Commit 2faa6ef3 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar

ima: provide 'ima_appraise=log' kernel option

The kernel boot parameter "ima_appraise" currently defines 'off',
'enforce' and 'fix' modes.  When designing a policy and labeling
the system, access to files are either blocked in the default
'enforce' mode or automatically fixed in the 'fix' mode.  It is
beneficial to be able to run the system in a logging only mode,
without fixing it, in order to properly analyze the system. This
patch adds a 'log' mode to run the system in a permissive mode and
log the appraisal results.
Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent 31b70f66
...@@ -1292,7 +1292,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. ...@@ -1292,7 +1292,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
Set number of hash buckets for inode cache. Set number of hash buckets for inode cache.
ima_appraise= [IMA] appraise integrity measurements ima_appraise= [IMA] appraise integrity measurements
Format: { "off" | "enforce" | "fix" } Format: { "off" | "enforce" | "fix" | "log" }
default: "enforce" default: "enforce"
ima_appraise_tcb [IMA] ima_appraise_tcb [IMA]
......
...@@ -159,8 +159,9 @@ void ima_delete_rules(void); ...@@ -159,8 +159,9 @@ void ima_delete_rules(void);
/* Appraise integrity measurements */ /* Appraise integrity measurements */
#define IMA_APPRAISE_ENFORCE 0x01 #define IMA_APPRAISE_ENFORCE 0x01
#define IMA_APPRAISE_FIX 0x02 #define IMA_APPRAISE_FIX 0x02
#define IMA_APPRAISE_MODULES 0x04 #define IMA_APPRAISE_LOG 0x04
#define IMA_APPRAISE_FIRMWARE 0x08 #define IMA_APPRAISE_MODULES 0x08
#define IMA_APPRAISE_FIRMWARE 0x10
#ifdef CONFIG_IMA_APPRAISE #ifdef CONFIG_IMA_APPRAISE
int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
......
...@@ -23,6 +23,8 @@ static int __init default_appraise_setup(char *str) ...@@ -23,6 +23,8 @@ static int __init default_appraise_setup(char *str)
{ {
if (strncmp(str, "off", 3) == 0) if (strncmp(str, "off", 3) == 0)
ima_appraise = 0; ima_appraise = 0;
else if (strncmp(str, "log", 3) == 0)
ima_appraise = IMA_APPRAISE_LOG;
else if (strncmp(str, "fix", 3) == 0) else if (strncmp(str, "fix", 3) == 0)
ima_appraise = IMA_APPRAISE_FIX; ima_appraise = IMA_APPRAISE_FIX;
return 1; return 1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment