Re: [PATCH v3 5/6] ima: require signature based appraisal

[Mimi Zohar]

On Fri, 2014-10-10 at 17:09 +0300, Dmitry Kasatkin wrote: 
> This patch provides kernel parameter CONFIG_IMA_APPRAISE_SIGNED_INIT
> to force IMA appraisal using signatures. This is useful, when EVM key
> is not initalized yet and we want securely initialize integrity or any
> other functionality.

Instead of "kernel parameter", I think you meant "config option".  A new
kernel parameter would need to be documented in
Documentation/kernel-parameters.

Mimi

> It forces embedded policy to require signature. Signed initialization
> script can initialize EVM key, update the IMA policy and change further
> requirement of everything to be signed.
> 
> Changes in v2:
> * policy change of this patch separated from the key loading patch
> 
> Signed-off-by: Dmitry Kasatkin <d.kasatkin@xxxxxxxxxxx>
> ---
>  security/integrity/ima/Kconfig      | 7 +++++++
>  security/integrity/ima/ima_policy.c | 5 +++++
>  2 files changed, 12 insertions(+)
> 
> diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> index 44941c1..6a1971f 100644
> --- a/security/integrity/ima/Kconfig
> +++ b/security/integrity/ima/Kconfig
> @@ -146,3 +146,10 @@ config IMA_X509_PATH
>  	default "/etc/ima/x509_ima.der"
>  	help
>  	   This option defines IMA X509 certificate path.
> +
> +config IMA_APPRAISE_SIGNED_INIT
> +	bool "Require signed user-space initialization"
> +	depends on IMA_LOAD_X509
> +	default n
> +	help
> +	   This option requires user-space init to be signed.
> diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> index 0d14d25..222ff79 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
> @@ -100,7 +100,12 @@ static struct ima_rule_entry default_appraise_rules[] = {
>  	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
>  	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
>  	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
> +#ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
>  	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
> +#else
> +	/* force signature */
> +	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
> +#endif
>  };
> 
>  static LIST_HEAD(ima_default_rules);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/