From: Denis Semakin <denis.semakin@huawei.com>
To: <linux-integrity@vger.kernel.org>
Cc: <artem.kuzin@huawei.com>, <konstantin.meskhidze@huawei.com>,
<yusongping@huawei.com>, <hukeping@huawei.com>,
<roberto.sassu@huawei.com>, <krzysztof.struczynski@huawei.com>,
<stefanb@linux.ibm.com>, <denis.semakin@huawei-partners.com>
Subject: [RFC PATCH v2 1/4] ima: Introduce PCR virtualization for IMA namespace.
Date: Mon, 31 Oct 2022 10:59:23 +0800 [thread overview]
Message-ID: <20221031025923.298708-1-denis.semakin@huawei.com> (raw)
In-Reply-To: <20221031025507.298323-1-denis.semakin@huawei.com>
Define a structure for virtual PCR and corresponding
function.
This function is called when IMA extends the real PCR register
and perform following operations:
1) Extends virtual PCR value in structure vpcr_entry;
2) XOR this vPCR with random secret;
3) Store xored value in specific field.
vpcr_digest := HASH256(vpcr_digest || new_digest);
vpcr_temp := vpcr_digest XOR vpcr_secret;
Signed-off-by: Denis Semakin <denis.semakin@huawei.com>
---
security/integrity/ima/ima.h | 11 +++++
security/integrity/ima/ima_init_ima_ns.c | 13 ++++++
security/integrity/ima/ima_ns.c | 3 ++
security/integrity/ima/ima_queue.c | 55 ++++++++++++++++++++++++
4 files changed, 82 insertions(+)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 7f263c9b5d31..cca984301968 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -119,6 +119,16 @@ struct ima_h_table {
struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
};
+struct vpcr_entry {
+ u8 vpcr_tmp[SHA256_DIGEST_SIZE];
+ u8 vpcr_digest[SHA256_DIGEST_SIZE];
+ u8 secret[SHA256_DIGEST_SIZE];
+ struct list_head list;
+};
+
+extern struct mutex vpcr_list_mutex;
+extern struct list_head vpcr_list;
+
struct ima_namespace {
unsigned long ima_ns_flags;
/* Bit numbers for above flags; use BIT() to get flag */
@@ -165,6 +175,7 @@ struct ima_namespace {
* and IMA default algo.
*/
int ima_extra_slots;
+ struct vpcr_entry vpcr;
} __randomize_layout;
extern struct ima_namespace init_ima_ns;
diff --git a/security/integrity/ima/ima_init_ima_ns.c b/security/integrity/ima/ima_init_ima_ns.c
index 986f594dd179..d29d113a322c 100644
--- a/security/integrity/ima/ima_init_ima_ns.c
+++ b/security/integrity/ima/ima_init_ima_ns.c
@@ -6,8 +6,12 @@
* Stefan Berger <stefanb@linux.vnet.ibm.com>
*/
+#include <linux/random.h>
#include "ima.h"
+LIST_HEAD(vpcr_list);
+struct mutex vpcr_list_mutex;
+
int ima_init_namespace(struct ima_namespace *ns)
{
int ret;
@@ -50,8 +54,17 @@ int ima_init_namespace(struct ima_namespace *ns)
ns->ima_tpm_chip = tpm_default_chip();
if (ns->ima_tpm_chip)
pr_info("No TPM chip found, activating TPM-bypass!\n");
+
+ mutex_init(&vpcr_list_mutex);
+ list_add(&ns->vpcr.list, &vpcr_list);
+ } else {
+ mutex_lock(&vpcr_list_mutex);
+ list_add_tail(&ns->vpcr.list, &vpcr_list);
+ mutex_unlock(&vpcr_list_mutex);
}
+ get_random_bytes(&ns->vpcr.secret, sizeof(ns->vpcr.secret));
+
set_bit(IMA_NS_ACTIVE, &ns->ima_ns_flags);
return 0;
diff --git a/security/integrity/ima/ima_ns.c b/security/integrity/ima/ima_ns.c
index 9f6ee3423d34..3f65bfbba98d 100644
--- a/security/integrity/ima/ima_ns.c
+++ b/security/integrity/ima/ima_ns.c
@@ -32,6 +32,9 @@ static void destroy_ima_ns(struct ima_namespace *ns)
ima_free_policy_rules(ns);
ima_free_ns_status_tree(ns);
ima_free_measurements(ns);
+ mutex_lock(&vpcr_list_mutex);
+ list_del(&ns->vpcr.list);
+ mutex_unlock(&vpcr_list_mutex);
}
void ima_free_ima_ns(struct ima_namespace *ns)
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index b7a3f608ee9d..6f1fcd4ee307 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -17,6 +17,7 @@
#include <linux/rculist.h>
#include <linux/slab.h>
+#include <crypto/algapi.h>
#include "ima.h"
#define AUDIT_CAUSE_LEN_MAX 32
@@ -127,6 +128,55 @@ unsigned long ima_get_binary_runtime_size(struct ima_namespace *ns)
return ns->binary_runtime_size + sizeof(struct ima_kexec_hdr);
}
+/**
+ * This function extends the virtual PCR for namespace.
+ * It calculates the HASH for given digest, store it in structure
+ * and XOR it with random secret.
+ * vpcr_digest := HASH(vpcr_digest || new_digest);
+ * vpcr_temp := vpcr_digest XOR vpcr_secret;
+ */
+
+static int ima_vpcr_extend(struct ima_namespace *ns,
+ struct tpm_digest *digests_arg, int pcr)
+{
+ int ret = 0;
+ u8 buf[IMA_MAX_DIGEST_SIZE * 2];
+ struct {
+ struct ima_digest_data hdr;
+ char digest[IMA_MAX_DIGEST_SIZE];
+ } hash = {};
+
+ size_t dig_len = hash_digest_size[ima_hash_algo];
+ loff_t size = SHA256_DIGEST_SIZE + dig_len;
+
+ /* paranoic zeroing */
+ memset(buf, 0, sizeof(buf));
+ memset(&hash.digest, 0, sizeof(hash.digest));
+
+ /* Use SHA256 hash for vPCR */
+ hash.hdr.algo = HASH_ALGO_SHA256;
+ hash.hdr.length = SHA256_DIGEST_SIZE;
+
+ memcpy(buf, ns->vpcr.vpcr_digest, SHA256_DIGEST_SIZE);
+ memcpy(buf + SHA256_DIGEST_SIZE, &digests_arg->digest[ns->ima_hash_algo_idx],
+ dig_len);
+
+ ret = ima_calc_buffer_hash(ns, buf, size, &hash.hdr);
+ if (ret < 0)
+ goto out;
+
+ if (mutex_lock_interruptible(&vpcr_list_mutex))
+ return -EINTR;
+
+ memcpy(ns->vpcr.vpcr_digest, &hash.digest, SHA256_DIGEST_SIZE);
+ crypto_xor_cpy(ns->vpcr.vpcr_tmp, ns->vpcr.vpcr_digest,
+ ns->vpcr.secret, SHA256_DIGEST_SIZE);
+ mutex_unlock(&vpcr_list_mutex);
+out:
+
+ return ret;
+}
+
static int ima_pcr_extend(struct ima_namespace *ns,
struct tpm_digest *digests_arg, int pcr)
{
@@ -135,9 +185,14 @@ static int ima_pcr_extend(struct ima_namespace *ns,
if (!ns->ima_tpm_chip)
return result;
+ result = ima_vpcr_extend(ns, digests_arg, pcr);
+ if (result != 0)
+ pr_err("Error extending vPCR, result: %d\n", result);
+
result = tpm_pcr_extend(ns->ima_tpm_chip, pcr, digests_arg);
if (result != 0)
pr_err("Error Communicating to TPM chip, result: %d\n", result);
+
return result;
}
--
2.38.GIT
next prev parent reply other threads:[~2022-10-31 2:59 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-31 2:55 [RFC PATCH v2 0/4] Virtualize PCR for Container-IMA Denis Semakin
2022-10-31 2:59 ` Denis Semakin [this message]
2022-10-31 2:59 ` [RFC PATCH v2 2/4] ima: Use tpm_chip from init IMA namespace Denis Semakin
2022-10-31 3:00 ` [RFC PATCH v2 3/4] ima: Create vpcr file on securityfs Denis Semakin
2022-10-31 3:00 ` [RFC PATCH v2 4/4] ima: Extend the real PCR12 with tempPCR value Denis Semakin
2023-01-27 8:19 ` [RFC PATCH v1 0/3] ima: vPCR debug/security Ilya Hanov
2023-01-27 8:19 ` [RFC PATCH v1 1/3] ima: Add a UUID value for each vPCR Ilya Hanov
2023-01-27 8:19 ` [RFC PATCH v1 2/3] ima: ascii_vpcr pseudo-file for sysadmins Ilya Hanov
2023-01-27 8:19 ` [RFC PATCH v1 3/3] ima: Use TPM RNG for vPCR.secret if it's presented Ilya Hanov
2023-03-29 8:58 ` [RFC PATCH v1 0/1] ima: obtain child measurement list from init namespace Denis Semakin
2023-05-02 13:36 ` Stefan Berger
2023-05-02 14:00 ` Denis Semakin
2023-03-29 9:03 ` [RFC PATCH v1 1/1] " Denis Semakin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221031025923.298708-1-denis.semakin@huawei.com \
--to=denis.semakin@huawei.com \
--cc=artem.kuzin@huawei.com \
--cc=denis.semakin@huawei-partners.com \
--cc=hukeping@huawei.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=krzysztof.struczynski@huawei.com \
--cc=linux-integrity@vger.kernel.org \
--cc=roberto.sassu@huawei.com \
--cc=stefanb@linux.ibm.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).