From: Tushar Sugandhi <tusharsu@linux.microsoft.com> To: zohar@linux.ibm.com, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Cc: tyhicks@linux.microsoft.com, sashal@kernel.org, jmorris@namei.org, nramas@linux.microsoft.com, linux-integrity@vger.kernel.org, selinux@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dm-devel@redhat.com Subject: [PATCH v10 3/8] IMA: define a hook to measure kernel integrity critical data Date: Thu, 7 Jan 2021 20:07:03 -0800 [thread overview] Message-ID: <20210108040708.8389-4-tusharsu@linux.microsoft.com> (raw) In-Reply-To: <20210108040708.8389-1-tusharsu@linux.microsoft.com> IMA provides capabilities to measure file and buffer data. However, various data structures, policies, and states stored in kernel memory also impact the integrity of the system. Several kernel subsystems contain such integrity critical data. These kernel subsystems help protect the integrity of the system. Currently, IMA does not provide a generic function for measuring kernel integrity critical data. Define ima_measure_critical_data, a new IMA hook, to measure kernel integrity critical data. Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> --- include/linux/ima.h | 7 +++++++ security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_main.c | 24 ++++++++++++++++++++++++ 4 files changed, 33 insertions(+), 1 deletion(-) diff --git a/include/linux/ima.h b/include/linux/ima.h index ac3d82f962f2..37a0727c1c31 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -30,6 +30,9 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size, extern void ima_post_path_mknod(struct dentry *dentry); extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); +extern void ima_measure_critical_data(const char *event_name, + const void *buf, size_t buf_len, + bool hash); #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM extern void ima_appraise_parse_cmdline(void); @@ -122,6 +125,10 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) } static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} + +static inline void ima_measure_critical_data(const char *event_name, + const void *buf, size_t buf_len, + bool hash) {} #endif /* CONFIG_IMA */ #ifndef CONFIG_IMA_KEXEC diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 0b4634515839..aa312472c7c5 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -201,6 +201,7 @@ static inline unsigned int ima_hash_key(u8 *digest) hook(POLICY_CHECK, policy) \ hook(KEXEC_CMDLINE, kexec_cmdline) \ hook(KEY_CHECK, key) \ + hook(CRITICAL_DATA, critical_data) \ hook(MAX_CHECK, none) #define __ima_hook_enumify(ENUM, str) ENUM, diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index e76499b1ce78..1dd70dc68ffd 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -176,7 +176,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, * subj=, obj=, type=, func=, mask=, fsmagic= * subj,obj, and type: are LSM specific. * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK - * | KEXEC_CMDLINE | KEY_CHECK + * | KEXEC_CMDLINE | KEY_CHECK | CRITICAL_DATA * mask: contains the permission mask * fsmagic: hex value * diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 494fb964497d..ef37307e79dd 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -913,6 +913,30 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) fdput(f); } +/** + * ima_measure_critical_data - measure kernel integrity critical data + * @event_name: event name for the record in the IMA measurement list + * @buf: pointer to buffer data + * @buf_len: length of buffer data (in bytes) + * @hash: measure buffer data hash + * + * Measure data critical to the integrity of the kernel into the IMA log + * and extend the pcr. Examples of critical data could be various data + * structures, policies, and states stored in kernel memory that can + * impact the integrity of the system. + */ +void ima_measure_critical_data(const char *event_name, + const void *buf, size_t buf_len, + bool hash) +{ + if (!event_name || !buf || !buf_len) + return; + + process_buffer_measurement(NULL, buf, buf_len, event_name, + CRITICAL_DATA, 0, NULL, + hash); +} + static int __init init_ima(void) { int error; -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Tushar Sugandhi <tusharsu@linux.microsoft.com> To: zohar@linux.ibm.com, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Cc: sashal@kernel.org, dm-devel@redhat.com, selinux@vger.kernel.org, jmorris@namei.org, linux-kernel@vger.kernel.org, nramas@linux.microsoft.com, linux-security-module@vger.kernel.org, tyhicks@linux.microsoft.com, linux-integrity@vger.kernel.org Subject: [dm-devel] [PATCH v10 3/8] IMA: define a hook to measure kernel integrity critical data Date: Thu, 7 Jan 2021 20:07:03 -0800 [thread overview] Message-ID: <20210108040708.8389-4-tusharsu@linux.microsoft.com> (raw) In-Reply-To: <20210108040708.8389-1-tusharsu@linux.microsoft.com> IMA provides capabilities to measure file and buffer data. However, various data structures, policies, and states stored in kernel memory also impact the integrity of the system. Several kernel subsystems contain such integrity critical data. These kernel subsystems help protect the integrity of the system. Currently, IMA does not provide a generic function for measuring kernel integrity critical data. Define ima_measure_critical_data, a new IMA hook, to measure kernel integrity critical data. Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> --- include/linux/ima.h | 7 +++++++ security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_main.c | 24 ++++++++++++++++++++++++ 4 files changed, 33 insertions(+), 1 deletion(-) diff --git a/include/linux/ima.h b/include/linux/ima.h index ac3d82f962f2..37a0727c1c31 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -30,6 +30,9 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size, extern void ima_post_path_mknod(struct dentry *dentry); extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); +extern void ima_measure_critical_data(const char *event_name, + const void *buf, size_t buf_len, + bool hash); #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM extern void ima_appraise_parse_cmdline(void); @@ -122,6 +125,10 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) } static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} + +static inline void ima_measure_critical_data(const char *event_name, + const void *buf, size_t buf_len, + bool hash) {} #endif /* CONFIG_IMA */ #ifndef CONFIG_IMA_KEXEC diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 0b4634515839..aa312472c7c5 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -201,6 +201,7 @@ static inline unsigned int ima_hash_key(u8 *digest) hook(POLICY_CHECK, policy) \ hook(KEXEC_CMDLINE, kexec_cmdline) \ hook(KEY_CHECK, key) \ + hook(CRITICAL_DATA, critical_data) \ hook(MAX_CHECK, none) #define __ima_hook_enumify(ENUM, str) ENUM, diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index e76499b1ce78..1dd70dc68ffd 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -176,7 +176,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, * subj=, obj=, type=, func=, mask=, fsmagic= * subj,obj, and type: are LSM specific. * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK - * | KEXEC_CMDLINE | KEY_CHECK + * | KEXEC_CMDLINE | KEY_CHECK | CRITICAL_DATA * mask: contains the permission mask * fsmagic: hex value * diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 494fb964497d..ef37307e79dd 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -913,6 +913,30 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) fdput(f); } +/** + * ima_measure_critical_data - measure kernel integrity critical data + * @event_name: event name for the record in the IMA measurement list + * @buf: pointer to buffer data + * @buf_len: length of buffer data (in bytes) + * @hash: measure buffer data hash + * + * Measure data critical to the integrity of the kernel into the IMA log + * and extend the pcr. Examples of critical data could be various data + * structures, policies, and states stored in kernel memory that can + * impact the integrity of the system. + */ +void ima_measure_critical_data(const char *event_name, + const void *buf, size_t buf_len, + bool hash) +{ + if (!event_name || !buf || !buf_len) + return; + + process_buffer_measurement(NULL, buf, buf_len, event_name, + CRITICAL_DATA, 0, NULL, + hash); +} + static int __init init_ima(void) { int error; -- 2.17.1 -- dm-devel mailing list dm-devel@redhat.com https://www.redhat.com/mailman/listinfo/dm-devel
next prev parent reply other threads:[~2021-01-08 4:08 UTC|newest] Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-01-08 4:07 [PATCH v10 0/8] IMA: support for measuring kernel integrity critical data Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 1/8] IMA: generalize keyring specific measurement constructs Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 2/8] IMA: add support to measure buffer data hash Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` Tushar Sugandhi [this message] 2021-01-08 4:07 ` [dm-devel] [PATCH v10 3/8] IMA: define a hook to measure kernel integrity critical data Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 4/8] IMA: add policy rule to measure " Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 5/8] IMA: limit critical data measurement based on a label Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-14 2:09 ` Mimi Zohar 2021-01-14 2:09 ` [dm-devel] " Mimi Zohar 2021-01-14 17:57 ` Tushar Sugandhi 2021-01-14 17:57 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 6/8] IMA: extend critical data hook to limit the " Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 7/8] IMA: define a builtin critical data measurement policy Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 8/8] selinux: include a consumer of the new IMA critical data hook Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-12 16:27 ` Paul Moore 2021-01-12 16:27 ` [dm-devel] " Paul Moore 2021-01-12 18:25 ` Lakshmi Ramasubramanian 2021-01-12 18:25 ` [dm-devel] " Lakshmi Ramasubramanian 2021-01-13 19:13 ` Mimi Zohar 2021-01-13 19:13 ` [dm-devel] " Mimi Zohar 2021-01-13 19:19 ` Paul Moore 2021-01-13 19:19 ` [dm-devel] " Paul Moore 2021-01-13 21:11 ` Mimi Zohar 2021-01-13 21:11 ` [dm-devel] " Mimi Zohar 2021-01-13 22:10 ` Paul Moore 2021-01-13 22:10 ` [dm-devel] " Paul Moore 2021-01-13 23:10 ` Mimi Zohar 2021-01-13 23:10 ` [dm-devel] " Mimi Zohar 2021-01-14 2:40 ` Paul Moore 2021-01-14 2:40 ` [dm-devel] " Paul Moore 2021-01-14 2:49 ` Mimi Zohar 2021-01-14 2:49 ` [dm-devel] " Mimi Zohar 2021-01-14 16:22 ` Lakshmi Ramasubramanian 2021-01-14 16:22 ` [dm-devel] " Lakshmi Ramasubramanian 2021-01-14 16:44 ` Mimi Zohar 2021-01-14 16:44 ` [dm-devel] " Mimi Zohar 2021-01-14 16:50 ` Mimi Zohar 2021-01-14 16:50 ` [dm-devel] " Mimi Zohar 2021-01-14 17:48 ` Lakshmi Ramasubramanian 2021-01-14 17:48 ` [dm-devel] " Lakshmi Ramasubramanian 2021-01-14 19:21 ` Lakshmi Ramasubramanian 2021-01-14 19:21 ` [dm-devel] " Lakshmi Ramasubramanian 2021-01-14 16:51 ` Paul Moore 2021-01-14 16:51 ` [dm-devel] " Paul Moore 2021-01-15 12:54 ` [PATCH v10 0/8] IMA: support for measuring kernel integrity critical data Mimi Zohar 2021-01-15 12:54 ` [dm-devel] " Mimi Zohar 2021-01-15 17:26 ` Tushar Sugandhi 2021-01-15 17:26 ` [dm-devel] " Tushar Sugandhi
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210108040708.8389-4-tusharsu@linux.microsoft.com \ --to=tusharsu@linux.microsoft.com \ --cc=agk@redhat.com \ --cc=casey@schaufler-ca.com \ --cc=dm-devel@redhat.com \ --cc=gmazyland@gmail.com \ --cc=jmorris@namei.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=nramas@linux.microsoft.com \ --cc=paul@paul-moore.com \ --cc=sashal@kernel.org \ --cc=selinux@vger.kernel.org \ --cc=snitzer@redhat.com \ --cc=stephen.smalley.work@gmail.com \ --cc=tyhicks@linux.microsoft.com \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.