From 9e67028e76514a8ee279d7d006dfb8069b5115ab Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Wed, 21 Feb 2018 11:36:32 -0500 Subject: ima: fail signature verification based on policy This patch addresses the fuse privileged mounted filesystems in environments which are unwilling to accept the risk of trusting the signature verification and want to always fail safe, but are for example using a pre-built kernel. This patch defines a new builtin policy named "fail_securely", which can be specified on the boot command line as an argument to "ima_policy=". Signed-off-by: Mimi Zohar Cc: Miklos Szeredi Cc: Seth Forshee Cc: Dongsu Park Cc: Alban Crequy Acked-by: Serge Hallyn Acked-by: "Eric W. Biederman" --- security/integrity/ima/ima_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'security/integrity/ima/ima_main.c') diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index f550f25294a3..5d122daf5c8a 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -238,7 +238,8 @@ static int process_measurement(struct file *file, const struct cred *cred, */ if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags) || ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) && - !(inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER))) { + !(inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER) && + !(action & IMA_FAIL_UNVERIFIABLE_SIGS))) { iint->flags &= ~IMA_DONE_MASK; iint->measured_pcrs = 0; } -- cgit v1.2.3-59-g8ed1b