From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AB8JxZo2t/aRczw05P3aiPkjGa3wGQcZ9tkRcbULl9Fo/6P7qqnvIfe1rUCWuiFrLy1wT0ZGu7+s ARC-Seal: i=1; a=rsa-sha256; t=1526568574; cv=none; d=google.com; s=arc-20160816; b=rlrD+2/NunDx+QvZgORh/2rjtjEhjINnwpb++KZf/wfu+Groi7mY5qCrCPwxwq9cQB rMmiFlcfj7G2JUbIKNh6Ealp888G4tqkUyiyhC11ywYSenEtnuDr1s93CVV8KFGgF33p 33O7FZhMOCleHGmsHh27e3W4hIAFOzMx9s2eMtu2Lz62EBx3GIJLMBoODBIB4R5u9Pw/ 9KBSLYD0c/tzMSo6TD5F+lIr9LNGS/af/0rLYki1ClHZTDy5kR3bbMuoCSMUsNFKBRWn E4gphkQ/x4CuOzcgaFcM7QBVquWL78BtftmMUnaudZmq/VG0ZRO58uSbtMPNjddM+EBa Ue2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:subject:cc:to:from:arc-authentication-results; bh=KpnNycjncj9Lb4iRUlPwW94OYbHEqlEdC5wTzp0JBkw=; b=xjiRyqBokHLif79DwA6VwLiyGrHdWf33Ak4g/986fW3rjEhnxUrPE7tdZ/QWjHlGrT ex7FTfn8brKH3BKWcaDf4Mx/zgb6D4+WUVu/XUTYPHeTFkAzPh6UZ+Nyte9zFyWo0pO1 vBUJcBKK+6v7894GVYwG2qDobCwCintoxZKC0lINTp1DxSP8ah7rLsElXDjwtnluRMha 49WqHFU3tvNFG4VERB17L+wsBzwwihJAQ2szEVDpfsqqqlKl1rurVy8z6rAkghvUDG/C Q5J22pNPZXy5a/vS2hVxUnrcAI90dgvBoZ4J8VkjxCUdaxtvr6DApt69OLl8GoC6+9wu R/YA== ARC-Authentication-Results: i=1; mx.google.com; spf=neutral (google.com: 148.163.158.5 is neither permitted nor denied by best guess record for domain of zohar@linux.vnet.ibm.com) smtp.mailfrom=zohar@linux.vnet.ibm.com; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Authentication-Results: mx.google.com; spf=neutral (google.com: 148.163.158.5 is neither permitted nor denied by best guess record for domain of zohar@linux.vnet.ibm.com) smtp.mailfrom=zohar@linux.vnet.ibm.com; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, David Howells , "Luis R . Rodriguez" , Eric Biederman , kexec@lists.infradead.org, Andres Rodriguez , Greg Kroah-Hartman , Ard Biesheuvel Subject: [PATCH v2 0/9] kexec/firmware: support system wide policy requiring signatures Date: Thu, 17 May 2018 10:48:41 -0400 X-Mailer: git-send-email 2.7.5 X-TM-AS-GCONF: 00 x-cbid: 18051714-0044-0000-0000-000005538AC9 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18051714-0045-0000-0000-000028950007 Message-Id: <1526568530-9144-1-git-send-email-zohar@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-05-17_08:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1805170137 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1600723169485644246?= X-GMAIL-MSGID: =?utf-8?q?1600723169485644246?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: IMA-appraisal is mostly being used in the embedded or single purpose closed system environments. In these environments, both the Kconfig options and the userspace tools can be modified appropriately to limit syscalls. For stock kernels, userspace applications need to continue to work with older kernels as well as with newer kernels. In this environment, the customer needs the ability to define a system wide IMA policy, such as requiring all kexec'ed images, firmware, kernel modules to be signed, without being dependent on either the Kconfig options or the userspace tools.[1] This patch set allows the customer to define a policy which requires the kexec'ed kernel images, firmware, and/or kernel modules to be signed. New to this patch set is the ability to configure a build time IMA policy, which is automatically loaded at run time without needing to specify it on the boot command line. The build time policy rules persist after loading a custom kernel policy. [1] kexec-tools suupports the new syscall based on a flag (-s). Changelog v3: - combined "kexec: limit kexec_load syscall" and "firmware: kernel signature verification" patch sets. - add support for build time policy. - defined generic security_kernel_read_blob() wrapper for security_kernel_read_file(). Suggested by Luis. - removed the CONFIG_CFG80211_REQUIRE_SIGNED_REGDB ifdef. If both REGDB and an IMA-appraisal policy require signed firmware, for now require both signatures. Subsequent patches might change this. - Still unclear if the pre-allocated firmware buffer can be accessed prior to the signature verification completes. Mimi Zohar (9): ima: based on policy verify firmware signatures (pre-allocated buffer) ima: fix updating the ima_appraise flag security: define security_kernel_read_blob() wrapper kexec: add call to LSM hook in original kexec_load syscall ima: based on policy require signed kexec kernel images firmware: add call to LSM hook before firmware sysfs fallback ima: based on policy require signed firmware (sysfs fallback) ima: add build time policy ima: based on policy prevent loading firmware (pre-allocated buffer) drivers/base/firmware_loader/fallback.c | 7 +++ include/linux/fs.h | 1 + include/linux/security.h | 6 +++ kernel/kexec.c | 11 +++++ security/integrity/ima/Kconfig | 58 +++++++++++++++++++++++++ security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_main.c | 29 +++++++++++++ security/integrity/ima/ima_policy.c | 76 +++++++++++++++++++++++++++------ security/security.c | 6 +++ 9 files changed, 183 insertions(+), 12 deletions(-) -- 2.7.5 From mboxrd@z Thu Jan 1 00:00:00 1970 From: zohar@linux.vnet.ibm.com (Mimi Zohar) Date: Thu, 17 May 2018 10:48:41 -0400 Subject: [PATCH v2 0/9] kexec/firmware: support system wide policy requiring signatures Message-ID: <1526568530-9144-1-git-send-email-zohar@linux.vnet.ibm.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org IMA-appraisal is mostly being used in the embedded or single purpose closed system environments. In these environments, both the Kconfig options and the userspace tools can be modified appropriately to limit syscalls. For stock kernels, userspace applications need to continue to work with older kernels as well as with newer kernels. In this environment, the customer needs the ability to define a system wide IMA policy, such as requiring all kexec'ed images, firmware, kernel modules to be signed, without being dependent on either the Kconfig options or the userspace tools.[1] This patch set allows the customer to define a policy which requires the kexec'ed kernel images, firmware, and/or kernel modules to be signed. New to this patch set is the ability to configure a build time IMA policy, which is automatically loaded at run time without needing to specify it on the boot command line. The build time policy rules persist after loading a custom kernel policy. [1] kexec-tools suupports the new syscall based on a flag (-s). Changelog v3: - combined "kexec: limit kexec_load syscall" and "firmware: kernel signature verification" patch sets. - add support for build time policy. - defined generic security_kernel_read_blob() wrapper for security_kernel_read_file(). Suggested by Luis. - removed the CONFIG_CFG80211_REQUIRE_SIGNED_REGDB ifdef. If both REGDB and an IMA-appraisal policy require signed firmware, for now require both signatures. Subsequent patches might change this. - Still unclear if the pre-allocated firmware buffer can be accessed prior to the signature verification completes. Mimi Zohar (9): ima: based on policy verify firmware signatures (pre-allocated buffer) ima: fix updating the ima_appraise flag security: define security_kernel_read_blob() wrapper kexec: add call to LSM hook in original kexec_load syscall ima: based on policy require signed kexec kernel images firmware: add call to LSM hook before firmware sysfs fallback ima: based on policy require signed firmware (sysfs fallback) ima: add build time policy ima: based on policy prevent loading firmware (pre-allocated buffer) drivers/base/firmware_loader/fallback.c | 7 +++ include/linux/fs.h | 1 + include/linux/security.h | 6 +++ kernel/kexec.c | 11 +++++ security/integrity/ima/Kconfig | 58 +++++++++++++++++++++++++ security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_main.c | 29 +++++++++++++ security/integrity/ima/ima_policy.c | 76 +++++++++++++++++++++++++++------ security/security.c | 6 +++ 9 files changed, 183 insertions(+), 12 deletions(-) -- 2.7.5 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fJKE0-0001dy-Jv for kexec@lists.infradead.org; Thu, 17 May 2018 14:49:53 +0000 Received: from pps.filterd (m0098394.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w4HEjVnG117125 for ; Thu, 17 May 2018 10:49:33 -0400 Received: from e06smtp14.uk.ibm.com (e06smtp14.uk.ibm.com [195.75.94.110]) by mx0a-001b2d01.pphosted.com with ESMTP id 2j1bj8gxxb-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 17 May 2018 10:49:32 -0400 Received: from localhost by e06smtp14.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 17 May 2018 15:49:30 +0100 From: Mimi Zohar Subject: [PATCH v2 0/9] kexec/firmware: support system wide policy requiring signatures Date: Thu, 17 May 2018 10:48:41 -0400 Message-Id: <1526568530-9144-1-git-send-email-zohar@linux.vnet.ibm.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "kexec" Errors-To: kexec-bounces+dwmw2=infradead.org@lists.infradead.org To: linux-integrity@vger.kernel.org Cc: Andres Rodriguez , Ard Biesheuvel , Greg Kroah-Hartman , kexec@lists.infradead.org, linux-kernel@vger.kernel.org, David Howells , linux-security-module@vger.kernel.org, Eric Biederman , Mimi Zohar , "Luis R . Rodriguez" IMA-appraisal is mostly being used in the embedded or single purpose closed system environments. In these environments, both the Kconfig options and the userspace tools can be modified appropriately to limit syscalls. For stock kernels, userspace applications need to continue to work with older kernels as well as with newer kernels. In this environment, the customer needs the ability to define a system wide IMA policy, such as requiring all kexec'ed images, firmware, kernel modules to be signed, without being dependent on either the Kconfig options or the userspace tools.[1] This patch set allows the customer to define a policy which requires the kexec'ed kernel images, firmware, and/or kernel modules to be signed. New to this patch set is the ability to configure a build time IMA policy, which is automatically loaded at run time without needing to specify it on the boot command line. The build time policy rules persist after loading a custom kernel policy. [1] kexec-tools suupports the new syscall based on a flag (-s). Changelog v3: - combined "kexec: limit kexec_load syscall" and "firmware: kernel signature verification" patch sets. - add support for build time policy. - defined generic security_kernel_read_blob() wrapper for security_kernel_read_file(). Suggested by Luis. - removed the CONFIG_CFG80211_REQUIRE_SIGNED_REGDB ifdef. If both REGDB and an IMA-appraisal policy require signed firmware, for now require both signatures. Subsequent patches might change this. - Still unclear if the pre-allocated firmware buffer can be accessed prior to the signature verification completes. Mimi Zohar (9): ima: based on policy verify firmware signatures (pre-allocated buffer) ima: fix updating the ima_appraise flag security: define security_kernel_read_blob() wrapper kexec: add call to LSM hook in original kexec_load syscall ima: based on policy require signed kexec kernel images firmware: add call to LSM hook before firmware sysfs fallback ima: based on policy require signed firmware (sysfs fallback) ima: add build time policy ima: based on policy prevent loading firmware (pre-allocated buffer) drivers/base/firmware_loader/fallback.c | 7 +++ include/linux/fs.h | 1 + include/linux/security.h | 6 +++ kernel/kexec.c | 11 +++++ security/integrity/ima/Kconfig | 58 +++++++++++++++++++++++++ security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_main.c | 29 +++++++++++++ security/integrity/ima/ima_policy.c | 76 +++++++++++++++++++++++++++------ security/security.c | 6 +++ 9 files changed, 183 insertions(+), 12 deletions(-) -- 2.7.5 _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec