Commit 2bfebea9 authored by James Morris's avatar James Morris

Merge branch 'next-integrity-for-james' of...

Merge branch 'next-integrity-for-james' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity into next-integrity

From Mimi:

"This pull request contains just three patches, the remainder are
either included in other pull requests (eg. audit, lockdown) or will
be upstreamed via other subsystems (eg. kselftests, Power).  Included
in this pull request is one bug fix, one documentation update, and
extending the x86 IMA arch policy rules to coordinate the different
kernel module signature verification methods."
parents fe9fd2ef 41475a3e
...@@ -1585,7 +1585,7 @@ ...@@ -1585,7 +1585,7 @@
Format: { "off" | "enforce" | "fix" | "log" } Format: { "off" | "enforce" | "fix" | "log" }
default: "enforce" default: "enforce"
ima_appraise_tcb [IMA] ima_appraise_tcb [IMA] Deprecated. Use ima_policy= instead.
The builtin appraise policy appraises all files The builtin appraise policy appraises all files
owned by uid=0. owned by uid=0.
...@@ -1612,8 +1612,7 @@ ...@@ -1612,8 +1612,7 @@
uid=0. uid=0.
The "appraise_tcb" policy appraises the integrity of The "appraise_tcb" policy appraises the integrity of
all files owned by root. (This is the equivalent all files owned by root.
of ima_appraise_tcb.)
The "secure_boot" policy appraises the integrity The "secure_boot" policy appraises the integrity
of files (eg. kexec kernel image, kernel modules, of files (eg. kexec kernel image, kernel modules,
......
...@@ -3,6 +3,7 @@ ...@@ -3,6 +3,7 @@
* Copyright (C) 2018 IBM Corporation * Copyright (C) 2018 IBM Corporation
*/ */
#include <linux/efi.h> #include <linux/efi.h>
#include <linux/module.h>
#include <linux/ima.h> #include <linux/ima.h>
extern struct boot_params boot_params; extern struct boot_params boot_params;
...@@ -64,12 +65,19 @@ static const char * const sb_arch_rules[] = { ...@@ -64,12 +65,19 @@ static const char * const sb_arch_rules[] = {
"appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig", "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig",
#endif /* CONFIG_KEXEC_VERIFY_SIG */ #endif /* CONFIG_KEXEC_VERIFY_SIG */
"measure func=KEXEC_KERNEL_CHECK", "measure func=KEXEC_KERNEL_CHECK",
#if !IS_ENABLED(CONFIG_MODULE_SIG)
"appraise func=MODULE_CHECK appraise_type=imasig",
#endif
"measure func=MODULE_CHECK",
NULL NULL
}; };
const char * const *arch_get_ima_policy(void) const char * const *arch_get_ima_policy(void)
{ {
if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
if (IS_ENABLED(CONFIG_MODULE_SIG))
set_module_sig_enforced();
return sb_arch_rules; return sb_arch_rules;
}
return NULL; return NULL;
} }
...@@ -676,6 +676,7 @@ static inline bool is_livepatch_module(struct module *mod) ...@@ -676,6 +676,7 @@ static inline bool is_livepatch_module(struct module *mod)
#endif /* CONFIG_LIVEPATCH */ #endif /* CONFIG_LIVEPATCH */
bool is_module_sig_enforced(void); bool is_module_sig_enforced(void);
void set_module_sig_enforced(void);
#else /* !CONFIG_MODULES... */ #else /* !CONFIG_MODULES... */
...@@ -796,6 +797,10 @@ static inline bool is_module_sig_enforced(void) ...@@ -796,6 +797,10 @@ static inline bool is_module_sig_enforced(void)
return false; return false;
} }
static inline void set_module_sig_enforced(void)
{
}
/* Dereference module function descriptor */ /* Dereference module function descriptor */
static inline static inline
void *dereference_module_function_descriptor(struct module *mod, void *ptr) void *dereference_module_function_descriptor(struct module *mod, void *ptr)
......
...@@ -286,6 +286,11 @@ bool is_module_sig_enforced(void) ...@@ -286,6 +286,11 @@ bool is_module_sig_enforced(void)
} }
EXPORT_SYMBOL(is_module_sig_enforced); EXPORT_SYMBOL(is_module_sig_enforced);
void set_module_sig_enforced(void)
{
sig_enforce = true;
}
/* Block module loading/unloading? */ /* Block module loading/unloading? */
int modules_disabled = 0; int modules_disabled = 0;
core_param(nomodule, modules_disabled, bint, 0); core_param(nomodule, modules_disabled, bint, 0);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment