leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

integrity: invalid kernel parameters feedback

Browse Source 
Don't silently ignore unknown or invalid ima_{policy,appraise,hash} and evm
kernel boot command line options.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Bruno Meneguele
2020-09-04 16:40:58 -03:00
committed by Mimi Zohar
parent 4afb28ab03
commit 7fe2bb7e7e
4 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
security/integrity/evm/evm_main.c
View File

@@ -59,6 +59,9 @@ static int __init evm_set_fixmode(char *str)
{ {
if (strncmp(str, "fix", 3) == 0) if (strncmp(str, "fix", 3) == 0)
evm_fixmode = 1; evm_fixmode = 1;
else
pr_err("invalid \"%s\" mode", str);
return 0; return 0;
} }
__setup("evm=", evm_set_fixmode); __setup("evm=", evm_set_fixmode);

2
security/integrity/ima/ima_appraise.c
View File

@@ -33,6 +33,8 @@ static int __init default_appraise_setup(char *str)
ima_appraise = IMA_APPRAISE_FIX; ima_appraise = IMA_APPRAISE_FIX;
else if (strncmp(str, "enforce", 7) == 0) else if (strncmp(str, "enforce", 7) == 0)
ima_appraise = IMA_APPRAISE_ENFORCE; ima_appraise = IMA_APPRAISE_ENFORCE;
else
pr_err("invalid \"%s\" appraise option", str);
#endif #endif
return 1; return 1;
} }

13
security/integrity/ima/ima_main.c
View File

@@ -50,18 +50,23 @@ static int __init hash_setup(char *str)
return 1; return 1;
if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) { if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) {
if (strncmp(str, "sha1", 4) == 0) if (strncmp(str, "sha1", 4) == 0) {
ima_hash_algo = HASH_ALGO_SHA1; ima_hash_algo = HASH_ALGO_SHA1;
else if (strncmp(str, "md5", 3) == 0) } else if (strncmp(str, "md5", 3) == 0) {
ima_hash_algo = HASH_ALGO_MD5; ima_hash_algo = HASH_ALGO_MD5;
else } else {
pr_err("invalid hash algorithm \"%s\" for template \"%s\"",
str, IMA_TEMPLATE_IMA_NAME);
return 1; return 1;
}
goto out; goto out;
} }
i = match_string(hash_algo_name, HASH_ALGO__LAST, str); i = match_string(hash_algo_name, HASH_ALGO__LAST, str);
if (i < 0) if (i < 0) {
pr_err("invalid hash algorithm \"%s\"", str);
return 1; return 1;
}
ima_hash_algo = i; ima_hash_algo = i;
out: out:

2
security/integrity/ima/ima_policy.c
View File

@@ -241,6 +241,8 @@ static int __init policy_setup(char *str)
ima_use_secure_boot = true; ima_use_secure_boot = true;
else if (strcmp(p, "fail_securely") == 0) else if (strcmp(p, "fail_securely") == 0)
ima_fail_unverifiable_sigs = true; ima_fail_unverifiable_sigs = true;
else
pr_err("policy \"%s\" not found", p);
} }
return 1; return 1;