From: Tushar Sugandhi <tusharsu@linux.microsoft.com> To: dm-devel@redhat.com, agk@redhat.com, snitzer@redhat.com Cc: zohar@linux.ibm.com, linux-integrity@vger.kernel.org, nramas@linux.microsoft.com, tusharsu@linux.microsoft.com Subject: [PATCH 0/7] device mapper target measurements using IMA Date: Mon, 12 Jul 2021 17:48:57 -0700 [thread overview] Message-ID: <20210713004904.8808-1-tusharsu@linux.microsoft.com> (raw) For a given system, various external services/infrastructure tools (including the attestation service) interact with it - both during the setup and during rest of the system run-time. They share sensitive data and/or execute critical workload on that system. The external services may want to verify the current run-time state of the relevant kernel subsystems before fully trusting the system with business-critical data/workload. Device mapper is one such kernel subsystem that plays a critical role on a given system by providing various important functionalities to the block devices with various target types like crypt, verity, integrity etc. Each of these target types’ functionalities can be configured with various attributes. The attributes chosen to configure these target types can significantly impact the security profile of the block device, and in-turn, of the system itself. For instance, the type of encryption algorithm and the key size determines the strength of encryption for a given block device. Therefore, verifying the current state of various block devices as well as their various target attributes is crucial for external services before fully trusting the system with business-critical data/workload. IMA provides the necessary functionality for device mapper to measure the state and configuration of various block devices - - BY device mapper itself, from within the kernel, - in a tamper resistant way, - and re-measured - triggered on state/configuration change. This patch series uses this IMA functionality, by calling the function ima_measure_critical_data(), when a block device state is changed (e.g. on device create, resume, rename, remove etc.) It measures the device state and configuration and stores it in IMA logs, so that it can be used by external services for managing the system. Tushar Sugandhi (7): dm: measure data on table load dm: measure data on device resume dm: measure data on device remove dm: measure data on table clear dm: measure data on device rename dm: update target specific status functions to measure data dm: add documentation for IMA measurement support .../admin-guide/device-mapper/dm-ima.rst | 306 ++++++++ .../admin-guide/device-mapper/index.rst | 1 + drivers/md/Makefile | 2 + drivers/md/dm-cache-target.c | 24 + drivers/md/dm-clone-target.c | 7 + drivers/md/dm-core.h | 5 + drivers/md/dm-crypt.c | 29 + drivers/md/dm-delay.c | 4 + drivers/md/dm-dust.c | 4 + drivers/md/dm-ebs-target.c | 3 + drivers/md/dm-era-target.c | 4 + drivers/md/dm-flakey.c | 4 + drivers/md/dm-ima.c | 725 ++++++++++++++++++ drivers/md/dm-ima.h | 56 ++ drivers/md/dm-integrity.c | 24 + drivers/md/dm-ioctl.c | 24 +- drivers/md/dm-linear.c | 8 + drivers/md/dm-log-userspace-base.c | 3 + drivers/md/dm-log-writes.c | 4 + drivers/md/dm-log.c | 10 + drivers/md/dm-mpath.c | 29 + drivers/md/dm-ps-historical-service-time.c | 3 + drivers/md/dm-ps-io-affinity.c | 3 + drivers/md/dm-ps-queue-length.c | 3 + drivers/md/dm-ps-round-robin.c | 4 + drivers/md/dm-ps-service-time.c | 3 + drivers/md/dm-raid.c | 39 + drivers/md/dm-raid1.c | 18 + drivers/md/dm-snap-persistent.c | 4 + drivers/md/dm-snap-transient.c | 4 + drivers/md/dm-snap.c | 13 + drivers/md/dm-stripe.c | 16 + drivers/md/dm-switch.c | 4 + drivers/md/dm-thin.c | 8 + drivers/md/dm-unstripe.c | 4 + drivers/md/dm-verity-target.c | 45 ++ drivers/md/dm-writecache.c | 3 + drivers/md/dm-zoned-target.c | 3 + drivers/md/dm.c | 3 + include/linux/device-mapper.h | 6 +- include/uapi/linux/dm-ioctl.h | 6 + 41 files changed, 1464 insertions(+), 4 deletions(-) create mode 100644 Documentation/admin-guide/device-mapper/dm-ima.rst create mode 100644 drivers/md/dm-ima.c create mode 100644 drivers/md/dm-ima.h -- 2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: Tushar Sugandhi <tusharsu@linux.microsoft.com> To: dm-devel@redhat.com, agk@redhat.com, snitzer@redhat.com Cc: tusharsu@linux.microsoft.com, nramas@linux.microsoft.com, linux-integrity@vger.kernel.org, zohar@linux.ibm.com Subject: [dm-devel] [PATCH 0/7] device mapper target measurements using IMA Date: Mon, 12 Jul 2021 17:48:57 -0700 [thread overview] Message-ID: <20210713004904.8808-1-tusharsu@linux.microsoft.com> (raw) For a given system, various external services/infrastructure tools (including the attestation service) interact with it - both during the setup and during rest of the system run-time. They share sensitive data and/or execute critical workload on that system. The external services may want to verify the current run-time state of the relevant kernel subsystems before fully trusting the system with business-critical data/workload. Device mapper is one such kernel subsystem that plays a critical role on a given system by providing various important functionalities to the block devices with various target types like crypt, verity, integrity etc. Each of these target types’ functionalities can be configured with various attributes. The attributes chosen to configure these target types can significantly impact the security profile of the block device, and in-turn, of the system itself. For instance, the type of encryption algorithm and the key size determines the strength of encryption for a given block device. Therefore, verifying the current state of various block devices as well as their various target attributes is crucial for external services before fully trusting the system with business-critical data/workload. IMA provides the necessary functionality for device mapper to measure the state and configuration of various block devices - - BY device mapper itself, from within the kernel, - in a tamper resistant way, - and re-measured - triggered on state/configuration change. This patch series uses this IMA functionality, by calling the function ima_measure_critical_data(), when a block device state is changed (e.g. on device create, resume, rename, remove etc.) It measures the device state and configuration and stores it in IMA logs, so that it can be used by external services for managing the system. Tushar Sugandhi (7): dm: measure data on table load dm: measure data on device resume dm: measure data on device remove dm: measure data on table clear dm: measure data on device rename dm: update target specific status functions to measure data dm: add documentation for IMA measurement support .../admin-guide/device-mapper/dm-ima.rst | 306 ++++++++ .../admin-guide/device-mapper/index.rst | 1 + drivers/md/Makefile | 2 + drivers/md/dm-cache-target.c | 24 + drivers/md/dm-clone-target.c | 7 + drivers/md/dm-core.h | 5 + drivers/md/dm-crypt.c | 29 + drivers/md/dm-delay.c | 4 + drivers/md/dm-dust.c | 4 + drivers/md/dm-ebs-target.c | 3 + drivers/md/dm-era-target.c | 4 + drivers/md/dm-flakey.c | 4 + drivers/md/dm-ima.c | 725 ++++++++++++++++++ drivers/md/dm-ima.h | 56 ++ drivers/md/dm-integrity.c | 24 + drivers/md/dm-ioctl.c | 24 +- drivers/md/dm-linear.c | 8 + drivers/md/dm-log-userspace-base.c | 3 + drivers/md/dm-log-writes.c | 4 + drivers/md/dm-log.c | 10 + drivers/md/dm-mpath.c | 29 + drivers/md/dm-ps-historical-service-time.c | 3 + drivers/md/dm-ps-io-affinity.c | 3 + drivers/md/dm-ps-queue-length.c | 3 + drivers/md/dm-ps-round-robin.c | 4 + drivers/md/dm-ps-service-time.c | 3 + drivers/md/dm-raid.c | 39 + drivers/md/dm-raid1.c | 18 + drivers/md/dm-snap-persistent.c | 4 + drivers/md/dm-snap-transient.c | 4 + drivers/md/dm-snap.c | 13 + drivers/md/dm-stripe.c | 16 + drivers/md/dm-switch.c | 4 + drivers/md/dm-thin.c | 8 + drivers/md/dm-unstripe.c | 4 + drivers/md/dm-verity-target.c | 45 ++ drivers/md/dm-writecache.c | 3 + drivers/md/dm-zoned-target.c | 3 + drivers/md/dm.c | 3 + include/linux/device-mapper.h | 6 +- include/uapi/linux/dm-ioctl.h | 6 + 41 files changed, 1464 insertions(+), 4 deletions(-) create mode 100644 Documentation/admin-guide/device-mapper/dm-ima.rst create mode 100644 drivers/md/dm-ima.c create mode 100644 drivers/md/dm-ima.h -- 2.25.1 -- dm-devel mailing list dm-devel@redhat.com https://listman.redhat.com/mailman/listinfo/dm-devel
next reply other threads:[~2021-07-13 0:49 UTC|newest] Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-07-13 0:48 Tushar Sugandhi [this message] 2021-07-13 0:48 ` [dm-devel] [PATCH 0/7] device mapper target measurements using IMA Tushar Sugandhi 2021-07-13 0:48 ` [PATCH 1/7] dm: measure data on table load Tushar Sugandhi 2021-07-13 0:48 ` [dm-devel] " Tushar Sugandhi 2021-07-21 2:12 ` Mimi Zohar 2021-07-21 2:12 ` [dm-devel] " Mimi Zohar 2021-07-21 15:42 ` Mike Snitzer 2021-07-21 15:42 ` [dm-devel] " Mike Snitzer 2021-07-21 16:07 ` Mimi Zohar 2021-07-21 16:07 ` [dm-devel] " Mimi Zohar 2021-07-21 21:17 ` Mimi Zohar 2021-07-21 21:17 ` [dm-devel] " Mimi Zohar 2021-07-29 19:58 ` Tushar Sugandhi 2021-07-29 19:58 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:48 ` [PATCH 2/7] dm: measure data on device resume Tushar Sugandhi 2021-07-13 0:48 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 3/7] dm: measure data on device remove Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 4/7] dm: measure data on table clear Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 5/7] dm: measure data on device rename Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 6/7] dm: update target specific status functions to measure data Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-13 1:06 ` Alasdair G Kergon 2021-07-13 1:06 ` [dm-devel] " Alasdair G Kergon 2021-07-14 20:23 ` Tushar Sugandhi 2021-07-14 20:23 ` [dm-devel] " Tushar Sugandhi 2021-07-13 0:49 ` [PATCH 7/7] dm: add documentation for IMA measurement support Tushar Sugandhi 2021-07-13 0:49 ` [dm-devel] " Tushar Sugandhi 2021-07-21 2:33 ` Mimi Zohar 2021-07-21 2:33 ` [dm-devel] " Mimi Zohar 2021-07-24 7:25 ` Tushar Sugandhi 2021-07-24 7:25 ` [dm-devel] " Tushar Sugandhi 2021-07-26 16:33 ` Mimi Zohar 2021-07-26 16:33 ` [dm-devel] " Mimi Zohar 2021-07-26 18:28 ` Tushar Sugandhi 2021-07-26 18:28 ` [dm-devel] " Tushar Sugandhi 2021-07-14 11:32 ` [dm-devel] [PATCH 0/7] device mapper target measurements using IMA Thore Sommer 2021-07-14 11:32 ` Thore Sommer 2021-07-14 20:20 ` Tushar Sugandhi 2021-07-14 20:20 ` Tushar Sugandhi 2021-07-27 10:18 ` Thore Sommer 2021-07-27 10:18 ` Thore Sommer 2021-07-27 20:33 ` Alasdair G Kergon 2021-07-27 20:33 ` Alasdair G Kergon 2021-07-28 3:10 ` Tushar Sugandhi 2021-07-28 3:10 ` Tushar Sugandhi 2021-07-28 17:14 ` Thore Sommer 2021-07-28 17:14 ` Thore Sommer 2021-07-29 17:32 ` Tushar Sugandhi 2021-07-29 17:32 ` Tushar Sugandhi 2021-07-28 17:34 ` Thore Sommer 2021-07-28 17:34 ` Thore Sommer 2021-07-28 21:33 ` Alasdair G Kergon 2021-07-28 21:33 ` Alasdair G Kergon 2021-08-02 10:45 ` Thore Sommer 2021-08-02 10:45 ` Thore Sommer 2021-07-29 19:24 ` Tushar Sugandhi 2021-07-29 19:24 ` Tushar Sugandhi 2021-08-02 10:38 ` Thore Sommer 2021-08-02 10:38 ` Thore Sommer 2021-07-20 21:27 ` Mike Snitzer 2021-07-20 21:27 ` [dm-devel] " Mike Snitzer 2021-07-24 6:57 ` Tushar Sugandhi
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210713004904.8808-1-tusharsu@linux.microsoft.com \ --to=tusharsu@linux.microsoft.com \ --cc=agk@redhat.com \ --cc=dm-devel@redhat.com \ --cc=linux-integrity@vger.kernel.org \ --cc=nramas@linux.microsoft.com \ --cc=snitzer@redhat.com \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.