linux-kernel - Re: [PATCH 07/27] kexec_file: Disable at runtime if securelevel has been set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1509364900.3583.54.camel@linux.vnet.ibm.com>
Date:   Mon, 30 Oct 2017 08:01:40 -0400
From:   Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:     David Howells <dhowells@...hat.com>
Cc:     joeyli <jlee@...e.com>, linux-security-module@...r.kernel.org,
        gnomes@...rguk.ukuu.org.uk, linux-efi@...r.kernel.org,
        matthew.garrett@...ula.com, gregkh@...uxfoundation.org,
        linux-kernel@...r.kernel.org, jforbes@...hat.com
Subject: Re: [PATCH 07/27] kexec_file: Disable at runtime if securelevel has
 been set

On Mon, 2017-10-30 at 09:00 +0000, David Howells wrote:
> Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:
> 
> > Yes, that works.  Thanks!  Remember is_ima_appraise_enabled() is
> > dependent on the "ima: require secure_boot rules in lockdown mode"
> > patch - http://kernsec.org/pipermail/linux-security-module-archive/201
> > 7-October/003910.html.
> 
> What happens if the file in question is being accessed from a filesystem that
> doesn't have xattrs and doesn't provide support for appraisal?  Is it rejected
> outright or just permitted?

IMA-appraisal returns -EACCES for any error, including lack of xattr
support.

Thiago Bauermann posted the "Appended signatures support for IMA
appraisal" patch set.  This patch set allows the current kernel module
appended signature format to be used for verifying the kernel image.
 Once that patch set is upstreamed, we'll be able to update the IMA
"secure_boot" policy to permit appended signatures.

Mimi