lkml.org 
[lkml]   [2018]   [Nov]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH 0/3] selftest/ima: fail kexec_load syscall
Date
The "ima: add support for arch specific policies" patch set introduced
architecture specific policies, including an x86 policy which prevents
loading a kernel image via the kexec_load syscall.

This patch set preq's that patch set, adding a missing kexec_load
syscall failure message, extending the existing support for detecting
secureboot mode, and defining a kexec_load syscall selftest to
simplify testing.

To run the kexec_load test requires root privileges. Execute:
"sudo make TARGETS=ima kselftest".

With secure boot enabled, the kexec_load fails, but the test
succeeds.

selftests: ima: test_kexec_load.sh
========================================
./test_kexec_load.sh: kexec_load failed [PASS]
ok 1..1 selftests: ima: test_kexec_load.sh [PASS]


Mimi

Mimi Zohar (3):
ima: add error mesage to kexec_load
selftests/ima: kexec_load syscall test
x86/ima: retry detecting secure boot mode

arch/x86/kernel/Makefile | 2 +
arch/x86/kernel/ima_arch.c | 46 +++++++++++++++++++++-
include/linux/ima.h | 2 +-
security/integrity/ima/ima_main.c | 4 +-
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/ima/Makefile | 11 ++++++
tools/testing/selftests/ima/config | 4 ++
tools/testing/selftests/ima/test_kexec_load.sh | 54 ++++++++++++++++++++++++++
8 files changed, 120 insertions(+), 4 deletions(-)
create mode 100644 tools/testing/selftests/ima/Makefile
create mode 100644 tools/testing/selftests/ima/config
create mode 100755 tools/testing/selftests/ima/test_kexec_load.sh

--
2.7.5

\
 
 \ /
  Last update: 2018-11-19 20:58    [W:0.074 / U:0.784 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site