Commit 31604143 authored by Roberto Sassu's avatar Roberto Sassu Committed by Zheng Zengkai
Browse files

ima: Add support for measurement with digest lists 



hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

-------------------------------------------------

IMA-Measure creates a new measurement entry every time a file is measured,
unless the same entry is already in the measurement list.

This patch introduces a new type of measurement list, recognizable by the
PCR number specified with the new ima_digest_list_pcr= kernel option. This
type of measurement list includes measurements of digest lists and files
not found in those lists.

The benefit of this patch is the availability of a predictable PCR that
can be used to seal data or TPM keys to the OS software. Unlike standard
measurements, digest list measurements only indicate that files with a
digest in those lists could have been accessed, but not if and when. With
standard measurements, however, the chosen PCR is unlikely predictable.

Both standard and digest list measurements can be generated at the same
time by adding '+' as a prefix to the value of ima_digest_list_pcr=
(example: with ima_digest_list_pcr=+11, IMA generates standard measurements
with PCR 10 and digest list measurements with PCR 11).

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: default avatarTianxing Zhang <zhangtianxing3@huawei.com>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent d2f957c7

Documentation/admin-guide/kernel-parameters.txt

+9 −0
Original line number Diff line number Diff line
@@ -1745,6 +1745,15 @@ 
			Use the canonical format for the binary runtime

			measurements, instead of host native format.



	ima_digest_list_pcr=

			[IMA]

			Specify which PCR is extended when file digests are

			not found in the loaded digest lists. If '+' is not

			specified, no measurement entry is created if the

			digest is found. Otherwise, IMA creates also entries

			with PCR 10, according to the existing behavior.

			Format: { [+]<unsigned int> }



	ima_hash=	[IMA]

			Format: { md5 | sha1 | rmd160 | sha256 | sha384

				   | sha512 | ... }

security/integrity/ima/ima.h

+6 −3
Original line number Diff line number Diff line
@@ -53,6 +53,8 @@ extern int ima_hash_algo_idx __ro_after_init; 
extern int ima_extra_slots __ro_after_init;

extern int ima_appraise;

extern struct tpm_chip *ima_tpm_chip;

extern int ima_digest_list_pcr;

extern bool ima_plus_standard_pcr;

extern const char boot_aggregate_name[];

extern int ima_digest_list_actions;
@@ -262,7 +264,8 @@ void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file, 
			   const unsigned char *filename,

			   struct evm_ima_xattr_data *xattr_value,

			   int xattr_len, const struct modsig *modsig, int pcr,

			   struct ima_template_desc *template_desc);

			   struct ima_template_desc *template_desc,

			   struct ima_digest *digest);

void process_buffer_measurement(struct inode *inode, const void *buf, int size,

				const char *eventname, enum ima_hooks func,

				int pcr, const char *keyring);
@@ -272,8 +275,8 @@ int ima_alloc_init_template(struct ima_event_data *event_data, 
			    struct ima_template_entry **entry,

			    struct ima_template_desc *template_desc);

int ima_store_template(struct ima_template_entry *entry, int violation,

		       struct inode *inode,

		       const unsigned char *filename, int pcr);

		       struct inode *inode, const unsigned char *filename,

		       int pcr, struct ima_digest *digest);

void ima_free_template_entry(struct ima_template_entry *entry);

const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);

security/integrity/ima/ima_api.c

+35 −7
Original line number Diff line number Diff line
@@ -101,11 +101,13 @@ int ima_alloc_init_template(struct ima_event_data *event_data, 
 */

int ima_store_template(struct ima_template_entry *entry,

		       int violation, struct inode *inode,

		       const unsigned char *filename, int pcr)

		       const unsigned char *filename, int pcr,

		       struct ima_digest *digest)

{

	static const char op[] = "add_template_measure";

	static const char audit_cause[] = "hashing_error";

	char *template_name = entry->template_desc->name;

	struct ima_template_entry *duplicated_entry = NULL;

	int result;



	if (!violation) {
@@ -118,8 +120,26 @@ int ima_store_template(struct ima_template_entry *entry, 
			return result;

		}

	}



	if (ima_plus_standard_pcr && !digest) {

		duplicated_entry = kmemdup(entry,

			sizeof(*entry) + entry->template_desc->num_fields *

			sizeof(struct ima_field_data), GFP_KERNEL);

		if (duplicated_entry)

			duplicated_entry->pcr = ima_digest_list_pcr;

	} else if (!ima_plus_standard_pcr && ima_digest_list_pcr >= 0) {

		pcr = ima_digest_list_pcr;

	}



	entry->pcr = pcr;

	result = ima_add_template_entry(entry, violation, op, inode, filename);

	if (!result && duplicated_entry) {

		result = ima_add_template_entry(duplicated_entry, violation, op,

						inode, filename);

		if (result < 0)

			kfree(duplicated_entry);

	}



	return result;

}
@@ -151,8 +171,8 @@ void ima_add_violation(struct file *file, const unsigned char *filename, 
		result = -ENOMEM;

		goto err_out;

	}

	result = ima_store_template(entry, violation, inode,

				    filename, CONFIG_IMA_MEASURE_PCR_IDX);

	result = ima_store_template(entry, violation, inode, filename,

				    CONFIG_IMA_MEASURE_PCR_IDX, NULL);

	if (result < 0)

		ima_free_template_entry(entry);

err_out:
@@ -297,13 +317,14 @@ void ima_store_measurement(struct integrity_iint_cache *iint, 
			   struct file *file, const unsigned char *filename,

			   struct evm_ima_xattr_data *xattr_value,

			   int xattr_len, const struct modsig *modsig, int pcr,

			   struct ima_template_desc *template_desc)

			   struct ima_template_desc *template_desc,

			   struct ima_digest *digest)

{

	static const char op[] = "add_template_measure";

	static const char audit_cause[] = "ENOMEM";

	int result = -ENOMEM;

	struct inode *inode = file_inode(file);

	struct ima_template_entry *entry;

	struct ima_template_entry *entry = NULL;

	struct ima_event_data event_data = { .iint = iint,

					     .file = file,

					     .filename = filename,
@@ -321,6 +342,11 @@ void ima_store_measurement(struct integrity_iint_cache *iint, 
	if (iint->measured_pcrs & (0x1 << pcr) && !modsig)

		return;



	if (digest && !ima_plus_standard_pcr && ima_digest_list_pcr >= 0) {

		result = -EEXIST;

		goto out;

	}



	result = ima_alloc_init_template(&event_data, &entry, template_desc);

	if (result < 0) {

		integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
@@ -328,12 +354,14 @@ void ima_store_measurement(struct integrity_iint_cache *iint, 
		return;

	}



	result = ima_store_template(entry, violation, inode, filename, pcr);

	result = ima_store_template(entry, violation, inode, filename, pcr,

				    digest);

out:

	if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {

		iint->flags |= IMA_MEASURED;

		iint->measured_pcrs |= (0x1 << pcr);

	}

	if (result < 0)

	if (result < 0 && entry)

		ima_free_template_entry(entry);

}

security/integrity/ima/ima_digest_list.c

+25 −0
Original line number Diff line number Diff line
@@ -29,6 +29,31 @@ struct ima_h_table ima_digests_htable = { 
	.queue[0 ... IMA_MEASURE_HTABLE_SIZE - 1] = HLIST_HEAD_INIT

};



static int __init digest_list_pcr_setup(char *str)

{

	int pcr, ret;



	ret = kstrtouint(str, 10, &pcr);

	if (ret) {

		pr_err("Invalid PCR number %s\n", str);

		return 1;

	}



	if (pcr == CONFIG_IMA_MEASURE_PCR_IDX) {

		pr_err("Default PCR cannot be used for digest lists\n");

		return 1;

	}



	ima_digest_list_pcr = pcr;

	ima_digest_list_actions |= IMA_MEASURE;



	if (*str == '+')

		ima_plus_standard_pcr = true;



	return 1;

}

__setup("ima_digest_list_pcr=", digest_list_pcr_setup);



/*************************

 * Get/add/del functions *

 *************************/

security/integrity/ima/ima_init.c

+1 −1
Original line number Diff line number Diff line
@@ -86,7 +86,7 @@ static int __init ima_add_boot_aggregate(void) 


	result = ima_store_template(entry, violation, NULL,

				    boot_aggregate_name,

				    CONFIG_IMA_MEASURE_PCR_IDX);

				    CONFIG_IMA_MEASURE_PCR_IDX, NULL);

	if (result < 0) {

		ima_free_template_entry(entry);

		audit_cause = "store_entry";