lkml.org 
[lkml]   [2018]   [May]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v4 5/8] ima: based on policy require signed firmware (sysfs fallback)
    Date
    Luis, is the security_kernel_post_read_file LSM hook in
    firmware_loading_store() still needed after this patch? Should it be
    calling security_kernel_load_data() instead?

    ---

    With an IMA policy requiring signed firmware, this patch prevents
    the sysfs fallback method of loading firmware.

    Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
    Cc: Luis R. Rodriguez <mcgrof@suse.com>
    Cc: David Howells <dhowells@redhat.com>
    Cc: Matthew Garrett <mjg59@google.com>
    ---
    security/integrity/ima/ima_main.c | 10 +++++++++-
    1 file changed, 9 insertions(+), 1 deletion(-)

    diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
    index a565d46084c2..4a87f78098c8 100644
    --- a/security/integrity/ima/ima_main.c
    +++ b/security/integrity/ima/ima_main.c
    @@ -475,8 +475,10 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,

    if (!file && read_id == READING_FIRMWARE) {
    if ((ima_appraise & IMA_APPRAISE_FIRMWARE) &&
    - (ima_appraise & IMA_APPRAISE_ENFORCE))
    + (ima_appraise & IMA_APPRAISE_ENFORCE)) {
    + pr_err("Prevent firmware loading_store.\n");
    return -EACCES; /* INTEGRITY_UNKNOWN */
    + }
    return 0;
    }

    @@ -520,6 +522,12 @@ int ima_load_data(enum kernel_load_data_id id)
    pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
    return -EACCES; /* INTEGRITY_UNKNOWN */
    }
    + break;
    + case LOADING_FIRMWARE:
    + if (ima_appraise & IMA_APPRAISE_FIRMWARE) {
    + pr_err("Prevent firmware sysfs fallback loading.\n");
    + return -EACCES; /* INTEGRITY_UNKNOWN */
    + }
    default:
    break;
    }
    --
    2.7.5
    \
     
     \ /
      Last update: 2018-05-29 20:04    [W:4.322 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site