mirror of
https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git
synced 2026-09-09 00:07:04 +08:00
CKI KWF Bot
6df11bffe0
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1979 JIRA: https://issues.redhat.com/browse/RHEL-104353 Upstream Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Conflicts: due to missing commits - security/selinux/hooks.c - 2c2b1e059792 ("selinux: add permission checks for loading other kinds of kernel files") - security/integrity/ima/ima_main.c - 37f670aacd48 ("lsm: use lsm_prop in security_current_getsecid") - 8f3fc4f3f8aa ("ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook") commit c200892b46ba3df3dd210b7117a463ec283600c3 Author: Coiby Xu <coxu@redhat.com> Date: Wed Nov 19 22:03:25 2025 +0800 ima: Access decompressed kernel module to verify appended signature Currently, when in-kernel module decompression (CONFIG_MODULE_DECOMPRESS) is enabled, IMA has no way to verify the appended module signature as it can't decompress the module. Define a new kernel_read_file_id enumerate READING_MODULE_COMPRESSED so IMA can calculate the compressed kernel module data hash on READING_MODULE_COMPRESSED and defer appraising/measuring it until on READING_MODULE when the module has been decompressed. Before enabling in-kernel module decompression, a kernel module in initramfs can still be loaded with ima_policy=secure_boot. So adjust the kernel module rule in secure_boot policy to allow either an IMA signature OR an appended signature i.e. to use "appraise func=MODULE_CHECK appraise_type=imasig|modsig". Reported-by: Karel Srot <ksrot@redhat.com> Suggested-by: Mimi Zohar <zohar@linux.ibm.com> Suggested-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Coiby Xu <coxu@redhat.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Fixes: 4cd30c5ff63d ("redhat/configs: enable in kernel compression/decompression of compressed modules") Signed-off-by: Coiby Xu <coxu@redhat.com> Approved-by: Ondrej Mosnáček <omosnacek@gmail.com> Approved-by: Richard Guy Briggs <rgb@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>