Messages in this thread Patch in this message | | | From | Mimi Zohar <> | Subject | [PATCH 2/6] ima: prevent sysfs fallback firmware loading | Date | Tue, 1 May 2018 09:48:19 -0400 |
| |
With an IMA policy requiring signed firmware, this patch prevents the sysfs fallback method of loading firmware.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: Luis R. Rodriguez <mcgrof@suse.com> Cc: David Howells <dhowells@redhat.com> Cc: Matthew Garrett <mjg59@google.com> --- security/integrity/ima/ima_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 754ece08e1c6..8759280dccf6 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -453,7 +453,17 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id) } return 0; } + + if (read_id == READING_FIRMWARE_FALLBACK) { + if ((ima_appraise & IMA_APPRAISE_FIRMWARE) && + (ima_appraise & IMA_APPRAISE_ENFORCE)) { + pr_err("Prevent firmware sysfs fallback loading.\n"); + return -EACCES; + } + return 0; + } return 0; + } static int read_idmap[READING_MAX_ID] = { -- 2.7.5
| |