From: Petr Vorel <pvorel@suse.cz>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: linux-kselftest@vger.kernel.org, Shuah Khan <shuah@kernel.org>,
linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 5/5] selftests/ima: loading kernel modules
Date: Thu, 28 Feb 2019 23:32:55 +0100 [thread overview]
Message-ID: <20190228223255.GE20335@dell5510> (raw)
In-Reply-To: <1551223620-11586-6-git-send-email-zohar@linux.ibm.com>
Hi Mimi,
> While the appended kernel module signature can be verified, when loading
> a kernel module via either the init_module or the finit_module syscall,
> verifying the IMA signature requires access to the file descriptor,
> which is only available via the finit_module syscall. As "modprobe"
> does not provide a flag allowing the syscall - init_module or
> finit_module - to be specified, this patch does not load a kernel
> module.
> This test simply verifies that on secure boot enabled systems with
> "CONFIG_IMA_ARCH_POLICY" configured, that at least an appended kernel
> module signature or an IMA signature is required based on the Kconfig
> and the runtime IMA policy.
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Petr Vorel <pvorel@suse.cz>
...
> diff --git a/tools/testing/selftests/ima/test_kernel_module.sh b/tools/testing/selftests/ima/test_kernel_module.sh
...
> +# Are appended signatures required?
> +if [ -e /sys/module/module/parameters/sig_enforce ]; then
> + sig_enforce=$(cat /sys/module/module/parameters/sig_enforce)
> + if [ $sig_enforce = "Y" ]; then
> + log_pass "appended kernel module signature required"
> + fi
> +fi
Another possible helper [1]:
is_enabled() # or sysfs_enabled
{
[ -f "$1" ] && [ "$(cat $1)" = "Y" -o "$(cat $1)" = "1" ]
}
is_enabled /sys/module/module/parameters/sig_enforce && \
log_pass "appended kernel module signature required"
...
Kind regards,
Petr
[1] https://github.com/linux-test-project/ltp/blob/master/ver_linux#L30
WARNING: multiple messages have this Message-ID (diff)
From: pvorel at suse.cz (Petr Vorel)
Subject: [PATCH v2 5/5] selftests/ima: loading kernel modules
Date: Thu, 28 Feb 2019 23:32:55 +0100 [thread overview]
Message-ID: <20190228223255.GE20335@dell5510> (raw)
In-Reply-To: <1551223620-11586-6-git-send-email-zohar@linux.ibm.com>
Hi Mimi,
> While the appended kernel module signature can be verified, when loading
> a kernel module via either the init_module or the finit_module syscall,
> verifying the IMA signature requires access to the file descriptor,
> which is only available via the finit_module syscall. As "modprobe"
> does not provide a flag allowing the syscall - init_module or
> finit_module - to be specified, this patch does not load a kernel
> module.
> This test simply verifies that on secure boot enabled systems with
> "CONFIG_IMA_ARCH_POLICY" configured, that at least an appended kernel
> module signature or an IMA signature is required based on the Kconfig
> and the runtime IMA policy.
> Signed-off-by: Mimi Zohar <zohar at linux.ibm.com>
Reviewed-by: Petr Vorel <pvorel at suse.cz>
...
> diff --git a/tools/testing/selftests/ima/test_kernel_module.sh b/tools/testing/selftests/ima/test_kernel_module.sh
...
> +# Are appended signatures required?
> +if [ -e /sys/module/module/parameters/sig_enforce ]; then
> + sig_enforce=$(cat /sys/module/module/parameters/sig_enforce)
> + if [ $sig_enforce = "Y" ]; then
> + log_pass "appended kernel module signature required"
> + fi
> +fi
Another possible helper [1]:
is_enabled() # or sysfs_enabled
{
[ -f "$1" ] && [ "$(cat $1)" = "Y" -o "$(cat $1)" = "1" ]
}
is_enabled /sys/module/module/parameters/sig_enforce && \
log_pass "appended kernel module signature required"
...
Kind regards,
Petr
[1] https://github.com/linux-test-project/ltp/blob/master/ver_linux#L30
WARNING: multiple messages have this Message-ID (diff)
From: pvorel@suse.cz (Petr Vorel)
Subject: [PATCH v2 5/5] selftests/ima: loading kernel modules
Date: Thu, 28 Feb 2019 23:32:55 +0100 [thread overview]
Message-ID: <20190228223255.GE20335@dell5510> (raw)
Message-ID: <20190228223255.4U1-fCVfw9jyjISo5QZSA3fVm9XfJ7qwXk3eum6IU3M@z> (raw)
In-Reply-To: <1551223620-11586-6-git-send-email-zohar@linux.ibm.com>
Hi Mimi,
> While the appended kernel module signature can be verified, when loading
> a kernel module via either the init_module or the finit_module syscall,
> verifying the IMA signature requires access to the file descriptor,
> which is only available via the finit_module syscall. As "modprobe"
> does not provide a flag allowing the syscall - init_module or
> finit_module - to be specified, this patch does not load a kernel
> module.
> This test simply verifies that on secure boot enabled systems with
> "CONFIG_IMA_ARCH_POLICY" configured, that at least an appended kernel
> module signature or an IMA signature is required based on the Kconfig
> and the runtime IMA policy.
> Signed-off-by: Mimi Zohar <zohar at linux.ibm.com>
Reviewed-by: Petr Vorel <pvorel at suse.cz>
...
> diff --git a/tools/testing/selftests/ima/test_kernel_module.sh b/tools/testing/selftests/ima/test_kernel_module.sh
...
> +# Are appended signatures required?
> +if [ -e /sys/module/module/parameters/sig_enforce ]; then
> + sig_enforce=$(cat /sys/module/module/parameters/sig_enforce)
> + if [ $sig_enforce = "Y" ]; then
> + log_pass "appended kernel module signature required"
> + fi
> +fi
Another possible helper [1]:
is_enabled() # or sysfs_enabled
{
[ -f "$1" ] && [ "$(cat $1)" = "Y" -o "$(cat $1)" = "1" ]
}
is_enabled /sys/module/module/parameters/sig_enforce && \
log_pass "appended kernel module signature required"
...
Kind regards,
Petr
[1] https://github.com/linux-test-project/ltp/blob/master/ver_linux#L30
next prev parent reply other threads:[~2019-02-28 22:33 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-26 23:26 [PATCH v2 0/5] selftests/ima: add kexec and kernel module tests Mimi Zohar
2019-02-26 23:26 ` Mimi Zohar
2019-02-26 23:26 ` zohar
2019-02-26 23:26 ` [PATCH v2 1/5] selftests/ima: cleanup the kexec selftest Mimi Zohar
2019-02-26 23:26 ` Mimi Zohar
2019-02-26 23:26 ` zohar
2019-02-27 0:57 ` shuah
2019-02-27 0:57 ` shuah
2019-02-27 0:57 ` shuah
2019-02-26 23:26 ` [PATCH v2 2/5] selftests/ima: define a set of common functions Mimi Zohar
2019-02-26 23:26 ` Mimi Zohar
2019-02-26 23:26 ` zohar
2019-02-27 1:01 ` shuah
2019-02-27 1:01 ` shuah
2019-02-27 1:01 ` shuah
2019-02-28 19:54 ` Petr Vorel
2019-02-28 19:54 ` Petr Vorel
2019-02-28 19:54 ` pvorel
2019-02-26 23:26 ` [PATCH v2 3/5] selftests/ima: define common logging functions Mimi Zohar
2019-02-26 23:26 ` Mimi Zohar
2019-02-26 23:26 ` zohar
2019-02-27 1:39 ` shuah
2019-02-27 1:39 ` shuah
2019-02-27 1:39 ` shuah
2019-02-28 20:18 ` Petr Vorel
2019-02-28 20:18 ` Petr Vorel
2019-02-28 20:18 ` pvorel
2019-02-28 21:01 ` Petr Vorel
2019-02-28 21:01 ` Petr Vorel
2019-02-28 21:01 ` pvorel
2019-02-26 23:26 ` [PATCH v2 4/5] selftests/ima: kexec_file_load syscall test Mimi Zohar
2019-02-26 23:26 ` Mimi Zohar
2019-02-26 23:26 ` zohar
2019-02-27 1:54 ` shuah
2019-02-27 1:54 ` shuah
2019-02-27 1:54 ` shuah
2019-02-28 22:00 ` Petr Vorel
2019-02-28 22:00 ` Petr Vorel
2019-02-28 22:00 ` pvorel
2019-03-10 17:48 ` Mimi Zohar
2019-03-10 17:48 ` Mimi Zohar
2019-03-10 17:48 ` zohar
2019-03-11 8:34 ` Petr Vorel
2019-03-11 8:34 ` Petr Vorel
2019-03-11 8:34 ` pvorel
2019-03-11 11:49 ` Mimi Zohar
2019-03-11 11:49 ` Mimi Zohar
2019-03-11 11:49 ` zohar
2019-02-28 22:20 ` Petr Vorel
2019-02-28 22:20 ` Petr Vorel
2019-02-28 22:20 ` pvorel
2019-02-26 23:27 ` [PATCH v2 5/5] selftests/ima: loading kernel modules Mimi Zohar
2019-02-26 23:27 ` Mimi Zohar
2019-02-26 23:27 ` zohar
2019-02-27 1:59 ` shuah
2019-02-27 1:59 ` shuah
2019-02-27 1:59 ` shuah
2019-02-27 14:14 ` Mimi Zohar
2019-02-27 14:14 ` Mimi Zohar
2019-02-27 14:14 ` zohar
2019-02-27 15:33 ` shuah
2019-02-27 15:33 ` shuah
2019-02-27 15:33 ` shuah
2019-02-27 18:37 ` Mimi Zohar
2019-02-27 18:37 ` Mimi Zohar
2019-02-27 18:37 ` zohar
2019-02-28 23:14 ` Petr Vorel
2019-02-28 23:14 ` Petr Vorel
2019-02-28 23:14 ` pvorel
2019-02-28 22:32 ` Petr Vorel [this message]
2019-02-28 22:32 ` Petr Vorel
2019-02-28 22:32 ` pvorel
2019-03-10 17:48 ` Mimi Zohar
2019-03-10 17:48 ` Mimi Zohar
2019-03-10 17:48 ` zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190228223255.GE20335@dell5510 \
--to=pvorel@suse.cz \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=shuah@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.