diff options
| author | Fan Wu <wufan@linux.microsoft.com> | 2024-08-03 09:08:20 +0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-08-20 21:01:52 +0300 |
| commit | a8a74df150835f5ceff89d40fadda1cf3961fdae (patch) | |
| tree | 84d6dd11e8afd5ff4fc46706374ab239888966b1 /security/ipe/hooks.c | |
| parent | 2fea0c26b82f304f43b3905e56d954cf98a6d0e9 (diff) | |
| download | linux-a8a74df150835f5ceff89d40fadda1cf3961fdae.tar.xz | |
ipe: introduce 'boot_verified' as a trust provider
IPE is designed to provide system level trust guarantees, this usually
implies that trust starts from bootup with a hardware root of trust,
which validates the bootloader. After this, the bootloader verifies
the kernel and the initramfs.
As there's no currently supported integrity method for initramfs, and
it's typically already verified by the bootloader. This patch introduces
a new IPE property `boot_verified` which allows author of IPE policy to
indicate trust for files from initramfs.
The implementation of this feature utilizes the newly added
`initramfs_populated` hook. This hook marks the superblock of the rootfs
after the initramfs has been unpacked into it.
Before mounting the real rootfs on top of the initramfs, initramfs
script will recursively remove all files and directories on the
initramfs. This is typically implemented by using switch_root(8)
(https://man7.org/linux/man-pages/man8/switch_root.8.html).
Therefore the initramfs will be empty and not accessible after the real
rootfs takes over. It is advised to switch to a different policy
that doesn't rely on the `boot_verified` property after this point.
This ensures that the trust policies remain relevant and effective
throughout the system's operation.
Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/ipe/hooks.c')
| -rw-r--r-- | security/ipe/hooks.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/security/ipe/hooks.c b/security/ipe/hooks.c index 0da4607cc4bc..0bd351e2b32a 100644 --- a/security/ipe/hooks.c +++ b/security/ipe/hooks.c @@ -4,6 +4,7 @@ */ #include <linux/fs.h> +#include <linux/fs_struct.h> #include <linux/types.h> #include <linux/binfmts.h> #include <linux/mman.h> @@ -182,3 +183,11 @@ int ipe_kernel_load_data(enum kernel_load_data_id id, bool contents) ipe_build_eval_ctx(&ctx, NULL, op); return ipe_evaluate_event(&ctx); } + +/** + * ipe_unpack_initramfs() - Mark the current rootfs as initramfs. + */ +void ipe_unpack_initramfs(void) +{ + ipe_sb(current->fs->root.mnt->mnt_sb)->initramfs = true; +} |