From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-26.2 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT, USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40A70C4361B for ; Wed, 9 Dec 2020 19:44:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E592223BC6 for ; Wed, 9 Dec 2020 19:44:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387969AbgLIToa (ORCPT ); Wed, 9 Dec 2020 14:44:30 -0500 Received: from linux.microsoft.com ([13.77.154.182]:47628 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387840AbgLITnp (ORCPT ); Wed, 9 Dec 2020 14:43:45 -0500 Received: from tusharsu-Ubuntu.lan (c-71-197-163-6.hsd1.wa.comcast.net [71.197.163.6]) by linux.microsoft.com (Postfix) with ESMTPSA id 0904320B718B; Wed, 9 Dec 2020 11:42:26 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 0904320B718B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1607542946; bh=a5f+ij0E0tDSy+bJfyUc0/IK+DK1TBFrlmTbWMu4t+0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FD3vrDkDlo6QTkWauiE9QzwtM+mluPQ6yhVNFD7T9OU9ijug1v0jKhU5B8IENxgZK e4Yg5U8HpJnQtE/yaVj3LmJ44f4giK57g87WSXqoqjcr2evPDuAr4Utmy7yLFx7JC4 Rpzd0ypeZLHaLdR6SdaprLtBjpSLXIN8Qo326gNQ= From: Tushar Sugandhi To: zohar@linux.ibm.com, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Cc: tyhicks@linux.microsoft.com, sashal@kernel.org, jmorris@namei.org, nramas@linux.microsoft.com, linux-integrity@vger.kernel.org, selinux@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dm-devel@redhat.com Subject: [PATCH v7 6/8] IMA: extend critical data hook to limit the measurement based on a label Date: Wed, 9 Dec 2020 11:42:10 -0800 Message-Id: <20201209194212.5131-7-tusharsu@linux.microsoft.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201209194212.5131-1-tusharsu@linux.microsoft.com> References: <20201209194212.5131-1-tusharsu@linux.microsoft.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The IMA hook ima_measure_critical_data() does not support a way to specify the source of the critical data provider. Thus, the data measurement cannot be constrained based on the data source label in the IMA policy. Extend the IMA hook ima_measure_critical_data() to support passing the data source label as an input parameter, so that the policy rule can be used to limit the measurements based on the label. Signed-off-by: Tushar Sugandhi --- include/linux/ima.h | 6 ++++-- security/integrity/ima/ima_main.c | 11 ++++++++--- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/include/linux/ima.h b/include/linux/ima.h index 675f54db6264..6434287a81cd 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -30,7 +30,8 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size, extern void ima_post_path_mknod(struct dentry *dentry); extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); -extern void ima_measure_critical_data(const char *event_name, +extern void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash); @@ -125,7 +126,8 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) } static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} -static inline void ima_measure_critical_data(const char *event_name, +static inline void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash) {} #endif /* CONFIG_IMA */ diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index ae59f4a4dd70..7c633901f441 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -924,6 +924,7 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) /** * ima_measure_critical_data - measure kernel integrity critical data + * @event_data_source: kernel data source being measured * @event_name: event name to be used for the buffer entry * @buf: pointer to buffer containing data to measure * @buf_len: length of buffer(in bytes) @@ -932,6 +933,9 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) * Measure the kernel subsystem data, critical to the integrity of the kernel, * into the IMA log and extend the @pcr. * + * Use @event_data_source to describe the kernel data source for the buffer + * being measured. + * * Use @event_name to describe the state/buffer data change. * Examples of critical data (buf) could be kernel in-memory r/o structures, * hash of the memory structures, or data that represents subsystem state @@ -944,17 +948,18 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) * * The data (buf) can only be measured, not appraised. */ -void ima_measure_critical_data(const char *event_name, +void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash) { - if (!event_name || !buf || !buf_len) { + if (!event_name || !event_data_source || !buf || !buf_len) { pr_err("Invalid arguments passed to %s().\n", __func__); return; } process_buffer_measurement(NULL, buf, buf_len, event_name, - CRITICAL_DATA, 0, NULL, + CRITICAL_DATA, 0, event_data_source, measure_buf_hash); } -- 2.17.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8DDD8C433FE for ; Thu, 10 Dec 2020 14:45:01 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id DE71622D74 for ; Thu, 10 Dec 2020 14:45:00 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DE71622D74 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=dm-devel-bounces@redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-425-uvHWZs3-NlGfQqiWCInyKA-1; Thu, 10 Dec 2020 09:44:55 -0500 X-MC-Unique: uvHWZs3-NlGfQqiWCInyKA-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 27FB7800D53; Thu, 10 Dec 2020 14:44:49 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 074FD10016F4; Thu, 10 Dec 2020 14:44:49 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id AD6F34E58E; Thu, 10 Dec 2020 14:44:48 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 0B9JgWAA017701 for ; Wed, 9 Dec 2020 14:42:33 -0500 Received: by smtp.corp.redhat.com (Postfix) id DB7F210F8E2D; Wed, 9 Dec 2020 19:42:32 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast03.extmail.prod.ext.rdu2.redhat.com [10.11.55.19]) by smtp.corp.redhat.com (Postfix) with ESMTPS id D74CA10F8E2A for ; Wed, 9 Dec 2020 19:42:30 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id EDC4D811E92 for ; Wed, 9 Dec 2020 19:42:29 +0000 (UTC) Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by relay.mimecast.com with ESMTP id us-mta-141-B_L2_ICIMROB3VDKaSZ6fw-1; Wed, 09 Dec 2020 14:42:27 -0500 X-MC-Unique: B_L2_ICIMROB3VDKaSZ6fw-1 Received: from tusharsu-Ubuntu.lan (c-71-197-163-6.hsd1.wa.comcast.net [71.197.163.6]) by linux.microsoft.com (Postfix) with ESMTPSA id 0904320B718B; Wed, 9 Dec 2020 11:42:26 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 0904320B718B From: Tushar Sugandhi To: zohar@linux.ibm.com, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Date: Wed, 9 Dec 2020 11:42:10 -0800 Message-Id: <20201209194212.5131-7-tusharsu@linux.microsoft.com> In-Reply-To: <20201209194212.5131-1-tusharsu@linux.microsoft.com> References: <20201209194212.5131-1-tusharsu@linux.microsoft.com> X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-loop: dm-devel@redhat.com X-Mailman-Approved-At: Thu, 10 Dec 2020 09:44:21 -0500 Cc: sashal@kernel.org, dm-devel@redhat.com, selinux@vger.kernel.org, jmorris@namei.org, linux-kernel@vger.kernel.org, nramas@linux.microsoft.com, linux-security-module@vger.kernel.org, tyhicks@linux.microsoft.com, linux-integrity@vger.kernel.org Subject: [dm-devel] [PATCH v7 6/8] IMA: extend critical data hook to limit the measurement based on a label X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dm-devel-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit The IMA hook ima_measure_critical_data() does not support a way to specify the source of the critical data provider. Thus, the data measurement cannot be constrained based on the data source label in the IMA policy. Extend the IMA hook ima_measure_critical_data() to support passing the data source label as an input parameter, so that the policy rule can be used to limit the measurements based on the label. Signed-off-by: Tushar Sugandhi --- include/linux/ima.h | 6 ++++-- security/integrity/ima/ima_main.c | 11 ++++++++--- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/include/linux/ima.h b/include/linux/ima.h index 675f54db6264..6434287a81cd 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -30,7 +30,8 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size, extern void ima_post_path_mknod(struct dentry *dentry); extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); -extern void ima_measure_critical_data(const char *event_name, +extern void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash); @@ -125,7 +126,8 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) } static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} -static inline void ima_measure_critical_data(const char *event_name, +static inline void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash) {} #endif /* CONFIG_IMA */ diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index ae59f4a4dd70..7c633901f441 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -924,6 +924,7 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) /** * ima_measure_critical_data - measure kernel integrity critical data + * @event_data_source: kernel data source being measured * @event_name: event name to be used for the buffer entry * @buf: pointer to buffer containing data to measure * @buf_len: length of buffer(in bytes) @@ -932,6 +933,9 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) * Measure the kernel subsystem data, critical to the integrity of the kernel, * into the IMA log and extend the @pcr. * + * Use @event_data_source to describe the kernel data source for the buffer + * being measured. + * * Use @event_name to describe the state/buffer data change. * Examples of critical data (buf) could be kernel in-memory r/o structures, * hash of the memory structures, or data that represents subsystem state @@ -944,17 +948,18 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) * * The data (buf) can only be measured, not appraised. */ -void ima_measure_critical_data(const char *event_name, +void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash) { - if (!event_name || !buf || !buf_len) { + if (!event_name || !event_data_source || !buf || !buf_len) { pr_err("Invalid arguments passed to %s().\n", __func__); return; } process_buffer_measurement(NULL, buf, buf_len, event_name, - CRITICAL_DATA, 0, NULL, + CRITICAL_DATA, 0, event_data_source, measure_buf_hash); } -- 2.17.1 -- dm-devel mailing list dm-devel@redhat.com https://www.redhat.com/mailman/listinfo/dm-devel