With an IMA policy requiring signed firmware, this patch prevents the sysfs fallback method of loading firmware.
Signed-off-by: Mimi Zohar <[email protected]> Cc: Luis R. Rodriguez <[email protected]> Cc: David Howells <[email protected]> Cc: Matthew Garrett <[email protected]> --- security/integrity/ima/ima_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 754ece08e1c6..8759280dccf6 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -453,7 +453,17 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id) } return 0; } + + if (read_id == READING_FIRMWARE_FALLBACK) { + if ((ima_appraise & IMA_APPRAISE_FIRMWARE) && + (ima_appraise & IMA_APPRAISE_ENFORCE)) { + pr_err("Prevent firmware sysfs fallback loading.\n"); + return -EACCES; + } + return 0; + } return 0; + } static int read_idmap[READING_MAX_ID] = { -- 2.7.5
