diff options
| author | James Morris <james.morris@microsoft.com> | 2019-04-12 15:20:23 -0700 |
|---|---|---|
| committer | James Morris <james.morris@microsoft.com> | 2019-04-12 15:20:23 -0700 |
| commit | 2bfebea90dd5e8c57ae1021a5d1bb6c1057eee6d (patch) | |
| tree | e3abbdd39c488daec66a7c7b6d93e34b51145e54 /arch/x86 | |
| parent | fe9fd2ef383c2f5883fcd3f7adce0de9ce2556ff (diff) | |
| parent | 41475a3ebaceb270e47a77356ddc30960354cb00 (diff) | |
Merge branch 'next-integrity-for-james' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity into next-integrity
From Mimi:
"This pull request contains just three patches, the remainder are
either included in other pull requests (eg. audit, lockdown) or will
be upstreamed via other subsystems (eg. kselftests, Power). Included
in this pull request is one bug fix, one documentation update, and
extending the x86 IMA arch policy rules to coordinate the different
kernel module signature verification methods."
Diffstat (limited to 'arch/x86')
| -rw-r--r-- | arch/x86/kernel/ima_arch.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/arch/x86/kernel/ima_arch.c b/arch/x86/kernel/ima_arch.c index e47cd9390ab4..85de790583f9 100644 --- a/arch/x86/kernel/ima_arch.c +++ b/arch/x86/kernel/ima_arch.c @@ -3,6 +3,7 @@ * Copyright (C) 2018 IBM Corporation */ #include <linux/efi.h> +#include <linux/module.h> #include <linux/ima.h> extern struct boot_params boot_params; @@ -64,12 +65,19 @@ static const char * const sb_arch_rules[] = { "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig", #endif /* CONFIG_KEXEC_VERIFY_SIG */ "measure func=KEXEC_KERNEL_CHECK", +#if !IS_ENABLED(CONFIG_MODULE_SIG) + "appraise func=MODULE_CHECK appraise_type=imasig", +#endif + "measure func=MODULE_CHECK", NULL }; const char * const *arch_get_ima_policy(void) { - if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) { + if (IS_ENABLED(CONFIG_MODULE_SIG)) + set_module_sig_enforced(); return sb_arch_rules; + } return NULL; } |