| 0e5f66bf | 03-Oct-2026 |
Fan Wu <wufan@kernel.org> |
ipe: fix enforcement audit
ipe_audit_enforce() starts an audit buffer but writes the state change with audit_log(), which logs its own record. Ending the unused buffer then emits an extra empty AUDI
ipe: fix enforcement audit
ipe_audit_enforce() starts an audit buffer but writes the state change with audit_log(), which logs its own record. Ending the unused buffer then emits an extra empty AUDIT_MAC_STATUS record.
Remove the unused buffer and log the state change with audit_log() alone.
Fixes: a68916eaedcd ("ipe: add permissive toggle") Assisted-by: LLM Signed-off-by: Fan Wu <wufan@kernel.org>
show more ...
|
| a53d9c9c | 03-Oct-2026 |
Fan Wu <wufan@kernel.org> |
ipe: correct policy text ownership comment
Policy text is separately allocated only when p->pkcs7 is NULL. Correct the comment to match the existing free logic.
No functional changes.
Assisted-by:
ipe: correct policy text ownership comment
Policy text is separately allocated only when p->pkcs7 is NULL. Correct the comment to match the existing free logic.
No functional changes.
Assisted-by: LLM Signed-off-by: Fan Wu <wufan@kernel.org>
show more ...
|
| 6adc404a | 03-Oct-2026 |
Fan Wu <wufan@kernel.org> |
ipe: check parser token table sizes
The parser token tables contain one entry for each enum value followed by a terminator. Add static assertions so adding an enum value without a corresponding toke
ipe: check parser token table sizes
The parser token tables contain one entry for each enum value followed by a terminator. Add static assertions so adding an enum value without a corresponding token fails the build.
Assisted-by: LLM Signed-off-by: Fan Wu <wufan@kernel.org>
show more ...
|
| e4933dbc | 03-Oct-2026 |
Fan Wu <wufan@kernel.org> |
ipe: use designated initializers for audit name tables
The audit name tables are indexed by enum values but initialized positionally. Adding an enum value in the middle can associate the following n
ipe: use designated initializers for audit name tables
The audit name tables are indexed by enum values but initialized positionally. Adding an enum value in the middle can associate the following names with the wrong values.
Use designated initializers to bind each name to its enum value.
No functional changes.
Assisted-by: LLM Signed-off-by: Fan Wu <wufan@kernel.org>
show more ...
|
| 2776e9c2 | 23-Sep-2026 |
Fan Wu <wufan@kernel.org> |
ipe: protect the dm-verity root hash with RCU
ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it
ipe: protect the dm-verity root hash with RCU
ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it.
Protect the root hash with RCU. The evaluation path already runs under rcu_read_lock().
Fixes: e155858dd995 ("ipe: add support for dm-verity as a trust provider") Cc: stable@vger.kernel.org Assisted-by: LLM [FW: remove model name according to latest guideline] Signed-off-by: Fan Wu <wufan@kernel.org>
show more ...
|
| c8321831 | 03-Dec-2025 |
Linus Torvalds <torvalds@linux-foundation.org> |
Merge tag 'ipe-pr-20251202' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe
Pull IPE udates from Fan Wu: "The primary change is the addition of support for the AT_EXECVE_CHECK flag. Th
Merge tag 'ipe-pr-20251202' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe
Pull IPE udates from Fan Wu: "The primary change is the addition of support for the AT_EXECVE_CHECK flag. This allows interpreters to signal the kernel to perform IPE security checks on script files before execution, extending IPE enforcement to indirectly executed scripts.
Update documentation for it, and also fix a comment"
* tag 'ipe-pr-20251202' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe: ipe: Update documentation for script enforcement ipe: Add AT_EXECVE_CHECK support for script enforcement ipe: Drop a duplicated CONFIG_ prefix in the ifdeffery
show more ...
|
| 67678189 | 06-Nov-2025 |
Yanzhu Huang <yanzhuhuang@linux.microsoft.com> |
ipe: Add AT_EXECVE_CHECK support for script enforcement
This patch adds a new ipe_bprm_creds_for_exec() hook that integrates with the AT_EXECVE_CHECK mechanism. To enable script enforcement, interpr
ipe: Add AT_EXECVE_CHECK support for script enforcement
This patch adds a new ipe_bprm_creds_for_exec() hook that integrates with the AT_EXECVE_CHECK mechanism. To enable script enforcement, interpreters need to incorporate the AT_EXECVE_CHECK flag when calling execveat() on script files before execution.
When a userspace interpreter calls execveat() with the AT_EXECVE_CHECK flag, this hook triggers IPE policy evaluation on the script file. The hook only triggers IPE when bprm->is_check is true, ensuring it's being called from an AT_EXECVE_CHECK context. It then builds an evaluation context for an IPE_OP_EXEC operation and invokes IPE policy. The kernel returns the policy decision to the interpreter, which can then decide whether to proceed with script execution.
This extends IPE enforcement to indirectly executed scripts, permitting trusted scripts to execute while denying untrusted ones.
Signed-off-by: Yanzhu Huang <yanzhuhuang@linux.microsoft.com> Signed-off-by: Fan Wu <wufan@kernel.org>
show more ...
|
| f40998a8 | 27-Sep-2024 |
Luca Boccassi <bluca@debian.org> |
ipe: fallback to platform keyring also if key in trusted keyring is rejected
If enabled, we fallback to the platform keyring if the trusted keyring doesn't have the key used to sign the ipe policy.
ipe: fallback to platform keyring also if key in trusted keyring is rejected
If enabled, we fallback to the platform keyring if the trusted keyring doesn't have the key used to sign the ipe policy. But if pkcs7_verify() rejects the key for other reasons, such as usage restrictions, we do not fallback. Do so, following the same change in dm-verity.
Signed-off-by: Luca Boccassi <bluca@debian.org> Suggested-by: Serge Hallyn <serge@hallyn.com> [FW: fixed some line length issues and a typo in the commit message] Signed-off-by: Fan Wu <wufan@kernel.org>
show more ...
|
| 02e2f9aa | 15-Sep-2024 |
Luca Boccassi <bluca@debian.org> |
ipe: allow secondary and platform keyrings to install/update policies
The current policy management makes it impossible to use IPE in a general purpose distribution. In such cases the users are not
ipe: allow secondary and platform keyrings to install/update policies
The current policy management makes it impossible to use IPE in a general purpose distribution. In such cases the users are not building the kernel, the distribution is, and access to the private key included in the trusted keyring is, for obvious reason, not available. This means that users have no way to enable IPE, since there will be no built-in generic policy, and no access to the key to sign updates validated by the trusted keyring.
Just as we do for dm-verity, kernel modules and more, allow the secondary and platform keyrings to also validate policies. This allows users enrolling their own keys in UEFI db or MOK to also sign policies, and enroll them. This makes it sensible to enable IPE in general purpose distributions, as it becomes usable by any user wishing to do so. Keys in these keyrings can already load kernels and kernel modules, so there is no security downgrade.
Add a kconfig each, like dm-verity does, but default to enabled if the dependencies are available.
Signed-off-by: Luca Boccassi <bluca@debian.org> Reviewed-by: Serge Hallyn <serge@hallyn.com> [FW: fixed some style issues] Signed-off-by: Fan Wu <wufan@kernel.org>
show more ...
|