Messages in this thread | | | Subject | Re: [PATCH] ima: require signed IMA policy when UEFI secure boot is enabled | From | Mimi Zohar <> | Date | Tue, 04 Jul 2023 08:57:10 -0400 |
| |
On Mon, 2023-07-03 at 19:54 +0800, Coiby Xu wrote: > With the introduction of the .machine keyring for UEFI-based systems, > users are able to add custom CAs keys via MOK. This allow users to sign > their own IMA polices. For the sake of security, mandate signed IMA > policy when UEFI secure boot is enabled. > > Suggested-by: Mimi Zohar <zohar@linux.ibm.com> > Signed-off-by: Coiby Xu <coxu@redhat.com> > --- > security/integrity/ima/ima_efi.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c > index 9db66fe310d4..bb2881759505 100644 > --- a/security/integrity/ima/ima_efi.c > +++ b/security/integrity/ima/ima_efi.c > @@ -58,6 +58,9 @@ static const char * const sb_arch_rules[] = { > #if !IS_ENABLED(CONFIG_MODULE_SIG) > "appraise func=MODULE_CHECK appraise_type=imasig", > #endif > +#if IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && IS_ENABLED(CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY) > + "appraise func=POLICY_CHECK appraise_type=imasig", > +#endif /* CONFIG_INTEGRITY_MACHINE_KEYRING && IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY */ > "measure func=MODULE_CHECK", > NULL > };
Thanks, Coiby.
Using IS_ENABLED() is not wrong, but unnecessary. IS_BUILTIN() suffices.
-- thanks,
Mimi
| |