Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Created attachment 1052836[details]
patch
Description of problem:
When RHEL 7.1 is booted with UEFI Secure Boot enabled, securelevel is set. If kexec is then used to load the same kernel, after reboot securelevel is disabled. In this state, the system is missing the protections provided by securelevel, for example kexec may be used to load an unsigned kernel via the legacy system call kexec_load.
In the securelevel patchset, the state of UEFI Secure Boot is queried in the EFI stub, and sets a boot_params flag to indicate the state of UEFI Secure Boot. This flag is then used in setup_arch() to determine the correct state of securelevel. If the kernel is not booted via the EFI stub, securelevel is not set even if UEFI Secure Boot is enabled.
I have attached a patch to upstream 4.1 (on top of the securelevel series) to query the state of UEFI Secure Boot from an init routine in start_kernel(), which covers both the EFI stub and non EFI stub cases to set securelevel correctly.
An alternative might be to make kexec_tools aware of the secure_boot flag in boot_params and pass it to the new kernel, but that would still assume the first kernel was booted through the EFI stub and had it set.
Version-Release number of selected component (if applicable): RHEL 7.1
How reproducible: Always
Steps to Reproduce:
1. Boot RHEL 7.1 on a system with UEFI Secure Boot enabled
2. kexec -s -l /boot/vmlinuz-3.10.0-229.7.2.el7.x86_64 --initrd=/boot/initramfs-3.10.0-229.7.2.el7.x86_64.img --reuse-cmdline
3. reboot
4. cat /sys/kernel/security/securelevel
5. kexec -l /boot/vmlinuz-3.10.0-229.7.2.el7.x86_64 --initrd=/boot/initramfs-3.10.0-229.7.2.el7.x86_64.img --reuse-cmdline
6. reboot
Actual results:
securelevel is 0 after kexec with UEFI Secure Boot enabled
Expected results:
securelevel is 1 after kexec with UEFI Secure Boot enabled
Additional info:
The patch needs a small change if it is to be x86-only, which is what was tested:
diff --git a/init/main.c b/init/main.c
index eee9db7..65395f9 100644
--- a/init/main.c
+++ b/init/main.c
@@ -636,11 +636,11 @@ asmlinkage __visible void __init start_kernel(void)
anon_vma_init();
acpi_early_init();
#ifdef CONFIG_X86
- if (efi_enabled(EFI_RUNTIME_SERVICES))
+ if (efi_enabled(EFI_RUNTIME_SERVICES)) {
efi_enter_virtual_mode();
-#endif
- if (efi_enabled(EFI_RUNTIME_SERVICES))
efi_secure_boot_init();
+ }
+#endif
Hi Dave,
This change works. It should be sufficient, since I suppose it is unlikely we would encounter a signed copy of a bootloader that does not use the efi stub.
Thanks.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHSA-2015-2152.html
Created attachment 1052836 [details] patch Description of problem: When RHEL 7.1 is booted with UEFI Secure Boot enabled, securelevel is set. If kexec is then used to load the same kernel, after reboot securelevel is disabled. In this state, the system is missing the protections provided by securelevel, for example kexec may be used to load an unsigned kernel via the legacy system call kexec_load. In the securelevel patchset, the state of UEFI Secure Boot is queried in the EFI stub, and sets a boot_params flag to indicate the state of UEFI Secure Boot. This flag is then used in setup_arch() to determine the correct state of securelevel. If the kernel is not booted via the EFI stub, securelevel is not set even if UEFI Secure Boot is enabled. I have attached a patch to upstream 4.1 (on top of the securelevel series) to query the state of UEFI Secure Boot from an init routine in start_kernel(), which covers both the EFI stub and non EFI stub cases to set securelevel correctly. An alternative might be to make kexec_tools aware of the secure_boot flag in boot_params and pass it to the new kernel, but that would still assume the first kernel was booted through the EFI stub and had it set. Version-Release number of selected component (if applicable): RHEL 7.1 How reproducible: Always Steps to Reproduce: 1. Boot RHEL 7.1 on a system with UEFI Secure Boot enabled 2. kexec -s -l /boot/vmlinuz-3.10.0-229.7.2.el7.x86_64 --initrd=/boot/initramfs-3.10.0-229.7.2.el7.x86_64.img --reuse-cmdline 3. reboot 4. cat /sys/kernel/security/securelevel 5. kexec -l /boot/vmlinuz-3.10.0-229.7.2.el7.x86_64 --initrd=/boot/initramfs-3.10.0-229.7.2.el7.x86_64.img --reuse-cmdline 6. reboot Actual results: securelevel is 0 after kexec with UEFI Secure Boot enabled Expected results: securelevel is 1 after kexec with UEFI Secure Boot enabled Additional info: