linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] ima: requiring signed kernel modules
@ 2019-01-31 19:18 Mimi Zohar
  2019-01-31 19:18 ` [PATCH] x86/ima: require " Mimi Zohar
  0 siblings, 1 reply; 17+ messages in thread
From: Mimi Zohar @ 2019-01-31 19:18 UTC (permalink / raw)
  To: linux-integrity
  Cc: linux-security-module, linux-kernel, Jessica Yu,
	Luis Chamberlain, David Howells, Seth Forshee, Justin Forbes,
	Matthew Garrett, Mimi Zohar

The kernel can be configured to verify the appended kernel module
signature, the IMA signature stored as an xattr, both types of
signatures, or none.  On systems with secure boot enabled AND the IMA
architecture specific policy enabled, this patch set requires the file
to be signed.

Both methods of loading kernel modules - init_module and finit_module
syscalls - need to either verify the kernel module signature or prevent
the kernel module from being loaded.

"modprobe" first tries loading the kernel module via the finit_module
syscall and falls back to the init_module syscall, making it difficult
to test one syscall and then the other.

Mimi Zohar (1):
  x86/ima: require signed kernel modules

 arch/x86/kernel/ima_arch.c        |  9 ++++++++-
 include/linux/module.h            |  7 ++++++-
 kernel/module.c                   | 15 +++++++++++----
 security/integrity/ima/ima_main.c |  2 +-
 4 files changed, 26 insertions(+), 7 deletions(-)

-- 
2.7.5


^ permalink raw reply	[flat|nested] 17+ messages in thread

end of thread, other threads:[~2019-02-11 16:19 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-31 19:18 [PATCH] ima: requiring signed kernel modules Mimi Zohar
2019-01-31 19:18 ` [PATCH] x86/ima: require " Mimi Zohar
2019-02-04 20:38   ` Luis Chamberlain
2019-02-04 22:05     ` Mimi Zohar
2019-02-04 22:30       ` Luis Chamberlain
2019-02-05 12:24         ` Mimi Zohar
2019-02-05 21:13           ` Luis Chamberlain
2019-02-05 23:13             ` Mimi Zohar
2019-02-05 15:18   ` Seth Forshee
2019-02-05 16:47     ` Mimi Zohar
2019-02-05 18:32       ` Seth Forshee
2019-02-05 18:52         ` Mimi Zohar
2019-02-08 19:21           ` Seth Forshee
2019-02-10 15:39             ` Mimi Zohar
2019-02-05 16:10   ` Nayna
2019-02-11 15:56   ` Jessica Yu
2019-02-11 16:19     ` Mimi Zohar

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).