lkml.org 
[lkml]   [2018]   [Jul]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v6 5/8] ima: based on policy require signed firmware (sysfs fallback)
    Date
    With an IMA policy requiring signed firmware, this patch prevents
    the sysfs fallback method of loading firmware.

    Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
    Cc: Luis R. Rodriguez <mcgrof@suse.com>
    Cc: Matthew Garrett <mjg59@google.com>
    ---
    security/integrity/ima/ima_main.c | 10 +++++++++-
    1 file changed, 9 insertions(+), 1 deletion(-)

    diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
    index 71fecfef0939..e467664965e7 100644
    --- a/security/integrity/ima/ima_main.c
    +++ b/security/integrity/ima/ima_main.c
    @@ -472,8 +472,10 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,

    if (!file && read_id == READING_FIRMWARE) {
    if ((ima_appraise & IMA_APPRAISE_FIRMWARE) &&
    - (ima_appraise & IMA_APPRAISE_ENFORCE))
    + (ima_appraise & IMA_APPRAISE_ENFORCE)) {
    + pr_err("Prevent firmware loading_store.\n");
    return -EACCES; /* INTEGRITY_UNKNOWN */
    + }
    return 0;
    }

    @@ -517,6 +519,12 @@ int ima_load_data(enum kernel_load_data_id id)
    pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
    return -EACCES; /* INTEGRITY_UNKNOWN */
    }
    + break;
    + case LOADING_FIRMWARE:
    + if (ima_appraise & IMA_APPRAISE_FIRMWARE) {
    + pr_err("Prevent firmware sysfs fallback loading.\n");
    + return -EACCES; /* INTEGRITY_UNKNOWN */
    + }
    default:
    break;
    }
    --
    2.7.5
    \
     
     \ /
      Last update: 2018-07-15 22:07    [W:2.502 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site