IMA: fix measuring asymmetric keys Kconfig

As a result of the asymmetric public keys subtype Kconfig option being defined as tristate, with the existing IMA Makefile, ima_asymmetric_keys.c could be built as a kernel module. To prevent this from happening, this patch defines and uses an intermediate Kconfig boolean option named IMA_MEASURE_ASYMMETRIC_KEYS.

Lakshmi Ramasubramanian committed 6 years ago

Commit ea789791 parent f47825c3 files · +9 −3Browse files

Unified · Split

3 files

include/linux/ima.h +2 −2
security/integrity/ima/Kconfig +6 −0
security/integrity/ima/Makefile +1 −1

include/linux/ima.h+2−2

@@ -101,7 +101,7 @@ static inline void ima_add_kexec_buffer(struct kimage *image) · 100 unmodified lines
101	101	{}
102	102	#endif
103	103
104		−#if defined(CONFIG_IMA) && defined(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE)
	104	+#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
105	105	extern void ima_post_key_create_or_update(struct key *keyring,
106	106	struct key *key,
107	107	const void *payload, size_t plen,
@@ -113,7 +113,7 @@ static inline void ima_post_key_create_or_update(struct key *keyring, · 5 unmodified lines
113	113	size_t plen,
114	114	unsigned long flags,
115	115	bool create) {}
116		−#endif /* CONFIG_IMA && CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE */
	116	+#endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */
117	117
118	118	#ifdef CONFIG_IMA_APPRAISE
119	119	extern bool is_ima_appraise_enabled(void);

security/integrity/ima/Kconfig+6−0

@@ -310,3 +310,9 @@ config IMA_APPRAISE_SIGNED_INIT · 309 unmodified lines
310	310	default n
311	311	help
312	312	This option requires user-space init to be signed.
	313	+
	314	+config IMA_MEASURE_ASYMMETRIC_KEYS
	315	+ bool
	316	+ depends on IMA
	317	+ depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
	318	+ default y

security/integrity/ima/Makefile+1−1

@@ -12,4 +12,4 @@ ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o · 11 unmodified lines
12	12	ima-$(CONFIG_IMA_APPRAISE_MODSIG) += ima_modsig.o
13	13	ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o
14	14	obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o
15		−obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += ima_asymmetric_keys.o
	15	+obj-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o