From: Mimi Zohar <zohar@linux.ibm.com>
To: Bruno Meneguele <bmeneg@redhat.com>,
linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: erichte@linux.ibm.com, nayna@linux.ibm.com
Subject: Re: [PATCH v3 1/2] arch/ima: extend secure boot check to include trusted boot
Date: Fri, 26 Jun 2020 16:23:12 -0400 [thread overview]
Message-ID: <1593202992.27152.463.camel@linux.ibm.com> (raw)
In-Reply-To: <20200623202640.4936-2-bmeneg@redhat.com>
On Tue, 2020-06-23 at 17:26 -0300, Bruno Meneguele wrote:
<snip>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index c1583d98c5e5..a760094e8f8d 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -694,7 +694,7 @@ int ima_load_data(enum kernel_load_data_id id)
> switch (id) {
> case LOADING_KEXEC_IMAGE:
> if (IS_ENABLED(CONFIG_KEXEC_SIG)
> - && arch_ima_get_secureboot()) {
> + && arch_ima_secure_or_trusted_boot()) {
> pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
> return -EACCES;
> }
Only IMA-appraisal enforces file integrity based on policy.
Mimi
next prev parent reply other threads:[~2020-06-26 20:23 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-23 20:26 [PATCH v3 0/2] ima: make appraisal state runtime dependent on secure boot Bruno Meneguele
2020-06-23 20:26 ` [PATCH v3 1/2] arch/ima: extend secure boot check to include trusted boot Bruno Meneguele
2020-06-26 20:23 ` Mimi Zohar [this message]
2020-06-29 23:52 ` Bruno Meneguele
2020-06-23 20:26 ` [PATCH v3 2/2] ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime Bruno Meneguele
2020-06-26 20:40 ` Mimi Zohar
2020-06-29 23:47 ` Bruno Meneguele
2020-06-30 11:00 ` Mimi Zohar
2020-06-30 17:00 ` Bruno Meneguele
2020-07-02 19:12 ` Bruno Meneguele
2020-06-26 14:46 ` [PATCH v3 0/2] ima: make appraisal state runtime dependent on secure boot Bruno Meneguele
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1593202992.27152.463.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=bmeneg@redhat.com \
--cc=erichte@linux.ibm.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nayna@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.