On Tue, Jul 07, 2020 at 07:56:37PM -0400, Nayna wrote: > > On 7/3/20 2:00 PM, Bruno Meneguele wrote: > > APPRAISE_BOOTPARAM has been marked as dependent on !ARCH_POLICY in compile > > time, enforcing the appraisal whenever the kernel had the arch policy option > > enabled. > > > > However it breaks systems where the option is set but the system wasn't > > booted in a "secure boot" platform. In this scenario, anytime an appraisal > > policy (i.e. ima_policy=appraisal_tcb) is used it will be forced, giving no > > chance to the user set the 'fix' state (ima_appraise=fix) to actually > > measure system's files. > > "measure" is incorrect. It is appraisal. >
Yes, of course, sorry.
> How about changing the statement to "without giving the user the opportunity
> to label the filesystem, before enforcing integrity." ?
>
Ack.
That's better :)
> > diff --git a/security/integrity/ima/ima_appraise.c
> > b/security/integrity/ima/ima_appraise.c
> > index a9649b04b9f1..4fc83b3fbd5c 100644
> > --- a/security/integrity/ima/ima_appraise.c
> > +++ b/security/integrity/ima/ima_appraise.c
> > @@ -18,14 +18,16 @@
> > static int __init default_appraise_setup(char *str)
> > {
> > -#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
> > - if (strncmp(str, "off", 3) == 0)
> > - ima_appraise = 0;
> > - else if (strncmp(str, "log", 3) == 0)
> > - ima_appraise = IMA_APPRAISE_LOG;
> > - else if (strncmp(str, "fix", 3) == 0)
> > - ima_appraise = IMA_APPRAISE_FIX;
> > -#endif
> > + if (IS_ENABLED(CONFIG_IMA_APPRAISE_BOOTPARAM) &&
> > + !arch_ima_get_secureboot()) {
> > + if (strncmp(str, "off", 3) == 0)
> > + ima_appraise = 0;
> > + else if (strncmp(str, "log", 3) == 0)
> > + ima_appraise = IMA_APPRAISE_LOG;
> > + else if (strncmp(str, "fix", 3) == 0)
> > + ima_appraise = IMA_APPRAISE_FIX;
> > + }
> > +
> > return 1;
> > }
>
> If secureboot is enabled, it is silently ignoring the boot parameters. It
> would be helpful if there is a log message notifying user about that.
>
> Can you please Cc powerpc, s390, and x86 mailing list and maintainers, when
> you post the next version ?
>
> I would try to test it sometime in this week.
>
Sure. I'm preparing a new version and will post soon.
> Thanks & Regards,
>
Thank you.
--
bmeneg
PGP Key: http://bmeneg.com/pubkey.txt
signature.asc
Description: PGP signature
