diff options
| author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2018-04-13 11:27:52 -0400 |
|---|---|---|
| committer | Justin M. Forbes <jforbes@fedoraproject.org> | 2018-06-13 11:10:08 -0500 |
| commit | d80c02f88bc3f81b647779caee4c7b209f5332a4 (patch) | |
| tree | 7bea86f3921a5eb7a7f17efc256a099aa5b2998a | |
| parent | 2aa9a943b31676ec5872383963b8a065a75d0300 (diff) | |
| download | linux-lockdown.tar.gz | |
lockdown: fix coordination of kernel module signature verificationlockdown
If both IMA-appraisal and sig_enforce are enabled, then both signatures
are currently required. If the IMA-appraisal signature verification
fails, it could rely on the appended signature verification; but with the
lockdown patch set, the appended signature verification assumes that if
IMA-appraisal is enabled, it has verified the signature. Basically each
signature verification method would be relying on the other to verify the
kernel module signature.
This patch addresses the problem of requiring both kernel module signature
verification methods, when both are enabled, by verifying just the
appended signature.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: Bruno E. O. Meneguele <bmeneg@redhat.com>
| -rw-r--r-- | kernel/module.c | 4 | ||||
| -rw-r--r-- | security/integrity/ima/ima_main.c | 7 |
2 files changed, 7 insertions, 4 deletions
diff --git a/kernel/module.c b/kernel/module.c index 1b95525cd4a502..38802de8b3e851 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2803,9 +2803,7 @@ static int module_sig_check(struct load_info *info, int flags, if (sig_enforce) { pr_notice("%s is rejected\n", reason); return -EKEYREJECTED; - } - - if (can_do_ima_check && is_ima_appraise_enabled()) + } else if (can_do_ima_check && is_ima_appraise_enabled()) return 0; if (kernel_is_locked_down(reason)) return -EPERM; diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index dca44cf7838ead..e4ecf0eafa4796 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -467,6 +467,7 @@ static int read_idmap[READING_MAX_ID] = { int ima_post_read_file(struct file *file, void *buf, loff_t size, enum kernel_read_file_id read_id) { + bool sig_enforce = is_module_sig_enforced(); enum ima_hooks func; u32 secid; @@ -477,7 +478,11 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, return 0; } - if (!file && read_id == READING_MODULE) /* MODULE_SIG_FORCE enabled */ + /* + * If both IMA-appraisal and appended signature verification are + * enabled, rely on the appended signature verification. + */ + if (sig_enforce && read_id == READING_MODULE) return 0; /* permit signed certs */ |