From: Ard Biesheuvel <ardb@kernel.org>
To: Chester Lin <clin@suse.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>,
James Morris <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
"H. Peter Anvin" <hpa@zytor.com>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Linux ARM <linux-arm-kernel@lists.infradead.org>,
linux-efi <linux-efi@vger.kernel.org>,
linux-integrity <linux-integrity@vger.kernel.org>,
linux-security-module@vger.kernel.org, X86 ML <x86@kernel.org>,
"Lee, Chun-Yi" <jlee@suse.com>
Subject: Re: [PATCH v3 3/3] arm64/ima: add ima_arch support
Date: Fri, 30 Oct 2020 12:53:25 +0100 [thread overview]
Message-ID: <CAMj1kXFhZEHP37_tkzzHHhkk-Ej+eRcCinMv-tOdp7vvb1d1mQ@mail.gmail.com> (raw)
In-Reply-To: <20201030060840.1810-4-clin@suse.com>
On Fri, 30 Oct 2020 at 07:09, Chester Lin <clin@suse.com> wrote:
>
> Add arm64 IMA arch support. The code and arch policy is mainly inherited
> from x86.
>
> Signed-off-by: Chester Lin <clin@suse.com>
> ---
> arch/arm64/Kconfig | 1 +
> arch/arm64/kernel/Makefile | 2 ++
> arch/arm64/kernel/ima_arch.c | 43 ++++++++++++++++++++++++++++++++++++
> 3 files changed, 46 insertions(+)
> create mode 100644 arch/arm64/kernel/ima_arch.c
>
> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index a42e8d13cc88..496a4a26afc6 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -201,6 +201,7 @@ config ARM64
> select SWIOTLB
> select SYSCTL_EXCEPTION_TRACE
> select THREAD_INFO_IN_TASK
> + imply IMA_SECURE_AND_OR_TRUSTED_BOOT if EFI
> help
> ARM 64-bit (AArch64) Linux support.
>
> diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
> index bbaf0bc4ad60..0f6cbb50668c 100644
> --- a/arch/arm64/kernel/Makefile
> +++ b/arch/arm64/kernel/Makefile
> @@ -69,3 +69,5 @@ extra-y += $(head-y) vmlinux.lds
> ifeq ($(CONFIG_DEBUG_EFI),y)
> AFLAGS_head.o += -DVMLINUX_PATH="\"$(realpath $(objtree)/vmlinux)\""
> endif
> +
> +obj-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT) += ima_arch.o
> diff --git a/arch/arm64/kernel/ima_arch.c b/arch/arm64/kernel/ima_arch.c
> new file mode 100644
> index 000000000000..564236d77adc
> --- /dev/null
> +++ b/arch/arm64/kernel/ima_arch.c
> @@ -0,0 +1,43 @@
> +// SPDX-License-Identifier: GPL-2.0+
> +/*
> + * Copyright (C) 2018 IBM Corporation
> + */
> +#include <linux/efi.h>
> +#include <linux/module.h>
> +#include <linux/ima.h>
> +
> +bool arch_ima_get_secureboot(void)
> +{
> + static bool sb_enabled;
> + static bool initialized;
> +
> + if (!initialized & efi_enabled(EFI_BOOT)) {
> + sb_enabled = ima_get_efi_secureboot();
> + initialized = true;
> + }
> +
> + return sb_enabled;
> +}
> +
> +/* secure and trusted boot arch rules */
> +static const char * const sb_arch_rules[] = {
> +#if !IS_ENABLED(CONFIG_KEXEC_SIG)
> + "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig",
> +#endif /* CONFIG_KEXEC_SIG */
> + "measure func=KEXEC_KERNEL_CHECK",
> +#if !IS_ENABLED(CONFIG_MODULE_SIG)
> + "appraise func=MODULE_CHECK appraise_type=imasig",
> +#endif
> + "measure func=MODULE_CHECK",
> + NULL
> +};
> +
> +const char * const *arch_get_ima_policy(void)
> +{
> + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
> + if (IS_ENABLED(CONFIG_MODULE_SIG))
> + set_module_sig_enforced();
> + return sb_arch_rules;
> + }
> + return NULL;
> +}
> --
> 2.28.0
>
Can we move all this stuff into security/integrity/ima/ima_efi.c instead?
next prev parent reply other threads:[~2020-10-30 11:53 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-30 6:08 [PATCH v3 0/3] add ima_arch support for ARM64 Chester Lin
2020-10-30 6:08 ` [PATCH v3 1/3] efi: generalize efi_get_secureboot Chester Lin
2020-10-30 11:51 ` Ard Biesheuvel
2020-11-02 5:30 ` Chester Lin
2020-10-30 6:08 ` [PATCH v3 2/3] ima: replace arch-specific get_sb_mode() with a common helper ima_get_efi_secureboot() Chester Lin
2020-10-30 11:52 ` Ard Biesheuvel
2020-10-30 6:08 ` [PATCH v3 3/3] arm64/ima: add ima_arch support Chester Lin
2020-10-30 11:53 ` Ard Biesheuvel [this message]
2020-11-02 7:20 ` Chester Lin
2020-11-02 12:13 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAMj1kXFhZEHP37_tkzzHHhkk-Ej+eRcCinMv-tOdp7vvb1d1mQ@mail.gmail.com \
--to=ardb@kernel.org \
--cc=bp@alien8.de \
--cc=catalin.marinas@arm.com \
--cc=clin@suse.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=hpa@zytor.com \
--cc=jlee@suse.com \
--cc=jmorris@namei.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=serge@hallyn.com \
--cc=tglx@linutronix.de \
--cc=will@kernel.org \
--cc=x86@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).