From: "Weiß, Michael" <michael.weiss@aisec.fraunhofer.de>
To: "zohar@linux.ibm.com" <zohar@linux.ibm.com>
Cc: "linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"jmorris@namei.org" <jmorris@namei.org>,
"serge@hallyn.com" <serge@hallyn.com>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"dmitry.kasatkin@gmail.com" <dmitry.kasatkin@gmail.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template
Date: Mon, 15 Feb 2021 15:36:51 +0000 [thread overview]
Message-ID: <bea7095300c3daeaae65e6e6f230d1a3a500c322.camel@aisec.fraunhofer.de> (raw)
In-Reply-To: <fe83fb7572e0eea7a9a9981a15c63f1f7709d714.camel@linux.ibm.com>
Hi Mimi,
On Mon, 2021-02-15 at 08:26 -0500, Mimi Zohar wrote:
> Hi Michael,
>
> On Mon, 2021-02-15 at 11:23 +0100, Michael Weiß wrote:
> > 'ima-modsig' was not in the list of selectable templates in Kconfig.
> > The missing Kconfig options were added to support the ima-modsig
> > template as default template.
> >
> > Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
>
> Since 'ima-modsig' is only needed for appended signatures (e.g. kexec
> kernel image on powerpc, kernel modules) a per policy rule "template="
> option was defined. There's also the 'ima_template=' boot command line
> option. Between these two options, I didn't see the need for making
> it a build time default option. Do you?
The use-case I had in mind was a simple measured boot,
no user-space applications, only to measure already signed modules
which are already signed by modsig
using a single policy line:
measure func=MODULE_CHECK
I thought for this purpose, we could just compile in the default
template to be modsig but it wasn't
selectable.
I have overlooked the policy rule "template=",
In the above use-case, it also just works to set the policy:
measure func=MODULE_CHECK template=ima-modsig
So, your are right maybe that is not necessary.
Regards,
Michael
>
> The patch itself looks good.
>
> thanks,
>
> Mimi
>
> > ---
> > security/integrity/ima/Kconfig | 3 +++
> > 1 file changed, 3 insertions(+)
> >
> > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> > index 12e9250c1bec..32b9325f49bf 100644
> > --- a/security/integrity/ima/Kconfig
> > +++ b/security/integrity/ima/Kconfig
> > @@ -78,6 +78,8 @@ choice
> > bool "ima-ng (default)"
> > config IMA_SIG_TEMPLATE
> > bool "ima-sig"
> > + config IMA_MODSIG_TEMPLATE
> > + bool "ima-modsig"
> > endchoice
> >
> > config IMA_DEFAULT_TEMPLATE
> > @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE
> > default "ima" if IMA_TEMPLATE
> > default "ima-ng" if IMA_NG_TEMPLATE
> > default "ima-sig" if IMA_SIG_TEMPLATE
> > + default "ima-modsig" if IMA_MODSIG_TEMPLATE
> >
> > choice
> > prompt "Default integrity hash algorithm"
>
>
prev parent reply other threads:[~2021-02-15 16:55 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-15 10:23 [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template Michael Weiß
2021-02-15 13:26 ` Mimi Zohar
2021-02-15 15:36 ` Weiß, Michael [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bea7095300c3daeaae65e6e6f230d1a3a500c322.camel@aisec.fraunhofer.de \
--to=michael.weiss@aisec.fraunhofer.de \
--cc=dmitry.kasatkin@gmail.com \
--cc=jmorris@namei.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).