21 May, 2019

1 commit


09 Jan, 2019

1 commit


19 Oct, 2018

2 commits

  • LoadPin's "enabled" setting is really about enforcement, not whether
    or not the LSM is using LSM hooks. Instead, split this out so that LSM
    enabling can be logically distinct from whether enforcement is happening
    (for example, the pinning happens when the LSM is enabled, but the pin
    is only checked when "enforce" is set). This allows LoadPin to continue
    to operate sanely in test environments once LSM enable/disable is
    centrally handled (i.e. we want LoadPin to be enabled separately from
    its enforcement).

    Signed-off-by: Kees Cook
    Reviewed-by: Casey Schaufler
    Reviewed-by: John Johansen

    Kees Cook
     
  • Instead of only reporting major/minor, include the actual block device
    name, at least as seen by the kernel.

    Signed-off-by: Kees Cook

    Kees Cook
     

17 Jul, 2018

1 commit

  • Both the init_module and finit_module syscalls call either directly
    or indirectly the security_kernel_read_file LSM hook. This patch
    replaces the direct call in init_module with a call to the new
    security_kernel_load_data hook and makes the corresponding changes
    in SELinux, LoadPin, and IMA.

    Signed-off-by: Mimi Zohar
    Cc: Jeff Vander Stoep
    Cc: Casey Schaufler
    Cc: Kees Cook
    Acked-by: Jessica Yu
    Acked-by: Paul Moore
    Acked-by: Kees Cook
    Signed-off-by: James Morris

    Mimi Zohar
     

23 Feb, 2018

1 commit


06 Mar, 2017

1 commit


19 Jan, 2017

1 commit

  • I am still tired of having to find indirect ways to determine
    what security modules are active on a system. I have added
    /sys/kernel/security/lsm, which contains a comma separated
    list of the active security modules. No more groping around
    in /proc/filesystems or other clever hacks.

    Unchanged from previous versions except for being updated
    to the latest security next branch.

    Signed-off-by: Casey Schaufler
    Acked-by: John Johansen
    Acked-by: Paul Moore
    Acked-by: Kees Cook
    Signed-off-by: James Morris

    Casey Schaufler
     

17 May, 2016

1 commit

  • Instead of being enabled by default when SECURITY_LOADPIN is selected,
    provide an additional (default off) config to determine the boot time
    behavior. As before, the "loadpin.enabled=0/1" kernel parameter remains
    available.

    Suggested-by: James Morris
    Signed-off-by: Kees Cook
    Signed-off-by: James Morris

    Kees Cook
     

21 Apr, 2016

1 commit

  • This LSM enforces that kernel-loaded files (modules, firmware, etc)
    must all come from the same filesystem, with the expectation that
    such a filesystem is backed by a read-only device such as dm-verity
    or CDROM. This allows systems that have a verified and/or unchangeable
    filesystem to enforce module and firmware loading restrictions without
    needing to sign the files individually.

    Signed-off-by: Kees Cook
    Acked-by: Serge Hallyn
    Signed-off-by: James Morris

    Kees Cook