On Mon, 2026-07-13 at 10:09 +0200, Enrico Bravi wrote: > This series aims to introduce integrity measurements when the IMA policy is > written on the securityfs file. > In particular, when a signed policy is not mandatory, it can be written > directly on the securityfs file. This allows to override the boot policy > at the first write, and append new policy rules at the subsequent writes (if > CONFIG_IMA_WRITE_POLICY=y). In this case new policy can be loaded > without being measured. > > The patch #1 introduces a new critical-data record for the newly loaded > policy. The measurement is performed over the textual representation of the > new policy once it becomes effective (after ima_update_policy()). As > suggested by Mimi, the new critical-data rule is added to the arch > specific policy rules (only when a signed policy is not mandatory). > > The patch #2, following what was suggested by Roberto, measures the input > buffer sent to the securityfs policy file, regardless of whether the new > policy will be accepted or not. This is done by calling > process_buffer_measurement(), enabling POLICY_CHECK in ima_match_rules() and > ima_match_rule_data() in order to catch it when 'measure func=POLICY_CHECK' > is defined (e.g., ima_policy=tcb). > > Changes in v6: > - Fixed a merge conflict. > - Initialized struct seq_file file. > - Fixed some lines longer than 80 characters. > - Moved from vmalloc() to kmalloc(). > - Corrected POLICY_CHECK behaviour in ima_match_rules().
Thanks, Enrico. The patches are now queued. Mimi
