From cb8f26d82a35ba56f3bd40cd6ba105de03602a4b Mon Sep 17 00:00:00 2001 From: Stefan Berger Date: Fri, 28 Apr 2023 08:23:10 -0400 Subject: ima: Fix the ima_policy_appraise_all to appraise executables & libraries Fix the ima_policy_appraise_all policy to appraise all executables and libraries. Also update the list of files that are not appraised to not appraise cgroup related files. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster --- .../ima_policy_appraise_all/files/ima_policy_appraise_all | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/meta-integrity/recipes-security/ima_policy_appraise_all/files/ima_policy_appraise_all b/meta-integrity/recipes-security/ima_policy_appraise_all/files/ima_policy_appraise_all index 36e71a7..3498025 100644 --- a/meta-integrity/recipes-security/ima_policy_appraise_all/files/ima_policy_appraise_all +++ b/meta-integrity/recipes-security/ima_policy_appraise_all/files/ima_policy_appraise_all @@ -25,5 +25,12 @@ dont_appraise fsmagic=0xf97cff8c dont_appraise fsmagic=0x6e736673 # EFIVARFS_MAGIC dont_appraise fsmagic=0xde5e81e4 +# Cgroup +dont_appraise fsmagic=0x27e0eb +# Cgroup2 +dont_appraise fsmagic=0x63677270 -appraise +# Appraise libraries +appraise func=MMAP_CHECK mask=MAY_EXEC +# Appraise executables +appraise func=BPRM_CHECK -- cgit v1.2.3-54-g00ecf