Re: [PATCH] allow disabling IMA at runtime

[Mimi Zohar]

Kyle McMartin <kyle@xxxxxxxxxxxxx> wrote on 08/25/2009 10:10:05 PM:

> From: Kyle McMartin <kyle@xxxxxxxxxx>
> 
> Due to a memory leak in IMA that we're currently debugging in Fedora
> rawhide, it would be nice to be able to disable that support at runtime.
> Currently it's only able to be built in, and there's no toggle to avoid
> initializing it.
> 
> Provide one, in order to enhance debuggability. If a user can reboot a
> machine and edit its command line, one can do a far sight worse things
> than disabling a security precaution.
> 
> Signed-off-by: Kyle McMartin <kyle@xxxxxxxxxx>

Have you tried using Eric's patch
"IMA: Minimal IMA policy and boot param for TCB IMA policy"
(commit 5789ba3bd0a3cd20df5980ebf03358f2eb44fd67), which introduced
the ima_tcb=1 command line option?  It wasn't backported to 2.6.30.

Mimi

> ---
> diff --git a/Documentation/kernel-parameters.txt 
b/Documentation/kernel-parameters.txt
> index 7936b80..0d1b1ed 100644
> --- a/Documentation/kernel-parameters.txt
> +++ b/Documentation/kernel-parameters.txt
> @@ -926,6 +926,11 @@ and is between 256 and 4096 characters. It is 
defined in the file
>     ihash_entries=   [KNL]
>           Set number of hash buckets for inode cache.
> 
> +   ima=      [IMA]
> +         Format: { "0" | "1" }
> +         0 -- disable IMA.
> +         1 -- enable IMA. (default)
> +
>     ima_audit=   [IMA]
>           Format: { "0" | "1" }
>           0 -- integrity auditing messages. (Default)
> diff --git a/security/integrity/ima/ima_main.c 
b/security/integrity/ima/ima_main.c
> index 101c512..cc7603e 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -339,10 +339,27 @@ int ima_bprm_check(struct linux_binprm *bprm)
>     return 0;
>  }
> 
> +static int ima_disabled = 0;
> +static int __init ima_enabled(char *str)
> +{
> +   unsigned long enabled;
> +
> +   if (!strict_strtoul(str, 0, &enabled))
> +      ima_disabled = enabled ? 0 : 1;
> +
> +   return 1;
> +}
> +__setup("ima=", ima_enabled);
> +
>  static int __init init_ima(void)
>  {
>     int error;
> 
> +   if (ima_disabled) {
> +      pr_info("IMA disabled at user request.\n");
> +      return 0;
> +   }
> +
>     ima_iintcache_init();
>     error = ima_init();
>     ima_initialized = 1;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/