Re: [PATCH v9 2/8] powerpc/ima: add support to initialize ima policy rules
From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2019-10-26 23:52:20
Also in:
linux-efi, linux-integrity, lkml
On Fri, 2019-10-25 at 12:02 -0500, Nayna Jain wrote:
On 10/24/19 12:35 PM, Lakshmi Ramasubramanian wrote:quoted
On 10/23/2019 8:47 PM, Nayna Jain wrote:quoted
+/* + * The "secure_rules" are enabled only on "secureboot" enabled systems. + * These rules verify the file signatures against known good values. + * The "appraise_type=imasig|modsig" option allows the known good signature + * to be stored as an xattr or as an appended signature. + * + * To avoid duplicate signature verification as much as possible, the IMA + * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE + * is not enabled. + */ +static const char *const secure_rules[] = { + "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig", +#ifndef CONFIG_MODULE_SIG_FORCE + "appraise func=MODULE_CHECK appraise_type=imasig|modsig", +#endif + NULL +};Is there any way to not use conditional compilation in the above array definition? Maybe define different functions to get "secure_rules" for when CONFIG_MODULE_SIG_FORCE is defined and when it is not defined.How will you decide which function to be called ?
You could call "is_module_sig_enforced()". Mimi