Bruno Meneguele df6aeb5235 ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime ... commit 311aa6aafe upstream. The IMA_APPRAISE_BOOTPARAM config allows enabling different "ima_appraise=" modes - log, fix, enforce - at run time, but not when IMA architecture specific policies are enabled.  This prevents properly labeling the filesystem on systems where secure boot is supported, but not enabled on the platform.  Only when secure boot is actually enabled should these IMA appraise modes be disabled. This patch removes the compile time dependency and makes it a runtime decision, based on the secure boot state of that platform. Test results as follows: -> x86-64 with secure boot enabled [ 0.015637] Kernel command line: <...> ima_policy=appraise_tcb ima_appraise=fix [ 0.015668] ima: Secure boot enabled: ignoring ima_appraise=fix boot parameter option -> powerpc with secure boot disabled [ 0.000000] Kernel command line: <...> ima_policy=appraise_tcb ima_appraise=fix [ 0.000000] Secure boot mode disabled -> Running the system without secure boot and with both options set: CONFIG_IMA_APPRAISE_BOOTPARAM=y CONFIG_IMA_ARCH_POLICY=y Audit prompts "missing-hash" but still allow execution and, consequently, filesystem labeling: type=INTEGRITY_DATA msg=audit(07/09/2020 12:30:27.778:1691) : pid=4976 uid=root auid=root ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=appraise_data cause=missing-hash comm=bash name=/usr/bin/evmctl dev="dm-0" ino=493150 res=no Cc: stable@vger.kernel.org Fixes: d958083a8f ("x86/ima: define arch_get_ima_policy() for x86") Signed-off-by: Bruno Meneguele <bmeneg@redhat.com> Cc: stable@vger.kernel.org # 5.0 Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-08-11 15:33:41 +02:00
..
apparmor	apparmor: ensure that dfa state tables have entries	2020-07-22 09:33:05 +02:00
integrity	ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime	2020-08-11 15:33:41 +02:00
keys	mm: add kvfree_sensitive() for freeing sensitive data objects	2020-06-17 16:40:23 +02:00
loadpin	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
lockdown	lockdown: Allow unprivileged users to see lockdown status	2020-06-22 09:30:53 +02:00
safesetid	LSM: SafeSetID: Stop releasing uninitialized ruleset	2019-09-17 11:27:05 -07:00
selinux	selinux: fix double free	2020-06-24 17:50:48 +02:00
smack	Smack: fix use-after-free in smk_write_relabel_self()	2020-08-11 15:33:35 +02:00
tomoyo	tomoyo: Use atomic_t for statistics counter	2020-02-05 21:22:41 +00:00
yama	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
Kconfig	Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-09-28 08:14:15 -07:00
Kconfig.hardening	meminit fix	2019-07-28 12:33:15 -07:00
Makefile	security: Add a static lockdown policy LSM	2019-08-19 21:54:15 -07:00
commoncap.c	exec: Always set cap_ambient in cap_bprm_set_creds	2020-06-03 08:21:23 +02:00
device_cgroup.c	docs: cgroup-v1: add it to the admin-guide book	2019-07-15 11:03:02 -03:00
inode.c	Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-07-19 10:42:02 -07:00
lsm_audit.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-09-28 08:14:15 -07:00