Messages in this thread | | | Subject | Re: [PATCH] allow disabling IMA at runtime | From | Mimi Zohar <> | Date | Wed, 26 Aug 2009 08:07:21 -0400 |
| |
Kyle McMartin <kyle@infradead.org> wrote on 08/25/2009 10:10:05 PM:
> From: Kyle McMartin <kyle@redhat.com> > > Due to a memory leak in IMA that we're currently debugging in Fedora > rawhide, it would be nice to be able to disable that support at runtime. > Currently it's only able to be built in, and there's no toggle to avoid > initializing it. > > Provide one, in order to enhance debuggability. If a user can reboot a > machine and edit its command line, one can do a far sight worse things > than disabling a security precaution. > > Signed-off-by: Kyle McMartin <kyle@redhat.com>
Have you tried using Eric's patch "IMA: Minimal IMA policy and boot param for TCB IMA policy" (commit 5789ba3bd0a3cd20df5980ebf03358f2eb44fd67), which introduced the ima_tcb=1 command line option? It wasn't backported to 2.6.30.
Mimi
> --- > diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt > index 7936b80..0d1b1ed 100644 > --- a/Documentation/kernel-parameters.txt > +++ b/Documentation/kernel-parameters.txt > @@ -926,6 +926,11 @@ and is between 256 and 4096 characters. It is defined in the file > ihash_entries= [KNL] > Set number of hash buckets for inode cache. > > + ima= [IMA] > + Format: { "0" | "1" } > + 0 -- disable IMA. > + 1 -- enable IMA. (default) > + > ima_audit= [IMA] > Format: { "0" | "1" } > 0 -- integrity auditing messages. (Default) > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > index 101c512..cc7603e 100644 > --- a/security/integrity/ima/ima_main.c > +++ b/security/integrity/ima/ima_main.c > @@ -339,10 +339,27 @@ int ima_bprm_check(struct linux_binprm *bprm) > return 0; > } > > +static int ima_disabled = 0; > +static int __init ima_enabled(char *str) > +{ > + unsigned long enabled; > + > + if (!strict_strtoul(str, 0, &enabled)) > + ima_disabled = enabled ? 0 : 1; > + > + return 1; > +} > +__setup("ima=", ima_enabled); > + > static int __init init_ima(void) > { > int error; > > + if (ima_disabled) { > + pr_info("IMA disabled at user request.\n"); > + return 0; > + } > + > ima_iintcache_init(); > error = ima_init(); > ima_initialized = 1;
| |