mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-03 17:40:04 +00:00
x86/ima: define arch_get_ima_policy() for x86
On x86, there are two methods of verifying a kexec'ed kernel image signature being loaded via the kexec_file_load syscall - an architecture specific implementaton or a IMA KEXEC_KERNEL_CHECK appraisal rule. Neither of these methods verify the kexec'ed kernel image signature being loaded via the kexec_load syscall. Secure boot enabled systems require kexec images to be signed. Therefore, this patch loads an IMA KEXEC_KERNEL_CHECK policy rule on secure boot enabled systems not configured with CONFIG_KEXEC_VERIFY_SIG enabled. When IMA_APPRAISE_BOOTPARAM is configured, different IMA appraise modes (eg. fix, log) can be specified on the boot command line, allowing unsigned or invalidly signed kernel images to be kexec'ed. This patch permits enabling IMA_APPRAISE_BOOTPARAM or IMA_ARCH_POLICY, but not both. Signed-off-by: Eric Richter <erichte@linux.ibm.com> Signed-off-by: Nayna Jain <nayna@linux.ibm.com> Cc: David Howells <dhowells@redhat.com> Cc: Eric Biederman <ebiederm@xmission.com> Cc: Peter Jones <pjones@redhat.com> Cc: Vivek Goyal <vgoyal@redhat.com> Cc: Dave Young <dyoung@redhat.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
parent
6191706246
commit
d958083a8f
3 changed files with 27 additions and 2 deletions
|
@ -15,3 +15,19 @@ bool arch_ima_get_secureboot(void)
|
||||||
else
|
else
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* secureboot arch rules */
|
||||||
|
static const char * const sb_arch_rules[] = {
|
||||||
|
#if !IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG)
|
||||||
|
"appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig",
|
||||||
|
#endif /* CONFIG_KEXEC_VERIFY_SIG */
|
||||||
|
"measure func=KEXEC_KERNEL_CHECK",
|
||||||
|
NULL
|
||||||
|
};
|
||||||
|
|
||||||
|
const char * const *arch_get_ima_policy(void)
|
||||||
|
{
|
||||||
|
if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot())
|
||||||
|
return sb_arch_rules;
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
|
@ -32,17 +32,18 @@ extern void ima_add_kexec_buffer(struct kimage *image);
|
||||||
|
|
||||||
#ifdef CONFIG_X86
|
#ifdef CONFIG_X86
|
||||||
extern bool arch_ima_get_secureboot(void);
|
extern bool arch_ima_get_secureboot(void);
|
||||||
|
extern const char * const *arch_get_ima_policy(void);
|
||||||
#else
|
#else
|
||||||
static inline bool arch_ima_get_secureboot(void)
|
static inline bool arch_ima_get_secureboot(void)
|
||||||
{
|
{
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
#endif
|
|
||||||
|
|
||||||
static inline const char * const *arch_get_ima_policy(void)
|
static inline const char * const *arch_get_ima_policy(void)
|
||||||
{
|
{
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
#else
|
#else
|
||||||
static inline int ima_bprm_check(struct linux_binprm *bprm)
|
static inline int ima_bprm_check(struct linux_binprm *bprm)
|
||||||
|
|
|
@ -157,6 +157,14 @@ config IMA_APPRAISE
|
||||||
<http://linux-ima.sourceforge.net>
|
<http://linux-ima.sourceforge.net>
|
||||||
If unsure, say N.
|
If unsure, say N.
|
||||||
|
|
||||||
|
config IMA_ARCH_POLICY
|
||||||
|
bool "Enable loading an IMA architecture specific policy"
|
||||||
|
depends on KEXEC_VERIFY_SIG || IMA_APPRAISE && INTEGRITY_ASYMMETRIC_KEYS
|
||||||
|
default n
|
||||||
|
help
|
||||||
|
This option enables loading an IMA architecture specific policy
|
||||||
|
based on run time secure boot flags.
|
||||||
|
|
||||||
config IMA_APPRAISE_BUILD_POLICY
|
config IMA_APPRAISE_BUILD_POLICY
|
||||||
bool "IMA build time configured policy rules"
|
bool "IMA build time configured policy rules"
|
||||||
depends on IMA_APPRAISE && INTEGRITY_ASYMMETRIC_KEYS
|
depends on IMA_APPRAISE && INTEGRITY_ASYMMETRIC_KEYS
|
||||||
|
@ -217,7 +225,7 @@ config IMA_APPRAISE_REQUIRE_POLICY_SIGS
|
||||||
|
|
||||||
config IMA_APPRAISE_BOOTPARAM
|
config IMA_APPRAISE_BOOTPARAM
|
||||||
bool "ima_appraise boot parameter"
|
bool "ima_appraise boot parameter"
|
||||||
depends on IMA_APPRAISE
|
depends on IMA_APPRAISE && !IMA_ARCH_POLICY
|
||||||
default y
|
default y
|
||||||
help
|
help
|
||||||
This option enables the different "ima_appraise=" modes
|
This option enables the different "ima_appraise=" modes
|
||||||
|
|
Loading…
Reference in a new issue