Messages in this thread Patch in this message | | | From | Nayna Jain <> | Subject | [PATCH v7 8/8] powerpc/ima: update ima arch policy to check for blacklist | Date | Mon, 7 Oct 2019 21:14:27 -0400 |
| |
This patch updates the arch specific policies for PowernV systems to add check against blacklisted binary hashes before doing the verification.
Signed-off-by: Nayna Jain <nayna@linux.ibm.com> --- arch/powerpc/kernel/ima_arch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/ima_arch.c b/arch/powerpc/kernel/ima_arch.c index 88bfe4a1a9a5..4fa41537b846 100644 --- a/arch/powerpc/kernel/ima_arch.c +++ b/arch/powerpc/kernel/ima_arch.c @@ -25,9 +25,9 @@ bool arch_ima_get_secureboot(void) static const char *const arch_rules[] = { "measure func=KEXEC_KERNEL_CHECK template=ima-modsig", "measure func=MODULE_CHECK template=ima-modsig", - "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig", + "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", #if !IS_ENABLED(CONFIG_MODULE_SIG_FORCE) - "appraise func=MODULE_CHECK appraise_type=imasig|modsig", + "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", #endif NULL }; -- 2.20.1
| |