Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a7f2a366 authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: fallback to MODULE_SIG_ENFORCE for existing kernel module syscall 



The new kernel module syscall appraises kernel modules based
on policy.   If the IMA policy requires kernel module checking,
fallback to module signature enforcing for the existing syscall.
Without CONFIG_MODULE_SIG_FORCE enabled, the kernel module's
integrity is unknown, return -EACCES.

Changelog v1:
- Fix ima_module_check() return result (Tetsuo Handa)

Reported-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
parent a49f0d1e

security/integrity/ima/ima.h

+1 −0
Original line number Diff line number Diff line
@@ -139,6 +139,7 @@ void ima_delete_rules(void); 
/* Appraise integrity measurements */

#define IMA_APPRAISE_ENFORCE	0x01

#define IMA_APPRAISE_FIX	0x02

#define IMA_APPRAISE_MODULES	0x04



#ifdef CONFIG_IMA_APPRAISE

int ima_appraise_measurement(struct integrity_iint_cache *iint,

security/integrity/ima/ima_main.c

+8 −4
Original line number Diff line number Diff line
@@ -291,11 +291,15 @@ EXPORT_SYMBOL_GPL(ima_file_check); 
 */

int ima_module_check(struct file *file)

{

	int rc;

	int rc = 0;



	if (!file)

		rc = INTEGRITY_UNKNOWN;

	else

	if (!file) {

		if (ima_appraise & IMA_APPRAISE_MODULES) {

#ifndef CONFIG_MODULE_SIG_FORCE

			rc = -EACCES;	/* INTEGRITY_UNKNOWN */

#endif

		}

	} else

		rc = process_measurement(file, file->f_dentry->d_name.name,

					 MAY_EXEC, MODULE_CHECK);

	return (ima_appraise & IMA_APPRAISE_ENFORCE) ? rc : 0;

security/integrity/ima/ima_policy.c

+2 −1
Original line number Diff line number Diff line
@@ -523,7 +523,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) 
	}

	if (!result && (entry->action == UNKNOWN))

		result = -EINVAL;



	else if (entry->func == MODULE_CHECK)

		ima_appraise |= IMA_APPRAISE_MODULES;

	audit_log_format(ab, "res=%d", !result);

	audit_log_end(ab);

	return result;