Commit 26b1959f authored by Michael Ellerman's avatar Michael Ellerman
Browse files

Merge branch 'topic/ima' into topic/secureboot 

From Nayna's cover letter:
  The IMA subsystem supports custom, built-in, arch-specific policies
  to define the files to be measured and appraised. These policies are
  honored based on priority, where arch-specific policy is the highest
  and custom is the lowest.

  PowerNV systems use a Linux-based bootloader to kexec the OS. The
  bootloader kernel relies on IMA for signature verification of the OS
  kernel before doing the kexec. This patchset adds support for
  powerpc arch-specific IMA policies that are conditionally defined
  based on a system's secure boot and trusted boot states. The OS
  secure boot and trusted boot states are determined via device-tree
  properties.

  The verification needs to be performed only for binaries that are
  not blacklisted. The kernel currently only checks against the
  blacklist of keys. However, doing so results in blacklisting all the
  binaries that are signed by the same key. In order to prevent just
  one particular binary from being loaded, it must be checked against
  a blacklist of binary hashes. This patchset also adds support to IMA
  for checking against a hash blacklist for files. signed by appended
  signature.
parents da0c9ea1 d72ea491

Documentation/ABI/testing/ima_policy

+4 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ Description: 
			lsm:	[[subj_user=] [subj_role=] [subj_type=]

				 [obj_user=] [obj_role=] [obj_type=]]

			option:	[[appraise_type=]] [template=] [permit_directio]

				[appraise_flag=]

		base: 	func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]

				[FIRMWARE_CHECK]

				[KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
@@ -38,6 +39,9 @@ Description: 
			fowner:= decimal value

		lsm:  	are LSM specific

		option:	appraise_type:= [imasig] [imasig|modsig]

			appraise_flag:= [check_blacklist]

			Currently, blacklist check is only for files signed with appended

			signature.

			template:= name of a defined IMA template type

			(eg, ima-ng). Only valid when action is "measure".

			pcr:= decimal value

arch/powerpc/Kconfig

+11 −0
Original line number Diff line number Diff line
@@ -934,6 +934,17 @@ config PPC_MEM_KEYS 


	  If unsure, say y.



config PPC_SECURE_BOOT

	prompt "Enable secure boot support"

	bool

	depends on PPC_POWERNV

	depends on IMA_ARCH_POLICY

	help

	  Systems with firmware secure boot enabled need to define security

	  policies to extend secure boot to the OS. This config allows a user

	  to enable OS secure boot on systems that have firmware support for

	  it. If in doubt say N.



endmenu



config ISA_DMA_API

arch/powerpc/include/asm/secure_boot.h

0 → 100644
+29 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Secure boot definitions

 *

 * Copyright (C) 2019 IBM Corporation

 * Author: Nayna Jain

 */

#ifndef _ASM_POWER_SECURE_BOOT_H

#define _ASM_POWER_SECURE_BOOT_H



#ifdef CONFIG_PPC_SECURE_BOOT



bool is_ppc_secureboot_enabled(void);

bool is_ppc_trustedboot_enabled(void);



#else



static inline bool is_ppc_secureboot_enabled(void)

{

	return false;

}



static inline bool is_ppc_trustedboot_enabled(void)

{

	return false;

}



#endif

#endif

arch/powerpc/kernel/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -161,6 +161,8 @@ ifneq ($(CONFIG_PPC_POWERNV)$(CONFIG_PPC_SVM),) 
obj-y				+= ucall.o

endif



obj-$(CONFIG_PPC_SECURE_BOOT)	+= secure_boot.o ima_arch.o



# Disable GCOV, KCOV & sanitizers in odd or sensitive code

GCOV_PROFILE_prom_init.o := n

KCOV_INSTRUMENT_prom_init.o := n

arch/powerpc/kernel/ima_arch.c

0 → 100644
+78 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/*

 * Copyright (C) 2019 IBM Corporation

 * Author: Nayna Jain

 */



#include <linux/ima.h>

#include <asm/secure_boot.h>



bool arch_ima_get_secureboot(void)

{

	return is_ppc_secureboot_enabled();

}



/*

 * The "secure_rules" are enabled only on "secureboot" enabled systems.

 * These rules verify the file signatures against known good values.

 * The "appraise_type=imasig|modsig" option allows the known good signature

 * to be stored as an xattr or as an appended signature.

 *

 * To avoid duplicate signature verification as much as possible, the IMA

 * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE

 * is not enabled.

 */

static const char *const secure_rules[] = {

	"appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",

#ifndef CONFIG_MODULE_SIG_FORCE

	"appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",

#endif

	NULL

};



/*

 * The "trusted_rules" are enabled only on "trustedboot" enabled systems.

 * These rules add the kexec kernel image and kernel modules file hashes to

 * the IMA measurement list.

 */

static const char *const trusted_rules[] = {

	"measure func=KEXEC_KERNEL_CHECK",

	"measure func=MODULE_CHECK",

	NULL

};



/*

 * The "secure_and_trusted_rules" contains rules for both the secure boot and

 * trusted boot. The "template=ima-modsig" option includes the appended

 * signature, when available, in the IMA measurement list.

 */

static const char *const secure_and_trusted_rules[] = {

	"measure func=KEXEC_KERNEL_CHECK template=ima-modsig",

	"measure func=MODULE_CHECK template=ima-modsig",

	"appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",

#ifndef CONFIG_MODULE_SIG_FORCE

	"appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",

#endif

	NULL

};



/*

 * Returns the relevant IMA arch-specific policies based on the system secure

 * boot state.

 */

const char *const *arch_get_ima_policy(void)

{

	if (is_ppc_secureboot_enabled()) {

		if (IS_ENABLED(CONFIG_MODULE_SIG))

			set_module_sig_enforced();



		if (is_ppc_trustedboot_enabled())

			return secure_and_trusted_rules;

		else

			return secure_rules;

	} else if (is_ppc_trustedboot_enabled()) {

		return trusted_rules;

	}



	return NULL;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE