Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorri...

Pull intgrity updates from James Morris:
 "This contains just three patches, the remainder were either included
  in other pull requests (eg. audit, lockdown) or will be upstreamed via
  other subsystems (eg. kselftests, Power).

  Included here is one bug fix, one documentation update, and extending
  the x86 IMA arch policy rules to coordinate the different kernel
  module signature verification methods"

* 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  doc/kernel-parameters.txt: Deprecate ima_appraise_tcb
  x86/ima: add missing include
  x86/ima: require signed kernel modules

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index fd03e2b629bbcfda55847e0cddd973bdd7b3a708..a1fe7e8c4f1542d5d6574574dc161f0f335920ec 100644 (file)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1588,7 +1588,7 @@
                        Format: { "off" | "enforce" | "fix" | "log" }
                        default: "enforce"
 
-       ima_appraise_tcb [IMA]
+       ima_appraise_tcb [IMA] Deprecated.  Use ima_policy= instead.
                        The builtin appraise policy appraises all files
                        owned by uid=0.
 
@@ -1615,8 +1615,7 @@
                        uid=0.
 
                        The "appraise_tcb" policy appraises the integrity of
-                       all files owned by root. (This is the equivalent
-                       of ima_appraise_tcb.)
+                       all files owned by root.
 
                        The "secure_boot" policy appraises the integrity
                        of files (eg. kexec kernel image, kernel modules,

diff --git a/arch/x86/kernel/ima_arch.c b/arch/x86/kernel/ima_arch.c
index e47cd9390ab4e417b4c151274d806be446c72585..85de790583f9afab967a79314420dfce679173c4 100644 (file)
--- a/arch/x86/kernel/ima_arch.c
+++ b/arch/x86/kernel/ima_arch.c
@@ -3,6 +3,7 @@
  * Copyright (C) 2018 IBM Corporation
  */
 #include <linux/efi.h>
+#include <linux/module.h>
 #include <linux/ima.h>
 
 extern struct boot_params boot_params;
@@ -64,12 +65,19 @@ static const char * const sb_arch_rules[] = {
        "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig",
 #endif /* CONFIG_KEXEC_VERIFY_SIG */
        "measure func=KEXEC_KERNEL_CHECK",
+#if !IS_ENABLED(CONFIG_MODULE_SIG)
+       "appraise func=MODULE_CHECK appraise_type=imasig",
+#endif
+       "measure func=MODULE_CHECK",
        NULL
 };
 
 const char * const *arch_get_ima_policy(void)
 {
-       if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot())
+       if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
+               if (IS_ENABLED(CONFIG_MODULE_SIG))
+                       set_module_sig_enforced();
                return sb_arch_rules;
+       }
        return NULL;
 }

diff --git a/include/linux/module.h b/include/linux/module.h
index 484b5cbb341055a93d7419d791ada7d744d1a8ac..8f75277d4cef2003236eb2072bf13ad26e3e2c97 100644 (file)
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -677,6 +677,7 @@ static inline bool is_livepatch_module(struct module *mod)
 #endif /* CONFIG_LIVEPATCH */
 
 bool is_module_sig_enforced(void);
+void set_module_sig_enforced(void);
 
 #else /* !CONFIG_MODULES... */
 
@@ -803,6 +804,10 @@ static inline bool is_module_sig_enforced(void)
        return false;
 }
 
+static inline void set_module_sig_enforced(void)
+{
+}
+
 /* Dereference module function descriptor */
 static inline
 void *dereference_module_function_descriptor(struct module *mod, void *ptr)

diff --git a/kernel/module.c b/kernel/module.c
index a9020bdd4cf6bddcb666583d91a02875204557d3..a9e1e7f2c224927a7fa997bb73b4fbb79933cbb6 100644 (file)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -290,6 +290,11 @@ bool is_module_sig_enforced(void)
 }
 EXPORT_SYMBOL(is_module_sig_enforced);
 
+void set_module_sig_enforced(void)
+{
+       sig_enforce = true;
+}
+
 /* Block module loading/unloading? */
 int modules_disabled = 0;
 core_param(nomodule, modules_disabled, bint, 0);