powerpc/ima: Update ima arch policy to check for blacklist

BugLink: https://bugs.launchpad.net/bugs/1866909
This patch updates the arch-specific policies for PowerNV system to
make sure that the binary hash is not blacklisted.

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1572492694-6520-9-git-send-email-zohar@linux.ibm.com
(cherry picked from commit dc87f18615db9dc74a75cfb4a57ed33b07a3903a)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/arch/powerpc/kernel/ima_arch.c b/arch/powerpc/kernel/ima_arch.c
index 0ef5956c9753e89becfc7040265b1c77a73bbfcb..b9de0fb45bb92533048cfd3534677a8d0a28b227 100644 (file)
--- a/arch/powerpc/kernel/ima_arch.c
+++ b/arch/powerpc/kernel/ima_arch.c
@@ -23,9 +23,9 @@ bool arch_ima_get_secureboot(void)
  * is not enabled.
  */
 static const char *const secure_rules[] = {
-       "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig",
+       "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
 #ifndef CONFIG_MODULE_SIG_FORCE
-       "appraise func=MODULE_CHECK appraise_type=imasig|modsig",
+       "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
 #endif
        NULL
 };
@@ -49,9 +49,9 @@ static const char *const trusted_rules[] = {
 static const char *const secure_and_trusted_rules[] = {
        "measure func=KEXEC_KERNEL_CHECK template=ima-modsig",
        "measure func=MODULE_CHECK template=ima-modsig",
-       "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig",
+       "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
 #ifndef CONFIG_MODULE_SIG_FORCE
-       "appraise func=MODULE_CHECK appraise_type=imasig|modsig",
+       "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
 #endif
        NULL
 };