Linux-Security-Module Archive on lore.kernel.org
 help / Atom feed
* [GIT PULL] linux-integrity patches for Linux 4.21
@ 2018-12-14 13:52 Mimi Zohar
  2018-12-17 19:28 ` James Morris
  0 siblings, 1 reply; 3+ messages in thread
From: Mimi Zohar @ 2018-12-14 13:52 UTC (permalink / raw)
  To: James Morris; +Cc: linux-security-module, linux-integrity

Hi James,

In Linux 4.19, a new LSM hook named security_kernel_load_data was
upstreamed, allowing LSMs and IMA to prevent the kexec_load
syscall.  Different signature verification methods exist for verifying
the kexec'ed kernel image.  This pull request adds additional support
in IMA to prevent loading unsigned kernel images via the kexec_load
syscall, independently of the IMA policy rules, based on the runtime
"secure boot" flag.  An initial IMA kselftest is included.

In addition, this pull request defines a new, separate keyring named
".platform" for storing the preboot/firmware keys needed for verifying
the kexec'ed kernel image's signature and includes the associated IMA
kexec usage of the ".platform" keyring.

(David Howell's and Josh Boyer's patches for reading the
preboot/firmware keys, which were previously posted for a different
use case scenario, are included here.)

Mimi

The following changes since commit 26b76320a8a550472bbb8f42257df83fcb8d8df6:

  Merge tag 'v4.20-rc2' into next-general (2018-11-12 09:07:41 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity

for you to fetch changes up to eed9de3b4f47114f440980203ca27c5fab70f529:

  ima: Use inode_is_open_for_write (2018-12-12 22:09:34 -0500)

----------------------------------------------------------------
Dave Howells (2):
      efi: Add EFI signature data types
      efi: Add an EFI signature blob parser

Eric Richter (1):
      x86/ima: define arch_get_ima_policy() for x86

Josh Boyer (2):
      efi: Import certificates from UEFI Secure Boot
      efi: Allow the "db" UEFI variable to be suppressed

Mimi Zohar (4):
      integrity: support new struct public_key_signature encoding field
      x86/ima: retry detecting secure boot mode
      ima: don't measure/appraise files on efivarfs
      selftests/ima: kexec_load syscall test

Nayna Jain (7):
      x86/ima: define arch_ima_get_secureboot
      ima: prevent kexec_load syscall based on runtime secureboot flag
      ima: refactor ima_init_policy()
      ima: add support for arch specific policies
      integrity: Define a trusted platform keyring
      integrity: Load certs to the platform keyring
      ima: Support platform keyring for kernel appraisal

Nikolay Borisov (1):
      ima: Use inode_is_open_for_write

Stefan Berger (1):
      docs: Extend trusted keys documentation for TPM 2.0

 Documentation/security/keys/trusted-encrypted.rst  |  31 +++-
 arch/x86/kernel/Makefile                           |   4 +
 arch/x86/kernel/ima_arch.c                         |  75 ++++++++
 include/linux/efi.h                                |  34 ++++
 include/linux/ima.h                                |  15 ++
 security/integrity/Kconfig                         |  11 ++
 security/integrity/Makefile                        |   5 +
 security/integrity/digsig.c                        | 110 ++++++++----
 security/integrity/digsig_asymmetric.c             |   1 +
 security/integrity/ima/Kconfig                     |  10 +-
 security/integrity/ima/ima_appraise.c              |  14 +-
 security/integrity/ima/ima_main.c                  |  21 ++-
 security/integrity/ima/ima_policy.c                | 171 +++++++++++++-----
 security/integrity/integrity.h                     |  23 ++-
 security/integrity/platform_certs/efi_parser.c     | 108 ++++++++++++
 security/integrity/platform_certs/load_uefi.c      | 194 +++++++++++++++++++++
 .../integrity/platform_certs/platform_keyring.c    |  58 ++++++
 tools/testing/selftests/Makefile                   |   1 +
 tools/testing/selftests/ima/Makefile               |  11 ++
 tools/testing/selftests/ima/config                 |   4 +
 tools/testing/selftests/ima/test_kexec_load.sh     |  54 ++++++
 21 files changed, 863 insertions(+), 92 deletions(-)
 create mode 100644 arch/x86/kernel/ima_arch.c
 create mode 100644 security/integrity/platform_certs/efi_parser.c
 create mode 100644 security/integrity/platform_certs/load_uefi.c
 create mode 100644 security/integrity/platform_certs/platform_keyring.c
 create mode 100644 tools/testing/selftests/ima/Makefile
 create mode 100644 tools/testing/selftests/ima/config
 create mode 100755 tools/testing/selftests/ima/test_kexec_load.sh


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [GIT PULL] linux-integrity patches for Linux 4.21
  2018-12-14 13:52 [GIT PULL] linux-integrity patches for Linux 4.21 Mimi Zohar
@ 2018-12-17 19:28 ` James Morris
  2018-12-17 19:32   ` Mimi Zohar
  0 siblings, 1 reply; 3+ messages in thread
From: James Morris @ 2018-12-17 19:28 UTC (permalink / raw)
  To: Mimi Zohar; +Cc: linux-security-module, linux-integrity

On Fri, 14 Dec 2018, Mimi Zohar wrote:

> The following changes since commit 26b76320a8a550472bbb8f42257df83fcb8d8df6:
> 
>   Merge tag 'v4.20-rc2' into next-general (2018-11-12 09:07:41 -0800)
> 
> are available in the git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
> 

Pulled to next-integrity and next-testing.

Also, please ask me to sync to an updated -rc version if you need a patch 
in there, rather than including it yourself.


-- 
James Morris
<jmorris@namei.org>


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [GIT PULL] linux-integrity patches for Linux 4.21
  2018-12-17 19:28 ` James Morris
@ 2018-12-17 19:32   ` Mimi Zohar
  0 siblings, 0 replies; 3+ messages in thread
From: Mimi Zohar @ 2018-12-17 19:32 UTC (permalink / raw)
  To: James Morris; +Cc: linux-security-module, linux-integrity

On Tue, 2018-12-18 at 06:28 +1100, James Morris wrote:
> On Fri, 14 Dec 2018, Mimi Zohar wrote:
> 
> > The following changes since commit 26b76320a8a550472bbb8f42257df83fcb8d8df6:
> > 
> >   Merge tag 'v4.20-rc2' into next-general (2018-11-12 09:07:41 -0800)
> > 
> > are available in the git repository at:
> > 
> >   git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
> > 
> 
> Pulled to next-integrity and next-testing.
> 
> Also, please ask me to sync to an updated -rc version if you need a patch 
> in there, rather than including it yourself.

Thanks, will do!

Mimi


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-14 13:52 [GIT PULL] linux-integrity patches for Linux 4.21 Mimi Zohar
2018-12-17 19:28 ` James Morris
2018-12-17 19:32   ` Mimi Zohar

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org linux-security-module@archiver.kernel.org
	public-inbox-index linux-security-module


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/ public-inbox