Re: [PATCH v3 3/6] ima: load x509 certificate from the kernel

From: Mimi Zohar
Date: Mon Nov 03 2014 - 16:25:00 EST


On Fri, 2014-10-10 at 17:09 +0300, Dmitry Kasatkin wrote:
> Define configuration option to load X509 certificate into the
> IMA trusted kernel keyring. It implements ima_load_x509() hook
> to load X509 certificate into the .ima trusted kernel keyring
> from root filesystem.
>
> Changes in v2:
> * added '__init'
> * use ima_policy_flag to disable appraisal to load keys
>
> Signed-off-by: Dmitry Kasatkin <d.kasatkin@xxxxxxxxxxx>
> ---
> security/integrity/ima/Kconfig | 15 +++++++++++++++
> security/integrity/ima/ima_init.c | 17 +++++++++++++++++
> security/integrity/integrity.h | 8 ++++++++
> 3 files changed, 40 insertions(+)
>
> diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> index e099875..44941c1 100644
> --- a/security/integrity/ima/Kconfig
> +++ b/security/integrity/ima/Kconfig
> @@ -131,3 +131,18 @@ config IMA_TRUSTED_KEYRING
> help
> This option requires that all keys added to the .ima
> keyring be signed by a key on the system trusted keyring.
> +
> +config IMA_LOAD_X509
> + bool "Load X509 certificate to the '.ima' trusted keyring"
> + depends on IMA_TRUSTED_KEYRING
> + default n
> + help
> + This option enables X509 certificate loading from the kernel
> + to the '.ima' trusted keyring.
> +
> +config IMA_X509_PATH
> + string "IMA X509 certificate path"
> + depends on IMA_LOAD_X509
> + default "/etc/ima/x509_ima.der"

The default dracut master key (modules/97masterkey/masterkey.sh) and EVM
key (modules/98integrity/evm_enable.sh) paths are defined as /etc/keys.
Next, EVM will want something similar as this patchset. Seems like
there should be a consistent "keys" directory.

Mimi

> + help
> + This option defines IMA X509 certificate path.
> diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
> index 9164fc8..0b6c305 100644
> --- a/security/integrity/ima/ima_init.c
> +++ b/security/integrity/ima/ima_init.c
> @@ -24,6 +24,12 @@
> #include <crypto/hash_info.h>
> #include "ima.h"
>
> +#ifdef CONFIG_IMA_X509_PATH
> +#define IMA_X509_PATH CONFIG_IMA_X509_PATH
> +#else
> +#define IMA_X509_PATH "/etc/ima/x509_ima.der"
> +#endif
> +
> /* name for boot aggregate entry */
> static const char *boot_aggregate_name = "boot_aggregate";
> int ima_used_chip;
> @@ -91,6 +97,17 @@ err_out:
> return result;
> }
>
> +#ifdef CONFIG_IMA_LOAD_X509
> +void __init ima_load_x509(void)
> +{
> + int unset_flags = ima_policy_flag & IMA_APPRAISE;
> +
> + ima_policy_flag &= ~unset_flags;
> + integrity_load_x509(INTEGRITY_KEYRING_IMA, IMA_X509_PATH);
> + ima_policy_flag |= unset_flags;
> +}
> +#endif
> +
> int __init ima_init(void)
> {
> u8 pcr_i[TPM_DIGEST_SIZE];
> diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
> index 1057abb..caa1f6c 100644
> --- a/security/integrity/integrity.h
> +++ b/security/integrity/integrity.h
> @@ -162,6 +162,14 @@ static inline int asymmetric_verify(struct key *keyring, const char *sig,
> }
> #endif
>
> +#ifdef CONFIG_IMA_LOAD_X509
> +void __init ima_load_x509(void);
> +#else
> +static inline void ima_load_x509(void)
> +{
> +}
> +#endif
> +
> #ifdef CONFIG_INTEGRITY_AUDIT
> /* declarations */
> void integrity_audit_msg(int audit_msgno, struct inode *inode,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/