Commit 7dcfeacc authored by Roberto Sassu's avatar Roberto Sassu Committed by Mimi Zohar
Browse files

ima: Define new template fields iuid and igid 



This patch defines the new template fields iuid and igid, which include
respectively the inode UID and GID. For idmapped mounts, still the original
UID and GID are provided.

These fields can be used to verify the EVM portable signature, if it was
included with the template fields sig or evmsig.

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Acked-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent cde1391a

Documentation/security/IMA-templates.rst

+2 −0
Original line number Diff line number Diff line
@@ -75,6 +75,8 @@ descriptors by adding their identifier to the format string 
 - 'modsig' the appended file signature;

 - 'buf': the buffer data that was used to generate the hash without size limitations;

 - 'evmsig': the EVM portable signature;

 - 'iuid': the inode UID;

 - 'igid': the inode GID;





Below, there is the list of defined template descriptors:

security/integrity/ima/ima_template.c

+4 −0
Original line number Diff line number Diff line
@@ -47,6 +47,10 @@ static const struct ima_template_field supported_fields[] = { 
	 .field_show = ima_show_template_sig},

	{.field_id = "evmsig", .field_init = ima_eventevmsig_init,

	 .field_show = ima_show_template_sig},

	{.field_id = "iuid", .field_init = ima_eventinodeuid_init,

	 .field_show = ima_show_template_uint},

	{.field_id = "igid", .field_init = ima_eventinodegid_init,

	 .field_show = ima_show_template_uint},

};



/*

security/integrity/ima/ima_template_lib.c

+45 −0
Original line number Diff line number Diff line
@@ -551,3 +551,48 @@ int ima_eventevmsig_init(struct ima_event_data *event_data, 
	kfree(xattr_data);

	return rc;

}



static int ima_eventinodedac_init_common(struct ima_event_data *event_data,

					 struct ima_field_data *field_data,

					 bool get_uid)

{

	unsigned int id;



	if (!event_data->file)

		return 0;



	if (get_uid)

		id = i_uid_read(file_inode(event_data->file));

	else

		id = i_gid_read(file_inode(event_data->file));



	if (ima_canonical_fmt) {

		if (sizeof(id) == sizeof(u16))

			id = cpu_to_le16(id);

		else

			id = cpu_to_le32(id);

	}



	return ima_write_template_field_data((void *)&id, sizeof(id),

					     DATA_FMT_UINT, field_data);

}



/*

 *  ima_eventinodeuid_init - include the inode UID as part of the template

 *  data

 */

int ima_eventinodeuid_init(struct ima_event_data *event_data,

			   struct ima_field_data *field_data)

{

	return ima_eventinodedac_init_common(event_data, field_data, true);

}



/*

 *  ima_eventinodegid_init - include the inode GID as part of the template

 *  data

 */

int ima_eventinodegid_init(struct ima_event_data *event_data,

			   struct ima_field_data *field_data)

{

	return ima_eventinodedac_init_common(event_data, field_data, false);

}

security/integrity/ima/ima_template_lib.h

+4 −0
Original line number Diff line number Diff line
@@ -50,4 +50,8 @@ int ima_eventmodsig_init(struct ima_event_data *event_data, 
			 struct ima_field_data *field_data);

int ima_eventevmsig_init(struct ima_event_data *event_data,

			 struct ima_field_data *field_data);

int ima_eventinodeuid_init(struct ima_event_data *event_data,

			   struct ima_field_data *field_data);

int ima_eventinodegid_init(struct ima_event_data *event_data,

			   struct ima_field_data *field_data);

#endif /* __LINUX_IMA_TEMPLATE_LIB_H */