Commit 9044d627 authored by Thiago Jung Bauermann's avatar Thiago Jung Bauermann Committed by Mimi Zohar
Browse files

ima: Add modsig appraise_type option for module-style appended signatures 



Introduce the modsig keyword to the IMA policy syntax to specify that
a given hook should expect the file to have the IMA signature appended
to it. Here is how it can be used in a rule:

appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig

With this rule, IMA will accept either a signature stored in the extended
attribute or an appended signature.

For now, the rule above will behave exactly the same as if
appraise_type=imasig was specified. The actual modsig implementation
will be introduced separately.

Suggested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarThiago Jung Bauermann <bauerman@linux.ibm.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent cf38fed1

Documentation/ABI/testing/ima_policy

+5 −1
Original line number Original line Diff line number Diff line
@@ -37,7 +37,7 @@ Description: 
			euid:= decimal value

			euid:= decimal value

			fowner:= decimal value

			fowner:= decimal value

		lsm:  	are LSM specific

		lsm:  	are LSM specific

		option:	appraise_type:= [imasig]

		option:	appraise_type:= [imasig] [imasig|modsig]

			template:= name of a defined IMA template type

			template:= name of a defined IMA template type

			(eg, ima-ng). Only valid when action is "measure".

			(eg, ima-ng). Only valid when action is "measure".

			pcr:= decimal value

			pcr:= decimal value
@@ -105,3 +105,7 @@ Description: 




			measure func=KEXEC_KERNEL_CHECK pcr=4

			measure func=KEXEC_KERNEL_CHECK pcr=4

			measure func=KEXEC_INITRAMFS_CHECK pcr=5

			measure func=KEXEC_INITRAMFS_CHECK pcr=5



		Example of appraise rule allowing modsig appended signatures:



			appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig

security/integrity/ima/Kconfig

+10 −0
Original line number Original line Diff line number Diff line
@@ -233,6 +233,16 @@ config IMA_APPRAISE_BOOTPARAM 
	  This option enables the different "ima_appraise=" modes

	  This option enables the different "ima_appraise=" modes

	  (eg. fix, log) from the boot command line.

	  (eg. fix, log) from the boot command line.





config IMA_APPRAISE_MODSIG

	bool "Support module-style signatures for appraisal"

	depends on IMA_APPRAISE

	default n

	help

	   Adds support for signatures appended to files. The format of the

	   appended signature is the same used for signed kernel modules.

	   The modsig keyword can be used in the IMA policy to allow a hook

	   to accept such signatures.



config IMA_TRUSTED_KEYRING

config IMA_TRUSTED_KEYRING

	bool "Require all keys on the .ima keyring be signed (deprecated)"

	bool "Require all keys on the .ima keyring be signed (deprecated)"

	depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING

	depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING

security/integrity/ima/Makefile

+1 −0
Original line number Original line Diff line number Diff line
@@ -9,5 +9,6 @@ obj-$(CONFIG_IMA) += ima.o 
ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \

ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \

	 ima_policy.o ima_template.o ima_template_lib.o

	 ima_policy.o ima_template.o ima_template_lib.o

ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o

ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o

ima-$(CONFIG_IMA_APPRAISE_MODSIG) += ima_modsig.o

ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o

ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o

obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o
 
obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o

security/integrity/ima/ima.h

+9 −0
Original line number Original line Diff line number Diff line
@@ -302,6 +302,15 @@ static inline int ima_read_xattr(struct dentry *dentry, 




#endif /* CONFIG_IMA_APPRAISE */

#endif /* CONFIG_IMA_APPRAISE */





#ifdef CONFIG_IMA_APPRAISE_MODSIG

bool ima_hook_supports_modsig(enum ima_hooks func);

#else

static inline bool ima_hook_supports_modsig(enum ima_hooks func)

{

	return false;

}

#endif /* CONFIG_IMA_APPRAISE_MODSIG */



/* LSM based policy rules require audit */

/* LSM based policy rules require audit */

#ifdef CONFIG_IMA_LSM_RULES

#ifdef CONFIG_IMA_LSM_RULES

security/integrity/ima/ima_modsig.c

0 → 100644
+31 −0
Original line number Original line Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0+

/*

 * IMA support for appraising module-style appended signatures.

 *

 * Copyright (C) 2019  IBM Corporation

 *

 * Author:

 * Thiago Jung Bauermann <bauerman@linux.ibm.com>

 */



#include "ima.h"



/**

 * ima_hook_supports_modsig - can the policy allow modsig for this hook?

 *

 * modsig is only supported by hooks using ima_post_read_file(), because only

 * they preload the contents of the file in a buffer. FILE_CHECK does that in

 * some cases, but not when reached from vfs_open(). POLICY_CHECK can support

 * it, but it's not useful in practice because it's a text file so deny.

 */

bool ima_hook_supports_modsig(enum ima_hooks func)

{

	switch (func) {

	case KEXEC_KERNEL_CHECK:

	case KEXEC_INITRAMFS_CHECK:

	case MODULE_CHECK:

		return true;

	default:

		return false;

	}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE