redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity 

Pull integrity updates from Mimi Zohar:
 "Just a couple of updates for linux-5.7:

   - A new Kconfig option to enable IMA architecture specific runtime
     policy rules needed for secure and/or trusted boot, as requested.

   - Some message cleanup (eg. pr_fmt, additional error messages)"

* 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: add a new CONFIG for loading arch-specific policies
  integrity: Remove duplicate pr_fmt definitions
  IMA: Add log statements for failure conditions
  IMA: Update KBUILD_MODNAME for IMA files to ima
alistair/sensors
Linus Torvalds 2020-04-02 14:49:46 -07:00
parent 6cad420cc6 9e2b4be377
commit 7f218319ca
25 changed files with 25 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
arch/powerpc/Kconfig
View File

@ -980,6 +980,7 @@ config PPC_SECURE_BOOT
bool
depends on PPC_POWERNV
depends on IMA_ARCH_POLICY
imply IMA_SECURE_AND_OR_TRUSTED_BOOT
help
Systems with firmware secure boot enabled need to define security
policies to extend secure boot to the OS. This config allows a user

1
arch/s390/Kconfig
View File

@ -195,6 +195,7 @@ config S390
select ARCH_HAS_FORCE_DMA_UNENCRYPTED
select SWIOTLB
select GENERIC_ALLOCATOR
imply IMA_SECURE_AND_OR_TRUSTED_BOOT
config SCHED_OMIT_FRAME_POINTER

2
arch/s390/kernel/Makefile
View File

@ -70,7 +70,7 @@ obj-$(CONFIG_JUMP_LABEL) += jump_label.o
obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o
obj-$(CONFIG_KEXEC_FILE) += kexec_elf.o
obj-$(CONFIG_IMA) += ima_arch.o
obj-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT) += ima_arch.o
obj-$(CONFIG_PERF_EVENTS) += perf_event.o perf_cpum_cf_common.o
obj-$(CONFIG_PERF_EVENTS) += perf_cpum_cf.o perf_cpum_sf.o

1
arch/x86/Kconfig
View File

@ -230,6 +230,7 @@ config X86
select VIRT_TO_BUS
select X86_FEATURE_NAMES if PROC_FS
select PROC_PID_ARCH_STATUS if PROC_FS
imply IMA_SECURE_AND_OR_TRUSTED_BOOT if EFI
config INSTRUCTION_DECODER
def_bool y

4
arch/x86/kernel/Makefile
View File

@ -155,6 +155,4 @@ ifeq ($(CONFIG_X86_64),y)
obj-y += vsmp_64.o
endif
ifdef CONFIG_EFI
obj-$(CONFIG_IMA) += ima_arch.o
endif
obj-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT) += ima_arch.o

3
include/linux/ima.h
View File

@ -30,8 +30,7 @@ extern void ima_kexec_cmdline(const void *buf, int size);
extern void ima_add_kexec_buffer(struct kimage *image);
#endif
#if (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390) \
|| defined(CONFIG_PPC_SECURE_BOOT)
#ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
extern bool arch_ima_get_secureboot(void);
extern const char * const *arch_get_ima_policy(void);
#else

2
security/integrity/digsig.c
View File

@ -6,8 +6,6 @@
* Dmitry Kasatkin <dmitry.kasatkin@intel.com>
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/err.h>
#include <linux/sched.h>
#include <linux/slab.h>

2
security/integrity/digsig_asymmetric.c
View File

@ -6,8 +6,6 @@
* Dmitry Kasatkin <dmitry.kasatkin@intel.com>
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/err.h>
#include <linux/ratelimit.h>
#include <linux/key-type.h>

2
security/integrity/evm/evm_crypto.c
View File

@ -10,8 +10,6 @@
* Using root's kernel master key (kmk), calculate the HMAC
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/export.h>
#include <linux/crypto.h>
#include <linux/xattr.h>

2
security/integrity/evm/evm_main.c
View File

@ -11,8 +11,6 @@
* evm_inode_removexattr, and evm_verifyxattr
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/init.h>
#include <linux/crypto.h>
#include <linux/audit.h>

2
security/integrity/evm/evm_secfs.c
View File

@ -10,8 +10,6 @@
* - Get the key and enable EVM
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/audit.h>
#include <linux/uaccess.h>
#include <linux/init.h>

7
security/integrity/ima/Kconfig
View File

@ -327,3 +327,10 @@ config IMA_QUEUE_EARLY_BOOT_KEYS
depends on IMA_MEASURE_ASYMMETRIC_KEYS
depends on SYSTEM_TRUSTED_KEYRING
default y
config IMA_SECURE_AND_OR_TRUSTED_BOOT
bool
depends on IMA_ARCH_POLICY
help
This option is selected by architectures to enable secure and/or
trusted boot based on IMA runtime policies.

6
security/integrity/ima/Makefile
View File

@ -11,6 +11,6 @@ ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o
ima-$(CONFIG_IMA_APPRAISE_MODSIG) += ima_modsig.o
ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o
obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o
obj-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o
obj-$(CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS) += ima_queue_keys.o
ima-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o
ima-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o
ima-$(CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS) += ima_queue_keys.o

2
security/integrity/ima/ima_asymmetric_keys.c
View File

@ -9,8 +9,6 @@
* create or update.
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <keys/asymmetric-type.h>
#include "ima.h"

2
security/integrity/ima/ima_crypto.c
View File

@ -10,8 +10,6 @@
* Calculates md5/sha1 file hash, template hash, boot-aggreate hash
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/kernel.h>
#include <linux/moduleparam.h>
#include <linux/ratelimit.h>

2
security/integrity/ima/ima_fs.c
View File

@ -12,8 +12,6 @@
* current measurement list and IMA statistics
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/fcntl.h>
#include <linux/slab.h>
#include <linux/init.h>

2
security/integrity/ima/ima_init.c
View File

@ -11,8 +11,6 @@
* initialization and cleanup functions
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/init.h>
#include <linux/scatterlist.h>
#include <linux/slab.h>

1
security/integrity/ima/ima_kexec.c
View File

@ -6,7 +6,6 @@
* Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
* Mimi Zohar <zohar@linux.vnet.ibm.com>
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/seq_file.h>
#include <linux/vmalloc.h>

5
security/integrity/ima/ima_main.c
View File

@ -15,8 +15,6 @@
* and ima_file_check.
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/file.h>
#include <linux/binfmts.h>
@ -757,6 +755,9 @@ void process_buffer_measurement(const void *buf, int size,
ima_free_template_entry(entry);
out:
if (ret < 0)
pr_devel("%s: failed, result: %d\n", __func__, ret);
return;
}

2
security/integrity/ima/ima_policy.c
View File

@ -7,8 +7,6 @@
* - initialize default measure policy rules
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/init.h>
#include <linux/list.h>
#include <linux/fs.h>

2
security/integrity/ima/ima_queue.c
View File

@ -15,8 +15,6 @@
* ever removed or changed during the boot-cycle.
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/rculist.h>
#include <linux/slab.h>
#include "ima.h"

2
security/integrity/ima/ima_queue_keys.c
View File

@ -8,8 +8,6 @@
* Enables deferred processing of keys
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/workqueue.h>
#include <keys/asymmetric-type.h>
#include "ima.h"

2
security/integrity/ima/ima_template.c
View File

@ -9,8 +9,6 @@
* Helpers to manage template descriptors.
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/rculist.h>
#include "ima.h"
#include "ima_template_lib.h"

2
security/integrity/ima/ima_template_lib.c
View File

@ -9,8 +9,6 @@
* Library of supported template fields.
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include "ima_template_lib.h"
static bool ima_template_hash_algo_allowed(u8 algo)

6
security/integrity/integrity.h
View File

@ -6,6 +6,12 @@
* Mimi Zohar <zohar@us.ibm.com>
*/
#ifdef pr_fmt
#undef pr_fmt
#endif
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/types.h>
#include <linux/integrity.h>
#include <crypto/sha.h>