• Bruno Meneguele's avatar
    ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime · 311aa6aa
    Bruno Meneguele authored
    The IMA_APPRAISE_BOOTPARAM config allows enabling different "ima_appraise="
    modes - log, fix, enforce - at run time, but not when IMA architecture
    specific policies are enabled.  This prevents properly labeling the
    filesystem on systems where secure boot is supported, but not enabled on the
    platform.  Only when secure boot is actually enabled should these IMA
    appraise modes be disabled.
    
    This patch removes the compile time dependency and makes it a runtime
    decision, based on the secure boot state of that platform.
    
    Test results as follows:
    
    -> x86-64 with secure boot enabled
    
    [    0.015637] Kernel command line: <...> ima_policy=appraise_tcb ima_appraise=fix
    [    0.015668] ima: Secure boot enabled: ignoring ima_appraise=fix boot parameter option
    
    -> powerpc with secure boot disabled
    
    [    0.000000] Kernel command line: <...> ima_policy=appraise_tcb ima_appraise=fix
    [    0.000000] Secure boot mode disabled
    
    -> Running the system without secure boot and with both options set:
    
    CONFIG_IMA_APPRAISE_BOOTPARAM=y
    CONFIG_IMA_ARCH_POLICY=y
    
    Audit prompts "missing-hash" but still allow execution and, consequently,
    filesystem labeling:
    
    type=INTEGRITY_DATA msg=audit(07/09/2020 12:30:27.778:1691) : pid=4976
    uid=root auid=root ses=2
    subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=appraise_data
    cause=missing-hash comm=bash name=/usr/bin/evmctl dev="dm-0" ino=493150
    res=no
    
    Cc: stable@vger.kernel.org
    Fixes: d958083a ("x86/ima: define arch_get_ima_policy() for x86")
    Signed-off-by: default avatarBruno Meneguele <bmeneg@redhat.com>
    Cc: stable@vger.kernel.org # 5.0
    Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    311aa6aa
Kconfig 10.6 KB