IMA: fix measuring asymmetric keys Kconfig

As a result of the asymmetric public keys subtype Kconfig option being defined as tristate, with the existing IMA Makefile, ima_asymmetric_keys.c could be built as a kernel module. To prevent this from happening, this patch defines and uses an intermediate Kconfig boolean option named IMA_MEASURE_ASYMMETRIC_KEYS.

Lakshmi Ramasubramanian committed 6 years ago

Commit ea789791 parent f47825c3 files · +9 −3Browse files

Unified · Split

3 files

include/linux/ima.h +2 −2
security/integrity/ima/Kconfig +6 −0
security/integrity/ima/Makefile +1 −1

include/linux/ima.h+2−2

@@ -101,7 +101,7 @@ static inline void ima_add_kexec_buffer(struct kimage *image) · 100 unmodified lines
101	{}	101	{}
102	#endif	102	#endif
103		103
104	#if defined(CONFIG_IMA) && defined(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE)	104	#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
105	extern void ima_post_key_create_or_update(struct key *keyring,	105	extern void ima_post_key_create_or_update(struct key *keyring,
106	struct key *key,	106	struct key *key,
107	const void *payload, size_t plen,	107	const void *payload, size_t plen,
@@ -113,7 +113,7 @@ static inline void ima_post_key_create_or_update(struct key *keyring, · 5 unmodified lines
113	size_t plen,	113	size_t plen,
114	unsigned long flags,	114	unsigned long flags,
115	bool create) {}	115	bool create) {}
116	#endif /* CONFIG_IMA && CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE */	116	#endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */
117		117
118	#ifdef CONFIG_IMA_APPRAISE	118	#ifdef CONFIG_IMA_APPRAISE
119	extern bool is_ima_appraise_enabled(void);	119	extern bool is_ima_appraise_enabled(void);

security/integrity/ima/Kconfig+6−0

@@ -310,3 +310,9 @@ config IMA_APPRAISE_SIGNED_INIT · 309 unmodified lines
310	default n	310	default n
311	help	311	help
312	This option requires user-space init to be signed.	312	This option requires user-space init to be signed.
		313
		314	config IMA_MEASURE_ASYMMETRIC_KEYS
		315	bool
		316	depends on IMA
		317	depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
		318	default y

security/integrity/ima/Makefile+1−1

@@ -12,4 +12,4 @@ ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o · 11 unmodified lines
12	ima-$(CONFIG_IMA_APPRAISE_MODSIG) += ima_modsig.o	12	ima-$(CONFIG_IMA_APPRAISE_MODSIG) += ima_modsig.o
13	ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o	13	ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o
14	obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o	14	obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o
15	obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += ima_asymmetric_keys.o	15	obj-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o