From: nayna@linux.vnet.ibm.com (Nayna Jain)
To: linux-security-module@vger.kernel.org
Subject: [PATCH v3 2/6] ima: prevent kexec_load syscall based on runtime secureboot flag
Date: Wed, 19 Sep 2018 13:25:18 +0530 [thread overview]
Message-ID: <20180919075522.7684-3-nayna@linux.vnet.ibm.com> (raw)
In-Reply-To: <20180919075522.7684-1-nayna@linux.vnet.ibm.com>
When CONFIG_KEXEC_VERIFY_SIG is enabled, the kexec_file_load syscall
requires the kexec'd kernel image to be signed. Distros are concerned
about totally disabling the kexec_load syscall. As a compromise, the
kexec_load syscall will only be disabled when CONFIG_KEXEC_VERIFY_SIG
is configured and the system is booted with secureboot enabled.
This patch disables the kexec_load syscall only for systems booted with
secureboot enabled.
Signed-off-by: Nayna Jain <nayna@linux.vnet.ibm.com>
---
security/integrity/ima/ima_main.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index dce0a8a217bb..bdb6e5563d05 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -505,20 +505,24 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
*/
int ima_load_data(enum kernel_load_data_id id)
{
- bool sig_enforce;
+ bool ima_enforce, sig_enforce;
- if ((ima_appraise & IMA_APPRAISE_ENFORCE) != IMA_APPRAISE_ENFORCE)
- return 0;
+ ima_enforce =
+ (ima_appraise & IMA_APPRAISE_ENFORCE) == IMA_APPRAISE_ENFORCE;
switch (id) {
case LOADING_KEXEC_IMAGE:
- if (ima_appraise & IMA_APPRAISE_KEXEC) {
+#ifdef CONFIG_KEXEC_VERIFY_SIG
+ if (arch_ima_get_secureboot())
+ return -EACCES;
+#endif
+ if (ima_enforce && (ima_appraise & IMA_APPRAISE_KEXEC)) {
pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
return -EACCES; /* INTEGRITY_UNKNOWN */
}
break;
case LOADING_FIRMWARE:
- if (ima_appraise & IMA_APPRAISE_FIRMWARE) {
+ if (ima_enforce && (ima_appraise & IMA_APPRAISE_FIRMWARE)) {
pr_err("Prevent firmware sysfs fallback loading.\n");
return -EACCES; /* INTEGRITY_UNKNOWN */
}
@@ -526,7 +530,8 @@ int ima_load_data(enum kernel_load_data_id id)
case LOADING_MODULE:
sig_enforce = is_module_sig_enforced();
- if (!sig_enforce && (ima_appraise & IMA_APPRAISE_MODULES)) {
+ if (ima_enforce && (!sig_enforce
+ && (ima_appraise & IMA_APPRAISE_MODULES))) {
pr_err("impossible to appraise a module without a file descriptor. sig_enforce kernel parameter might help\n");
return -EACCES; /* INTEGRITY_UNKNOWN */
}
--
2.13.6
next prev parent reply other threads:[~2018-09-19 7:55 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-19 7:55 [PATCH v3 0/6] Add support for architecture specific IMA policies Nayna Jain
2018-09-19 7:55 ` [PATCH v3 1/6] x86/ima: define arch_ima_get_secureboot Nayna Jain
2018-09-19 7:55 ` Nayna Jain [this message]
2018-09-19 7:55 ` [PATCH v3 3/6] ima: refactor ima_init_policy() Nayna Jain
2018-09-21 8:34 ` Dan Carpenter
2018-09-24 11:10 ` Nayna Jain
2018-09-19 7:55 ` [PATCH v3 4/6] ima: add support for arch specific policies Nayna Jain
2018-09-19 7:55 ` [PATCH v3 5/6] ima: add support for external setting of ima_appraise Nayna Jain
2018-09-19 7:55 ` [PATCH v3 6/6] x86/ima: define arch_get_ima_policy() for x86 Nayna Jain
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180919075522.7684-3-nayna@linux.vnet.ibm.com \
--to=nayna@linux.vnet.ibm.com \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).