bianbu-repo-mirror/bianbu-linux-6.6
1
0
Fork 0
mirror of https://gitee.com/bianbu-linux/linux-6.6 synced 2025-04-24 14:07:52 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

ima: ensure IMA_APPRAISE_MODSIG has necessary dependencies

Browse source 
IMA_APPRAISE_MODSIG is used for verifying the integrity of both kernel
and modules. Enabling IMA_APPRAISE_MODSIG without MODULES causes a build
break.

Ensure the build time kernel signing key is only generated if both
IMA_APPRAISE_MODSIG and MODULES are enabled.

Fixes: 0165f4ca22 ("ima: enable signing of modules with build time generated key")
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Nayna Jain 2021-04-22 21:16:02 -04:00 • committed by Mimi Zohar
parent 28073eb09c
commit 781a573948
3 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
certs/Kconfig
View file

@ -4,7 +4,7 @@ menu "Certificates for signature checking"
config MODULE_SIG_KEY config MODULE_SIG_KEY
string "File name or PKCS#11 URI of module signing key" string "File name or PKCS#11 URI of module signing key"
default "certs/signing_key.pem" default "certs/signing_key.pem"
depends on MODULE_SIG || IMA_APPRAISE_MODSIG depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES)
help help
Provide the file name of a private key/certificate in PEM format, Provide the file name of a private key/certificate in PEM format,
or a PKCS#11 URI according to RFC7512. The file should contain, or or a PKCS#11 URI according to RFC7512. The file should contain, or

2
certs/Makefile
View file

@ -36,8 +36,10 @@ ifeq ($(CONFIG_MODULE_SIG),y)
endif endif
ifeq ($(CONFIG_IMA_APPRAISE_MODSIG),y) ifeq ($(CONFIG_IMA_APPRAISE_MODSIG),y)
ifeq ($(CONFIG_MODULES),y)
SIGN_KEY = y SIGN_KEY = y
endif endif
endif
ifdef SIGN_KEY ifdef SIGN_KEY
############################################################################### ###############################################################################

3
certs/system_certificates.S
View file

@ -9,7 +9,8 @@
system_certificate_list: system_certificate_list:
__cert_list_start: __cert_list_start:
__module_cert_start: __module_cert_start:
#if defined(CONFIG_MODULE_SIG) || defined(CONFIG_IMA_APPRAISE_MODSIG) #if defined(CONFIG_MODULE_SIG) || (defined(CONFIG_IMA_APPRAISE_MODSIG) \
&& defined(CONFIG_MODULES))
.incbin "certs/signing_key.x509" .incbin "certs/signing_key.x509"
#endif #endif
__module_cert_end: __module_cert_end: