git/linux-nf
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git synced 2026-04-17 22:24:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

scripts: add boot policy generation program

Browse Source 
Enables an IPE policy to be enforced from kernel start, enabling access
control based on trust from kernel startup. This is accomplished by
transforming an IPE policy indicated by CONFIG_IPE_BOOT_POLICY into a
c-string literal that is parsed at kernel startup as an unsigned policy.

Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Deven Bowers
2024-08-02 23:08:31 -07:00
committed by Paul Moore
parent 31f8c8682f
commit ba199dc909
10 changed files with 198 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
security/ipe/.gitignore vendored Normal file
View File

@@ -0,0 +1,2 @@
# SPDX-License-Identifier: GPL-2.0-only
boot_policy.c

10
security/ipe/Kconfig
View File

@@ -21,6 +21,16 @@ menuconfig SECURITY_IPE
If unsure, answer N.
if SECURITY_IPE
config IPE_BOOT_POLICY
string "Integrity policy to apply on system startup"
help
This option specifies a filepath to an IPE policy that is compiled
into the kernel. This policy will be enforced until a policy update
is deployed via the $securityfs/ipe/policies/$policy_name/active
interface.
If unsure, leave blank.
menu "IPE Trust Providers"
config IPE_PROP_DM_VERITY

11
security/ipe/Makefile
View File

@@ -5,7 +5,16 @@
# Makefile for building the IPE module as part of the kernel tree.
#
quiet_cmd_polgen = IPE_POL $(2)
cmd_polgen = scripts/ipe/polgen/polgen security/ipe/boot_policy.c $(2)
targets += boot_policy.c
$(obj)/boot_policy.c: scripts/ipe/polgen/polgen $(CONFIG_IPE_BOOT_POLICY) FORCE
$(call if_changed,polgen,$(CONFIG_IPE_BOOT_POLICY))
obj-$(CONFIG_SECURITY_IPE) += \
boot_policy.o \
digest.o \
eval.o \
hooks.o \
@@ -15,3 +24,5 @@ obj-$(CONFIG_SECURITY_IPE) += \
policy_fs.o \
policy_parser.o \
audit.o \
clean-files := boot_policy.c \

8
security/ipe/fs.c
View File

@@ -190,6 +190,7 @@ static const struct file_operations enforce_fops = {
static int __init ipe_init_securityfs(void)
{
int rc = 0;
struct ipe_policy *ap;
if (!ipe_enabled)
return -EOPNOTSUPP;
@@ -220,6 +221,13 @@ static int __init ipe_init_securityfs(void)
goto err;
}
ap = rcu_access_pointer(ipe_active_policy);
if (ap) {
rc = ipe_new_policyfs_node(ap);
if (rc)
goto err;
}
np = securityfs_create_file("new_policy", 0200, root, NULL, &np_fops);
if (IS_ERR(np)) {
rc = PTR_ERR(np);

12
security/ipe/ipe.c
View File

@@ -9,6 +9,7 @@
#include "hooks.h"
#include "eval.h"
extern const char *const ipe_boot_policy;
bool ipe_enabled;
static struct lsm_blob_sizes ipe_blobs __ro_after_init = {
@@ -74,9 +75,20 @@ static struct security_hook_list ipe_hooks[] __ro_after_init = {
*/
static int __init ipe_init(void)
{
struct ipe_policy *p = NULL;
security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid);
ipe_enabled = true;
if (ipe_boot_policy) {
p = ipe_new_policy(ipe_boot_policy, strlen(ipe_boot_policy),
NULL, 0);
if (IS_ERR(p))
return PTR_ERR(p);
rcu_assign_pointer(ipe_active_policy, p);
}
return 0;
}