Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 22 Jun 2020 16:21:12 -0300
From:   Bruno Meneguele <bmeneg@redhat.com>
To:     Nayna <nayna@linux.vnet.ibm.com>
Cc:     linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
        zohar@linux.ibm.com, erichte@linux.ibm.com, nayna@linux.ibm.com,
        stable@vger.kernel.org
Subject: Re: [PATCH v2] ima: move APPRAISE_BOOTPARAM dependency on
 ARCH_POLICY to runtime
Message-ID: <20200622192112.GB8956@glitch>
References: <20200622172754.10763-1-bmeneg@redhat.com>
 <043e52d4-6835-c2c4-bc9d-d36ddb3db0e9@linux.vnet.ibm.com>
MIME-Version: 1.0
In-Reply-To: <043e52d4-6835-c2c4-bc9d-d36ddb3db0e9@linux.vnet.ibm.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="s2ZSL+KKDSLx8OML"
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

--s2ZSL+KKDSLx8OML
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jun 22, 2020 at 03:01:27PM -0400, Nayna wrote:
>=20
> On 6/22/20 1:27 PM, Bruno Meneguele wrote:
> > IMA_APPRAISE_BOOTPARAM has been marked as dependent on !IMA_ARCH_POLICY=
 in
> > compile time, enforcing the appraisal whenever the kernel had the arch
> > policy option enabled.
> >=20
> > However it breaks systems where the option is actually set but the syst=
em
> > wasn't booted in a "secure boot" platform. In this scenario, anytime th=
e
> > an appraisal policy (i.e. ima_policy=3Dappraisal_tcb) is used it will b=
e
> > forced, giving no chance to the user set the 'fix' state (ima_appraise=
=3Dfix)
> > to actually measure system's files.
> >=20
> > This patch remove this compile time dependency and move it to a runtime
> > decision, based on the arch policy loading failure/success.
>=20
> Thanks for looking at this.
>=20
> For arch specific policies, kernel signature verification is enabled base=
d
> on the secure boot state of the system. Perhaps, enforce the appraisal as
> well based on if secure boot is enabled.
>=20
> Thanks & Regards,

That's a good point.

I'm going to take another look and see where the check fits better and
come back with a new patch(set).

Thanks Nayna.

--=20
bmeneg=20
PGP Key: http://bmeneg.com/pubkey.txt

--s2ZSL+KKDSLx8OML
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEdWo6nTbnZdbDmXutYdRkFR+RokMFAl7xBKgACgkQYdRkFR+R
okM+3gf/WklZhJKgeCkRvrX3iYG8I3bbB7Vve/pzDsKzG9dYjwuriAm4fN8Eoaa9
inXX10GjEZ4s+7bWDQUn++hiYVSG+tfYKvYQZLPa0AJBwar+m7VroeoyoV3W3vu6
GAo9FwHLB50n02qyEv1vwalBy59mazStcToTKDnLQQ6dRetAD/CzZHce5qLojYvS
R8GX28GhmyNPxERFrAn/0J72oK1nJV8MOfMrIjLlh8xryBrTM8uLsiPUgwsYrUEZ
cPo/jRriLK9d49WWA2adw7mlhlxZ8/RN1ZcByDWthcUOp/a2GzgZaqMNCoYoKSyO
EhhSgJkW8xg5/O9jpgh+h+cevAWazQ==
=hG7c
-----END PGP SIGNATURE-----

--s2ZSL+KKDSLx8OML--