Skip to content

[FEATURE] Enable IMA so MOK-signed modules load under Secure Boot #862

@mbocevski

Description

@mbocevski

Pre-flight checklist

  • I have searched existing issues/PRs and this has not been requested before.
  • I have read the Contributing Guidelines.

Request type

  • Kernel config change (enable/disable option)
  • Security hardening

Summary

linux-cachyos builds with IMA disabled (# CONFIG_IMA is not set and # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set). With those off, arch_ima_get_secureboot() is a stub that always returns false (include/linux/ima.h), so load_uefi_certs() in security/integrity/platform_certs/load_uefi.c returns before load_moklist_certs() and MOK keys are never loaded into the .machine keyring:

/* the MOK/MOKx can not be trusted when secure boot is disabled */
if (!arch_ima_get_secureboot())
    return 0;

The result is that MOK-signed kernel modules can't be loaded under Secure Boot.

Proposed change: enable the same options the Fedora packaging already uses —
CONFIG_IMA, CONFIG_IMA_APPRAISE, CONFIG_IMA_APPRAISE_BOOTPARAM, CONFIG_IMA_ARCH_POLICY, CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT. On EFI x86, IMA_SECURE_AND_OR_TRUSTED_BOOT is implied once IMA + IMA_ARCH_POLICY are on.

Motivation / use case

With Secure Boot on (lockdown=integrity), DKMS modules (openrazer-dkms, nvidia-dkms, etc.) signed with the DKMS MOK key fail to load even after the key is enrolled and trusted:

modprobe: ERROR: could not insert 'razerkbd': Operation not permitted
Lockdown: modprobe: unsigned module loading is restricted

The key is enrolled and trusted (mokutil --list-enrolled and mokutil --trust-mok confirm it), but .machine stays empty. dmesg shows the UEFI:db certs loading into .platform but no UEFI:MokListRT line, even though MokListRT and MokListTrustedRT are present in the mokvar table. Enabling IMA fixes it.

This does not add a new module-signing requirement: the x86 secure-boot IMA policy only adds appraise func=MODULE_CHECK/KEXEC_KERNEL_CHECK rules when MODULE_SIG/KEXEC_SIG are off, and both are already enabled, so only measurement rules are added.

Patch / upstream reference

Already reported and fixed for the Fedora packaging in copr-linux-cachyos:

That commit enabled IMA in the .spec files; the Arch PKGBUILD never got the same change.

PR with the fix (all kernel variants): #863

Testing / benchmarks

Rebuilt linux-cachyos 7.0.10-2 with these options enabled. After reboot, .machine contains the DKMS key, dmesg shows Loading X.509 certificate: UEFI:MokListRT (MOKvar table), and the modules that were blocked now load. nvidia is unaffected (it's signed by the in-kernel build key, not the MOK).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions