Commit f4001947 authored May 15, 2019 by Petr Vorel Committed by Mimi Zohar May 19, 2019

ima: fix wrong signed policy requirement when not appraising



Kernel booted just with ima_policy=tcb (not with
ima_policy=appraise_tcb) shouldn't require signed policy.

Regression found with LTP test ima_policy.sh.

Fixes: c52657d9 ("ima: refactor ima_init_policy()")
Cc: stable@vger.kernel.org  (linux-5.0)
Signed-off-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

parent 558b523d

security/integrity/ima/ima_policy.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -498,12 +498,13 @@ static void add_rules(struct ima_rule_entry *entries, int count,

		list_add_tail(&entry->list, &ima_policy_rules);
		}
		if (entries[i].action == APPRAISE)
		if (entries[i].action == APPRAISE) {
		temp_ima_appraise \|= ima_appraise_flag(entries[i].func);
		if (entries[i].func == POLICY_CHECK)
		temp_ima_appraise \|= IMA_APPRAISE_POLICY;
		}
		}
		}

		static int ima_parse_rule(char rule, struct ima_rule_entry entry);

Admin message