Received: by 2002:a25:8b91:0:0:0:0:0 with SMTP id j17csp791242ybl; Tue, 28 Jan 2020 12:12:20 -0800 (PST) X-Google-Smtp-Source: APXvYqxArJdOHX8lNFeeXuT3DRkU2zszPZO/Cc/WL+HKL2UeqKbNZwCaaiJLEfu8rr2+HsMq26tq X-Received: by 2002:a9d:6b03:: with SMTP id g3mr17840343otp.200.1580242339845; Tue, 28 Jan 2020 12:12:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1580242339; cv=none; d=google.com; s=arc-20160816; b=MYIJy5Qq6RPA3Om7a0JVJlGoqSb0HVFfXmom6UEvZ3jNUaXujJ81TOulid3d4q975K oI+pxGKqNweGV8sIMqiaf6JzWPafy8JCD0h0Xj76qOvTPCGn3JyjyebwMtULcqDnyUVU 806ycHlNfDDnUgrLFG7JfjLtMX7lOrflgWGRdCXIY+WFhYLaJ7GCTsALqTgySD13luMf B8JMAf0E+vQZpvBgErUagI6tIxMtYUJTI80SPnuRKnZVZXdjMwg/LHvnyQJccH65Z/rd Bby9gQRAjkER1TndJsgUzWgRAhwcYBicpArXRHRNw2l6nsX292n2z243+yT+77GC6t6G 6GRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:content-transfer-encoding :mime-version:date:cc:to:from:subject; bh=wRpFIW0V1dSDZQ+u9rltXKoi2f3+z/Hx61fXxUBUZ1A=; b=0SljhvOq1Axq9UUB8ceEVW9uIMxXfxC/MFgUTLHjqwLbaBDct712CuiVzS0Q2llrcK tBuoEHrnR3TaEa3nyxHEqHvcvR9FNEL8fUgdisxsG2namPN35hDmBTZm8Gc5b785C2fZ ymD1aFzhSu8uofxt2uxDNI+9Ux+e0vIepMwzNHpyD5KD/hX5wHoFBTdmXTAvb0kOjA92 QBVO76Bubi3/Pl6eC5rAeMAWT1aV7/gpO8aHtb8H+9UIqQOZxinMIOfCUPicnFMult4p iSyhrF39KqDj03sfEDDU8QBFK8s1Zy8Sp+/5t4dtzR06ofeeb5CYb2boP8CH7k2fwEpk PDvg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i13si8952527oth.175.2020.01.28.12.12.07; Tue, 28 Jan 2020 12:12:19 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726299AbgA1UJy (ORCPT + 99 others); Tue, 28 Jan 2020 15:09:54 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:38998 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726141AbgA1UJx (ORCPT ); Tue, 28 Jan 2020 15:09:53 -0500 Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 00SK9WZj125493 for ; Tue, 28 Jan 2020 15:09:52 -0500 Received: from e06smtp01.uk.ibm.com (e06smtp01.uk.ibm.com [195.75.94.97]) by mx0b-001b2d01.pphosted.com with ESMTP id 2xrfg1eab5-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 28 Jan 2020 15:09:51 -0500 Received: from localhost by e06smtp01.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 28 Jan 2020 20:09:50 -0000 Received: from b06cxnps4075.portsmouth.uk.ibm.com (9.149.109.197) by e06smtp01.uk.ibm.com (192.168.101.131) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Tue, 28 Jan 2020 20:09:48 -0000 Received: from d06av25.portsmouth.uk.ibm.com (d06av25.portsmouth.uk.ibm.com [9.149.105.61]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 00SK9mgh58851500 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 28 Jan 2020 20:09:48 GMT Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0AAE711C04C; Tue, 28 Jan 2020 20:09:48 +0000 (GMT) Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 31BDD11C04A; Tue, 28 Jan 2020 20:09:47 +0000 (GMT) Received: from localhost.localdomain (unknown [9.80.227.61]) by d06av25.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 28 Jan 2020 20:09:47 +0000 (GMT) Subject: [GIT PULL] integrity subsystem updates for v5.6 From: Mimi Zohar To: Linus Torvalds Cc: linux-integrity , linux-kernel Date: Tue, 28 Jan 2020 15:09:46 -0500 Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 x-cbid: 20012820-4275-0000-0000-0000039BC873 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20012820-4276-0000-0000-000038AFE1B0 Message-Id: <1580242186.5088.96.camel@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-01-28_07:2020-01-28,2020-01-28 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 adultscore=0 malwarescore=0 mlxlogscore=999 priorityscore=1501 impostorscore=0 phishscore=0 mlxscore=0 lowpriorityscore=0 clxscore=1015 spamscore=0 suspectscore=2 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1911200001 definitions=main-2001280150 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Linus, Two new features - measuring certificates and querying IMA for a file hash - and three bug fixes are included in this pull request. - Measuring certificates is like the rest of IMA, based on policy, but requires loading a custom policy.  Certificates loaded onto a keyring, for example during early boot, before a custom policy has been loaded, are queued and only processed after loading the custom policy. - IMA calculates and caches files hashes.  Other kernel subsystems, and possibly kernel modules, are interested in accessing these cached file hashes.   The bug fixes prevents classifying a file short read (e.g. shutdown) as an invalid file signature, adds a missing blank when displaying the securityfs policy rules containing LSM labels, and, lastly, fixes the handling of the IMA policy information for unknown LSM labels. thanks, Mimi The following changes since commit e42617b825f8073569da76dc4510bfa019b1c35a: Linux 5.5-rc1 (2019-12-08 14:57:55 -0800) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity for you to fetch changes up to d54e17b4066612d88c4ef3e5fb3115f12733763d: Merge branch 'next-integrity.defer-measuring-keys' into next-integrity (2020-01-23 17:24:35 -0500) ---------------------------------------------------------------- Clay Chang (1): ima: Add a space after printing LSM rules for readability Florent Revest (1): ima: add the ability to query the cached hash of a given file Janne Karhunen (1): ima: ima/lsm policy rule loading logic bug fixes Lakshmi Ramasubramanian (11): IMA: Check IMA policy flag IMA: Add KEY_CHECK func to measure keys IMA: Define an IMA hook to measure keys KEYS: Call the IMA hook to measure keys IMA: Add support to limit measuring keys IMA: Read keyrings= option from the IMA policy IMA: fix measuring asymmetric keys Kconfig IMA: pre-allocate buffer to hold keyrings string IMA: Define workqueue for early boot key measurements IMA: Call workqueue functions to measure queued keys IMA: Defined delayed workqueue to free the queued keys Mimi Zohar (2): Merge branch 'next-integrity.measure-keys' into next-integrity Merge branch 'next-integrity.defer-measuring-keys' into next-integrity Patrick Callaghan (1): ima: avoid appraise error for hash calc interrupt Documentation/ABI/testing/ima_policy | 16 ++- include/linux/ima.h | 20 ++++ security/integrity/ima/Kconfig | 12 ++ security/integrity/ima/Makefile | 2 + security/integrity/ima/ima.h | 33 +++++- security/integrity/ima/ima_api.c | 8 +- security/integrity/ima/ima_appraise.c | 4 +- security/integrity/ima/ima_asymmetric_keys.c | 66 +++++++++++ security/integrity/ima/ima_crypto.c | 4 +- security/integrity/ima/ima_init.c | 8 +- security/integrity/ima/ima_main.c | 61 +++++++++- security/integrity/ima/ima_policy.c | 165 ++++++++++++++++++++++---- security/integrity/ima/ima_queue_keys.c | 171 +++++++++++++++++++++++++++ security/keys/key.c | 10 ++ 14 files changed, 540 insertions(+), 40 deletions(-) create mode 100644 security/integrity/ima/ima_asymmetric_keys.c create mode 100644 security/integrity/ima/ima_queue_keys.c