From 6c2abf8f4baafc00ced2a6140b5ef9260359107a Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Mon, 18 Feb 2019 12:44:58 +0000 Subject: [PATCH] ima: require secure_boot rules in lockdown mode Require the "secure_boot" rules, whether or not it is specified on the boot command line, for both the builtin and custom policies in secure boot lockdown mode. Signed-off-by: Mimi Zohar Signed-off-by: David Howells Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name 0003-ima-require-secure_boot-rules-in-lockdown-mode.patch --- security/integrity/ima/ima_policy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 6df7f641ff6..c411234e775 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -643,6 +643,7 @@ static int __init ima_init_arch_policy(void) void __init ima_init_policy(void) { int build_appraise_entries, arch_entries; + bool kernel_locked_down = __kernel_is_locked_down(NULL, false); /* if !ima_policy, we load NO default rules */ if (ima_policy) @@ -680,7 +681,7 @@ void __init ima_init_policy(void) * Insert the builtin "secure_boot" policy rules requiring file * signatures, prior to other appraise rules. */ - if (ima_use_secure_boot) + if (ima_use_secure_boot || kernel_locked_down) add_rules(secure_boot_rules, ARRAY_SIZE(secure_boot_rules), IMA_DEFAULT_POLICY); -- 2.30.2