Merge branch 'next-integrity-for-james' of... (2bfebea9) · Commits · 戴 / test

Documentation/admin-guide/kernel-parameters.txt

+2 −3

Original line number	Diff line number	Diff line
		@@ -1585,7 +1585,7 @@
		Format: { "off" \| "enforce" \| "fix" \| "log" }
		default: "enforce"

		ima_appraise_tcb [IMA]
		ima_appraise_tcb [IMA] Deprecated. Use ima_policy= instead.
		The builtin appraise policy appraises all files
		owned by uid=0.

		@@ -1612,8 +1612,7 @@
		uid=0.

		The "appraise_tcb" policy appraises the integrity of
		all files owned by root. (This is the equivalent
		of ima_appraise_tcb.)
		all files owned by root.

		The "secure_boot" policy appraises the integrity
		of files (eg. kexec kernel image, kernel modules,

+9 −1

Original line number	Diff line number	Diff line
		@@ -3,6 +3,7 @@
		* Copyright (C) 2018 IBM Corporation
		*/
		#include <linux/efi.h>
		#include <linux/module.h>
		#include <linux/ima.h>

		extern struct boot_params boot_params;
		@@ -64,12 +65,19 @@ static const char * const sb_arch_rules[] = {
		"appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig",
		#endif /* CONFIG_KEXEC_VERIFY_SIG */
		"measure func=KEXEC_KERNEL_CHECK",
		#if !IS_ENABLED(CONFIG_MODULE_SIG)
		"appraise func=MODULE_CHECK appraise_type=imasig",
		#endif
		"measure func=MODULE_CHECK",
		NULL
		};

		const char * const *arch_get_ima_policy(void)
		{
		if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot())
		if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
		if (IS_ENABLED(CONFIG_MODULE_SIG))
		set_module_sig_enforced();
		return sb_arch_rules;
		}
		return NULL;
		}

+5 −0

Original line number	Diff line number	Diff line
		@@ -676,6 +676,7 @@ static inline bool is_livepatch_module(struct module *mod)
		#endif /* CONFIG_LIVEPATCH */

		bool is_module_sig_enforced(void);
		void set_module_sig_enforced(void);

		#else /* !CONFIG_MODULES... */

		@@ -796,6 +797,10 @@ static inline bool is_module_sig_enforced(void)
		return false;
		}

		static inline void set_module_sig_enforced(void)
		{
		}

		/* Dereference module function descriptor */
		static inline
		void dereference_module_function_descriptor(struct module mod, void *ptr)

+5 −0

Original line number	Diff line number	Diff line
		@@ -286,6 +286,11 @@ bool is_module_sig_enforced(void)
		}
		EXPORT_SYMBOL(is_module_sig_enforced);

		void set_module_sig_enforced(void)
		{
		sig_enforce = true;
		}

		/* Block module loading/unloading? */
		int modules_disabled = 0;
		core_param(nomodule, modules_disabled, bint, 0);