Received: by 2002:a05:7412:2a8c:b0:e2:908c:2ebd with SMTP id u12csp2385337rdh; Wed, 27 Sep 2023 00:26:07 -0700 (PDT) X-Google-Smtp-Source: AGHT+IG1O9jNmfa5SuD3IHKd+FgnyQseG/YMF7AtuXG86iBaS6meodqRxlDkUI2L9y9CiFg+Elue X-Received: by 2002:a17:902:c40d:b0:1c3:2423:8e24 with SMTP id k13-20020a170902c40d00b001c324238e24mr1282773plk.8.1695799567405; Wed, 27 Sep 2023 00:26:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695799567; cv=none; d=google.com; s=arc-20160816; b=D05faQqj0fa2cTfQZcD/aZ9lvTbELmPfYvr+4PqD2h+fCJzYzpRv7KQ3OUa1d0LOpG MtL+YtHs3NvkZC/d6+6f38EFKlYIbijF0Cm1YNRF9owO0dwH5b3c4nozA1wLAV6hcnBD cs/O6eTynQUTPaMdde2JRjn4EqVQgsW7V33TdAOi6UYnE5iIU7IYJNATkaQ9hzEmkIAN fPAelBKSAi1a2X2r9ECvCUgWvTq83DHE1QzT75Djzdz2QEWG6zJWl2cUXvEnxfQuB/Ul C7jTQ7dcZuyffx6cSqJmtxrMgRQK2d0aUdmnDF3n3BRYXKrZ/u89NbGGArQ+BYcEAGTy a+CA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=y/VhslcEPqN+5PK98H+khM/YkagejvLsUdoj+IiJ1g4=; fh=TZBBN/bV/p/+dxQYdlCuzfA2xYWmgNJv2xUSR1GHp40=; b=M/8w5cDcZKFpuA+q4U4DzR7ju5+33Dl7emLCUAm2DKsFy+C3hsxDZACm1dIeJQD0Sm ZDGl0zHBmCvStLVcpjpnbqwn7HbZX6uSz8zjj6SeHMAccHtwTrJKWgvYolL51Fbp/45R Q/JBMtqUFk/QYK1fWFJalnVWz+Fw3V2/SBIzHdpRkLy49iXwWyhewO3G8GmNxKsc+8iZ YydiEbcNnx4QspAVFa6B2b9YT3v071s72jY1OFjcKGiJjuIZovKE9JEJwLrpd+K85JVK gnoO6Zm2QWfPIJtgk2AhMV+0FGsDL2l9Q/QBqqt8ZmcckhQLv8Y5HyT9Fy3NVYQKO/o/ ONpw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=gCFdqpmx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from groat.vger.email (groat.vger.email. [23.128.96.35]) by mx.google.com with ESMTPS id l3-20020a170903244300b001a94b91f402si16331670pls.218.2023.09.27.00.26.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 Sep 2023 00:26:07 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=gCFdqpmx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by groat.vger.email (Postfix) with ESMTP id 52B75802923F; Wed, 27 Sep 2023 00:23:19 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at groat.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229965AbjI0HWe (ORCPT + 99 others); Wed, 27 Sep 2023 03:22:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43836 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229499AbjI0HWb (ORCPT ); Wed, 27 Sep 2023 03:22:31 -0400 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2BB78BF; Wed, 27 Sep 2023 00:22:30 -0700 (PDT) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2FB5C433CB; Wed, 27 Sep 2023 07:22:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1695799349; bh=ie+gDwMLwUQ8Z89F6h2q5E8Syfe9PDI3vuz9pSKTnG0=; h=From:To:Cc:Subject:Date:From; b=gCFdqpmx9M72kPP7CNAQQGCOQmOE3LpCAmQ7oxYgX1FAzceSh53vZTXDqWK521DCP N2LENb/9ieHXwkGBQMjNyoGFrcfFqfhaaiSQuiUyTYnZ2mxoloO6iHHeWtSI/zGhQ3 abBsJPJTyQp+/nW54GsFeXrMGlX7XeybL6I97AjNyE3vLWG7VowMDx2au2HQqYlgVT NHMoXKe7etrDw8ITUnIg+q9drfFcxNxcQcY5KF3mrrGGWKb+pv9ZlGoz3AAvYXJgfq 4xVBCbDVhR+FNR+UksAazFv1PUDFea7B51i3gEr+W2o8NqqnsA5t/Msf5/EHzcN6q7 ZGS1UD6VY+O5A== From: Arnd Bergmann To: Mimi Zohar , Dmitry Kasatkin Cc: Arnd Bergmann , Paul Moore , James Morris , "Serge E. Hallyn" , Jarkko Sakkinen , Nayna Jain , Eric Snowberg , Tianjia Zhang , Randy Dunlap , Oleksandr Tymoshenko , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] ima: rework CONFIG_IMA dependency block Date: Wed, 27 Sep 2023 09:22:14 +0200 Message-Id: <20230927072223.2555698-1-arnd@kernel.org> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-1.2 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Wed, 27 Sep 2023 00:23:19 -0700 (PDT) From: Arnd Bergmann Changing the direct dependencies of IMA_BLACKLIST_KEYRING and IMA_LOAD_X509 caused them to no longer depend on IMA, but a a configuration without IMA results in link failures: arm-linux-gnueabi-ld: security/integrity/iint.o: in function `integrity_load_keys': iint.c:(.init.text+0xd8): undefined reference to `ima_load_x509' aarch64-linux-ld: security/integrity/digsig_asymmetric.o: in function `asymmetric_verify': digsig_asymmetric.c:(.text+0x104): undefined reference to `ima_blacklist_keyring' Adding explicit dependencies on IMA would fix this, but a more reliable way to do this is to enclose the entire Kconfig file in an 'if IMA' block. This also allows removing the existing direct dependencies. Fixes: be210c6d3597f ("ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig") Signed-off-by: Arnd Bergmann --- security/integrity/ima/Kconfig | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 4e559bd1fd41c..a6bd817efc1a6 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -29,9 +29,11 @@ config IMA to learn more about IMA. If unsure, say N. +if IMA + config IMA_KEXEC bool "Enable carrying the IMA measurement list across a soft boot" - depends on IMA && TCG_TPM && HAVE_IMA_KEXEC + depends on TCG_TPM && HAVE_IMA_KEXEC default n help TPM PCRs are only reset on a hard reboot. In order to validate @@ -43,7 +45,6 @@ config IMA_KEXEC config IMA_MEASURE_PCR_IDX int - depends on IMA range 8 14 default 10 help @@ -53,7 +54,7 @@ config IMA_MEASURE_PCR_IDX config IMA_LSM_RULES bool - depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR) + depends on AUDIT && (SECURITY_SELINUX || SECURITY_SMACK || SECURITY_APPARMOR) default y help Disabling this option will disregard LSM based policy rules. @@ -61,7 +62,6 @@ config IMA_LSM_RULES choice prompt "Default template" default IMA_NG_TEMPLATE - depends on IMA help Select the default IMA measurement template. @@ -80,14 +80,12 @@ endchoice config IMA_DEFAULT_TEMPLATE string - depends on IMA default "ima-ng" if IMA_NG_TEMPLATE default "ima-sig" if IMA_SIG_TEMPLATE choice prompt "Default integrity hash algorithm" default IMA_DEFAULT_HASH_SHA1 - depends on IMA help Select the default hash algorithm used for the measurement list, integrity appraisal and audit log. The compiled default @@ -117,7 +115,6 @@ endchoice config IMA_DEFAULT_HASH string - depends on IMA default "sha1" if IMA_DEFAULT_HASH_SHA1 default "sha256" if IMA_DEFAULT_HASH_SHA256 default "sha512" if IMA_DEFAULT_HASH_SHA512 @@ -126,7 +123,6 @@ config IMA_DEFAULT_HASH config IMA_WRITE_POLICY bool "Enable multiple writes to the IMA policy" - depends on IMA default n help IMA policy can now be updated multiple times. The new rules get @@ -137,7 +133,6 @@ config IMA_WRITE_POLICY config IMA_READ_POLICY bool "Enable reading back the current IMA policy" - depends on IMA default y if IMA_WRITE_POLICY default n if !IMA_WRITE_POLICY help @@ -147,7 +142,6 @@ config IMA_READ_POLICY config IMA_APPRAISE bool "Appraise integrity measurements" - depends on IMA default n help This option enables local measurement integrity appraisal. @@ -304,7 +298,6 @@ config IMA_APPRAISE_SIGNED_INIT config IMA_MEASURE_ASYMMETRIC_KEYS bool - depends on IMA depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y default y @@ -323,7 +316,8 @@ config IMA_SECURE_AND_OR_TRUSTED_BOOT config IMA_DISABLE_HTABLE bool "Disable htable to allow measurement of duplicate records" - depends on IMA default n help This option disables htable to allow measurement of duplicate records. + +endif -- 2.39.2