressed artifact or kernel-side support for decompression
> within the kexec_file_load path.
>
> Signed-off-by: Alejandro Hernandez Samaniego <[email protected]>
Hi Alejandro,
Thanks for the patch.
Overall this looks good to me. But I'm wondering if you could spin a v2
to address a minor code-style issue I have noted inline.
> ---
> kexec/kexec.c | 42 +++++++++++++++++++++++++++++++++++-------
> 1 file changed, 35 insertions(+), 7 deletions(-)
>
> diff --git a/kexec/kexec.c b/kexec/kexec.c
> index 08edfca..a388762 100644
> --- a/kexec/kexec.c
> +++ b/kexec/kexec.c
> @@ -1328,17 +1328,41 @@ static int do_kexec_file_load(int fileind, int argc,
> char **argv,
>
> kernel = argv[fileind];
>
> - /* slurp in the input kernel */
> + /* Hold original fd with its xattrs */
> + kernel_fd = open(kernel, O_RDONLY);
> + if (kernel_fd == -1) {
> + fprintf(stderr, "Failed to open file %s:%s\n", kernel,
> + strerror(errno));
> + return EFAILED;
> + }
> +
> + /* Compressed vs Uncompressed */
> + struct stat kernel_stat;
> + off_t kernel_file_size = -1;
I would prefer if we stuck to declaring local variables
at the top of this function.
> + if (fstat(kernel_fd, &kernel_stat) == 0)
> + kernel_file_size = kernel_stat.st_size;
> +
> + /* slurp in the input kernel */
> kernel_buf = slurp_decompress_file(kernel, &kernel_size);
> if (!kernel_buf) {
> fprintf(stderr, "Failed to decompress file %s:%s\n", kernel,
> strerror(errno));
> + close(kernel_fd);
> return EFAILED;
> }
...
