aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMing Liu <liu.ming50@gmail.com>2021-04-08 20:38:14 +0200
committerArmin Kuster <akuster808@gmail.com>2021-04-12 07:07:11 -0700
commit076e75d5cc1fe7b43af8dcd10d8b2b18af422c84 (patch)
tree87b360346c5fd05ba23b8ecedbbb9096e3e4d1d4
parent269cd6a9a2ac11c563cbfd808e276f05b4a1d130 (diff)
downloadmeta-security-076e75d5cc1fe7b43af8dcd10d8b2b18af422c84.tar.gz
meta-security-076e75d5cc1fe7b43af8dcd10d8b2b18af422c84.tar.bz2
meta-security-076e75d5cc1fe7b43af8dcd10d8b2b18af422c84.zip
initramfs-framework-ima: introduce IMA_FORCE
Introduce IMA_FORCE to allow the IMA policy be applied forcely even 'no_ima' boot parameter is available. This ensures the end users have a way to disable 'no_ima' support if they want to, because it may expose a security risk if an attacker can find a way to change kernel arguments, it will easily bypass rootfs authenticity checks. Signed-off-by: Sergio Prado <sergio.prado@toradex.com> Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
-rw-r--r--meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb5
-rw-r--r--meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima/ima9
2 files changed, 12 insertions, 2 deletions
diff --git a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb
index 77f6f7c..6471c53 100644
--- a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb
+++ b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb
@@ -14,6 +14,9 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384
# to this recipe can just point towards one of its own files.
IMA_POLICY ?= "ima-policy-hashed"
+# Force proceed IMA procedure even 'no_ima' boot parameter is available.
+IMA_FORCE ?= "false"
+
SRC_URI = " file://ima"
inherit features_check
@@ -23,6 +26,8 @@ do_install () {
install -d ${D}/${sysconfdir}/ima
install -d ${D}/init.d
install ${WORKDIR}/ima ${D}/init.d/20-ima
+
+ sed -i "s/@@FORCE_IMA@@/${IMA_FORCE}/g" ${D}/init.d/20-ima
}
FILES_${PN} = "/init.d ${sysconfdir}"
diff --git a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima/ima b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima/ima
index cff26a3..8971494 100644
--- a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima/ima
+++ b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima/ima
@@ -2,11 +2,16 @@
#
# Loads IMA policy into the kernel.
+force_ima=@@FORCE_IMA@@
+
ima_enabled() {
- if [ "$bootparam_no_ima" = "true" ]; then
+ if [ "$force_ima" = "true" ]; then
+ return 0
+ elif [ "$bootparam_no_ima" = "true" ]; then
return 1
+ else
+ return 0
fi
- return 0
}
ima_run() {