1 files changed, 9 insertions, 1 deletions

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 71fecfef0939..e467664965e7 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -472,8 +472,10 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
 
         if (!file && read_id == READING_FIRMWARE) {
                 if ((ima_appraise & IMA_APPRAISE_FIRMWARE) &&
-                    (ima_appraise & IMA_APPRAISE_ENFORCE))
+                    (ima_appraise & IMA_APPRAISE_ENFORCE)) {
+                        pr_err("Prevent firmware loading_store.\n");
                         return -EACCES; /* INTEGRITY_UNKNOWN */
+                }
                 return 0;
         }
 
@@ -517,6 +519,12 @@ int ima_load_data(enum kernel_load_data_id id)
                         pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
                         return -EACCES; /* INTEGRITY_UNKNOWN */
                 }
+                break;
+        case LOADING_FIRMWARE:
+                if (ima_appraise & IMA_APPRAISE_FIRMWARE) {
+                        pr_err("Prevent firmware sysfs fallback loading.\n");
+                        return -EACCES; /* INTEGRITY_UNKNOWN */
+                }
         default:
                 break;
         }