<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 11/25/21 13:02, Michal Suchanek
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:8b30a3c6a4e845eb77f276298424811897efdebf.1637862358.git.msuchanek@suse.de">
<pre class="moz-quote-pre" wrap="">Copy the code from s390x
Signed-off-by: Michal Suchanek <a class="moz-txt-link-rfc2396E" href="mailto:msuchanek@suse.de"><msuchanek@suse.de></a>
---
arch/powerpc/Kconfig | 11 +++++++++++
arch/powerpc/kexec/elf_64.c | 36 ++++++++++++++++++++++++++++++++++++
2 files changed, 47 insertions(+)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index ac0c515552fd..ecc1227a77f1 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -561,6 +561,17 @@ config KEXEC_FILE
config ARCH_HAS_KEXEC_PURGATORY
def_bool KEXEC_FILE
+config KEXEC_SIG
+ bool "Verify kernel signature during kexec_file_load() syscall"
+ depends on KEXEC_FILE && MODULE_SIG_FORMAT
+ help
+ This option makes kernel signature verification mandatory for
+ the kexec_file_load() syscall.
+</pre>
</blockquote>
<p>Since powerpc also supports IMA_ARCH_POLICY for kernel image
signature verification, please include the following:<br>
</p>
<p>"<span style="color: rgb(29, 28, 29); font-family: Slack-Lato,
appleLogo, sans-serif; font-size: 15px; font-style: normal;
font-variant-ligatures: common-ligatures; font-variant-caps:
normal; font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255); text-decoration-thickness: initial; text-decoration-style:
initial; text-decoration-color: initial; display: inline
!important; float: none;">An alternative implementation for the
powerpc arch is IMA_ARCH_POLICY. It verifies the appended kernel
image signature and additionally includes both the signed and
unsigned file hashes in the IMA measurement list, extends the
IMA PCR in the TPM, and prevents blacklisted binary kernel
images from being kexec'd"</span></p>
<p>Thanks & Regards,</p>
<p> - Nayna<br>
</p>
</body>
</html>