| Message ID | 20230703115442.129725-1-coxu@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | ima: require signed IMA policy when UEFI secure boot is enabled | expand |
On Mon, 2023-07-03 at 19:54 +0800, Coiby Xu wrote: > With the introduction of the .machine keyring for UEFI-based systems, > users are able to add custom CAs keys via MOK. This allow users to sign > their own IMA polices. For the sake of security, mandate signed IMA > policy when UEFI secure boot is enabled. > > Suggested-by: Mimi Zohar <zohar@linux.ibm.com> > Signed-off-by: Coiby Xu <coxu@redhat.com> > --- > security/integrity/ima/ima_efi.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c > index 9db66fe310d4..bb2881759505 100644 > --- a/security/integrity/ima/ima_efi.c > +++ b/security/integrity/ima/ima_efi.c > @@ -58,6 +58,9 @@ static const char * const sb_arch_rules[] = { > #if !IS_ENABLED(CONFIG_MODULE_SIG) > "appraise func=MODULE_CHECK appraise_type=imasig", > #endif > +#if IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && IS_ENABLED(CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY) > + "appraise func=POLICY_CHECK appraise_type=imasig", > +#endif /* CONFIG_INTEGRITY_MACHINE_KEYRING && IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY */ > "measure func=MODULE_CHECK", > NULL > }; Thanks, Coiby. Using IS_ENABLED() is not wrong, but unnecessary. IS_BUILTIN() suffices.
On Tue, Jul 04, 2023 at 08:57:10AM -0400, Mimi Zohar wrote: >On Mon, 2023-07-03 at 19:54 +0800, Coiby Xu wrote: >> With the introduction of the .machine keyring for UEFI-based systems, >> users are able to add custom CAs keys via MOK. This allow users to sign >> their own IMA polices. For the sake of security, mandate signed IMA >> policy when UEFI secure boot is enabled. >> >> Suggested-by: Mimi Zohar <zohar@linux.ibm.com> >> Signed-off-by: Coiby Xu <coxu@redhat.com> >> --- >> security/integrity/ima/ima_efi.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c >> index 9db66fe310d4..bb2881759505 100644 >> --- a/security/integrity/ima/ima_efi.c >> +++ b/security/integrity/ima/ima_efi.c >> @@ -58,6 +58,9 @@ static const char * const sb_arch_rules[] = { >> #if !IS_ENABLED(CONFIG_MODULE_SIG) >> "appraise func=MODULE_CHECK appraise_type=imasig", >> #endif >> +#if IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && IS_ENABLED(CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY) >> + "appraise func=POLICY_CHECK appraise_type=imasig", >> +#endif /* CONFIG_INTEGRITY_MACHINE_KEYRING && IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY */ >> "measure func=MODULE_CHECK", >> NULL >> }; > >Thanks, Coiby. You are welcome! > >Using IS_ENABLED() is not wrong, but unnecessary. IS_BUILTIN() >suffices. Thanks for the reminding! When I was going to apply this suggestion, I noticed ima_efi.c uses IS_ENABLED for all configuration items i.e. CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG which are all of bool type. Would you like me to switch all IS_ENABLEs to IS_BUILTIN or still use IS_ENABLED? While IS_BUILTIN is exclusively for bool type, it's not as intuitive as IS_ENABLED. So it's not easy for me to make a choice. > >-- >thanks, > >Mimi >
On Fri, 2023-07-14 at 09:29 +0800, Coiby Xu wrote: > On Tue, Jul 04, 2023 at 08:57:10AM -0400, Mimi Zohar wrote: > >On Mon, 2023-07-03 at 19:54 +0800, Coiby Xu wrote: > >> With the introduction of the .machine keyring for UEFI-based systems, > >> users are able to add custom CAs keys via MOK. This allow users to sign > >> their own IMA polices. For the sake of security, mandate signed IMA > >> policy when UEFI secure boot is enabled. > >> > >> Suggested-by: Mimi Zohar <zohar@linux.ibm.com> > >> Signed-off-by: Coiby Xu <coxu@redhat.com> With commit 099f26f22f58 ("integrity: machine keyring CA configuration") it is now possible to require signed IMA policies without having to recompile the kernel. Please note this change might affect existing users/tests. > >> --- > >> security/integrity/ima/ima_efi.c | 3 +++ > >> 1 file changed, 3 insertions(+) > >> > >> diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c > >> index 9db66fe310d4..bb2881759505 100644 > >> --- a/security/integrity/ima/ima_efi.c > >> +++ b/security/integrity/ima/ima_efi.c > >> @@ -58,6 +58,9 @@ static const char * const sb_arch_rules[] = { > >> #if !IS_ENABLED(CONFIG_MODULE_SIG) > >> "appraise func=MODULE_CHECK appraise_type=imasig", > >> #endif > >> +#if IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && IS_ENABLED(CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY) > >> + "appraise func=POLICY_CHECK appraise_type=imasig", > >> +#endif /* CONFIG_INTEGRITY_MACHINE_KEYRING && IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY */ > >> "measure func=MODULE_CHECK", > >> NULL > >> }; > > > >Thanks, Coiby. > > You are welcome! > > > > >Using IS_ENABLED() is not wrong, but unnecessary. IS_BUILTIN() > >suffices. > > Thanks for the reminding! When I was going to apply this suggestion, I > noticed ima_efi.c uses IS_ENABLED for all configuration items i.e. > CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG which are all of bool type. Would > you like me to switch all IS_ENABLEs to IS_BUILTIN or still use > IS_ENABLED? While IS_BUILTIN is exclusively for bool type, it's not as > intuitive as IS_ENABLED. So it's not easy for me to make a choice. Sure, for consistency with the other rules IS_ENABLED is fine. thanks, Mimi
diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c index 9db66fe310d4..bb2881759505 100644 --- a/security/integrity/ima/ima_efi.c +++ b/security/integrity/ima/ima_efi.c @@ -58,6 +58,9 @@ static const char * const sb_arch_rules[] = { #if !IS_ENABLED(CONFIG_MODULE_SIG) "appraise func=MODULE_CHECK appraise_type=imasig", #endif +#if IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && IS_ENABLED(CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY) + "appraise func=POLICY_CHECK appraise_type=imasig", +#endif /* CONFIG_INTEGRITY_MACHINE_KEYRING && IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY */ "measure func=MODULE_CHECK", NULL };
With the introduction of the .machine keyring for UEFI-based systems, users are able to add custom CAs keys via MOK. This allow users to sign their own IMA polices. For the sake of security, mandate signed IMA policy when UEFI secure boot is enabled. Suggested-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Coiby Xu <coxu@redhat.com> --- security/integrity/ima/ima_efi.c | 3 +++ 1 file changed, 3 insertions(+)