| Message ID | 20200108003647.2472-1-nramas@linux.microsoft.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | IMA: Defined CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS to enable IMA hook to measure keys | expand |
The subject line is too long. How about "IMA: fix measuring asymmetric keys Kconfig"? On Tue, 2020-01-07 at 16:36 -0800, Lakshmi Ramasubramanian wrote: > CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is a tristate and not a bool. > If this config is set to "=m", ima_asymmetric_keys.c is built > as a kernel module when it is actually not. Simplify the wording by removing the unnecessary "not a bool" and "when it is actually not". > > Defined a new config CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS that is > defined when CONFIG_IMA and CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE > are defined. How about using James wording - "intermediate boolean config variable"? > Asymmetric key structure is defined only when > CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is defined. Since the IMA hook > measures asymmetric keys, the IMA hook is defined in > ima_asymmetric_keys.c which is built only if > CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS is defined. > > Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Please include a "Suggested-by:" tag for James. thanks, Mimi
diff --git a/include/linux/ima.h b/include/linux/ima.h index 3b89136bc218..f4644c54f648 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -101,7 +101,7 @@ static inline void ima_add_kexec_buffer(struct kimage *image) {} #endif -#if defined(CONFIG_IMA) && defined(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) +#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS extern void ima_post_key_create_or_update(struct key *keyring, struct key *key, const void *payload, size_t plen, @@ -113,7 +113,7 @@ static inline void ima_post_key_create_or_update(struct key *keyring, size_t plen, unsigned long flags, bool create) {} -#endif /* CONFIG_IMA && CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE */ +#endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */ #ifdef CONFIG_IMA_APPRAISE extern bool is_ima_appraise_enabled(void); diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 838476d780e5..355754a6b6ca 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -310,3 +310,9 @@ config IMA_APPRAISE_SIGNED_INIT default n help This option requires user-space init to be signed. + +config IMA_MEASURE_ASYMMETRIC_KEYS + bool + depends on IMA + depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y + default y diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile index 207a0a9eb72c..3e9d0ad68c7b 100644 --- a/security/integrity/ima/Makefile +++ b/security/integrity/ima/Makefile @@ -12,4 +12,4 @@ ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o ima-$(CONFIG_IMA_APPRAISE_MODSIG) += ima_modsig.o ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o -obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += ima_asymmetric_keys.o +obj-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o
CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is a tristate and not a bool. If this config is set to "=m", ima_asymmetric_keys.c is built as a kernel module when it is actually not. Defined a new config CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS that is defined when CONFIG_IMA and CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE are defined. Asymmetric key structure is defined only when CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is defined. Since the IMA hook measures asymmetric keys, the IMA hook is defined in ima_asymmetric_keys.c which is built only if CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS is defined. Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Cc: David Howells <dhowells@redhat.com> Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reported-by: kbuild test robot <lkp@intel.com> # ima_asymmetric_keys.c is built as a kernel module when it is actually not. Fixes: 88e70da170e8 ("IMA: Define an IMA hook to measure keys") Fixes: cb1aa3823c92 ("KEYS: Call the IMA hook to measure keys") --- include/linux/ima.h | 4 ++-- security/integrity/ima/Kconfig | 6 ++++++ security/integrity/ima/Makefile | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-)