lkml.org 
[lkml]   [2014]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v3 5/6] ima: require signature based appraisal
From
Date
On Fri, 2014-10-10 at 17:09 +0300, Dmitry Kasatkin wrote: 
> This patch provides kernel parameter CONFIG_IMA_APPRAISE_SIGNED_INIT
> to force IMA appraisal using signatures. This is useful, when EVM key
> is not initalized yet and we want securely initialize integrity or any
> other functionality.

Instead of "kernel parameter", I think you meant "config option". A new
kernel parameter would need to be documented in
Documentation/kernel-parameters.

Mimi

> It forces embedded policy to require signature. Signed initialization
> script can initialize EVM key, update the IMA policy and change further
> requirement of everything to be signed.
>
> Changes in v2:
> * policy change of this patch separated from the key loading patch
>
> Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
> ---
> security/integrity/ima/Kconfig | 7 +++++++
> security/integrity/ima/ima_policy.c | 5 +++++
> 2 files changed, 12 insertions(+)
>
> diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> index 44941c1..6a1971f 100644
> --- a/security/integrity/ima/Kconfig
> +++ b/security/integrity/ima/Kconfig
> @@ -146,3 +146,10 @@ config IMA_X509_PATH
> default "/etc/ima/x509_ima.der"
> help
> This option defines IMA X509 certificate path.
> +
> +config IMA_APPRAISE_SIGNED_INIT
> + bool "Require signed user-space initialization"
> + depends on IMA_LOAD_X509
> + default n
> + help
> + This option requires user-space init to be signed.
> diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> index 0d14d25..222ff79 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
> @@ -100,7 +100,12 @@ static struct ima_rule_entry default_appraise_rules[] = {
> {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
> {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
> {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
> +#ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
> {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
> +#else
> + /* force signature */
> + {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
> +#endif
> };
>
> static LIST_HEAD(ima_default_rules);




\
 
 \ /
  Last update: 2014-10-13 20:01    [W:0.090 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site