* [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template @ 2021-02-15 10:23 Michael Weiß 2021-02-15 13:26 ` Mimi Zohar 0 siblings, 1 reply; 3+ messages in thread From: Michael Weiß @ 2021-02-15 10:23 UTC (permalink / raw) To: Mimi Zohar Cc: linux-integrity, Michael Weiß, Dmitry Kasatkin, James Morris, Serge E. Hallyn, linux-security-module, linux-kernel 'ima-modsig' was not in the list of selectable templates in Kconfig. The missing Kconfig options were added to support the ima-modsig template as default template. Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> --- security/integrity/ima/Kconfig | 3 +++ 1 file changed, 3 insertions(+) diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 12e9250c1bec..32b9325f49bf 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -78,6 +78,8 @@ choice bool "ima-ng (default)" config IMA_SIG_TEMPLATE bool "ima-sig" + config IMA_MODSIG_TEMPLATE + bool "ima-modsig" endchoice config IMA_DEFAULT_TEMPLATE @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE default "ima" if IMA_TEMPLATE default "ima-ng" if IMA_NG_TEMPLATE default "ima-sig" if IMA_SIG_TEMPLATE + default "ima-modsig" if IMA_MODSIG_TEMPLATE choice prompt "Default integrity hash algorithm" -- 2.20.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template 2021-02-15 10:23 [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template Michael Weiß @ 2021-02-15 13:26 ` Mimi Zohar 2021-02-15 15:36 ` Weiß, Michael 0 siblings, 1 reply; 3+ messages in thread From: Mimi Zohar @ 2021-02-15 13:26 UTC (permalink / raw) To: Michael Weiß Cc: linux-integrity, Dmitry Kasatkin, James Morris, Serge E. Hallyn, linux-security-module, linux-kernel Hi Michael, On Mon, 2021-02-15 at 11:23 +0100, Michael Weiß wrote: > 'ima-modsig' was not in the list of selectable templates in Kconfig. > The missing Kconfig options were added to support the ima-modsig > template as default template. > > Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> Since 'ima-modsig' is only needed for appended signatures (e.g. kexec kernel image on powerpc, kernel modules) a per policy rule "template=" option was defined. There's also the 'ima_template=' boot command line option. Between these two options, I didn't see the need for making it a build time default option. Do you? The patch itself looks good. thanks, Mimi > --- > security/integrity/ima/Kconfig | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > index 12e9250c1bec..32b9325f49bf 100644 > --- a/security/integrity/ima/Kconfig > +++ b/security/integrity/ima/Kconfig > @@ -78,6 +78,8 @@ choice > bool "ima-ng (default)" > config IMA_SIG_TEMPLATE > bool "ima-sig" > + config IMA_MODSIG_TEMPLATE > + bool "ima-modsig" > endchoice > > config IMA_DEFAULT_TEMPLATE > @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE > default "ima" if IMA_TEMPLATE > default "ima-ng" if IMA_NG_TEMPLATE > default "ima-sig" if IMA_SIG_TEMPLATE > + default "ima-modsig" if IMA_MODSIG_TEMPLATE > > choice > prompt "Default integrity hash algorithm" ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template 2021-02-15 13:26 ` Mimi Zohar @ 2021-02-15 15:36 ` Weiß, Michael 0 siblings, 0 replies; 3+ messages in thread From: Weiß, Michael @ 2021-02-15 15:36 UTC (permalink / raw) To: zohar Cc: linux-integrity, jmorris, serge, linux-security-module, dmitry.kasatkin, linux-kernel Hi Mimi, On Mon, 2021-02-15 at 08:26 -0500, Mimi Zohar wrote: > Hi Michael, > > On Mon, 2021-02-15 at 11:23 +0100, Michael Weiß wrote: > > 'ima-modsig' was not in the list of selectable templates in Kconfig. > > The missing Kconfig options were added to support the ima-modsig > > template as default template. > > > > Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> > > Since 'ima-modsig' is only needed for appended signatures (e.g. kexec > kernel image on powerpc, kernel modules) a per policy rule "template=" > option was defined. There's also the 'ima_template=' boot command line > option. Between these two options, I didn't see the need for making > it a build time default option. Do you? The use-case I had in mind was a simple measured boot, no user-space applications, only to measure already signed modules which are already signed by modsig using a single policy line: measure func=MODULE_CHECK I thought for this purpose, we could just compile in the default template to be modsig but it wasn't selectable. I have overlooked the policy rule "template=", In the above use-case, it also just works to set the policy: measure func=MODULE_CHECK template=ima-modsig So, your are right maybe that is not necessary. Regards, Michael > > The patch itself looks good. > > thanks, > > Mimi > > > --- > > security/integrity/ima/Kconfig | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > > index 12e9250c1bec..32b9325f49bf 100644 > > --- a/security/integrity/ima/Kconfig > > +++ b/security/integrity/ima/Kconfig > > @@ -78,6 +78,8 @@ choice > > bool "ima-ng (default)" > > config IMA_SIG_TEMPLATE > > bool "ima-sig" > > + config IMA_MODSIG_TEMPLATE > > + bool "ima-modsig" > > endchoice > > > > config IMA_DEFAULT_TEMPLATE > > @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE > > default "ima" if IMA_TEMPLATE > > default "ima-ng" if IMA_NG_TEMPLATE > > default "ima-sig" if IMA_SIG_TEMPLATE > > + default "ima-modsig" if IMA_MODSIG_TEMPLATE > > > > choice > > prompt "Default integrity hash algorithm" > > ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-02-15 16:55 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-02-15 10:23 [PATCH] integrity/ima: Provide Kconfig option for ima-modsig template Michael Weiß 2021-02-15 13:26 ` Mimi Zohar 2021-02-15 15:36 ` Weiß, Michael
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).