Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH v2] powerpc/ima: fix secure boot rules in ima arch policy
@ 2020-05-01 14:16 Nayna Jain
  2020-05-07  2:05 ` Mimi Zohar
  2020-05-13 12:43 ` Michael Ellerman
  0 siblings, 2 replies; 3+ messages in thread
From: Nayna Jain @ 2020-05-01 14:16 UTC (permalink / raw)
  To: linux-integrity, linuxppc-dev
  Cc: linux-kernel, Mimi Zohar, Michael Ellerman, Nayna Jain

To prevent verifying the kernel module appended signature twice
(finit_module), once by the module_sig_check() and again by IMA, powerpc
secure boot rules define an IMA architecture specific policy rule
only if CONFIG_MODULE_SIG_FORCE is not enabled. This, unfortunately, does
not take into account the ability of enabling "sig_enforce" on the boot
command line (module.sig_enforce=1).

Including the IMA module appraise rule results in failing the finit_module
syscall, unless the module signing public key is loaded onto the IMA
keyring.

This patch fixes secure boot policy rules to be based on CONFIG_MODULE_SIG
instead.

Fixes: 4238fad366a6 ("powerpc/ima: Add support to initialize ima policy rules")
Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
---
v2:
* Fixes the patch description to specify the problem more clearly as asked 
by Michael Ellerman.

 arch/powerpc/kernel/ima_arch.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kernel/ima_arch.c b/arch/powerpc/kernel/ima_arch.c
index e34116255ced..957abd592075 100644
--- a/arch/powerpc/kernel/ima_arch.c
+++ b/arch/powerpc/kernel/ima_arch.c
@@ -19,12 +19,12 @@ bool arch_ima_get_secureboot(void)
  * to be stored as an xattr or as an appended signature.
  *
  * To avoid duplicate signature verification as much as possible, the IMA
- * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE
+ * policy rule for module appraisal is added only if CONFIG_MODULE_SIG
  * is not enabled.
  */
 static const char *const secure_rules[] = {
 	"appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
-#ifndef CONFIG_MODULE_SIG_FORCE
+#ifndef CONFIG_MODULE_SIG
 	"appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
 #endif
 	NULL
@@ -50,7 +50,7 @@ static const char *const secure_and_trusted_rules[] = {
 	"measure func=KEXEC_KERNEL_CHECK template=ima-modsig",
 	"measure func=MODULE_CHECK template=ima-modsig",
 	"appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
-#ifndef CONFIG_MODULE_SIG_FORCE
+#ifndef CONFIG_MODULE_SIG
 	"appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
 #endif
 	NULL
-- 
2.18.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] powerpc/ima: fix secure boot rules in ima arch policy
  2020-05-01 14:16 [PATCH v2] powerpc/ima: fix secure boot rules in ima arch policy Nayna Jain
@ 2020-05-07  2:05 ` Mimi Zohar
  2020-05-13 12:43 ` Michael Ellerman
  1 sibling, 0 replies; 3+ messages in thread
From: Mimi Zohar @ 2020-05-07  2:05 UTC (permalink / raw)
  To: Nayna Jain, linux-integrity, linuxppc-dev; +Cc: linux-kernel, Michael Ellerman

On Fri, 2020-05-01 at 10:16 -0400, Nayna Jain wrote:
> To prevent verifying the kernel module appended signature twice
> (finit_module), once by the module_sig_check() and again by IMA, powerpc
> secure boot rules define an IMA architecture specific policy rule
> only if CONFIG_MODULE_SIG_FORCE is not enabled. This, unfortunately, does
> not take into account the ability of enabling "sig_enforce" on the boot
> command line (module.sig_enforce=1).
> 
> Including the IMA module appraise rule results in failing the finit_module
> syscall, unless the module signing public key is loaded onto the IMA
> keyring.
> 
> This patch fixes secure boot policy rules to be based on CONFIG_MODULE_SIG
> instead.
> 
> Fixes: 4238fad366a6 ("powerpc/ima: Add support to initialize ima policy rules")
> Signed-off-by: Nayna Jain <nayna@linux.ibm.com>

Thanks, Nayna.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] powerpc/ima: fix secure boot rules in ima arch policy
  2020-05-01 14:16 [PATCH v2] powerpc/ima: fix secure boot rules in ima arch policy Nayna Jain
  2020-05-07  2:05 ` Mimi Zohar
@ 2020-05-13 12:43 ` Michael Ellerman
  1 sibling, 0 replies; 3+ messages in thread
From: Michael Ellerman @ 2020-05-13 12:43 UTC (permalink / raw)
  To: Nayna Jain, linuxppc-dev, linux-integrity
  Cc: Mimi Zohar, Michael Ellerman, linux-kernel

On Fri, 1 May 2020 10:16:52 -0400, Nayna Jain wrote:
> To prevent verifying the kernel module appended signature twice
> (finit_module), once by the module_sig_check() and again by IMA, powerpc
> secure boot rules define an IMA architecture specific policy rule
> only if CONFIG_MODULE_SIG_FORCE is not enabled. This, unfortunately, does
> not take into account the ability of enabling "sig_enforce" on the boot
> command line (module.sig_enforce=1).
> 
> [...]

Applied to powerpc/fixes.

[1/1] powerpc/ima: Fix secure boot rules in ima arch policy
      https://git.kernel.org/powerpc/c/fa4f3f56ccd28ac031ab275e673ed4098855fed4

cheers

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-01 14:16 [PATCH v2] powerpc/ima: fix secure boot rules in ima arch policy Nayna Jain
2020-05-07  2:05 ` Mimi Zohar
2020-05-13 12:43 ` Michael Ellerman

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org
	public-inbox-index linux-integrity

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git