From: Mimi Zohar <zohar@linux.ibm.com>
To: Bruno Meneguele <bmeneg@redhat.com>
Cc: linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
erichte@linux.ibm.com, nayna@linux.ibm.com
Subject: Re: [PATCH v3 2/2] ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime
Date: Tue, 30 Jun 2020 07:00:48 -0400 [thread overview]
Message-ID: <1593514848.5085.82.camel@linux.ibm.com> (raw)
In-Reply-To: <20200629234744.GA2756@glitch>
On Mon, 2020-06-29 at 20:47 -0300, Bruno Meneguele wrote:
>
> > I'm not if the "secure_boot" flag is available prior to calling
> > default_appraise_setup(), but if it is, you could modify the test
> > there to also check if the system is booted in secure boot mode (eg.
> > IS_ENABLED(CONFIG_IMA_APPRAISE_BOOTPARAM) &&
> > !arch_ima_get_secureboot())
> >
>
> Well pointed. I built a custom x86 kernel with some workaround to get
> this flag status within default_appraise_setup() and as a result the
> flag is was correctly available.
>
> Considering the nature of this flag (platform's firmware (in all
> arches?)) can we trust that every arch supporting secure/trusted boot
> will have it available in the __setup() call time?
Calling default_appraise_setup() could be deferred.
>
> > > + /* In secure and/or trusted boot the appraisal must be
> > > + * enforced, regardless kernel parameters, preventing
> > > + * runtime changes */
> >
> > Only "appraise" rules are enforced.
> >
>
> Hmm.. do you mean the comment wording is wrong/"could be better",
> pointing the "appraise" action explicitly?
No, it's more than just the comment. Like "trusted boot", IMA-
measurement only measures files, never enforces integrity.
"ima_appraise" mode is only applicable to IMA-appraisal.
Mimi
next prev parent reply other threads:[~2020-06-30 11:00 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-23 20:26 [PATCH v3 0/2] ima: make appraisal state runtime dependent on secure boot Bruno Meneguele
2020-06-23 20:26 ` [PATCH v3 1/2] arch/ima: extend secure boot check to include trusted boot Bruno Meneguele
2020-06-26 20:23 ` Mimi Zohar
2020-06-29 23:52 ` Bruno Meneguele
2020-06-23 20:26 ` [PATCH v3 2/2] ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime Bruno Meneguele
2020-06-26 20:40 ` Mimi Zohar
2020-06-29 23:47 ` Bruno Meneguele
2020-06-30 11:00 ` Mimi Zohar [this message]
2020-06-30 17:00 ` Bruno Meneguele
2020-07-02 19:12 ` Bruno Meneguele
2020-06-26 14:46 ` [PATCH v3 0/2] ima: make appraisal state runtime dependent on secure boot Bruno Meneguele
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1593514848.5085.82.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=bmeneg@redhat.com \
--cc=erichte@linux.ibm.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nayna@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.