selftests/kexec/test_kexec_load.sh

0001 #!/bin/sh
0002 # SPDX-License-Identifier: GPL-2.0
0003 #
0004 # Prevent loading a kernel image via the kexec_load syscall when
0005 # signatures are required.  (Dependent on CONFIG_IMA_ARCH_POLICY.)
0006
0007 TEST="$0"
0008 . ./kexec_common_lib.sh
0009
0010 # kexec requires root privileges
0011 require_root_privileges
0012
0013 # get the kernel config
0014 get_kconfig
0015
0016 kconfig_enabled "CONFIG_KEXEC=y" "kexec_load is enabled"
0017 if [ $? -eq 0 ]; then
0018         log_skip "kexec_load is not enabled"
0019 fi
0020
0021 kconfig_enabled "CONFIG_IMA_APPRAISE=y" "IMA enabled"
0022 ima_appraise=$?
0023
0024 kconfig_enabled "CONFIG_IMA_ARCH_POLICY=y" \
0025         "IMA architecture specific policy enabled"
0026 arch_policy=$?
0027
0028 get_secureboot_mode
0029 secureboot=$?
0030
0031 # kexec_load should fail in secure boot mode and CONFIG_IMA_ARCH_POLICY enabled
0032 kexec --load $KERNEL_IMAGE > /dev/null 2>&1
0033 if [ $? -eq 0 ]; then
0034         kexec --unload
0035         if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ]; then
0036                 log_fail "kexec_load succeeded"
0037         elif [ $ima_appraise -eq 0 -o $arch_policy -eq 0 ]; then
0038                 log_info "Either IMA or the IMA arch policy is not enabled"
0039         fi
0040         log_pass "kexec_load succeeded"
0041 else
0042         if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ] ; then
0043                 log_pass "kexec_load failed"
0044         else
0045                 log_fail "kexec_load failed"
0046         fi
0047 fi