1 files changed, 7 insertions, 0 deletions

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index cea84d8bd7be..07099a8bc283 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -84,6 +84,7 @@ static struct ima_rule_entry default_rules[] = {
         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, .uid = GLOBAL_ROOT_UID,
          .flags = IMA_FUNC | IMA_MASK | IMA_UID},
         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
+        {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 };
 
 static struct ima_rule_entry default_appraise_rules[] = {
@@ -241,6 +242,8 @@ static int get_subaction(struct ima_rule_entry *rule, int func)
                 return IMA_BPRM_APPRAISE;
         case MODULE_CHECK:
                 return IMA_MODULE_APPRAISE;
+        case FIRMWARE_CHECK:
+                return IMA_FIRMWARE_APPRAISE;
         case FILE_CHECK:
         default:
                 return IMA_FILE_APPRAISE;
@@ -486,6 +489,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
                                 entry->func = FILE_CHECK;
                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
                                 entry->func = MODULE_CHECK;
+                        else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
+                                entry->func = FIRMWARE_CHECK;
                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
                                 entry->func = MMAP_CHECK;
@@ -636,6 +641,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
                 result = -EINVAL;
         else if (entry->func == MODULE_CHECK)
                 ima_appraise |= IMA_APPRAISE_MODULES;
+        else if (entry->func == FIRMWARE_CHECK)
+                ima_appraise |= IMA_APPRAISE_FIRMWARE;
         audit_log_format(ab, "res=%d", !result);
         audit_log_end(ab);
         return result;