From dd000cd2fd91c63e5b4d660ec4f44666a1779716 Mon Sep 17 00:00:00 2001 From: Laura Abbott Date: Thu, 3 Jan 2019 08:27:44 -0800 Subject: Linux v4.20-10911-g645ff1e8e704 Dropped part of the efi-lockdown patchset for IMA until conflicts get resolved. --- efi-lockdown.patch | 233 ----------------------------------------------------- 1 file changed, 233 deletions(-) (limited to 'efi-lockdown.patch') diff --git a/efi-lockdown.patch b/efi-lockdown.patch index 6347e5dc6..b858022dd 100644 --- a/efi-lockdown.patch +++ b/efi-lockdown.patch @@ -518,239 +518,6 @@ index f35ffdd096ad..2615669dbf03 100644 -- 2.14.3 -From 2d534703537af95f601d3bdab11ee6ba8b3bc2dc Mon Sep 17 00:00:00 2001 -From: Mimi Zohar -Date: Mon, 9 Apr 2018 09:52:45 +0100 -Subject: [PATCH 03/24] ima: require secure_boot rules in lockdown mode - -Require the "secure_boot" rules, whether or not it is specified -on the boot command line, for both the builtin and custom policies -in secure boot lockdown mode. - -Signed-off-by: Mimi Zohar -Signed-off-by: David Howells ---- - security/integrity/ima/ima_policy.c | 34 +++++++++++++++++++++++------ - 1 file changed, 27 insertions(+), 7 deletions(-) - -diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c -index 8c9499867c91..f8428f579924 100644 ---- a/security/integrity/ima/ima_policy.c -+++ b/security/integrity/ima/ima_policy.c -@@ -481,14 +481,21 @@ static int ima_appraise_flag(enum ima_hooks func) - */ - void __init ima_init_policy(void) - { -- int i, measure_entries, appraise_entries, secure_boot_entries; -+ int i; -+ int measure_entries = 0; -+ int appraise_entries = 0; -+ int secure_boot_entries = 0; -+ bool kernel_locked_down = __kernel_is_locked_down(NULL, false); - - /* if !ima_policy set entries = 0 so we load NO default rules */ -- measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0; -- appraise_entries = ima_use_appraise_tcb ? -- ARRAY_SIZE(default_appraise_rules) : 0; -- secure_boot_entries = ima_use_secure_boot ? -- ARRAY_SIZE(secure_boot_rules) : 0; -+ if (ima_policy) -+ measure_entries = ARRAY_SIZE(dont_measure_rules); -+ -+ if (ima_use_appraise_tcb) -+ appraise_entries = ARRAY_SIZE(default_appraise_rules); -+ -+ if (ima_use_secure_boot || kernel_locked_down) -+ secure_boot_entries = ARRAY_SIZE(secure_boot_rules); - - for (i = 0; i < measure_entries; i++) - list_add_tail(&dont_measure_rules[i].list, &ima_default_rules); -@@ -509,12 +516,25 @@ void __init ima_init_policy(void) - - /* - * Insert the builtin "secure_boot" policy rules requiring file -- * signatures, prior to any other appraise rules. -+ * signatures, prior to any other appraise rules. In secure boot -+ * lock-down mode, also require these appraise rules for custom -+ * policies. - */ - for (i = 0; i < secure_boot_entries; i++) { -+ struct ima_rule_entry *entry; -+ -+ /* Include for builtin policies */ - list_add_tail(&secure_boot_rules[i].list, &ima_default_rules); - temp_ima_appraise |= - ima_appraise_flag(secure_boot_rules[i].func); -+ -+ /* Include for custom policies */ -+ if (kernel_locked_down) { -+ entry = kmemdup(&secure_boot_rules[i], sizeof(*entry), -+ GFP_KERNEL); -+ if (entry) -+ list_add_tail(&entry->list, &ima_policy_rules); -+ } - } - - /* --- -2.17.1 - -From 980a380dc973c5a7745e4833aba368637a99df2e Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Mon, 9 Apr 2018 09:52:46 +0100 -Subject: [PATCH] Enforce module signatures if the kernel is locked down - -If the kernel is locked down, require that all modules have valid -signatures that we can verify or that IMA can validate the file. - -I have adjusted the errors generated: - - (1) If there's no signature (ENODATA) or we can't check it (ENOPKG, - ENOKEY), then: - - (a) If signatures are enforced then EKEYREJECTED is returned. - - (b) If IMA will have validated the image, return 0 (okay). - - (c) If there's no signature or we can't check it, but the kernel is - locked down then EPERM is returned (this is then consistent with - other lockdown cases). - - (2) If the signature is unparseable (EBADMSG, EINVAL), the signature fails - the check (EKEYREJECTED) or a system error occurs (eg. ENOMEM), we - return the error we got. - -Note that the X.509 code doesn't check for key expiry as the RTC might not -be valid or might not have been transferred to the kernel's clock yet. - -Signed-off-by: David Howells -Reviewed-by: Jiri Bohac -cc: "Lee, Chun-Yi" -cc: James Morris ---- - kernel/module.c | 56 +++++++++++++++++++++++++++++++++++++------------ - 1 file changed, 43 insertions(+), 13 deletions(-) - -diff --git a/kernel/module.c b/kernel/module.c -index b046a32520d8..3bb0722c106e 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -64,6 +64,7 @@ - #include - #include - #include -+#include - #include - #include "module-internal.h" - -@@ -2741,10 +2742,12 @@ static inline void kmemleak_load_module(const struct module *mod, - #endif - - #ifdef CONFIG_MODULE_SIG --static int module_sig_check(struct load_info *info, int flags) -+static int module_sig_check(struct load_info *info, int flags, -+ bool can_do_ima_check) - { -- int err = -ENOKEY; -+ int err = -ENODATA; - const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1; -+ const char *reason; - const void *mod = info->hdr; - - /* -@@ -2759,19 +2762,46 @@ static int module_sig_check(struct load_info *info, int flags) - err = mod_verify_sig(mod, info); - } - -- if (!err) { -+ switch (err) { -+ case 0: - info->sig_ok = true; - return 0; -- } - -- /* Not having a signature is only an error if we're strict. */ -- if (err == -ENOKEY && !is_module_sig_enforced()) -- err = 0; -+ /* We don't permit modules to be loaded into trusted kernels -+ * without a valid signature on them, but if we're not -+ * enforcing, certain errors are non-fatal. -+ */ -+ case -ENODATA: -+ reason = "Loading of unsigned module"; -+ goto decide; -+ case -ENOPKG: -+ reason = "Loading of module with unsupported crypto"; -+ goto decide; -+ case -ENOKEY: -+ reason = "Loading of module with unavailable key"; -+ decide: -+ if (sig_enforce) { -+ pr_notice("%s is rejected\n", reason); -+ return -EKEYREJECTED; -+ } - -- return err; -+ if (can_do_ima_check && is_ima_appraise_enabled()) -+ return 0; -+ if (kernel_is_locked_down(reason)) -+ return -EPERM; -+ return 0; -+ -+ /* All other errors are fatal, including nomem, unparseable -+ * signatures and signature check failures - even if signatures -+ * aren't required. -+ */ -+ default: -+ return err; -+ } - } - #else /* !CONFIG_MODULE_SIG */ --static int module_sig_check(struct load_info *info, int flags) -+static int module_sig_check(struct load_info *info, int flags, -+ bool can_do_ima_check) - { - return 0; - } -@@ -3620,7 +3650,7 @@ static int unknown_module_param_cb(char *param, char *val, const char *modname, - /* Allocate and load the module: note that size of section 0 is always - zero, and we rely on this for optional sections. */ - static int load_module(struct load_info *info, const char __user *uargs, -- int flags) -+ int flags, bool can_do_ima_check) - { - struct module *mod; - long err = 0; -@@ -3639,7 +3669,7 @@ static int load_module(struct load_info *info, const char __user *uargs, - goto free_copy; - } - -- err = module_sig_check(info, flags); -+ err = module_sig_check(info, flags, can_do_ima_check); - if (err) - goto free_copy; - -@@ -3834,7 +3864,7 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, - if (err) - return err; - -- return load_module(&info, uargs, 0); -+ return load_module(&info, uargs, 0, false); - } - - SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags) -@@ -3861,7 +3891,7 @@ SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags) - info.hdr = hdr; - info.len = size; - -- return load_module(&info, uargs, flags); -+ return load_module(&info, uargs, flags, true); - } - - static inline int within(unsigned long addr, void *start, unsigned long size) --- -2.17.1 - From 7948946e19294e7560c81b177b2788d21ed79f59 Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Mon, 9 Apr 2018 09:52:46 +0100 -- cgit