From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755059AbdKGKxq (ORCPT ); Tue, 7 Nov 2017 05:53:46 -0500 Received: from lhrrgout.huawei.com ([194.213.3.17]:39778 "EHLO lhrrgout.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751749AbdKGKml (ORCPT ); Tue, 7 Nov 2017 05:42:41 -0500 From: Roberto Sassu To: CC: , , , , , Roberto Sassu Subject: [PATCH v2 07/15] ima: add parser of compact digest list Date: Tue, 7 Nov 2017 11:37:02 +0100 Message-ID: <20171107103710.10883-8-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20171107103710.10883-1-roberto.sassu@huawei.com> References: <20171107103710.10883-1-roberto.sassu@huawei.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.204.65.254] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090201.5A018E1F.0471,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: ae72bd7ff58400102ef4f46631aec8c8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch introduces the parser for the compact digest list. Its format is: entry_id[2] count[4] data_len[4] data[data_len] entry_id[2] count[4] data_len[4] data[data_len] ... entry_id, count and data_len are in little endian. This format is suitable to store a large number of digests, as there is no metadata provided for each. Digests (which have all the same size) are concatenated together and placed after the header. COMPACT_DIGEST (0) and COMPACT_DIGEST_MUTABLE (1) entry IDs are supported. If the entry ID is COMPACT_DIGEST and appraisal is in enforcing mode, file updates are denied. If the entry ID is COMPACT_DIGEST_MUTABLE, file updates are permitted. Changelog v1: - Renamed COMPACT_LIST_ID_DIGEST to COMPACT_DIGEST - Added support for immutable/mutable files Signed-off-by: Roberto Sassu --- security/integrity/ima/ima_digest_list.c | 66 ++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/security/integrity/ima/ima_digest_list.c b/security/integrity/ima/ima_digest_list.c index 28172424e5a2..6ad00ba32c94 100644 --- a/security/integrity/ima/ima_digest_list.c +++ b/security/integrity/ima/ima_digest_list.c @@ -23,6 +23,69 @@ enum digest_metadata_fields {DATA_ALGO, DATA_DIGEST, DATA_SIGNATURE, DATA_FILE_PATH, DATA_REF_ID, DATA_TYPE, DATA__LAST}; +enum digest_data_types {DATA_TYPE_COMPACT_LIST}; + +enum compact_list_entry_ids {COMPACT_DIGEST, COMPACT_DIGEST_MUTABLE}; + +struct compact_list_hdr { + u16 entry_id; + u32 count; + u32 datalen; +} __packed; + +static int ima_parse_compact_list(loff_t size, void *buf) +{ + void *bufp = buf, *bufendp = buf + size; + int digest_len = hash_digest_size[ima_hash_algo]; + struct compact_list_hdr *hdr; + u8 is_mutable = 0; + int ret, i; + + while (bufp < bufendp) { + if (bufp + sizeof(*hdr) > bufendp) { + pr_err("compact list, missing header\n"); + return -EINVAL; + } + + hdr = bufp; + + if (ima_canonical_fmt) { + hdr->entry_id = le16_to_cpu(hdr->entry_id); + hdr->count = le32_to_cpu(hdr->count); + hdr->datalen = le32_to_cpu(hdr->datalen); + } + + switch (hdr->entry_id) { + case COMPACT_DIGEST_MUTABLE: + is_mutable = 1; + case COMPACT_DIGEST: + break; + default: + pr_err("compact list, invalid data type\n"); + return -EINVAL; + } + + bufp += sizeof(*hdr); + + for (i = 0; i < hdr->count && + bufp + digest_len <= bufendp; i++) { + ret = ima_add_digest_data_entry(bufp, is_mutable); + if (ret < 0 && ret != -EEXIST) + return ret; + + bufp += digest_len; + } + + if (i != hdr->count || + bufp != (void *)hdr + sizeof(*hdr) + hdr->datalen) { + pr_err("compact list, invalid data\n"); + return -EINVAL; + } + } + + return 0; +} + static int ima_parse_digest_list_data(struct ima_field_data *data) { void *digest_list; @@ -47,6 +110,9 @@ static int ima_parse_digest_list_data(struct ima_field_data *data) } switch (data_type) { + case DATA_TYPE_COMPACT_LIST: + ret = ima_parse_compact_list(digest_list_size, digest_list); + break; default: pr_err("Parser for data type %d not implemented\n", data_type); ret = -EINVAL; -- 2.11.0