diff mbox

[v2,2/2] ima: check signature enforcement against cmdline param instead of CONFIG

Message ID 9fee5f63971c31870a345b2619251f23b4f7462e.1508776704.git.brdeoliv@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Bruno E. O. Meneguele Oct. 23, 2017, 4:43 p.m. UTC
When the user requests MODULE_CHECK policy and its kernel is compiled
with CONFIG_MODULE_SIG_FORCE not set, all modules would not load, just
those loaded in initram time. One option the user would have would be
set a kernel cmdline param (module.sig_enforce) to true, but the IMA
module check code doesn't rely on this value, it checks just

This patch solves this problem checking for the exported value of
module.sig_enforce cmdline param intead of CONFIG_MODULE_SIG_FORCE,
which holds the effective value (CONFIG || param).

Signed-off-by: Bruno E. O. Meneguele <brdeoliv@redhat.com>
 security/integrity/ima/ima_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


kernel test robot Oct. 24, 2017, 10:41 a.m. UTC | #1
Hi Bruno,

[auto build test ERROR on linus/master]
[also build test ERROR on v4.14-rc6 next-20171018]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Bruno-E-O-Meneguele/ima-change-how-MODULE_SIG_FORCE-is-checked-on-modules-checking-policy/20171024-105837
config: i386-randconfig-x0-10241354 (attached as .config)
compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901
        # save the attached .config to linux build tree
        make ARCH=i386 

All errors (new ones prefixed by >>):

   security/integrity/ima/ima_main.o: In function `ima_read_file':
>> ima_main.c:(.text+0x98e): undefined reference to `is_module_sig_enforced'

0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation
diff mbox


diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index e4ab8ef8016e..d11a7fcc5c8b 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -356,12 +356,12 @@  void ima_post_path_mknod(struct dentry *dentry)
 int ima_read_file(struct file *file, enum kernel_read_file_id read_id)
+	bool sig_enforce = is_module_sig_enforced();
 	if (!file && read_id == READING_MODULE) {
-		if ((ima_appraise & IMA_APPRAISE_MODULES) &&
+		if (!sig_enforce && (ima_appraise & IMA_APPRAISE_MODULES) &&
 		    (ima_appraise & IMA_APPRAISE_ENFORCE))
 		return 0;	/* We rely on module signature checking */
 	return 0;