Commit 7664cd6e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'next-integrity' of... 

Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull intgrity updates from James Morris:
 "This contains just three patches, the remainder were either included
  in other pull requests (eg. audit, lockdown) or will be upstreamed via
  other subsystems (eg. kselftests, Power).

  Included here is one bug fix, one documentation update, and extending
  the x86 IMA arch policy rules to coordinate the different kernel
  module signature verification methods"

* 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  doc/kernel-parameters.txt: Deprecate ima_appraise_tcb
  x86/ima: add missing include
  x86/ima: require signed kernel modules
parents 88238805 2bfebea9

Documentation/admin-guide/kernel-parameters.txt

+2 −3
Original line number Diff line number Diff line
@@ -1588,7 +1588,7 @@ 
			Format: { "off" | "enforce" | "fix" | "log" }

			default: "enforce"



	ima_appraise_tcb [IMA]

	ima_appraise_tcb [IMA] Deprecated.  Use ima_policy= instead.

			The builtin appraise policy appraises all files

			owned by uid=0.
@@ -1615,8 +1615,7 @@ 
			uid=0.



			The "appraise_tcb" policy appraises the integrity of

			all files owned by root. (This is the equivalent

			of ima_appraise_tcb.)

			all files owned by root.



			The "secure_boot" policy appraises the integrity

			of files (eg. kexec kernel image, kernel modules,

arch/x86/kernel/ima_arch.c

+9 −1
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
 * Copyright (C) 2018 IBM Corporation

 */

#include <linux/efi.h>

#include <linux/module.h>

#include <linux/ima.h>



extern struct boot_params boot_params;
@@ -64,12 +65,19 @@ static const char * const sb_arch_rules[] = { 
	"appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig",

#endif /* CONFIG_KEXEC_VERIFY_SIG */

	"measure func=KEXEC_KERNEL_CHECK",

#if !IS_ENABLED(CONFIG_MODULE_SIG)

	"appraise func=MODULE_CHECK appraise_type=imasig",

#endif

	"measure func=MODULE_CHECK",

	NULL

};



const char * const *arch_get_ima_policy(void)

{

	if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot())

	if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {

		if (IS_ENABLED(CONFIG_MODULE_SIG))

			set_module_sig_enforced();

		return sb_arch_rules;

	}

	return NULL;

}

include/linux/module.h

+5 −0
Original line number Diff line number Diff line
@@ -677,6 +677,7 @@ static inline bool is_livepatch_module(struct module *mod) 
#endif /* CONFIG_LIVEPATCH */



bool is_module_sig_enforced(void);

void set_module_sig_enforced(void);



#else /* !CONFIG_MODULES... */
@@ -803,6 +804,10 @@ static inline bool is_module_sig_enforced(void) 
	return false;

}



static inline void set_module_sig_enforced(void)

{

}



/* Dereference module function descriptor */

static inline

void *dereference_module_function_descriptor(struct module *mod, void *ptr)

kernel/module.c

+5 −0
Original line number Diff line number Diff line
@@ -290,6 +290,11 @@ bool is_module_sig_enforced(void) 
}

EXPORT_SYMBOL(is_module_sig_enforced);



void set_module_sig_enforced(void)

{

	sig_enforce = true;

}



/* Block module loading/unloading? */

int modules_disabled = 0;

core_param(nomodule, modules_disabled, bint, 0);

CRA Git | Maintained and supported by SUSTech CRA and CCSE