| Message ID | 20210215102305.10722-1-michael.weiss@aisec.fraunhofer.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | integrity/ima: Provide Kconfig option for ima-modsig template | expand |
Hi Michael, On Mon, 2021-02-15 at 11:23 +0100, Michael Weiß wrote: > 'ima-modsig' was not in the list of selectable templates in Kconfig. > The missing Kconfig options were added to support the ima-modsig > template as default template. > > Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> Since 'ima-modsig' is only needed for appended signatures (e.g. kexec kernel image on powerpc, kernel modules) a per policy rule "template=" option was defined. There's also the 'ima_template=' boot command line option. Between these two options, I didn't see the need for making it a build time default option. Do you? The patch itself looks good. thanks, Mimi > --- > security/integrity/ima/Kconfig | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > index 12e9250c1bec..32b9325f49bf 100644 > --- a/security/integrity/ima/Kconfig > +++ b/security/integrity/ima/Kconfig > @@ -78,6 +78,8 @@ choice > bool "ima-ng (default)" > config IMA_SIG_TEMPLATE > bool "ima-sig" > + config IMA_MODSIG_TEMPLATE > + bool "ima-modsig" > endchoice > > config IMA_DEFAULT_TEMPLATE > @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE > default "ima" if IMA_TEMPLATE > default "ima-ng" if IMA_NG_TEMPLATE > default "ima-sig" if IMA_SIG_TEMPLATE > + default "ima-modsig" if IMA_MODSIG_TEMPLATE > > choice > prompt "Default integrity hash algorithm"
Hi Mimi, On Mon, 2021-02-15 at 08:26 -0500, Mimi Zohar wrote: > Hi Michael, > > On Mon, 2021-02-15 at 11:23 +0100, Michael Weiß wrote: > > 'ima-modsig' was not in the list of selectable templates in Kconfig. > > The missing Kconfig options were added to support the ima-modsig > > template as default template. > > > > Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> > > Since 'ima-modsig' is only needed for appended signatures (e.g. kexec > kernel image on powerpc, kernel modules) a per policy rule "template=" > option was defined. There's also the 'ima_template=' boot command line > option. Between these two options, I didn't see the need for making > it a build time default option. Do you? The use-case I had in mind was a simple measured boot, no user-space applications, only to measure already signed modules which are already signed by modsig using a single policy line: measure func=MODULE_CHECK I thought for this purpose, we could just compile in the default template to be modsig but it wasn't selectable. I have overlooked the policy rule "template=", In the above use-case, it also just works to set the policy: measure func=MODULE_CHECK template=ima-modsig So, your are right maybe that is not necessary. Regards, Michael > > The patch itself looks good. > > thanks, > > Mimi > > > --- > > security/integrity/ima/Kconfig | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > > index 12e9250c1bec..32b9325f49bf 100644 > > --- a/security/integrity/ima/Kconfig > > +++ b/security/integrity/ima/Kconfig > > @@ -78,6 +78,8 @@ choice > > bool "ima-ng (default)" > > config IMA_SIG_TEMPLATE > > bool "ima-sig" > > + config IMA_MODSIG_TEMPLATE > > + bool "ima-modsig" > > endchoice > > > > config IMA_DEFAULT_TEMPLATE > > @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE > > default "ima" if IMA_TEMPLATE > > default "ima-ng" if IMA_NG_TEMPLATE > > default "ima-sig" if IMA_SIG_TEMPLATE > > + default "ima-modsig" if IMA_MODSIG_TEMPLATE > > > > choice > > prompt "Default integrity hash algorithm" > >
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 12e9250c1bec..32b9325f49bf 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -78,6 +78,8 @@ choice bool "ima-ng (default)" config IMA_SIG_TEMPLATE bool "ima-sig" + config IMA_MODSIG_TEMPLATE + bool "ima-modsig" endchoice config IMA_DEFAULT_TEMPLATE @@ -86,6 +88,7 @@ config IMA_DEFAULT_TEMPLATE default "ima" if IMA_TEMPLATE default "ima-ng" if IMA_NG_TEMPLATE default "ima-sig" if IMA_SIG_TEMPLATE + default "ima-modsig" if IMA_MODSIG_TEMPLATE choice prompt "Default integrity hash algorithm"
'ima-modsig' was not in the list of selectable templates in Kconfig. The missing Kconfig options were added to support the ima-modsig template as default template. Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> --- security/integrity/ima/Kconfig | 3 +++ 1 file changed, 3 insertions(+)