linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v4] ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime
@ 2020-07-03 18:00 Bruno Meneguele
       [not found] ` <91a81761-1490-7250-8245-4d78d190385f@linux.vnet.ibm.com>
  0 siblings, 1 reply; 2+ messages in thread
From: Bruno Meneguele @ 2020-07-03 18:00 UTC (permalink / raw)
  To: linux-integrity, linux-kernel
  Cc: zohar, erichte, nayna, Bruno Meneguele, stable

APPRAISE_BOOTPARAM has been marked as dependent on !ARCH_POLICY in compile
time, enforcing the appraisal whenever the kernel had the arch policy option
enabled.

However it breaks systems where the option is set but the system wasn't
booted in a "secure boot" platform. In this scenario, anytime an appraisal
policy (i.e. ima_policy=appraisal_tcb) is used it will be forced, giving no
chance to the user set the 'fix' state (ima_appraise=fix) to actually
measure system's files.

Considering the ARCH_POLICY is only effective when secure boot is actually
enabled this patch remove the compile time dependency and move it to a
runtime decision, based on the secure boot state of that platform.

Cc: stable@vger.kernel.org
Fixes: d958083a8f64 ("x86/ima: define arch_get_ima_policy() for x86")
Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
Changelog:
	v4:
	  - instead of change arch_policy loading code, check secure boot state
		at "ima_appraise=" parameter handler (Mimi)
	v3:
	  - extend secure boot arch checker to also consider trusted boot
	  - enforce IMA appraisal when secure boot is effectively enabled (Nayna)
	  - fix ima_appraise flag assignment by or'ing it (Mimi)
	v2:
	  - pr_info() message prefix correction

 security/integrity/ima/Kconfig        |  2 +-
 security/integrity/ima/ima_appraise.c | 18 ++++++++++--------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index edde88dbe576..62dc11a5af01 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -232,7 +232,7 @@ config IMA_APPRAISE_REQUIRE_POLICY_SIGS
 
 config IMA_APPRAISE_BOOTPARAM
 	bool "ima_appraise boot parameter"
-	depends on IMA_APPRAISE && !IMA_ARCH_POLICY
+	depends on IMA_APPRAISE
 	default y
 	help
 	  This option enables the different "ima_appraise=" modes
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index a9649b04b9f1..4fc83b3fbd5c 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -18,14 +18,16 @@
 
 static int __init default_appraise_setup(char *str)
 {
-#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
-	if (strncmp(str, "off", 3) == 0)
-		ima_appraise = 0;
-	else if (strncmp(str, "log", 3) == 0)
-		ima_appraise = IMA_APPRAISE_LOG;
-	else if (strncmp(str, "fix", 3) == 0)
-		ima_appraise = IMA_APPRAISE_FIX;
-#endif
+	if (IS_ENABLED(CONFIG_IMA_APPRAISE_BOOTPARAM) &&
+	    !arch_ima_get_secureboot()) {
+		if (strncmp(str, "off", 3) == 0)
+			ima_appraise = 0;
+		else if (strncmp(str, "log", 3) == 0)
+			ima_appraise = IMA_APPRAISE_LOG;
+		else if (strncmp(str, "fix", 3) == 0)
+			ima_appraise = IMA_APPRAISE_FIX;
+	}
+
 	return 1;
 }
 
-- 
2.26.2


^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH v4] ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime
       [not found] ` <91a81761-1490-7250-8245-4d78d190385f@linux.vnet.ibm.com>
@ 2020-07-08 13:39   ` Bruno Meneguele
  0 siblings, 0 replies; 2+ messages in thread
From: Bruno Meneguele @ 2020-07-08 13:39 UTC (permalink / raw)
  To: Nayna; +Cc: linux-integrity, linux-kernel, zohar, erichte, nayna, stable

[-- Attachment #1: Type: text/plain, Size: 2368 bytes --]

On Tue, Jul 07, 2020 at 07:56:37PM -0400, Nayna wrote:
> 
> On 7/3/20 2:00 PM, Bruno Meneguele wrote:
> > APPRAISE_BOOTPARAM has been marked as dependent on !ARCH_POLICY in compile
> > time, enforcing the appraisal whenever the kernel had the arch policy option
> > enabled.
> > 
> > However it breaks systems where the option is set but the system wasn't
> > booted in a "secure boot" platform. In this scenario, anytime an appraisal
> > policy (i.e. ima_policy=appraisal_tcb) is used it will be forced, giving no
> > chance to the user set the 'fix' state (ima_appraise=fix) to actually
> > measure system's files.
> 
> "measure" is incorrect. It is appraisal.
> 

Yes, of course, sorry.

> How about changing the statement to "without giving the user the opportunity
> to label the filesystem, before enforcing integrity." ?
> 

Ack.
That's better :)

> > diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
> > index a9649b04b9f1..4fc83b3fbd5c 100644
> > --- a/security/integrity/ima/ima_appraise.c
> > +++ b/security/integrity/ima/ima_appraise.c
> > @@ -18,14 +18,16 @@
> >   static int __init default_appraise_setup(char *str)
> >   {
> > -#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
> > -	if (strncmp(str, "off", 3) == 0)
> > -		ima_appraise = 0;
> > -	else if (strncmp(str, "log", 3) == 0)
> > -		ima_appraise = IMA_APPRAISE_LOG;
> > -	else if (strncmp(str, "fix", 3) == 0)
> > -		ima_appraise = IMA_APPRAISE_FIX;
> > -#endif
> > +	if (IS_ENABLED(CONFIG_IMA_APPRAISE_BOOTPARAM) &&
> > +	    !arch_ima_get_secureboot()) {
> > +		if (strncmp(str, "off", 3) == 0)
> > +			ima_appraise = 0;
> > +		else if (strncmp(str, "log", 3) == 0)
> > +			ima_appraise = IMA_APPRAISE_LOG;
> > +		else if (strncmp(str, "fix", 3) == 0)
> > +			ima_appraise = IMA_APPRAISE_FIX;
> > +	}
> > +
> >   	return 1;
> >   }
> 
> If secureboot is enabled, it is silently ignoring the boot parameters. It
> would be helpful if there is a log message notifying user about that.
> 
> Can you please Cc powerpc, s390, and x86 mailing list and maintainers, when
> you post the next version ?
> 
> I would try to test it sometime in this week.
> 

Sure. I'm preparing a new version and will post soon.

> Thanks & Regards,
> 

Thank you.

-- 
bmeneg 
PGP Key: http://bmeneg.com/pubkey.txt

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2020-07-08 13:39 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-03 18:00 [PATCH v4] ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime Bruno Meneguele
     [not found] ` <91a81761-1490-7250-8245-4d78d190385f@linux.vnet.ibm.com>
2020-07-08 13:39   ` Bruno Meneguele

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).