From: Eric Richter <erichte@linux.vnet.ibm.com> To: linux-integrity <linux-integrity@vger.kernel.org> Cc: linux-security-module <linux-security-module@vger.kernel.org>, linux-efi <linux-efi@vger.kernel.org>, linux-kernel <linux-kernel@vger.kernel.org>, David Howells <dhowells@redhat.com>, Seth Forshee <seth.forshee@canonical.com>, Justin Forbes <jforbes@redhat.com>, Nayna Jain <nayna@linux.vnet.ibm.com> Subject: [PATCH 2/4] ima: add support for external setting of ima_appraise Date: Wed, 25 Jul 2018 18:31:58 -0500 [thread overview] Message-ID: <20180725233200.761-3-erichte@linux.vnet.ibm.com> (raw) In-Reply-To: <20180725233200.761-1-erichte@linux.vnet.ibm.com> From: Nayna Jain <nayna@linux.vnet.ibm.com> The "ima_appraise" mode defaults to enforcing, unless configured to allow the boot command line "ima_appraise" option. This patch allows the "ima_appraise" mode to be defined based on the arch setting. Signed-off-by: Nayna Jain <nayna@linux.vnet.ibm.com> --- security/integrity/ima/ima.h | 5 +++++ security/integrity/ima/ima_appraise.c | 11 +++++++++-- security/integrity/ima/ima_policy.c | 5 ++++- 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 588e4813370..6e5fa7c4280 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -248,6 +248,7 @@ enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len); int ima_read_xattr(struct dentry *dentry, struct evm_ima_xattr_data **xattr_value); +void set_ima_appraise(char *str); #else static inline int ima_appraise_measurement(enum ima_hooks func, @@ -290,6 +291,10 @@ static inline int ima_read_xattr(struct dentry *dentry, return 0; } +static inline void set_ima_appraise(char *str) +{ +} + #endif /* CONFIG_IMA_APPRAISE */ /* LSM based policy rules require audit */ diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 8bd7a0733e5..e061613bcb8 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -18,15 +18,22 @@ #include "ima.h" -static int __init default_appraise_setup(char *str) +void set_ima_appraise(char *str) { -#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM if (strncmp(str, "off", 3) == 0) ima_appraise = 0; else if (strncmp(str, "log", 3) == 0) ima_appraise = IMA_APPRAISE_LOG; else if (strncmp(str, "fix", 3) == 0) ima_appraise = IMA_APPRAISE_FIX; + else if (strncmp(str, "enforce", 7) == 0) + ima_appraise = IMA_APPRAISE_ENFORCE; +} + +static int __init default_appraise_setup(char *str) +{ +#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM + set_ima_appraise(str); #endif return 1; } diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index b47db4d7fea..402e5bd1093 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -573,8 +573,11 @@ void __init ima_init_policy(void) * (Highest priority) */ arch_policy_entries = ima_init_arch_policy(); - if (arch_policy_entries > 0) + if (arch_policy_entries > 0) { pr_info("Adding %d architecture policy rules.\n", arch_policy_entries); + set_ima_appraise("enforce"); + } + for (i = 0; i < arch_policy_entries; i++) { struct ima_rule_entry *entry; -- 2.14.4
WARNING: multiple messages have this Message-ID (diff)
From: erichte@linux.vnet.ibm.com (Eric Richter) To: linux-security-module@vger.kernel.org Subject: [PATCH 2/4] ima: add support for external setting of ima_appraise Date: Wed, 25 Jul 2018 18:31:58 -0500 [thread overview] Message-ID: <20180725233200.761-3-erichte@linux.vnet.ibm.com> (raw) In-Reply-To: <20180725233200.761-1-erichte@linux.vnet.ibm.com> From: Nayna Jain <nayna@linux.vnet.ibm.com> The "ima_appraise" mode defaults to enforcing, unless configured to allow the boot command line "ima_appraise" option. This patch allows the "ima_appraise" mode to be defined based on the arch setting. Signed-off-by: Nayna Jain <nayna@linux.vnet.ibm.com> --- security/integrity/ima/ima.h | 5 +++++ security/integrity/ima/ima_appraise.c | 11 +++++++++-- security/integrity/ima/ima_policy.c | 5 ++++- 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 588e4813370..6e5fa7c4280 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -248,6 +248,7 @@ enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len); int ima_read_xattr(struct dentry *dentry, struct evm_ima_xattr_data **xattr_value); +void set_ima_appraise(char *str); #else static inline int ima_appraise_measurement(enum ima_hooks func, @@ -290,6 +291,10 @@ static inline int ima_read_xattr(struct dentry *dentry, return 0; } +static inline void set_ima_appraise(char *str) +{ +} + #endif /* CONFIG_IMA_APPRAISE */ /* LSM based policy rules require audit */ diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 8bd7a0733e5..e061613bcb8 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -18,15 +18,22 @@ #include "ima.h" -static int __init default_appraise_setup(char *str) +void set_ima_appraise(char *str) { -#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM if (strncmp(str, "off", 3) == 0) ima_appraise = 0; else if (strncmp(str, "log", 3) == 0) ima_appraise = IMA_APPRAISE_LOG; else if (strncmp(str, "fix", 3) == 0) ima_appraise = IMA_APPRAISE_FIX; + else if (strncmp(str, "enforce", 7) == 0) + ima_appraise = IMA_APPRAISE_ENFORCE; +} + +static int __init default_appraise_setup(char *str) +{ +#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM + set_ima_appraise(str); #endif return 1; } diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index b47db4d7fea..402e5bd1093 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -573,8 +573,11 @@ void __init ima_init_policy(void) * (Highest priority) */ arch_policy_entries = ima_init_arch_policy(); - if (arch_policy_entries > 0) + if (arch_policy_entries > 0) { pr_info("Adding %d architecture policy rules.\n", arch_policy_entries); + set_ima_appraise("enforce"); + } + for (i = 0; i < arch_policy_entries; i++) { struct ima_rule_entry *entry; -- 2.14.4 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info@ http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2018-07-25 23:32 UTC|newest] Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-07-25 23:31 [PATCH 0/4] Add support for architecture-specific IMA policies Eric Richter 2018-07-25 23:31 ` Eric Richter 2018-07-25 23:31 ` [PATCH 1/4] ima: add support for arch specific policies Eric Richter 2018-07-25 23:31 ` Eric Richter 2018-07-28 2:24 ` kbuild test robot 2018-07-28 2:24 ` kbuild test robot 2018-08-03 10:08 ` Nayna Jain 2018-08-03 10:08 ` Nayna Jain 2018-08-03 10:08 ` Nayna Jain 2018-07-28 2:24 ` [RFC PATCH] ima: arch_policy_rules can be static kbuild test robot 2018-07-28 2:24 ` kbuild test robot 2018-07-25 23:31 ` Eric Richter [this message] 2018-07-25 23:31 ` [PATCH 2/4] ima: add support for external setting of ima_appraise Eric Richter 2018-07-25 23:31 ` [PATCH 3/4] ima: add support for KEXEC_ORIG_KERNEL_CHECK Eric Richter 2018-07-25 23:31 ` Eric Richter 2018-08-03 13:11 ` Seth Forshee 2018-08-03 13:11 ` Seth Forshee 2018-08-03 14:54 ` Mimi Zohar 2018-08-03 14:54 ` Mimi Zohar 2018-08-03 14:54 ` Mimi Zohar 2018-08-03 16:16 ` Seth Forshee 2018-08-03 16:16 ` Seth Forshee 2018-08-03 16:16 ` Seth Forshee 2018-08-03 19:47 ` Mimi Zohar 2018-08-03 19:47 ` Mimi Zohar 2018-08-03 19:47 ` Mimi Zohar 2018-07-25 23:32 ` [PATCH 4/4] x86/ima: define arch_get_ima_policy() for x86 Eric Richter 2018-07-25 23:32 ` Eric Richter 2018-07-28 12:22 ` kbuild test robot 2018-07-28 12:22 ` kbuild test robot 2018-07-28 12:22 ` kbuild test robot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180725233200.761-3-erichte@linux.vnet.ibm.com \ --to=erichte@linux.vnet.ibm.com \ --cc=dhowells@redhat.com \ --cc=jforbes@redhat.com \ --cc=linux-efi@vger.kernel.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=nayna@linux.vnet.ibm.com \ --cc=seth.forshee@canonical.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.