Messages in this thread |  | | Subject | Re: [PATCH v3 5/6] ima: require signature based appraisal | From | Mimi Zohar <> | Date | Mon, 13 Oct 2014 13:33:23 -0400 |
| |
On Fri, 2014-10-10 at 17:09 +0300, Dmitry Kasatkin wrote: > This patch provides kernel parameter CONFIG_IMA_APPRAISE_SIGNED_INIT > to force IMA appraisal using signatures. This is useful, when EVM key > is not initalized yet and we want securely initialize integrity or any > other functionality.
Instead of "kernel parameter", I think you meant "config option". A new kernel parameter would need to be documented in Documentation/kernel-parameters.
Mimi
> It forces embedded policy to require signature. Signed initialization > script can initialize EVM key, update the IMA policy and change further > requirement of everything to be signed. > > Changes in v2: > * policy change of this patch separated from the key loading patch > > Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> > --- > security/integrity/ima/Kconfig | 7 +++++++ > security/integrity/ima/ima_policy.c | 5 +++++ > 2 files changed, 12 insertions(+) > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > index 44941c1..6a1971f 100644 > --- a/security/integrity/ima/Kconfig > +++ b/security/integrity/ima/Kconfig > @@ -146,3 +146,10 @@ config IMA_X509_PATH > default "/etc/ima/x509_ima.der" > help > This option defines IMA X509 certificate path. > + > +config IMA_APPRAISE_SIGNED_INIT > + bool "Require signed user-space initialization" > + depends on IMA_LOAD_X509 > + default n > + help > + This option requires user-space init to be signed. > diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c > index 0d14d25..222ff79 100644 > --- a/security/integrity/ima/ima_policy.c > +++ b/security/integrity/ima/ima_policy.c > @@ -100,7 +100,12 @@ static struct ima_rule_entry default_appraise_rules[] = { > {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, > {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, > {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC}, > +#ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT > {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER}, > +#else > + /* force signature */ > + {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED}, > +#endif > }; > > static LIST_HEAD(ima_default_rules);
|  |