diff mbox series

[v2] ima: require signed IMA policy when UEFI secure boot is enabled

Message ID 20230726020806.926734-1-coxu@redhat.com
State New
Headers
Series [v2] ima: require signed IMA policy when UEFI secure boot is enabled |

Commit Message

Coiby Xu July 26, 2023, 2:08 a.m. UTC 
  With commit 099f26f22f58 ("integrity: machine keyring CA
configuration"), users are able to add custom IMA CA keys via
MOK.  This allows users to sign their own IMA polices without
recompiling the kernel. For the sake of security, mandate signed IMA
policy when UEFI secure boot is enabled.

Note this change may affect existing users/tests i.e users won't be able
to load an unsigned IMA policy when the IMA architecture specific policy
is configured and UEFI secure boot is enabled.

Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
v2
 - improve commit message [Mimi]
  - explicitly mention the dependent commit
  - add a note that the change will affect user space
 - remove "/* CONFIG_INTEGRITY_MACHINE_KEYRING .. */" to improve code
   readability
---
 security/integrity/ima/ima_efi.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Mimi Zohar July 27, 2023, 5:38 p.m. UTC | #1 
On Wed, 2023-07-26 at 10:08 +0800, Coiby Xu wrote:
> With commit 099f26f22f58 ("integrity: machine keyring CA
> configuration"), users are able to add custom IMA CA keys via
> MOK.  This allows users to sign their own IMA polices without
> recompiling the kernel. For the sake of security, mandate signed IMA
> policy when UEFI secure boot is enabled.
> 
> Note this change may affect existing users/tests i.e users won't be able
> to load an unsigned IMA policy when the IMA architecture specific policy
> is configured and UEFI secure boot is enabled.
> 
> Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---
> v2
>  - improve commit message [Mimi]
>   - explicitly mention the dependent commit
>   - add a note that the change will affect user space
>  - remove "/* CONFIG_INTEGRITY_MACHINE_KEYRING .. */" to improve code
>    readability

Thank you for updating the commit message.  The patch is now queued in
next-integrity-testing.
diff mbox series

Patch

diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c
index 9db66fe310d4..138029bfcce1 100644
--- a/security/integrity/ima/ima_efi.c
+++ b/security/integrity/ima/ima_efi.c
@@ -57,6 +57,9 @@  static const char * const sb_arch_rules[] = {
 	"measure func=KEXEC_KERNEL_CHECK",
 #if !IS_ENABLED(CONFIG_MODULE_SIG)
 	"appraise func=MODULE_CHECK appraise_type=imasig",
+#endif
+#if IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && IS_ENABLED(CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY)
+	"appraise func=POLICY_CHECK appraise_type=imasig",
 #endif
 	"measure func=MODULE_CHECK",
 	NULL