From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751818AbdJ3MBx (ORCPT ); Mon, 30 Oct 2017 08:01:53 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:47692 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751630AbdJ3MBu (ORCPT ); Mon, 30 Oct 2017 08:01:50 -0400 Subject: Re: [PATCH 07/27] kexec_file: Disable at runtime if securelevel has been set From: Mimi Zohar To: David Howells Cc: joeyli , linux-security-module@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, matthew.garrett@nebula.com, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, jforbes@redhat.com Date: Mon, 30 Oct 2017 08:01:40 -0400 In-Reply-To: <17798.1509354029@warthog.procyon.org.uk> References: <1509027463.5886.26.camel@linux.vnet.ibm.com> <150842463163.7923.11081723749106843698.stgit@warthog.procyon.org.uk> <150842468754.7923.10037578333644594134.stgit@warthog.procyon.org.uk> <1508774083.3639.124.camel@linux.vnet.ibm.com> <20171026074243.GM8550@linux-l9pv.suse> <17798.1509354029@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 x-cbid: 17103012-0012-0000-0000-000005876719 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17103012-0013-0000-0000-00001901ECF1 Message-Id: <1509364900.3583.54.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-10-30_03:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1710300167 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 2017-10-30 at 09:00 +0000, David Howells wrote: > Mimi Zohar wrote: > > > Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is > > dependent on the "ima: require secure_boot rules in lockdown mode" > > patch - http://kernsec.org/pipermail/linux-security-module-archive/201 > > 7-October/003910.html. > > What happens if the file in question is being accessed from a filesystem that > doesn't have xattrs and doesn't provide support for appraisal? Is it rejected > outright or just permitted? IMA-appraisal returns -EACCES for any error, including lack of xattr support. Thiago Bauermann posted the "Appended signatures support for IMA appraisal" patch set.  This patch set allows the current kernel module appended signature format to be used for verifying the kernel image.  Once that patch set is upstreamed, we'll be able to update the IMA "secure_boot" policy to permit appended signatures. Mimi