* [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load
@ 2019-06-12 22:15 Prakhar Srivastava
2019-06-12 22:15 ` [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments Prakhar Srivastava
` (3 more replies)
0 siblings, 4 replies; 21+ messages in thread
From: Prakhar Srivastava @ 2019-06-12 22:15 UTC (permalink / raw)
To: linux-integrity, linux-security-module, linux-kernel
Cc: zohar, roberto.sassu, vgoyal, Prakhar Srivastava
The kexec boot command line arguments are not currently being
measured.
Currently during soft reboot(kexec)
- the PCRS are not reset
- the command line arguments used for the next kernel are not measured.
This gives the impression to the secure boot attestation that a cold boot took
place.
For secure boot attestation, it is necessary to measure the kernel
command line. For cold boot, the boot loader can be enhanced to measure
these parameters.
(https://mjg59.dreamwidth.org/48897.html)
This patch set aims to address measuring the boot command line during
soft reboot(kexec_file_load).
To achive the above the patch series does the following
-Add a new ima hook: ima_kexec_cmdline which measures the cmdline args
into the ima log, behind a new ima policy entry KEXEC_CMDLINE.
The kexec cmdline hash is stored in the "d-ng" field of the template data.
-Since the cmldine args cannot be appraised, a new template field(buf) is
added. The template field contains the buffer passed(cmldine args), which
can be used to appraise/attest at a later stage.
The kexec cmdline buffer is stored as HEX in the buf field of the event_data.
-Call the ima_kexec_cmdline(...) hook from kexec_file_load call.
The ima logs need to be carried over to the next kernel, which will be followed
up by other patchsets for x86_64 and arm64.
The kexec cmdline hash is stored in the "d-ng" field of the template data.
and can be verified using
sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements |
grep kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum
Changelog:
V8(since V7):
- added a new ima template name "ima-buf"
- code cleanup
V7:
- rebased to next-queued-testing
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/log/?h=next-queued-testing
V6:
-add a new ima hook and policy to measure the cmdline
args(ima_kexec_cmdline)
-add a new template field buf to contain the buffer measured.
[suggested by Mimi Zohar]
add new fields to ima_event_data to store/read buffer data.
[suggested by Roberto]
-call ima_kexec_cmdline from kexec_file_load path
v5:
-add a new ima hook and policy to measure the cmdline
args(ima_kexec_cmdline)
-add a new template field buf to contain the buffer measured.
[suggested by Mimi Zohar]
-call ima_kexec_cmdline from kexec_file_load path
v4:
- per feedback from LSM community, removed the LSM hook and renamed the
IMA policy to KEXEC_CMDLINE
v3: (rebase changes to next-general)
- Add policy checks for buffer[suggested by Mimi Zohar]
- use the IMA_XATTR to add buffer
- Add kexec_cmdline used for kexec file load
- Add an LSM hook to allow usage by other LSM.[suggestd by Mimi Zohar]
v2:
- Add policy checks for buffer[suggested by Mimi Zohar]
- Add an LSM hook to allow usage by other LSM.[suggestd by Mimi Zohar]
- use the IMA_XATTR to add buffer instead of sig template
v1:
-Add kconfigs to control the ima_buffer_check
-measure the cmdline args suffixed with the kernel file name
-add the buffer to the template sig field.
Prakhar Srivastava (3):
Add a new ima hook ima_kexec_cmdline to measure cmdline args
add a new ima template field buf
call ima_kexec_cmdline to measure the cmdline args
Documentation/ABI/testing/ima_policy | 1 +
Documentation/security/IMA-templates.rst | 2 +-
include/linux/ima.h | 2 +
kernel/kexec_file.c | 8 ++-
security/integrity/ima/ima.h | 3 +
security/integrity/ima/ima_api.c | 5 +-
security/integrity/ima/ima_init.c | 2 +-
security/integrity/ima/ima_main.c | 80 +++++++++++++++++++++++
security/integrity/ima/ima_policy.c | 9 +++
security/integrity/ima/ima_template.c | 2 +
security/integrity/ima/ima_template_lib.c | 20 ++++++
security/integrity/ima/ima_template_lib.h | 4 ++
12 files changed, 131 insertions(+), 7 deletions(-)
--
2.17.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments 2019-06-12 22:15 [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Prakhar Srivastava @ 2019-06-12 22:15 ` Prakhar Srivastava 2019-06-13 19:10 ` James Morris 2019-06-13 19:22 ` Mimi Zohar 2019-06-12 22:15 ` [PATCH V8 2/3] Define a new ima template field buf Prakhar Srivastava ` (2 subsequent siblings) 3 siblings, 2 replies; 21+ messages in thread From: Prakhar Srivastava @ 2019-06-12 22:15 UTC (permalink / raw) To: linux-integrity, linux-security-module, linux-kernel Cc: zohar, roberto.sassu, vgoyal, Prakhar Srivastava This patch adds support in ima to measure kexec cmdline args during soft reboot(kexec_file_load). - A new ima hook ima_kexec_cmdline is defined to be called by the kexec code. - A new function process_buffer_measurement is defined to measure the buffer hash into the ima log. - A new func policy KEXEC_CMDLINE is defined to control the measurement.[Suggested by Mimi] Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> --- Documentation/ABI/testing/ima_policy | 1 + include/linux/ima.h | 2 + security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_api.c | 1 + security/integrity/ima/ima_main.c | 77 ++++++++++++++++++++++++++++ security/integrity/ima/ima_policy.c | 9 ++++ 6 files changed, 91 insertions(+) diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy index b383c1763610..fc376a323908 100644 --- a/Documentation/ABI/testing/ima_policy +++ b/Documentation/ABI/testing/ima_policy @@ -28,6 +28,7 @@ Description: base: func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK] [FIRMWARE_CHECK] [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK] + [KEXEC_CMDLINE] mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] [[^]MAY_EXEC] fsmagic:= hex value diff --git a/include/linux/ima.h b/include/linux/ima.h index fd9f7cf4cdf5..b42f5a006042 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -26,6 +26,7 @@ extern int ima_read_file(struct file *file, enum kernel_read_file_id id); extern int ima_post_read_file(struct file *file, void *buf, loff_t size, enum kernel_read_file_id id); extern void ima_post_path_mknod(struct dentry *dentry); +extern void ima_kexec_cmdline(const void *buf, int size); #ifdef CONFIG_IMA_KEXEC extern void ima_add_kexec_buffer(struct kimage *image); @@ -92,6 +93,7 @@ static inline void ima_post_path_mknod(struct dentry *dentry) return; } +static inline void ima_kexec_cmdline(const void *buf, int size) {} #endif /* CONFIG_IMA */ #ifndef CONFIG_IMA_KEXEC diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 18b48a6d0b80..a4ad1270bffa 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -185,6 +185,7 @@ static inline unsigned long ima_hash_key(u8 *digest) hook(KEXEC_KERNEL_CHECK) \ hook(KEXEC_INITRAMFS_CHECK) \ hook(POLICY_CHECK) \ + hook(KEXEC_CMDLINE) \ hook(MAX_CHECK) #define __ima_hook_enumify(ENUM) ENUM, diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index 78eb11c7ac07..ea7d8cbf712f 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -176,6 +176,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, * subj=, obj=, type=, func=, mask=, fsmagic= * subj,obj, and type: are LSM specific. * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK + * | KEXEC_CMDLINE * mask: contains the permission mask * fsmagic: hex value * diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index af341a80118f..d78b15a0bd44 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -605,6 +605,83 @@ int ima_load_data(enum kernel_load_data_id id) return 0; } +/* + * process_buffer_measurement - Measure the buffer to ima log. + * @buf: pointer to the buffer that needs to be added to the log. + * @size: size of buffer(in bytes). + * @eventname: event name to be used for the buffer entry. + * @cred: a pointer to a credentials structure for user validation. + * @secid: the secid of the task to be validated. + * + * Based on policy, the buffer is measured into the ima log. + */ +static void process_buffer_measurement(const void *buf, int size, + const char *eventname, + const struct cred *cred, u32 secid) +{ + int ret = 0; + struct ima_template_entry *entry = NULL; + struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; + struct ima_event_data event_data = {.iint = iint }; + struct ima_template_desc *template_desc = NULL; + struct { + struct ima_digest_data hdr; + char digest[IMA_MAX_DIGEST_SIZE]; + } hash; + int violation = 0; + int pcr = CONFIG_IMA_MEASURE_PCR_IDX; + int action = 0; + + action = ima_get_action(NULL, cred, secid, 0, KEXEC_CMDLINE, &pcr, + &template_desc); + if (!(action & IMA_MEASURE)) + goto out; + + memset(iint, 0, sizeof(*iint)); + memset(&hash, 0, sizeof(hash)); + + event_data.filename = eventname; + + iint->ima_hash = &hash.hdr; + iint->ima_hash->algo = ima_hash_algo; + iint->ima_hash->length = hash_digest_size[ima_hash_algo]; + + ret = ima_calc_buffer_hash(buf, size, iint->ima_hash); + if (ret < 0) + goto out; + + ret = ima_alloc_init_template(&event_data, &entry, template_desc); + if (ret < 0) + goto out; + + if (action & IMA_MEASURE) + ret = ima_store_template(entry, violation, NULL, buf, pcr); + + if (ret < 0) + ima_free_template_entry(entry); + +out: + return; +} + +/** + * ima_kexec_cmdline - measure kexec cmdline boot args + * @buf: pointer to buffer + * @size: size of buffer + * + * Buffers can only be measured, not appraised. + */ +void ima_kexec_cmdline(const void *buf, int size) +{ + u32 secid; + + if (buf && size != 0) { + security_task_getsecid(current, &secid); + process_buffer_measurement(buf, size, "kexec-cmdline", + current_cred(), secid); + } +} + static int __init init_ima(void) { int error; diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index fd9b01881d17..98e351e13557 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -292,6 +292,13 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, { int i; + /* only incase of KEXEC_CMDLINE, inode is NULL */ + if (func == KEXEC_CMDLINE) { + if ((rule->flags & IMA_FUNC) && + (rule->func == func) && (!inode)) + return true; + return false; + } if ((rule->flags & IMA_FUNC) && (rule->func != func && func != POST_SETATTR)) return false; @@ -880,6 +887,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) entry->func = KEXEC_INITRAMFS_CHECK; else if (strcmp(args[0].from, "POLICY_CHECK") == 0) entry->func = POLICY_CHECK; + else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0) + entry->func = KEXEC_CMDLINE; else result = -EINVAL; if (!result) -- 2.19.1 ^ permalink raw reply related [flat|nested] 21+ messages in thread
* Re: [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments 2019-06-12 22:15 ` [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments Prakhar Srivastava @ 2019-06-13 19:10 ` James Morris 2019-06-13 19:22 ` Mimi Zohar 1 sibling, 0 replies; 21+ messages in thread From: James Morris @ 2019-06-13 19:10 UTC (permalink / raw) To: Prakhar Srivastava Cc: linux-integrity, linux-security-module, linux-kernel, zohar, roberto.sassu, vgoyal On Wed, 12 Jun 2019, Prakhar Srivastava wrote: > This patch adds support in ima to measure kexec cmdline args > during soft reboot(kexec_file_load). > > - A new ima hook ima_kexec_cmdline is defined to be called by the > kexec code. > - A new function process_buffer_measurement is defined to measure > the buffer hash into the ima log. > - A new func policy KEXEC_CMDLINE is defined to control the > measurement.[Suggested by Mimi] > > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> > + struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; > + struct ima_event_data event_data = {.iint = iint }; Minor nit: looks like this could be simplified to: struct integrity_iint_cache iint = {}; struct ima_event_data event_data = {.iint = &iint }; which also saves the later memset. 'hash' can also be initialized with '= {}'. -- James Morris <jmorris@namei.org> ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments 2019-06-12 22:15 ` [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments Prakhar Srivastava 2019-06-13 19:10 ` James Morris @ 2019-06-13 19:22 ` Mimi Zohar 2019-06-14 17:48 ` prakhar srivastava 1 sibling, 1 reply; 21+ messages in thread From: Mimi Zohar @ 2019-06-13 19:22 UTC (permalink / raw) To: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel Cc: roberto.sassu, vgoyal Hi Prakhar, Patches titles in the subject line need to be prefixed with the subsystem, in this case "ima: ". On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: > This patch adds support in ima to measure kexec cmdline args > during soft reboot(kexec_file_load). Based on the patch title, the word "ima" is redundant. Patch descriptions are suppose to be written in the third person. "This patch adds" is unnecessary. Please review section 3 "Describe your changes" in Documentation/process/submitting-patches.rst. > > - A new ima hook ima_kexec_cmdline is defined to be called by the > kexec code. > - A new function process_buffer_measurement is defined to measure > the buffer hash into the ima log. > - A new func policy KEXEC_CMDLINE is defined to control the > measurement.[Suggested by Mimi] > > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> > diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c > index fd9b01881d17..98e351e13557 100644 > --- a/security/integrity/ima/ima_policy.c > +++ b/security/integrity/ima/ima_policy.c > @@ -292,6 +292,13 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, > { > int i; > > + /* only incase of KEXEC_CMDLINE, inode is NULL */ > + if (func == KEXEC_CMDLINE) { > + if ((rule->flags & IMA_FUNC) && > + (rule->func == func) && (!inode)) Thank you for fixing the other formatting issues. Here's another one. Is checking !inode needed? Mimi > + return true; > + return false; > + } > if ((rule->flags & IMA_FUNC) && > (rule->func != func && func != POST_SETATTR)) > return false; > ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments 2019-06-13 19:22 ` Mimi Zohar @ 2019-06-14 17:48 ` prakhar srivastava 0 siblings, 0 replies; 21+ messages in thread From: prakhar srivastava @ 2019-06-14 17:48 UTC (permalink / raw) To: Mimi Zohar Cc: linux-integrity, linux-security-module, linux-kernel, Roberto Sassu, vgoyal On Thu, Jun 13, 2019 at 12:22 PM Mimi Zohar <zohar@linux.ibm.com> wrote: > > Hi Prakhar, > > Patches titles in the subject line need to be prefixed with the > subsystem, in this case "ima: ". > > On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: > > This patch adds support in ima to measure kexec cmdline args > > during soft reboot(kexec_file_load). > > Based on the patch title, the word "ima" is redundant. Patch > descriptions are suppose to be written in the third person. "This > patch adds" is unnecessary. Please review section 3 "Describe your > changes" in Documentation/process/submitting-patches.rst. > > > > > - A new ima hook ima_kexec_cmdline is defined to be called by the > > kexec code. > > - A new function process_buffer_measurement is defined to measure > > the buffer hash into the ima log. > > - A new func policy KEXEC_CMDLINE is defined to control the > > measurement.[Suggested by Mimi] > > > > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> > > > > diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c > > index fd9b01881d17..98e351e13557 100644 > > --- a/security/integrity/ima/ima_policy.c > > +++ b/security/integrity/ima/ima_policy.c > > @@ -292,6 +292,13 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, > > { > > int i; > > > > + /* only incase of KEXEC_CMDLINE, inode is NULL */ > > + if (func == KEXEC_CMDLINE) { > > + if ((rule->flags & IMA_FUNC) && > > + (rule->func == func) && (!inode)) > > Thank you for fixing the other formatting issues. Here's another one. > Is checking !inode needed? Since i am adding a new type(buffer) for measurement, and only one (file or buffer) can be passed in, this is guarding against passing the func as KEXEC_CMDLINE for a file. I will remove it, since the check will still return true/false, if the rule doesn't exist. and fix other formatting issues. Thanks, - Prakhar Srivastava > Mimi > > > + return true; > > + return false; > > + } > > if ((rule->flags & IMA_FUNC) && > > (rule->func != func && func != POST_SETATTR)) > > return false; > > > ^ permalink raw reply [flat|nested] 21+ messages in thread
* [PATCH V8 2/3] Define a new ima template field buf 2019-06-12 22:15 [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Prakhar Srivastava 2019-06-12 22:15 ` [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments Prakhar Srivastava @ 2019-06-12 22:15 ` Prakhar Srivastava 2019-06-13 19:15 ` James Morris 2019-06-13 19:59 ` Mimi Zohar 2019-06-12 22:15 ` [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args Prakhar Srivastava 2019-06-13 20:48 ` [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Mimi Zohar 3 siblings, 2 replies; 21+ messages in thread From: Prakhar Srivastava @ 2019-06-12 22:15 UTC (permalink / raw) To: linux-integrity, linux-security-module, linux-kernel Cc: zohar, roberto.sassu, vgoyal, Prakhar Srivastava A buffer(kexec cmdline args) measured into ima cannot be appraised without already being aware of the buffer contents. Since hashes are non-reversible, raw buffer is needed for validation or regenerating hash for appraisal/attestation. This patch adds support to ima to allow store/read the buffer contents in HEX. - Add two new fields to ima_event_data to hold the buf and buf_len [Suggested by Roberto] - Add a new temaplte field 'buf' to be used to store/read the buffer data.[Suggested by Mimi] - Updated process_buffer_meaurement to add the buffer to ima_event_data. process_buffer_measurement added in "Define a new IMA hook to measure the boot command line arguments" - Add a new template policy name ima-buf to represent 'd-ng|n-ng|buf' Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> --- Documentation/security/IMA-templates.rst | 7 ++++--- security/integrity/ima/ima.h | 2 ++ security/integrity/ima/ima_api.c | 4 ++-- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 2 ++ security/integrity/ima/ima_template.c | 3 +++ security/integrity/ima/ima_template_lib.c | 21 +++++++++++++++++++++ security/integrity/ima/ima_template_lib.h | 4 ++++ 8 files changed, 39 insertions(+), 6 deletions(-) diff --git a/Documentation/security/IMA-templates.rst b/Documentation/security/IMA-templates.rst index 2cd0e273cc9a..fccdbbc984f5 100644 --- a/Documentation/security/IMA-templates.rst +++ b/Documentation/security/IMA-templates.rst @@ -69,14 +69,15 @@ descriptors by adding their identifier to the format string algorithm (field format: [<hash algo>:]digest, where the digest prefix is shown only if the hash algorithm is not SHA1 or MD5); - 'n-ng': the name of the event, without size limitations; - - 'sig': the file signature. - + - 'sig': the file signature; + - 'buf': the buffer data that was used to generate the hash without size limitations; Below, there is the list of defined template descriptors: - "ima": its format is ``d|n``; - "ima-ng" (default): its format is ``d-ng|n-ng``; - - "ima-sig": its format is ``d-ng|n-ng|sig``. + - "ima-sig": its format is ``d-ng|n-ng|sig``; + - "ima-buf": its format is ``d-ng|n-ng|buf``; diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index a4ad1270bffa..16110180545c 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -65,6 +65,8 @@ struct ima_event_data { struct evm_ima_xattr_data *xattr_value; int xattr_len; const char *violation; + const void *buf; + int buf_len; }; /* IMA template field data definition */ diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index ea7d8cbf712f..83ca99d65e4b 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -140,7 +140,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, struct ima_template_entry *entry; struct inode *inode = file_inode(file); struct ima_event_data event_data = {iint, file, filename, NULL, 0, - cause}; + cause, NULL, 0}; int violation = 1; int result; @@ -296,7 +296,7 @@ void ima_store_measurement(struct integrity_iint_cache *iint, struct inode *inode = file_inode(file); struct ima_template_entry *entry; struct ima_event_data event_data = {iint, file, filename, xattr_value, - xattr_len, NULL}; + xattr_len, NULL, NULL, 0}; int violation = 0; if (iint->measured_pcrs & (0x1 << pcr)) diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c index 993d0f1915ff..c8591406c0e2 100644 --- a/security/integrity/ima/ima_init.c +++ b/security/integrity/ima/ima_init.c @@ -50,7 +50,7 @@ static int __init ima_add_boot_aggregate(void) struct ima_template_entry *entry; struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; struct ima_event_data event_data = {iint, NULL, boot_aggregate_name, - NULL, 0, NULL}; + NULL, 0, NULL, NULL, 0}; int result = -ENOMEM; int violation = 0; struct { diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index d78b15a0bd44..720151b766fa 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -641,6 +641,8 @@ static void process_buffer_measurement(const void *buf, int size, memset(&hash, 0, sizeof(hash)); event_data.filename = eventname; + event_data.buf = buf; + event_data.buf_len = size; iint->ima_hash = &hash.hdr; iint->ima_hash->algo = ima_hash_algo; diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c index e6e892f31cbd..632f314c0e5a 100644 --- a/security/integrity/ima/ima_template.c +++ b/security/integrity/ima/ima_template.c @@ -26,6 +26,7 @@ static struct ima_template_desc builtin_templates[] = { {.name = IMA_TEMPLATE_IMA_NAME, .fmt = IMA_TEMPLATE_IMA_FMT}, {.name = "ima-ng", .fmt = "d-ng|n-ng"}, {.name = "ima-sig", .fmt = "d-ng|n-ng|sig"}, + {.name = "ima-buf", .fmt = "d-ng|n-ng|buf"}, {.name = "", .fmt = ""}, /* placeholder for a custom format */ }; @@ -43,6 +44,8 @@ static const struct ima_template_field supported_fields[] = { .field_show = ima_show_template_string}, {.field_id = "sig", .field_init = ima_eventsig_init, .field_show = ima_show_template_sig}, + {.field_id = "buf", .field_init = ima_eventbuf_init, + .field_show = ima_show_template_buf}, }; #define MAX_TEMPLATE_NAME_LEN 15 diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c index 513b457ae900..baf4de45c5aa 100644 --- a/security/integrity/ima/ima_template_lib.c +++ b/security/integrity/ima/ima_template_lib.c @@ -162,6 +162,12 @@ void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); } +void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, + struct ima_field_data *field_data) +{ + ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); +} + /** * ima_parse_buf() - Parses lengths and data from an input buffer * @bufstartp: Buffer start address. @@ -389,3 +395,18 @@ int ima_eventsig_init(struct ima_event_data *event_data, return ima_write_template_field_data(xattr_value, event_data->xattr_len, DATA_FMT_HEX, field_data); } + +/* + * ima_eventbuf_init - include the buffer(kexec-cmldine) as part of the + * template data. + */ +int ima_eventbuf_init(struct ima_event_data *event_data, + struct ima_field_data *field_data) +{ + if ((!event_data->buf) || (event_data->buf_len == 0)) + return 0; + + return ima_write_template_field_data(event_data->buf, + event_data->buf_len, DATA_FMT_HEX, + field_data); +} diff --git a/security/integrity/ima/ima_template_lib.h b/security/integrity/ima/ima_template_lib.h index 6a3d8b831deb..f0178bc60c55 100644 --- a/security/integrity/ima/ima_template_lib.h +++ b/security/integrity/ima/ima_template_lib.h @@ -29,6 +29,8 @@ void ima_show_template_string(struct seq_file *m, enum ima_show_type show, struct ima_field_data *field_data); void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, struct ima_field_data *field_data); +void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, + struct ima_field_data *field_data); int ima_parse_buf(void *bufstartp, void *bufendp, void **bufcurp, int maxfields, struct ima_field_data *fields, int *curfields, unsigned long *len_mask, int enforce_mask, char *bufname); @@ -42,4 +44,6 @@ int ima_eventname_ng_init(struct ima_event_data *event_data, struct ima_field_data *field_data); int ima_eventsig_init(struct ima_event_data *event_data, struct ima_field_data *field_data); +int ima_eventbuf_init(struct ima_event_data *event_data, + struct ima_field_data *field_data); #endif /* __LINUX_IMA_TEMPLATE_LIB_H */ -- 2.19.1 ^ permalink raw reply related [flat|nested] 21+ messages in thread
* Re: [PATCH V8 2/3] Define a new ima template field buf 2019-06-12 22:15 ` [PATCH V8 2/3] Define a new ima template field buf Prakhar Srivastava @ 2019-06-13 19:15 ` James Morris 2019-06-13 19:59 ` Mimi Zohar 1 sibling, 0 replies; 21+ messages in thread From: James Morris @ 2019-06-13 19:15 UTC (permalink / raw) To: Prakhar Srivastava Cc: linux-integrity, linux-security-module, linux-kernel, zohar, roberto.sassu, vgoyal On Wed, 12 Jun 2019, Prakhar Srivastava wrote: > A buffer(kexec cmdline args) measured into ima cannot be > appraised without already being aware of the buffer contents. > Since hashes are non-reversible, raw buffer is needed for > validation or regenerating hash for appraisal/attestation. > > This patch adds support to ima to allow store/read the > buffer contents in HEX. > > - Add two new fields to ima_event_data to hold the buf and > buf_len [Suggested by Roberto] > - Add a new temaplte field 'buf' to be used to store/read > the buffer data.[Suggested by Mimi] > - Updated process_buffer_meaurement to add the buffer to > ima_event_data. process_buffer_measurement added in > "Define a new IMA hook to measure the boot command line > arguments" > - Add a new template policy name ima-buf to represent > 'd-ng|n-ng|buf' > > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> > Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by: James Morris <jamorris@linux.microsoft.com> -- James Morris <jmorris@namei.org> ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 2/3] Define a new ima template field buf 2019-06-12 22:15 ` [PATCH V8 2/3] Define a new ima template field buf Prakhar Srivastava 2019-06-13 19:15 ` James Morris @ 2019-06-13 19:59 ` Mimi Zohar 2019-06-14 10:57 ` Mimi Zohar 1 sibling, 1 reply; 21+ messages in thread From: Mimi Zohar @ 2019-06-13 19:59 UTC (permalink / raw) To: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel Cc: roberto.sassu, vgoyal On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: As before, the patch title needs to be prefixed with "ima: ". > /* IMA template field data definition */ > diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c > index ea7d8cbf712f..83ca99d65e4b 100644 > --- a/security/integrity/ima/ima_api.c > +++ b/security/integrity/ima/ima_api.c > @@ -140,7 +140,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, > struct ima_template_entry *entry; > struct inode *inode = file_inode(file); > struct ima_event_data event_data = {iint, file, filename, NULL, 0, > - cause}; > + cause, NULL, 0}; This change here and > int violation = 1; > int result; > > @@ -296,7 +296,7 @@ void ima_store_measurement(struct integrity_iint_cache *iint, > struct inode *inode = file_inode(file); > struct ima_template_entry *entry; > struct ima_event_data event_data = {iint, file, filename, xattr_value, > - xattr_len, NULL}; > + xattr_len, NULL, NULL, 0}; here and > int violation = 0; > > if (iint->measured_pcrs & (0x1 << pcr)) > diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c > index 993d0f1915ff..c8591406c0e2 100644 > --- a/security/integrity/ima/ima_init.c > +++ b/security/integrity/ima/ima_init.c > @@ -50,7 +50,7 @@ static int __init ima_add_boot_aggregate(void) > struct ima_template_entry *entry; > struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; > struct ima_event_data event_data = {iint, NULL, boot_aggregate_name, > - NULL, 0, NULL}; > + NULL, 0, NULL, NULL, 0}; here, don't belong in this patch. It belongs in "IMA: support for per policy rule template formats", in case it should ever be backported. Please post this as a separate patch, that will be squashed with "IMA: support for per policy rule template formats". > int result = -ENOMEM; > int violation = 0; > struct { > diff --git a/security/integrity/ima/ima_template_lib.h b/security/integrity/ima/ima_template_lib.h > index 6a3d8b831deb..f0178bc60c55 100644 > --- a/security/integrity/ima/ima_template_lib.h > +++ b/security/integrity/ima/ima_template_lib.h > @@ -29,6 +29,8 @@ void ima_show_template_string(struct seq_file *m, enum ima_show_type show, > struct ima_field_data *field_data); > void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, > struct ima_field_data *field_data); > +void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, > + struct ima_field_data *field_data); Formatting ... > int ima_parse_buf(void *bufstartp, void *bufendp, void **bufcurp, > int maxfields, struct ima_field_data *fields, int *curfields, > unsigned long *len_mask, int enforce_mask, char *bufname); > @@ -42,4 +44,6 @@ int ima_eventname_ng_init(struct ima_event_data *event_data, > struct ima_field_data *field_data); > int ima_eventsig_init(struct ima_event_data *event_data, > struct ima_field_data *field_data); > +int ima_eventbuf_init(struct ima_event_data *event_data, > + struct ima_field_data *field_data); Formatting ... > #endif /* __LINUX_IMA_TEMPLATE_LIB_H */ ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 2/3] Define a new ima template field buf 2019-06-13 19:59 ` Mimi Zohar @ 2019-06-14 10:57 ` Mimi Zohar 2019-06-14 14:14 ` Mimi Zohar 0 siblings, 1 reply; 21+ messages in thread From: Mimi Zohar @ 2019-06-14 10:57 UTC (permalink / raw) To: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel Cc: roberto.sassu, vgoyal Hi Prakhar, > > diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c > > index ea7d8cbf712f..83ca99d65e4b 100644 > > --- a/security/integrity/ima/ima_api.c > > +++ b/security/integrity/ima/ima_api.c > > @@ -140,7 +140,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, > > struct ima_template_entry *entry; > > struct inode *inode = file_inode(file); > > struct ima_event_data event_data = {iint, file, filename, NULL, 0, > > - cause}; > > + cause, NULL, 0}; > > This change here and > > > int violation = 1; > > int result; > > > > @@ -296,7 +296,7 @@ void ima_store_measurement(struct integrity_iint_cache *iint, > > struct inode *inode = file_inode(file); > > struct ima_template_entry *entry; > > struct ima_event_data event_data = {iint, file, filename, xattr_value, > > - xattr_len, NULL}; > > + xattr_len, NULL, NULL, 0}; > > here and > > > int violation = 0; > > > > if (iint->measured_pcrs & (0x1 << pcr)) > > diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c > > index 993d0f1915ff..c8591406c0e2 100644 > > --- a/security/integrity/ima/ima_init.c > > +++ b/security/integrity/ima/ima_init.c > > @@ -50,7 +50,7 @@ static int __init ima_add_boot_aggregate(void) > > struct ima_template_entry *entry; > > struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; > > struct ima_event_data event_data = {iint, NULL, boot_aggregate_name, > > - NULL, 0, NULL}; > > + NULL, 0, NULL, NULL, 0}; > > here, don't belong in this patch. It belongs in "IMA: support for per > policy rule template formats", in case it should ever be backported. > Please post this as a separate patch, that will be squashed with > "IMA: support for per policy rule template formats". Might mistake. I should have picked up Thaigo's "ima: Use designated initializers for struct ima_event_data". Please drop these changes instead. thanks, Mimi > > > int result = -ENOMEM; > > int violation = 0; > > struct { > ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 2/3] Define a new ima template field buf 2019-06-14 10:57 ` Mimi Zohar @ 2019-06-14 14:14 ` Mimi Zohar 2019-06-14 17:52 ` prakhar srivastava 0 siblings, 1 reply; 21+ messages in thread From: Mimi Zohar @ 2019-06-14 14:14 UTC (permalink / raw) To: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel Cc: roberto.sassu, thiago Jung Bauermann > > > diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c > > > index 993d0f1915ff..c8591406c0e2 100644 > > > --- a/security/integrity/ima/ima_init.c > > > +++ b/security/integrity/ima/ima_init.c > > > @@ -50,7 +50,7 @@ static int __init ima_add_boot_aggregate(void) > > > struct ima_template_entry *entry; > > > struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; > > > struct ima_event_data event_data = {iint, NULL, boot_aggregate_name, > > > - NULL, 0, NULL}; > > > + NULL, 0, NULL, NULL, 0}; > > > > here, don't belong in this patch. It belongs in "IMA: support for per > > policy rule template formats", in case it should ever be backported. > > Please post this as a separate patch, that will be squashed with > > "IMA: support for per policy rule template formats". > > My mistake. I should have picked up Thaigo's "ima: Use designated > initializers for struct ima_event_data". Please drop these changes > instead. Sorry for the confusion. I just pushed out Thiago's patch. thanks, Mimi ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 2/3] Define a new ima template field buf 2019-06-14 14:14 ` Mimi Zohar @ 2019-06-14 17:52 ` prakhar srivastava 0 siblings, 0 replies; 21+ messages in thread From: prakhar srivastava @ 2019-06-14 17:52 UTC (permalink / raw) To: Mimi Zohar Cc: linux-integrity, linux-security-module, linux-kernel, Roberto Sassu, thiago Jung Bauermann On Fri, Jun 14, 2019 at 7:14 AM Mimi Zohar <zohar@linux.ibm.com> wrote: > > > > > diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c > > > > index 993d0f1915ff..c8591406c0e2 100644 > > > > --- a/security/integrity/ima/ima_init.c > > > > +++ b/security/integrity/ima/ima_init.c > > > > @@ -50,7 +50,7 @@ static int __init ima_add_boot_aggregate(void) > > > > struct ima_template_entry *entry; > > > > struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; > > > > struct ima_event_data event_data = {iint, NULL, boot_aggregate_name, > > > > - NULL, 0, NULL}; > > > > + NULL, 0, NULL, NULL, 0}; > > > > > > here, don't belong in this patch. It belongs in "IMA: support for per > > > policy rule template formats", in case it should ever be backported. > > > Please post this as a separate patch, that will be squashed with > > > "IMA: support for per policy rule template formats". > > > > My mistake. I should have picked up Thaigo's "ima: Use designated > > initializers for struct ima_event_data". Please drop these changes > > instead. > > Sorry for the confusion. I just pushed out Thiago's patch. > Just to clarify: - no split up of patch is needed. - only formatting needs to cleaned up. Apologies for the formatting issues, my editor switches back to tab as 4 chars. Thanks, Prakhar Srivastava > thanks, > > Mimi > ^ permalink raw reply [flat|nested] 21+ messages in thread
* [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args 2019-06-12 22:15 [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Prakhar Srivastava 2019-06-12 22:15 ` [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments Prakhar Srivastava 2019-06-12 22:15 ` [PATCH V8 2/3] Define a new ima template field buf Prakhar Srivastava @ 2019-06-12 22:15 ` Prakhar Srivastava 2019-06-12 22:31 ` Mimi Zohar ` (2 more replies) 2019-06-13 20:48 ` [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Mimi Zohar 3 siblings, 3 replies; 21+ messages in thread From: Prakhar Srivastava @ 2019-06-12 22:15 UTC (permalink / raw) To: linux-integrity, linux-security-module, linux-kernel Cc: zohar, roberto.sassu, vgoyal, Prakhar Srivastava During soft reboot(kexec_file_load) boot cmdline args are not measured.Thus the new kernel on load boots with an assumption of cold reboot. This patch makes a call to the ima hook ima_kexec_cmdline, added in "Define a new IMA hook to measure the boot command line arguments" to measure the boot cmdline args into the ima log. - call ima_kexec_cmdline from kexec_file_load. - move the call ima_add_kexec_buffer after the cmdline args have been measured. Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> --- kernel/kexec_file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 072b6ee55e3f..b0c724e5d86c 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -198,9 +198,6 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, return ret; image->kernel_buf_len = size; - /* IMA needs to pass the measurement list to the next kernel. */ - ima_add_kexec_buffer(image); - /* Call arch image probe handlers */ ret = arch_kexec_kernel_image_probe(image, image->kernel_buf, image->kernel_buf_len); @@ -241,8 +238,14 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, ret = -EINVAL; goto out; } + + ima_kexec_cmdline(image->cmdline_buf, + image->cmdline_buf_len - 1); } + /* IMA needs to pass the measurement list to the next kernel. */ + ima_add_kexec_buffer(image); + /* Call arch image load handlers */ ldata = arch_kexec_kernel_image_load(image); -- 2.19.1 ^ permalink raw reply related [flat|nested] 21+ messages in thread
* Re: [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args 2019-06-12 22:15 ` [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args Prakhar Srivastava @ 2019-06-12 22:31 ` Mimi Zohar 2019-06-13 8:26 ` Dave Young 2019-06-13 19:16 ` James Morris 2019-06-13 20:20 ` Mimi Zohar 2 siblings, 1 reply; 21+ messages in thread From: Mimi Zohar @ 2019-06-12 22:31 UTC (permalink / raw) To: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel Cc: roberto.sassu, vgoyal, Eric W. Biederman, Dave Young, kexec [Cc: kexec mailing list] Hi Eric, Dave, On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: > During soft reboot(kexec_file_load) boot cmdline args > are not measured.Thus the new kernel on load boots with > an assumption of cold reboot. > > This patch makes a call to the ima hook ima_kexec_cmdline, > added in "Define a new IMA hook to measure the boot command > line arguments" > to measure the boot cmdline args into the ima log. > > - call ima_kexec_cmdline from kexec_file_load. > - move the call ima_add_kexec_buffer after the cmdline > args have been measured. > > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Dave Young <dyoung@redhat.com> Any chance we could get some Acks? thanks, Mimi > --- > kernel/kexec_file.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c > index 072b6ee55e3f..b0c724e5d86c 100644 > --- a/kernel/kexec_file.c > +++ b/kernel/kexec_file.c > @@ -198,9 +198,6 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, > return ret; > image->kernel_buf_len = size; > > - /* IMA needs to pass the measurement list to the next kernel. */ > - ima_add_kexec_buffer(image); > - > /* Call arch image probe handlers */ > ret = arch_kexec_kernel_image_probe(image, image->kernel_buf, > image->kernel_buf_len); > @@ -241,8 +238,14 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, > ret = -EINVAL; > goto out; > } > + > + ima_kexec_cmdline(image->cmdline_buf, > + image->cmdline_buf_len - 1); > } > > + /* IMA needs to pass the measurement list to the next kernel. */ > + ima_add_kexec_buffer(image); > + > /* Call arch image load handlers */ > ldata = arch_kexec_kernel_image_load(image); > ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args 2019-06-12 22:31 ` Mimi Zohar @ 2019-06-13 8:26 ` Dave Young 2019-06-13 20:07 ` Mimi Zohar 0 siblings, 1 reply; 21+ messages in thread From: Dave Young @ 2019-06-13 8:26 UTC (permalink / raw) To: Mimi Zohar Cc: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel, roberto.sassu, Eric W. Biederman, vgoyal, kexec On 06/12/19 at 06:31pm, Mimi Zohar wrote: > [Cc: kexec mailing list] > > Hi Eric, Dave, > > On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: > > During soft reboot(kexec_file_load) boot cmdline args > > are not measured.Thus the new kernel on load boots with > > an assumption of cold reboot. > > > > This patch makes a call to the ima hook ima_kexec_cmdline, > > added in "Define a new IMA hook to measure the boot command > > line arguments" > > to measure the boot cmdline args into the ima log. > > > > - call ima_kexec_cmdline from kexec_file_load. > > - move the call ima_add_kexec_buffer after the cmdline > > args have been measured. > > > > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> > Cc: Eric W. Biederman <ebiederm@xmission.com> > Cc: Dave Young <dyoung@redhat.com> > > Any chance we could get some Acks? The ima_* is blackbox functions to me, looks like this patch is trying to measure kexec cmdline buffer and save in some ima logs and then add all the measure results including those for kernel/initrd to a kexec_buf and pass to 2nd kernel. It should be good and only take effect when IMA enabled. If all the assumptions are right: Acked-by: Dave Young <dyoung@redhat.com> > > thanks, > > Mimi > > > --- > > kernel/kexec_file.c | 9 ++++++--- > > 1 file changed, 6 insertions(+), 3 deletions(-) > > > > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c > > index 072b6ee55e3f..b0c724e5d86c 100644 > > --- a/kernel/kexec_file.c > > +++ b/kernel/kexec_file.c > > @@ -198,9 +198,6 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, > > return ret; > > image->kernel_buf_len = size; > > > > - /* IMA needs to pass the measurement list to the next kernel. */ > > - ima_add_kexec_buffer(image); > > - > > /* Call arch image probe handlers */ > > ret = arch_kexec_kernel_image_probe(image, image->kernel_buf, > > image->kernel_buf_len); > > @@ -241,8 +238,14 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, > > ret = -EINVAL; > > goto out; > > } > > + > > + ima_kexec_cmdline(image->cmdline_buf, > > + image->cmdline_buf_len - 1); > > } > > > > + /* IMA needs to pass the measurement list to the next kernel. */ > > + ima_add_kexec_buffer(image); > > + > > /* Call arch image load handlers */ > > ldata = arch_kexec_kernel_image_load(image); > > > > > _______________________________________________ > kexec mailing list > kexec@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/kexec Thanks Dave ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args 2019-06-13 8:26 ` Dave Young @ 2019-06-13 20:07 ` Mimi Zohar 0 siblings, 0 replies; 21+ messages in thread From: Mimi Zohar @ 2019-06-13 20:07 UTC (permalink / raw) To: Dave Young Cc: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel, roberto.sassu, Eric W. Biederman, vgoyal, kexec On Thu, 2019-06-13 at 16:26 +0800, Dave Young wrote: > On 06/12/19 at 06:31pm, Mimi Zohar wrote: > > [Cc: kexec mailing list] > > > > Hi Eric, Dave, > > > > On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: > > > During soft reboot(kexec_file_load) boot cmdline args > > > are not measured.Thus the new kernel on load boots with > > > an assumption of cold reboot. > > > > > > This patch makes a call to the ima hook ima_kexec_cmdline, > > > added in "Define a new IMA hook to measure the boot command > > > line arguments" > > > to measure the boot cmdline args into the ima log. > > > > > > - call ima_kexec_cmdline from kexec_file_load. > > > - move the call ima_add_kexec_buffer after the cmdline > > > args have been measured. > > > > > > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> > > Cc: Eric W. Biederman <ebiederm@xmission.com> > > Cc: Dave Young <dyoung@redhat.com> > > > > Any chance we could get some Acks? > > The ima_* is blackbox functions to me, looks like this patch is trying > to measure kexec cmdline buffer and save in some ima logs and then add all the > measure results including those for kernel/initrd to a kexec_buf and pass to 2nd Right, including the new boot command line measurement. > kernel. > > It should be good and only take effect when IMA enabled. If all the > assumptions are right: > > Acked-by: Dave Young <dyoung@redhat.com> Thanks, Dave. ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args 2019-06-12 22:15 ` [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args Prakhar Srivastava 2019-06-12 22:31 ` Mimi Zohar @ 2019-06-13 19:16 ` James Morris 2019-06-13 20:20 ` Mimi Zohar 2 siblings, 0 replies; 21+ messages in thread From: James Morris @ 2019-06-13 19:16 UTC (permalink / raw) To: Prakhar Srivastava Cc: linux-integrity, linux-security-module, linux-kernel, zohar, roberto.sassu, vgoyal On Wed, 12 Jun 2019, Prakhar Srivastava wrote: > During soft reboot(kexec_file_load) boot cmdline args > are not measured.Thus the new kernel on load boots with > an assumption of cold reboot. > > This patch makes a call to the ima hook ima_kexec_cmdline, > added in "Define a new IMA hook to measure the boot command > line arguments" > to measure the boot cmdline args into the ima log. > > - call ima_kexec_cmdline from kexec_file_load. > - move the call ima_add_kexec_buffer after the cmdline > args have been measured. > > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com> > --- > kernel/kexec_file.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) Reviewed-by: James Morris <jamorris@linux.microsoft.com> -- James Morris <jmorris@namei.org> ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args 2019-06-12 22:15 ` [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args Prakhar Srivastava 2019-06-12 22:31 ` Mimi Zohar 2019-06-13 19:16 ` James Morris @ 2019-06-13 20:20 ` Mimi Zohar 2 siblings, 0 replies; 21+ messages in thread From: Mimi Zohar @ 2019-06-13 20:20 UTC (permalink / raw) To: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel Cc: roberto.sassu, vgoyal On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: > During soft reboot(kexec_file_load) boot cmdline args Any reason for not spelling it out and using the "boot command line"? > are not measured.Thus the new kernel on load boots with > an assumption of cold reboot. Double spaces after a period. What does "boots with an assumption of cold reboot" mean? Not all systems are booted the same way. Is this comment relevant? > > This patch makes a call to the ima hook ima_kexec_cmdline, > added in "Define a new IMA hook to measure the boot command > line arguments" "added in ..." is unnecessry. > to measure the boot cmdline args into the ima log. ^IMA measurement list. Mimi ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load 2019-06-12 22:15 [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Prakhar Srivastava ` (2 preceding siblings ...) 2019-06-12 22:15 ` [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args Prakhar Srivastava @ 2019-06-13 20:48 ` Mimi Zohar 2019-06-14 17:39 ` prakhar srivastava 3 siblings, 1 reply; 21+ messages in thread From: Mimi Zohar @ 2019-06-13 20:48 UTC (permalink / raw) To: Prakhar Srivastava, linux-integrity, linux-security-module, linux-kernel Cc: roberto.sassu, vgoyal On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: > The kexec cmdline hash is stored in the "d-ng" field of the template data. > and can be verified using > sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements | > grep kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum This information should also be included in one of the patches. Mimi ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load 2019-06-13 20:48 ` [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Mimi Zohar @ 2019-06-14 17:39 ` prakhar srivastava 0 siblings, 0 replies; 21+ messages in thread From: prakhar srivastava @ 2019-06-14 17:39 UTC (permalink / raw) To: Mimi Zohar Cc: linux-integrity, linux-security-module, linux-kernel, Roberto Sassu, vgoyal On Thu, Jun 13, 2019 at 1:48 PM Mimi Zohar <zohar@linux.ibm.com> wrote: > > On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote: > > > The kexec cmdline hash is stored in the "d-ng" field of the template data. > > and can be verified using > > sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements | > > grep kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum > > This information should also be included in one of the patches. > Noted. I will add this to the 2/3 patch, since that the one that adds the template. - Thanks, Prakhar Srivastava > Mimi > ^ permalink raw reply [flat|nested] 21+ messages in thread
* [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load
@ 2019-06-17 18:35 Prakhar Srivastava
0 siblings, 0 replies; 21+ messages in thread
From: Prakhar Srivastava @ 2019-06-17 18:35 UTC (permalink / raw)
To: linux-integrity, linux-security-module, linux-kernel
Cc: zohar, roberto.sassu, Prakhar Srivastava
The kexec boot command line arguments are not currently being
measured.
Currently during soft reboot(kexec)
- the PCRS are not reset
- the command line arguments used for the next kernel are not measured.
This gives the impression to the secure boot attestation that a cold boot took
place.
For secure boot attestation, it is necessary to measure the kernel
command line. For cold boot, the boot loader can be enhanced to measure
these parameters.
(https://mjg59.dreamwidth.org/48897.html)
This patch set aims to address measuring the boot command line during
soft reboot(kexec_file_load).
To achive the above the patch series does the following
-Add a new ima hook: ima_kexec_cmdline which measures the cmdline args
into the ima log, behind a new ima policy entry KEXEC_CMDLINE.
The kexec cmdline hash is stored in the "d-ng" field of the template data.
-Since the cmldine args cannot be appraised, a new template field(buf) is
added. The template field contains the buffer passed(cmldine args), which
can be used to appraise/attest at a later stage.
The kexec cmdline buffer is stored as HEX in the buf field of the event_data.
-Call the ima_kexec_cmdline(...) hook from kexec_file_load call.
The ima logs need to be carried over to the next kernel, which will be followed
up by other patchsets for x86_64 and arm64.
The kexec cmdline hash is stored in the "d-ng" field of the template data.
and can be verified using
sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements |
grep kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum
Changelog:
V9(since V8):
- code cleanup
V8(since V7):
- added a new ima template name "ima-buf"
- code cleanup
V7:
- rebased to next-queued-testing
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/log/?h=next-queued-testing
V6:
-add a new ima hook and policy to measure the cmdline
args(ima_kexec_cmdline)
-add a new template field buf to contain the buffer measured.
[suggested by Mimi Zohar]
add new fields to ima_event_data to store/read buffer data.
[suggested by Roberto]
-call ima_kexec_cmdline from kexec_file_load path
v5:
-add a new ima hook and policy to measure the cmdline
args(ima_kexec_cmdline)
-add a new template field buf to contain the buffer measured.
[suggested by Mimi Zohar]
-call ima_kexec_cmdline from kexec_file_load path
v4:
- per feedback from LSM community, removed the LSM hook and renamed the
IMA policy to KEXEC_CMDLINE
v3: (rebase changes to next-general)
- Add policy checks for buffer[suggested by Mimi Zohar]
- use the IMA_XATTR to add buffer
- Add kexec_cmdline used for kexec file load
- Add an LSM hook to allow usage by other LSM.[suggestd by Mimi Zohar]
v2:
- Add policy checks for buffer[suggested by Mimi Zohar]
- Add an LSM hook to allow usage by other LSM.[suggestd by Mimi Zohar]
- use the IMA_XATTR to add buffer instead of sig template
v1:
-Add kconfigs to control the ima_buffer_check
-measure the cmdline args suffixed with the kernel file name
-add the buffer to the template sig field.
Prakhar Srivastava (3):
Add a new ima hook ima_kexec_cmdline to measure cmdline args
add a new ima template field buf
call ima_kexec_cmdline to measure the cmdline args
Documentation/ABI/testing/ima_policy | 1 +
Documentation/security/IMA-templates.rst | 2 +-
include/linux/ima.h | 2 +
kernel/kexec_file.c | 8 ++-
security/integrity/ima/ima.h | 3 +
security/integrity/ima/ima_api.c | 5 +-
security/integrity/ima/ima_init.c | 2 +-
security/integrity/ima/ima_main.c | 80 +++++++++++++++++++++++
security/integrity/ima/ima_policy.c | 9 +++
security/integrity/ima/ima_template.c | 2 +
security/integrity/ima/ima_template_lib.c | 20 ++++++
security/integrity/ima/ima_template_lib.h | 4 ++
12 files changed, 131 insertions(+), 7 deletions(-)
--
2.17.1
^ permalink raw reply [flat|nested] 21+ messages in thread* [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load
@ 2019-06-17 18:37 Prakhar Srivastava
0 siblings, 0 replies; 21+ messages in thread
From: Prakhar Srivastava @ 2019-06-17 18:37 UTC (permalink / raw)
To: linux-integrity, linux-security-module, linux-kernel
Cc: zohar, roberto.sassu, Prakhar Srivastava
The kexec boot command line arguments are not currently being
measured.
Currently during soft reboot(kexec)
- the PCRS are not reset
- the command line arguments used for the next kernel are not measured.
This gives the impression to the secure boot attestation that a cold boot took
place.
For secure boot attestation, it is necessary to measure the kernel
command line. For cold boot, the boot loader can be enhanced to measure
these parameters.
(https://mjg59.dreamwidth.org/48897.html)
This patch set aims to address measuring the boot command line during
soft reboot(kexec_file_load).
To achive the above the patch series does the following
-Add a new ima hook: ima_kexec_cmdline which measures the cmdline args
into the ima log, behind a new ima policy entry KEXEC_CMDLINE.
The kexec cmdline hash is stored in the "d-ng" field of the template data.
-Since the cmldine args cannot be appraised, a new template field(buf) is
added. The template field contains the buffer passed(cmldine args), which
can be used to appraise/attest at a later stage.
The kexec cmdline buffer is stored as HEX in the buf field of the event_data.
-Call the ima_kexec_cmdline(...) hook from kexec_file_load call.
The ima logs need to be carried over to the next kernel, which will be followed
up by other patchsets for x86_64 and arm64.
The kexec cmdline hash is stored in the "d-ng" field of the template data.
and can be verified using
sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements |
grep kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum
Changelog:
V9(since V8):
- code cleanup
V8(since V7):
- added a new ima template name "ima-buf"
- code cleanup
V7:
- rebased to next-queued-testing
https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/log/?h=next-queued-testing
V6:
-add a new ima hook and policy to measure the cmdline
args(ima_kexec_cmdline)
-add a new template field buf to contain the buffer measured.
[suggested by Mimi Zohar]
add new fields to ima_event_data to store/read buffer data.
[suggested by Roberto]
-call ima_kexec_cmdline from kexec_file_load path
v5:
-add a new ima hook and policy to measure the cmdline
args(ima_kexec_cmdline)
-add a new template field buf to contain the buffer measured.
[suggested by Mimi Zohar]
-call ima_kexec_cmdline from kexec_file_load path
v4:
- per feedback from LSM community, removed the LSM hook and renamed the
IMA policy to KEXEC_CMDLINE
v3: (rebase changes to next-general)
- Add policy checks for buffer[suggested by Mimi Zohar]
- use the IMA_XATTR to add buffer
- Add kexec_cmdline used for kexec file load
- Add an LSM hook to allow usage by other LSM.[suggestd by Mimi Zohar]
v2:
- Add policy checks for buffer[suggested by Mimi Zohar]
- Add an LSM hook to allow usage by other LSM.[suggestd by Mimi Zohar]
- use the IMA_XATTR to add buffer instead of sig template
v1:
-Add kconfigs to control the ima_buffer_check
-measure the cmdline args suffixed with the kernel file name
-add the buffer to the template sig field.
Prakhar Srivastava (3):
Add a new ima hook ima_kexec_cmdline to measure cmdline args
add a new ima template field buf
call ima_kexec_cmdline to measure the cmdline args
Documentation/ABI/testing/ima_policy | 1 +
Documentation/security/IMA-templates.rst | 2 +-
include/linux/ima.h | 2 +
kernel/kexec_file.c | 8 ++-
security/integrity/ima/ima.h | 3 +
security/integrity/ima/ima_api.c | 5 +-
security/integrity/ima/ima_init.c | 2 +-
security/integrity/ima/ima_main.c | 80 +++++++++++++++++++++++
security/integrity/ima/ima_policy.c | 9 +++
security/integrity/ima/ima_template.c | 2 +
security/integrity/ima/ima_template_lib.c | 20 ++++++
security/integrity/ima/ima_template_lib.h | 4 ++
12 files changed, 131 insertions(+), 7 deletions(-)
--
2.17.1
^ permalink raw reply [flat|nested] 21+ messages in threadend of thread, other threads:[~2019-06-17 18:38 UTC | newest] Thread overview: 21+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-06-12 22:15 [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Prakhar Srivastava 2019-06-12 22:15 ` [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments Prakhar Srivastava 2019-06-13 19:10 ` James Morris 2019-06-13 19:22 ` Mimi Zohar 2019-06-14 17:48 ` prakhar srivastava 2019-06-12 22:15 ` [PATCH V8 2/3] Define a new ima template field buf Prakhar Srivastava 2019-06-13 19:15 ` James Morris 2019-06-13 19:59 ` Mimi Zohar 2019-06-14 10:57 ` Mimi Zohar 2019-06-14 14:14 ` Mimi Zohar 2019-06-14 17:52 ` prakhar srivastava 2019-06-12 22:15 ` [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args Prakhar Srivastava 2019-06-12 22:31 ` Mimi Zohar 2019-06-13 8:26 ` Dave Young 2019-06-13 20:07 ` Mimi Zohar 2019-06-13 19:16 ` James Morris 2019-06-13 20:20 ` Mimi Zohar 2019-06-13 20:48 ` [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Mimi Zohar 2019-06-14 17:39 ` prakhar srivastava 2019-06-17 18:35 Prakhar Srivastava 2019-06-17 18:37 Prakhar Srivastava
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).