Received: by 2002:ac0:8c9a:0:0:0:0:0 with SMTP id r26csp5244773ima; Tue, 5 Feb 2019 08:34:05 -0800 (PST) X-Google-Smtp-Source: AHgI3IYO7TEUVDGUZ5YH9PHxWkZFoRtwqpaNPyRt8ZeYdstt/Ap+28FGQnPJu1oj6cuCt3keEWHh X-Received: by 2002:a62:68c5:: with SMTP id d188mr6016708pfc.194.1549384445883; Tue, 05 Feb 2019 08:34:05 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1549384445; cv=none; d=google.com; s=arc-20160816; b=HNBgN4zQRxLEIORCiiIUBV93pkdblkMw1bBkLGO3YSm4NEeHHNn4zUgxzFF6y9MHJB sFXWuY0y9D12h0fzH43ELHW1NM7k3X/8Ev5Dzrh7hPLDS79srs8PN+F4XZa1uKn/QJV4 QQ+Q1OM5iUW3jmH37ZgqvIROikqX3IiKgix0CqzaEfnhTLoniQCX6dbZbhlRxdmAgTq2 73AcU9UeWbw2y5cx36jRL4fMQVosF6MpKspunxb+BIrxoSIAhEBbSDSDgmUsxxUGJlP6 vn9Alkgv1qEofwfIoGZG6I1nFcAbfc2HWn5XwZS6usqUKCpzWjfTnWurignf6BmVMYtL 9Zdg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:content-language :content-transfer-encoding:in-reply-to:mime-version:user-agent:date :from:references:cc:to:subject; bh=+WZ3JlaWbUHfR9ANNNR86NaJdZstf7/7gEiVQSAkyzw=; b=iiKbfM57L3LQRnhngPjUwX+aQgwdsbZ0r+pMl7c18BqXy31bh9H+/TdtDEF8liB4QU v10ofyakPgE0izzpetBSMq/BFX+B75/HE4Wzu54b1XZYULHQ0UYpwu3jPEQa6LrWBqGO 0RCD8YKw6k6fYp99nChP5XHPAvv8zZXxs8AnbhMsWCkmR3QGUszxZp7sbaDaRjyfq9eH xPjXF1g/wE23PyPgkKVPcv6dSAInD9V7mUnB0esJXVAwAQDxufrlDQHwTVc9Ybfm/mDu FEwhIEeXOna+WJpQDOCx0gXSNMwLyF2RcOAyGlTplMrtL971Is+1pRpPSlfC4LLG53Me jASA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id w11si2365870pfk.210.2019.02.05.08.33.48; Tue, 05 Feb 2019 08:34:05 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730391AbfBEQLB (ORCPT + 99 others); Tue, 5 Feb 2019 11:11:01 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:57508 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1730353AbfBEQLA (ORCPT ); Tue, 5 Feb 2019 11:11:00 -0500 Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x15GA1N3062564 for ; Tue, 5 Feb 2019 11:10:58 -0500 Received: from e31.co.us.ibm.com (e31.co.us.ibm.com [32.97.110.149]) by mx0b-001b2d01.pphosted.com with ESMTP id 2qfc1hdrd1-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 05 Feb 2019 11:10:57 -0500 Received: from localhost by e31.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 5 Feb 2019 16:10:56 -0000 Received: from b03cxnp08027.gho.boulder.ibm.com (9.17.130.19) by e31.co.us.ibm.com (192.168.1.131) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Tue, 5 Feb 2019 16:10:53 -0000 Received: from b03ledav006.gho.boulder.ibm.com (b03ledav006.gho.boulder.ibm.com [9.17.130.237]) by b03cxnp08027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id x15GAqXN16515146 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 5 Feb 2019 16:10:52 GMT Received: from b03ledav006.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 955D8C605D; Tue, 5 Feb 2019 16:10:52 +0000 (GMT) Received: from b03ledav006.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 159FEC605A; Tue, 5 Feb 2019 16:10:51 +0000 (GMT) Received: from swastik.ibm.com (unknown [9.85.201.117]) by b03ledav006.gho.boulder.ibm.com (Postfix) with ESMTP; Tue, 5 Feb 2019 16:10:50 +0000 (GMT) Subject: Re: [PATCH] x86/ima: require signed kernel modules To: Mimi Zohar , linux-integrity@vger.kernel.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Jessica Yu , Luis Chamberlain , David Howells , Seth Forshee , Justin Forbes , Matthew Garrett References: <1548962339-10681-1-git-send-email-zohar@linux.ibm.com> <1548962339-10681-2-git-send-email-zohar@linux.ibm.com> From: Nayna Date: Tue, 5 Feb 2019 11:10:49 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <1548962339-10681-2-git-send-email-zohar@linux.ibm.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-TM-AS-GCONF: 00 x-cbid: 19020516-8235-0000-0000-00000E56DD05 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00010542; HX=3.00000242; KW=3.00000007; PH=3.00000004; SC=3.00000279; SDB=6.01156712; UDB=6.00603406; IPR=6.00937236; MB=3.00025446; MTD=3.00000008; XFM=3.00000015; UTC=2019-02-05 16:10:56 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 19020516-8236-0000-0000-0000445A135F Message-Id: <422fd184-8766-4718-d302-db68ed7b90ec@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-02-05_07:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=937 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1902050124 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/31/2019 02:18 PM, Mimi Zohar wrote: > Require signed kernel modules on systems with secure boot mode enabled. > > To coordinate between appended kernel module signatures and IMA > signatures, only define an IMA MODULE_CHECK policy rule if > CONFIG_MODULE_SIG is not enabled. > > This patch defines a function named set_module_sig_required() and renames > is_module_sig_enforced() to is_module_sig_enforced_or_required(). The > call to set_module_sig_required() is dependent on CONFIG_IMA_ARCH_POLICY > being enabled. > > Signed-off-by: Mimi Zohar > --- > Reviewed-by: Nayna Jain Thanks & Regards,      - Nayna