From: Mimi Zohar <zohar@linux.vnet.ibm.com> To: linux-security-module <linux-security-module@vger.kernel.org> Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>, linux-ima-devel@lists.sourceforge.net, Dave Young <dyoung@redhat.com>, kexec@lists.infradead.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>, Andrew Morton <akpm@linux-foundation.org>, Mimi Zohar <zohar@linuv.vnet.ibm.com> Subject: [PATHC v2 2/9] ima: permit duplicate measurement list entries Date: Tue, 30 Aug 2016 18:40:04 -0400 [thread overview] Message-ID: <1472596811-9596-3-git-send-email-zohar@linux.vnet.ibm.com> (raw) In-Reply-To: <1472596811-9596-1-git-send-email-zohar@linux.vnet.ibm.com> Measurements carried across kexec need to be added to the IMA measurement list, but should not prevent measurements of the newly booted kernel from being added to the measurement list. This patch adds support for allowing duplicate measurements. The "boot_aggregate" measurement entry is the delimiter between soft boots. Signed-off-by: Mimi Zohar <zohar@linuv.vnet.ibm.com> --- security/integrity/ima/ima_queue.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c index 4b1bb77..12d1b04 100644 --- a/security/integrity/ima/ima_queue.c +++ b/security/integrity/ima/ima_queue.c @@ -65,11 +65,12 @@ static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value, } /* ima_add_template_entry helper function: - * - Add template entry to measurement list and hash table. + * - Add template entry to the measurement list and hash table, for + * all entries except those carried across kexec. * * (Called with ima_extend_list_mutex held.) */ -static int ima_add_digest_entry(struct ima_template_entry *entry) +static int ima_add_digest_entry(struct ima_template_entry *entry, int flags) { struct ima_queue_entry *qe; unsigned int key; @@ -85,8 +86,10 @@ static int ima_add_digest_entry(struct ima_template_entry *entry) list_add_tail_rcu(&qe->later, &ima_measurements); atomic_long_inc(&ima_htable.len); - key = ima_hash_key(entry->digest); - hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]); + if (flags) { + key = ima_hash_key(entry->digest); + hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]); + } return 0; } @@ -126,7 +129,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation, } } - result = ima_add_digest_entry(entry); + result = ima_add_digest_entry(entry, 1); if (result < 0) { audit_cause = "ENOMEM"; audit_info = 0; @@ -155,7 +158,7 @@ int ima_restore_measurement_entry(struct ima_template_entry *entry) int result = 0; mutex_lock(&ima_extend_list_mutex); - result = ima_add_digest_entry(entry); + result = ima_add_digest_entry(entry, 0); mutex_unlock(&ima_extend_list_mutex); return result; } -- 2.1.0
WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.vnet.ibm.com> To: linux-security-module <linux-security-module@vger.kernel.org> Cc: linuxppc-dev@lists.ozlabs.org, kexec@lists.infradead.org, linux-kernel@vger.kernel.org, Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>, Mimi Zohar <zohar@linuv.vnet.ibm.com>, linux-ima-devel@lists.sourceforge.net, Andrew Morton <akpm@linux-foundation.org>, Mimi Zohar <zohar@linux.vnet.ibm.com>, Dave Young <dyoung@redhat.com> Subject: [PATHC v2 2/9] ima: permit duplicate measurement list entries Date: Tue, 30 Aug 2016 18:40:04 -0400 [thread overview] Message-ID: <1472596811-9596-3-git-send-email-zohar@linux.vnet.ibm.com> (raw) In-Reply-To: <1472596811-9596-1-git-send-email-zohar@linux.vnet.ibm.com> Measurements carried across kexec need to be added to the IMA measurement list, but should not prevent measurements of the newly booted kernel from being added to the measurement list. This patch adds support for allowing duplicate measurements. The "boot_aggregate" measurement entry is the delimiter between soft boots. Signed-off-by: Mimi Zohar <zohar@linuv.vnet.ibm.com> --- security/integrity/ima/ima_queue.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c index 4b1bb77..12d1b04 100644 --- a/security/integrity/ima/ima_queue.c +++ b/security/integrity/ima/ima_queue.c @@ -65,11 +65,12 @@ static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value, } /* ima_add_template_entry helper function: - * - Add template entry to measurement list and hash table. + * - Add template entry to the measurement list and hash table, for + * all entries except those carried across kexec. * * (Called with ima_extend_list_mutex held.) */ -static int ima_add_digest_entry(struct ima_template_entry *entry) +static int ima_add_digest_entry(struct ima_template_entry *entry, int flags) { struct ima_queue_entry *qe; unsigned int key; @@ -85,8 +86,10 @@ static int ima_add_digest_entry(struct ima_template_entry *entry) list_add_tail_rcu(&qe->later, &ima_measurements); atomic_long_inc(&ima_htable.len); - key = ima_hash_key(entry->digest); - hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]); + if (flags) { + key = ima_hash_key(entry->digest); + hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]); + } return 0; } @@ -126,7 +129,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation, } } - result = ima_add_digest_entry(entry); + result = ima_add_digest_entry(entry, 1); if (result < 0) { audit_cause = "ENOMEM"; audit_info = 0; @@ -155,7 +158,7 @@ int ima_restore_measurement_entry(struct ima_template_entry *entry) int result = 0; mutex_lock(&ima_extend_list_mutex); - result = ima_add_digest_entry(entry); + result = ima_add_digest_entry(entry, 0); mutex_unlock(&ima_extend_list_mutex); return result; } -- 2.1.0 _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
next prev parent reply other threads:[~2016-08-30 22:40 UTC|newest] Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-08-30 22:40 [PATHC v2 0/9] ima: carry the measurement list across kexec Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-08-30 22:40 ` [PATHC v2 1/9] ima: on soft reboot, restore the measurement list Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar [this message] 2016-08-30 22:40 ` [PATHC v2 2/9] ima: permit duplicate measurement list entries Mimi Zohar 2016-08-30 22:40 ` [PATHC v2 3/9] ima: maintain memory size needed for serializing the measurement list Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-08-30 22:40 ` [PATHC v2 4/9] ima: serialize the binary_runtime_measurements Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-08-30 22:40 ` [PATHC v2 5/9] ima: on soft reboot, save the measurement list Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-09-01 1:57 ` Dave Young 2016-09-01 1:57 ` Dave Young 2016-09-02 13:22 ` Mimi Zohar 2016-09-02 13:22 ` Mimi Zohar 2016-08-30 22:40 ` [PATHC v2 6/9] ima: store the builtin/custom template definitions in a list Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-08-30 22:40 ` [PATHC v2 7/9] ima: support restoring multiple template formats Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-08-30 22:40 ` [PATHC v2 8/9] ima: define a canonical binary_runtime_measurements list format Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-08-30 22:40 ` [PATHC v2 9/9] ima: platform-independent hash value Mimi Zohar 2016-08-30 22:40 ` Mimi Zohar 2016-08-31 20:50 ` [PATHC v2 0/9] ima: carry the measurement list across kexec Andrew Morton 2016-08-31 20:50 ` Andrew Morton 2016-08-31 22:38 ` Mimi Zohar 2016-08-31 22:38 ` Mimi Zohar 2016-09-15 15:44 ` Mimi Zohar 2016-09-15 15:44 ` Mimi Zohar 2016-09-16 19:47 ` Eric W. Biederman 2016-09-16 19:47 ` Eric W. Biederman 2016-09-16 21:03 ` Eric W. Biederman 2016-09-16 21:03 ` Eric W. Biederman 2016-09-16 23:32 ` Thiago Jung Bauermann 2016-09-16 23:32 ` Thiago Jung Bauermann 2016-09-17 5:17 ` Eric W. Biederman 2016-09-17 5:17 ` Eric W. Biederman 2016-09-18 21:25 ` Thiago Jung Bauermann 2016-09-18 21:25 ` Thiago Jung Bauermann 2016-09-20 16:07 ` Eric W. Biederman 2016-09-20 16:07 ` Eric W. Biederman 2016-09-26 18:31 ` Thiago Jung Bauermann 2016-09-26 18:31 ` Thiago Jung Bauermann 2016-09-29 21:43 ` Eric W. Biederman 2016-09-29 21:43 ` Eric W. Biederman 2016-09-29 22:21 ` Thiago Jung Bauermann 2016-09-29 22:21 ` Thiago Jung Bauermann
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1472596811-9596-3-git-send-email-zohar@linux.vnet.ibm.com \ --to=zohar@linux.vnet.ibm.com \ --cc=akpm@linux-foundation.org \ --cc=bauerman@linux.vnet.ibm.com \ --cc=dyoung@redhat.com \ --cc=kexec@lists.infradead.org \ --cc=linux-ima-devel@lists.sourceforge.net \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=linuxppc-dev@lists.ozlabs.org \ --cc=zohar@linuv.vnet.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.