Re: [PATCH] allow disabling IMA at runtime

From: Mimi Zohar
Date: Wed Aug 26 2009 - 08:07:29 EST


Kyle McMartin <kyle@xxxxxxxxxxxxx> wrote on 08/25/2009 10:10:05 PM:

> From: Kyle McMartin <kyle@xxxxxxxxxx>
>
> Due to a memory leak in IMA that we're currently debugging in Fedora
> rawhide, it would be nice to be able to disable that support at runtime.
> Currently it's only able to be built in, and there's no toggle to avoid
> initializing it.
>
> Provide one, in order to enhance debuggability. If a user can reboot a
> machine and edit its command line, one can do a far sight worse things
> than disabling a security precaution.
>
> Signed-off-by: Kyle McMartin <kyle@xxxxxxxxxx>

Have you tried using Eric's patch
"IMA: Minimal IMA policy and boot param for TCB IMA policy"
(commit 5789ba3bd0a3cd20df5980ebf03358f2eb44fd67), which introduced
the ima_tcb=1 command line option? It wasn't backported to 2.6.30.

Mimi

> ---
> diff --git a/Documentation/kernel-parameters.txt
b/Documentation/kernel-parameters.txt
> index 7936b80..0d1b1ed 100644
> --- a/Documentation/kernel-parameters.txt
> +++ b/Documentation/kernel-parameters.txt
> @@ -926,6 +926,11 @@ and is between 256 and 4096 characters. It is
defined in the file
> ihash_entries= [KNL]
> Set number of hash buckets for inode cache.
>
> + ima= [IMA]
> + Format: { "0" | "1" }
> + 0 -- disable IMA.
> + 1 -- enable IMA. (default)
> +
> ima_audit= [IMA]
> Format: { "0" | "1" }
> 0 -- integrity auditing messages. (Default)
> diff --git a/security/integrity/ima/ima_main.c
b/security/integrity/ima/ima_main.c
> index 101c512..cc7603e 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -339,10 +339,27 @@ int ima_bprm_check(struct linux_binprm *bprm)
> return 0;
> }
>
> +static int ima_disabled = 0;
> +static int __init ima_enabled(char *str)
> +{
> + unsigned long enabled;
> +
> + if (!strict_strtoul(str, 0, &enabled))
> + ima_disabled = enabled ? 0 : 1;
> +
> + return 1;
> +}
> +__setup("ima=", ima_enabled);
> +
> static int __init init_ima(void)
> {
> int error;
>
> + if (ima_disabled) {
> + pr_info("IMA disabled at user request.\n");
> + return 0;
> + }
> +
> ima_iintcache_init();
> error = ima_init();
> ima_initialized = 1;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/