ima: provide 'ima_appraise=log' kernel option

The kernel boot parameter "ima_appraise" currently defines 'off',
'enforce' and 'fix' modes.  When designing a policy and labeling
the system, access to files are either blocked in the default
'enforce' mode or automatically fixed in the 'fix' mode.  It is
beneficial to be able to run the system in a logging only mode,
without fixing it, in order to properly analyze the system. This
patch adds a 'log' mode to run the system in a permissive mode and
log the appraisal results.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 90c12c59116830cd67e7fecda515f0ee33a8a103..2aa1b6e74acad4d6782466f868900487f8e40276 100644 (file)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1292,7 +1292,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        Set number of hash buckets for inode cache.
 
        ima_appraise=   [IMA] appraise integrity measurements
-                       Format: { "off" | "enforce" | "fix" }
+                       Format: { "off" | "enforce" | "fix" | "log" }
                        default: "enforce"
 
        ima_appraise_tcb [IMA]

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 8e4bb883fc13302278cf1f566e3e6a06aca84dfa..d61680dcd3650705d8213a984833a30eea8ac62e 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -159,8 +159,9 @@ void ima_delete_rules(void);
 /* Appraise integrity measurements */
 #define IMA_APPRAISE_ENFORCE   0x01
 #define IMA_APPRAISE_FIX       0x02
-#define IMA_APPRAISE_MODULES   0x04
-#define IMA_APPRAISE_FIRMWARE  0x08
+#define IMA_APPRAISE_LOG       0x04
+#define IMA_APPRAISE_MODULES   0x08
+#define IMA_APPRAISE_FIRMWARE  0x10
 
 #ifdef CONFIG_IMA_APPRAISE
 int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 013ec3f0e42da5e7809bbe87edfad69a56347b4e..2dc13fbb7e91cc74e93ec0cb595057295a2a57da 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -23,6 +23,8 @@ static int __init default_appraise_setup(char *str)
 {
        if (strncmp(str, "off", 3) == 0)
                ima_appraise = 0;
+       else if (strncmp(str, "log", 3) == 0)
+               ima_appraise = IMA_APPRAISE_LOG;
        else if (strncmp(str, "fix", 3) == 0)
                ima_appraise = IMA_APPRAISE_FIX;
        return 1;