diff options
| author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2012-12-21 08:34:21 -0500 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2012-12-24 09:35:48 -0500 |
| commit | a7f2a366f62319dfebf8d4dfe8b211f631c78457 (patch) | |
| tree | 67e502cd2da52cc6c75d1fa9dcaed27fd05b86e2 /security/integrity/ima/ima_policy.c | |
| parent | a49f0d1ea3ec94fc7cf33a7c36a16343b74bd565 (diff) | |
| download | op-kernel-dev-a7f2a366f62319dfebf8d4dfe8b211f631c78457.zip op-kernel-dev-a7f2a366f62319dfebf8d4dfe8b211f631c78457.tar.gz | |
ima: fallback to MODULE_SIG_ENFORCE for existing kernel module syscall
The new kernel module syscall appraises kernel modules based
on policy. If the IMA policy requires kernel module checking,
fallback to module signature enforcing for the existing syscall.
Without CONFIG_MODULE_SIG_FORCE enabled, the kernel module's
integrity is unknown, return -EACCES.
Changelog v1:
- Fix ima_module_check() return result (Tetsuo Handa)
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Diffstat (limited to 'security/integrity/ima/ima_policy.c')
| -rw-r--r-- | security/integrity/ima/ima_policy.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index af7d182..479fca9 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -523,7 +523,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) } if (!result && (entry->action == UNKNOWN)) result = -EINVAL; - + else if (entry->func == MODULE_CHECK) + ima_appraise |= IMA_APPRAISE_MODULES; audit_log_format(ab, "res=%d", !result); audit_log_end(ab); return result; |
