summaryrefslogtreecommitdiff
path: root/include/linux/ima.h
diff options
context:
space:
mode:
authorEric Richter <erichte@linux.ibm.com>2018-10-09 23:00:37 +0530
committerMimi Zohar <zohar@linux.ibm.com>2018-12-11 07:13:41 -0500
commitd958083a8f6408e76850bc7394976050d7e43173 (patch)
tree3d28df0a128bec514ed7ab644f909e3c2aea44c6 /include/linux/ima.h
parent6191706246de99ff2fac4b6f157f20205a0943cd (diff)
x86/ima: define arch_get_ima_policy() for x86
On x86, there are two methods of verifying a kexec'ed kernel image signature being loaded via the kexec_file_load syscall - an architecture specific implementaton or a IMA KEXEC_KERNEL_CHECK appraisal rule. Neither of these methods verify the kexec'ed kernel image signature being loaded via the kexec_load syscall. Secure boot enabled systems require kexec images to be signed. Therefore, this patch loads an IMA KEXEC_KERNEL_CHECK policy rule on secure boot enabled systems not configured with CONFIG_KEXEC_VERIFY_SIG enabled. When IMA_APPRAISE_BOOTPARAM is configured, different IMA appraise modes (eg. fix, log) can be specified on the boot command line, allowing unsigned or invalidly signed kernel images to be kexec'ed. This patch permits enabling IMA_APPRAISE_BOOTPARAM or IMA_ARCH_POLICY, but not both. Signed-off-by: Eric Richter <erichte@linux.ibm.com> Signed-off-by: Nayna Jain <nayna@linux.ibm.com> Cc: David Howells <dhowells@redhat.com> Cc: Eric Biederman <ebiederm@xmission.com> Cc: Peter Jones <pjones@redhat.com> Cc: Vivek Goyal <vgoyal@redhat.com> Cc: Dave Young <dyoung@redhat.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'include/linux/ima.h')
-rw-r--r--include/linux/ima.h3
1 files changed, 2 insertions, 1 deletions
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 62c5241b0899..5ab9134d4fd7 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -32,17 +32,18 @@ extern void ima_add_kexec_buffer(struct kimage *image);
#ifdef CONFIG_X86
extern bool arch_ima_get_secureboot(void);
+extern const char * const *arch_get_ima_policy(void);
#else
static inline bool arch_ima_get_secureboot(void)
{
return false;
}
-#endif
static inline const char * const *arch_get_ima_policy(void)
{
return NULL;
}
+#endif
#else
static inline int ima_bprm_check(struct linux_binprm *bprm)