Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 8 Jul 2020 10:39:41 -0300
From:   Bruno Meneguele <bmeneg@redhat.com>
To:     Nayna <nayna@linux.vnet.ibm.com>
Cc:     linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
        zohar@linux.ibm.com, erichte@linux.ibm.com, nayna@linux.ibm.com,
        stable@vger.kernel.org
Subject: Re: [PATCH v4] ima: move APPRAISE_BOOTPARAM dependency on
 ARCH_POLICY to runtime
Message-ID: <20200708133941.GA2651@glitch>
References: <20200703180049.15608-1-bmeneg@redhat.com>
 <91a81761-1490-7250-8245-4d78d190385f@linux.vnet.ibm.com>
MIME-Version: 1.0
In-Reply-To: <91a81761-1490-7250-8245-4d78d190385f@linux.vnet.ibm.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="YiEDa0DAkWCtVeE4"
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

--YiEDa0DAkWCtVeE4
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jul 07, 2020 at 07:56:37PM -0400, Nayna wrote:
>=20
> On 7/3/20 2:00 PM, Bruno Meneguele wrote:
> > APPRAISE_BOOTPARAM has been marked as dependent on !ARCH_POLICY in comp=
ile
> > time, enforcing the appraisal whenever the kernel had the arch policy o=
ption
> > enabled.
> >=20
> > However it breaks systems where the option is set but the system wasn't
> > booted in a "secure boot" platform. In this scenario, anytime an apprai=
sal
> > policy (i.e. ima_policy=3Dappraisal_tcb) is used it will be forced, giv=
ing no
> > chance to the user set the 'fix' state (ima_appraise=3Dfix) to actually
> > measure system's files.
>=20
> "measure" is incorrect. It is appraisal.
>=20

Yes, of course, sorry.

> How about changing the statement to "without giving the user the opportun=
ity
> to label the filesystem, before enforcing integrity." ?
>=20

Ack.
That's better :)

> > diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity=
/ima/ima_appraise.c
> > index a9649b04b9f1..4fc83b3fbd5c 100644
> > --- a/security/integrity/ima/ima_appraise.c
> > +++ b/security/integrity/ima/ima_appraise.c
> > @@ -18,14 +18,16 @@
> >   static int __init default_appraise_setup(char *str)
> >   {
> > -#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
> > -=09if (strncmp(str, "off", 3) =3D=3D 0)
> > -=09=09ima_appraise =3D 0;
> > -=09else if (strncmp(str, "log", 3) =3D=3D 0)
> > -=09=09ima_appraise =3D IMA_APPRAISE_LOG;
> > -=09else if (strncmp(str, "fix", 3) =3D=3D 0)
> > -=09=09ima_appraise =3D IMA_APPRAISE_FIX;
> > -#endif
> > +=09if (IS_ENABLED(CONFIG_IMA_APPRAISE_BOOTPARAM) &&
> > +=09    !arch_ima_get_secureboot()) {
> > +=09=09if (strncmp(str, "off", 3) =3D=3D 0)
> > +=09=09=09ima_appraise =3D 0;
> > +=09=09else if (strncmp(str, "log", 3) =3D=3D 0)
> > +=09=09=09ima_appraise =3D IMA_APPRAISE_LOG;
> > +=09=09else if (strncmp(str, "fix", 3) =3D=3D 0)
> > +=09=09=09ima_appraise =3D IMA_APPRAISE_FIX;
> > +=09}
> > +
> >   =09return 1;
> >   }
>=20
> If secureboot is enabled, it is silently ignoring the boot parameters. It
> would be helpful if there is a log message notifying user about that.
>=20
> Can you please Cc powerpc, s390, and x86 mailing list and maintainers, wh=
en
> you post the next version ?
>=20
> I would try to test it sometime in this week.
>=20

Sure. I'm preparing a new version and will post soon.

> Thanks & Regards,
>=20

Thank you.

--=20
bmeneg=20
PGP Key: http://bmeneg.com/pubkey.txt

--YiEDa0DAkWCtVeE4
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEdWo6nTbnZdbDmXutYdRkFR+RokMFAl8FzJ0ACgkQYdRkFR+R
okMq6Af8C2ESthjH/+dcvYY/UHC/wi1UDnVP+n25pPQ5U7Is2K0Xo4Q8wUhBfxVM
+lcoVTkmqED/SVLlqXsStb9y3Qk8HDvlC3LRYfdkD2w7bdIpMkuBB6Ba5MbsPRr+
NTnIwGC082mwafFxrC3ISUcJ/lOWx1vrUETPttd6evuG3b2ogGI7iEHYntCifAhv
GPIbKhJaAdyoJx2ynldpYCPYcKwN/4uv6XrOfiwmrGPYbjBqssqqyuqly4wu2s66
bwmLQtiaCZb88TMVhAXkN4DAJirijPDAEGgt+VrKbpgsBrbTidFAfDoYO+ASf5qQ
QqI7/t89XIw5EHNNfgkAQxJKcxoaWw==
=jY7V
-----END PGP SIGNATURE-----

--YiEDa0DAkWCtVeE4--