lkml.org 
[lkml]   [2020]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[RFC PATCH 2/2] ima: Change default secure_boot policy to include appended signatures
    Date
    Change the default secure_boot policy from:

    appraise func=MODULE_CHECK appraise_type=imasig
    appraise func=FIRMWARE_CHECK appraise_type=imasig
    appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig
    appraise func=POLICY_CHECK appraise_type=imasig

    to

    appraise func=MODULE_CHECK appraise_type=imasig|modsig
    appraise func=FIRMWARE_CHECK appraise_type=imasig
    appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig
    appraise func=POLICY_CHECK appraise_type=imasig

    This will allow appended signatures to work with the default
    secure_boot policy.

    Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
    ---
    security/integrity/ima/ima_policy.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
    index ef8dfd47c7e3..5d835715b472 100644
    --- a/security/integrity/ima/ima_policy.c
    +++ b/security/integrity/ima/ima_policy.c
    @@ -189,11 +189,11 @@ static struct ima_rule_entry build_appraise_rules[] __ro_after_init = {

    static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
    {.action = APPRAISE, .func = MODULE_CHECK,
    - .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
    + .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED | IMA_MODSIG_ALLOWED},
    {.action = APPRAISE, .func = FIRMWARE_CHECK,
    .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
    {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
    - .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
    + .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED | IMA_MODSIG_ALLOWED},
    {.action = APPRAISE, .func = POLICY_CHECK,
    .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
    };
    --
    2.18.1
    \
     
     \ /
      Last update: 2020-02-06 17:46    [W:3.962 / U:0.868 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site