Commit dc87f186 authored by Nayna Jain's avatar Nayna Jain Committed by Michael Ellerman
Browse files

powerpc/ima: Update ima arch policy to check for blacklist 



This patch updates the arch-specific policies for PowerNV system to
make sure that the binary hash is not blacklisted.

Signed-off-by: default avatarNayna Jain <nayna@linux.ibm.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1572492694-6520-9-git-send-email-zohar@linux.ibm.com
parent 273df864

arch/powerpc/kernel/ima_arch.c

+4 −4
Original line number Diff line number Diff line
@@ -23,9 +23,9 @@ bool arch_ima_get_secureboot(void) 
 * is not enabled.

 */

static const char *const secure_rules[] = {

	"appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig",

	"appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",

#ifndef CONFIG_MODULE_SIG_FORCE

	"appraise func=MODULE_CHECK appraise_type=imasig|modsig",

	"appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",

#endif

	NULL

};
@@ -49,9 +49,9 @@ static const char *const trusted_rules[] = { 
static const char *const secure_and_trusted_rules[] = {

	"measure func=KEXEC_KERNEL_CHECK template=ima-modsig",

	"measure func=MODULE_CHECK template=ima-modsig",

	"appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig",

	"appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",

#ifndef CONFIG_MODULE_SIG_FORCE

	"appraise func=MODULE_CHECK appraise_type=imasig|modsig",

	"appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",

#endif

	NULL

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE