On Tue, Jul 07, 2020 at 07:56:37PM -0400, Nayna wrote:

On 7/3/20 2:00 PM, Bruno Meneguele wrote:

...

APPRAISE_BOOTPARAM has been marked as dependent on !ARCH_POLICY in compile time, enforcing the appraisal whenever the kernel had the arch policy option enabled.

However it breaks systems where the option is set but the system wasn't booted in a "secure boot" platform. In this scenario, anytime an appraisal policy (i.e. ima_policy=appraisal_tcb) is used it will be forced, giving no chance to the user set the 'fix' state (ima_appraise=fix) to actually measure system's files.

"measure" is incorrect. It is appraisal.

Yes, of course, sorry.

How about changing the statement to "without giving the user the opportunity to label the filesystem, before enforcing integrity." ?

Ack. That's better :)

...

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index a9649b04b9f1..4fc83b3fbd5c 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -18,14 +18,16 @@ static int __init default_appraise_setup(char *str) { -#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM

• if (strncmp(str, "off", 3) == 0)

• ima_appraise = 0;
  

• else if (strncmp(str, "log", 3) == 0)

• ima_appraise = IMA_APPRAISE_LOG;
  

• else if (strncmp(str, "fix", 3) == 0)

• ima_appraise = IMA_APPRAISE_FIX;
  

-#endif

• if (IS_ENABLED(CONFIG_IMA_APPRAISE_BOOTPARAM) &&

•    !arch_ima_get_secureboot()) {
  

• if (strncmp(str, "off", 3) == 0)
  

• 	ima_appraise = 0;
  

• else if (strncmp(str, "log", 3) == 0)
  

• 	ima_appraise = IMA_APPRAISE_LOG;
  

• else if (strncmp(str, "fix", 3) == 0)
  

• 	ima_appraise = IMA_APPRAISE_FIX;
  

• }
• return 1; }

If secureboot is enabled, it is silently ignoring the boot parameters. It would be helpful if there is a log message notifying user about that.

Can you please Cc powerpc, s390, and x86 mailing list and maintainers, when you post the next version ?

I would try to test it sometime in this week.

Sure. I'm preparing a new version and will post soon.

Thanks & Regards,

Thank you.