diff options
| author |   Nayna Jain <nayna@linux.ibm.com> | 2020-05-01 10:16:52 -0400 |
|---|---|---|
| committer |   Michael Ellerman <mpe@ellerman.id.au> | 2020-05-07 17:25:54 +1000 |
| commit | fa4f3f56ccd28ac031ab275e673ed4098855fed4 (patch) | |
| tree | 82f32d7e2dc20a7ed61c556e6831627ec3ed0e73 /tools/perf/scripts/python/export-to-postgresql.py | |
| parent | powerpc/64s/kuap: Restore AMR in fast_interrupt_return (diff) | |
| download | wireguard-linux-fa4f3f56ccd28ac031ab275e673ed4098855fed4.tar.xz wireguard-linux-fa4f3f56ccd28ac031ab275e673ed4098855fed4.zip | |
powerpc/ima: Fix secure boot rules in ima arch policy
To prevent verifying the kernel module appended signature
twice (finit_module), once by the module_sig_check() and again by IMA,
powerpc secure boot rules define an IMA architecture specific policy
rule only if CONFIG_MODULE_SIG_FORCE is not enabled. This,
unfortunately, does not take into account the ability of enabling
"sig_enforce" on the boot command line (module.sig_enforce=1).
Including the IMA module appraise rule results in failing the
finit_module syscall, unless the module signing public key is loaded
onto the IMA keyring.
This patch fixes secure boot policy rules to be based on
CONFIG_MODULE_SIG instead.
Fixes: 4238fad366a6 ("powerpc/ima: Add support to initialize ima policy rules")
Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Link: https://lore.kernel.org/r/1588342612-14532-1-git-send-email-nayna@linux.ibm.com
Diffstat (limited to 'tools/perf/scripts/python/export-to-postgresql.py')
0 files changed, 0 insertions, 0 deletions