Changes in ima_arch.c

f20765fd - integrity: Always reference the blacklist keyring with appraisal

Wed, 26 Jul 2023 21:17:25 +0000

integrity: Always reference the blacklist keyring with appraisalCommit 273df864cf746 ("ima: Check against blacklisted hashes for files withmodsig") introduced an appraise_flag option for referencing the blacklistkeyring. Any matching binary found on this keyring fails signaturevalidation. This flag only works with module appended signatures.An important part of a PKI infrastructure is to have the ability to dorevocation at a later time should a vulnerability be found. Expand therevocation flag usage to all appraisal functions. The flag is nowenabled by default. Setting the flag with an IMA policy has beendeprecated. Without a revocation capability like this in place, onlyauthenticity can be maintained. With this change, integrity can now beachieved with digital signature based IMA appraisal.Signed-off-by: Eric Snowberg Reviewed-by: Nayna Jain Signed-off-by: Mimi Zohar List of files: /linux-6.15/arch/powerpc/kernel/ima_arch.c

fa4f3f56 - powerpc/ima: Fix secure boot rules in ima arch policy

Fri, 01 May 2020 14:16:52 +0000

powerpc/ima: Fix secure boot rules in ima arch policyTo prevent verifying the kernel module appended signaturetwice (finit_module), once by the module_sig_check() and again by IMA,powerpc secure boot rules define an IMA architecture specific policyrule only if CONFIG_MODULE_SIG_FORCE is not enabled. This,unfortunately, does not take into account the ability of enabling"sig_enforce" on the boot command line (module.sig_enforce=1).Including the IMA module appraise rule results in failing thefinit_module syscall, unless the module signing public key is loadedonto the IMA keyring.This patch fixes secure boot policy rules to be based onCONFIG_MODULE_SIG instead.Fixes: 4238fad366a6 ("powerpc/ima: Add support to initialize ima policy rules")Signed-off-by: Nayna Jain Signed-off-by: Michael Ellerman Signed-off-by: Mimi Zohar Link: https://lore.kernel.org/r/1588342612-14532-1-git-send-email-nayna@linux.ibm.com List of files: /linux-6.15/arch/powerpc/kernel/ima_arch.c

d72ea491 - powerpc/ima: Indicate kernel modules appended signatures are enforced

Thu, 31 Oct 2019 03:31:34 +0000

powerpc/ima: Indicate kernel modules appended signatures are enforcedThe arch specific kernel module policy rule requires kernel modules tobe signed, either as an IMA signature, stored as an xattr, or as anappended signature. As a result, kernel modules appended signaturescould be enforced without "sig_enforce" being set or reflected in/sys/module/module/parameters/sig_enforce. This patch sets"sig_enforce".Signed-off-by: Mimi Zohar Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1572492694-6520-10-git-send-email-zohar@linux.ibm.com List of files: /linux-6.15/arch/powerpc/kernel/ima_arch.c

dc87f186 - powerpc/ima: Update ima arch policy to check for blacklist

Thu, 31 Oct 2019 03:31:33 +0000

powerpc/ima: Update ima arch policy to check for blacklistThis patch updates the arch-specific policies for PowerNV system tomake sure that the binary hash is not blacklisted.Signed-off-by: Nayna Jain Signed-off-by: Mimi Zohar Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1572492694-6520-9-git-send-email-zohar@linux.ibm.com List of files: /linux-6.15/arch/powerpc/kernel/ima_arch.c

1917855f - powerpc/ima: Define trusted boot policy

Thu, 31 Oct 2019 03:31:29 +0000

powerpc/ima: Define trusted boot policyThis patch defines an arch-specific trusted boot only policy and acombined secure and trusted boot policy.Signed-off-by: Nayna Jain Signed-off-by: Mimi Zohar Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1572492694-6520-5-git-send-email-zohar@linux.ibm.com List of files: /linux-6.15/arch/powerpc/kernel/ima_arch.c

4238fad3 - powerpc/ima: Add support to initialize ima policy rules

Thu, 31 Oct 2019 03:31:27 +0000

powerpc/ima: Add support to initialize ima policy rulesPowerNV systems use a Linux-based bootloader, which rely on the IMAsubsystem to enforce different secure boot modes. Since theverification policy may differ based on the secure boot mode of thesystem, the policies must be defined at runtime.This patch implements arch-specific support to define IMA policy rulesbased on the runtime secure boot mode of the system.This patch provides arch-specific IMA policies if PPC_SECURE_BOOTconfig is enabled.Signed-off-by: Nayna Jain Signed-off-by: Mimi Zohar Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1572492694-6520-3-git-send-email-zohar@linux.ibm.com List of files: /linux-6.15/arch/powerpc/kernel/ima_arch.c