Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c57782c1 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar
Browse files

ima: require signature based appraisal 



This patch provides CONFIG_IMA_APPRAISE_SIGNED_INIT kernel configuration
option to force IMA appraisal using signatures. This is useful, when EVM
key is not initialized yet and we want securely initialize integrity or
any other functionality.

It forces embedded policy to require signature. Signed initialization
script can initialize EVM key, update the IMA policy and change further
requirement of everything to be signed.

Changes in v3:
* kernel parameter fixed to configuration option in the patch description

Changes in v2:
* policy change of this patch separated from the key loading patch

Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent c9cd2ce2

security/integrity/ima/Kconfig

+7 −0
Original line number Original line Diff line number Diff line
@@ -149,3 +149,10 @@ config IMA_X509_PATH 
	default "/etc/keys/x509_ima.der"

	default "/etc/keys/x509_ima.der"

	help

	help

	   This option defines IMA X509 certificate path.

	   This option defines IMA X509 certificate path.



config IMA_APPRAISE_SIGNED_INIT

	bool "Require signed user-space initialization"

	depends on IMA_LOAD_X509

	default n

	help

	   This option requires user-space init to be signed.

security/integrity/ima/ima_policy.c

+6 −0
Original line number Original line Diff line number Diff line
@@ -100,7 +100,13 @@ static struct ima_rule_entry default_appraise_rules[] = { 
	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},

	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},

#ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT

	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},

	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},

#else

	/* force signature */

	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID,

	 .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},

#endif

};

};





static LIST_HEAD(ima_default_rules);

static LIST_HEAD(ima_default_rules);