Messages in this thread | | | Date | Tue, 30 Jun 2020 14:00:43 -0300 | From | Bruno Meneguele <> | Subject | Re: [PATCH v3 2/2] ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime |
| |
On Tue, Jun 30, 2020 at 07:00:48AM -0400, Mimi Zohar wrote: > On Mon, 2020-06-29 at 20:47 -0300, Bruno Meneguele wrote: > > > > > > I'm not if the "secure_boot" flag is available prior to calling > > > default_appraise_setup(), but if it is, you could modify the test > > > there to also check if the system is booted in secure boot mode (eg. > > > IS_ENABLED(CONFIG_IMA_APPRAISE_BOOTPARAM) && > > > !arch_ima_get_secureboot()) > > > > > > > Well pointed. I built a custom x86 kernel with some workaround to get > > this flag status within default_appraise_setup() and as a result the > > flag is was correctly available. > > > > Considering the nature of this flag (platform's firmware (in all > > arches?)) can we trust that every arch supporting secure/trusted boot > > will have it available in the __setup() call time? > > Calling default_appraise_setup() could be deferred. >
Hmmm.. ok, I'm going to investigate it further. Didn't really know that.
> > > > > > + /* In secure and/or trusted boot the appraisal must be > > > > + * enforced, regardless kernel parameters, preventing > > > > + * runtime changes */ > > > > > > Only "appraise" rules are enforced. > > > > > > > Hmm.. do you mean the comment wording is wrong/"could be better", > > pointing the "appraise" action explicitly? > > No, it's more than just the comment. Like "trusted boot", IMA- > measurement only measures files, never enforces integrity. > "ima_appraise" mode is only applicable to IMA-appraisal.
ah! Ok, I see it now and in fact it shouldn't be part of the check alongside secureboot.
Well, I'm going to rethink the approach entirely then. As you said, only deferring default_appraise_setup() may be probably enough.
Thanks Mimi.
-- bmeneg PGP Key: http://bmeneg.com/pubkey.txt [unhandled content-type:application/pgp-signature] | |