Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp1557638pxa; Thu, 13 Aug 2020 11:04:18 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyoBOJBmA9+esOgiY52YstVgVLZ2Dq+ROwSNtaLGCfUsy4Qa/puOHgVXuOgjnw6sLkE4b+F X-Received: by 2002:a05:6402:1545:: with SMTP id p5mr5662581edx.388.1597341858030; Thu, 13 Aug 2020 11:04:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597341858; cv=none; d=google.com; s=arc-20160816; b=KO2/TWA7YfFRDbb1CTviNPTuXLA2VaPBi5FYaT3DHYqpGgvoQ629jUCMxoNhLBy4XQ HX+MaaV3jrHsk4+8MprWVpaaPwcO2G5Fai/qlhorASwn58tE7xtPUzdg/B1eg7bT66pM cB9/w/pa47AsetMHtu5zlcSQj7f9cOKVb8PcXzN2HmmwJ6KAG9A8wPUovxnzbxEznJS6 TT2sid3sUmSZ9mz1MMQwSfKJJ2M453R/Ik7M2allV+0fkm/oOAnlRxPMyhACxHaFDqLo r/KBZncrrEfTvIzLur34HW1+5oJjgwIBcqPmhqfdFAmKLZXjHTaozDUyoPUkwA7YRw5S R4Fw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:from:references:cc:to:subject:dkim-signature:dkim-filter; bh=Modxb3K7yV+fn+lZsLzpD0bAJRLvdDqXtA/f5BPYSis=; b=tQ9+IdDZd+wK8rIuCJlPJWrsJ/NxF7gw71+lF92wfRGJM70pcnKiGapO7PeZdRzhT+ P31I16l+yjPdvyXoVkxdgBSfHyroHj+rC519kk2M0X4i5ZlfoBF2X34o1szfUy+XwNUM 58OOrDx1TP9OSpsTPlXVz4V3L6lHF4dgWiQiNC8rljPot+RUZk+dAvVKn+Co3iMVRFrT gIQgYx7Vv/NE/wD59om8pecP+zCzhrHJL5w/PstOEU69HyKfqdaZux1XYd9upRalaK+M 29Vb2AqG06h6oUksZsldQNp14c1wXoWbEvRfbl+1Py3tsmir3efSnIf0dbzrWiJH6M2y z/XA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=RgebBq50; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id k7si3228238ejx.93.2020.08.13.11.03.55; Thu, 13 Aug 2020 11:04:18 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=RgebBq50; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726546AbgHMSDI (ORCPT + 99 others); Thu, 13 Aug 2020 14:03:08 -0400 Received: from linux.microsoft.com ([13.77.154.182]:41566 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726167AbgHMSDG (ORCPT ); Thu, 13 Aug 2020 14:03:06 -0400 Received: from [192.168.0.104] (c-73-42-176-67.hsd1.wa.comcast.net [73.42.176.67]) by linux.microsoft.com (Postfix) with ESMTPSA id 22C4420B4908; Thu, 13 Aug 2020 11:03:05 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 22C4420B4908 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1597341785; bh=Modxb3K7yV+fn+lZsLzpD0bAJRLvdDqXtA/f5BPYSis=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=RgebBq50MoWJJfQ7slTtrv5HkiXjG+9SaCMslTqbChbX1hVnbpmfrZSXcIDcSXNAu qNuXkGBr41h1uCxxJxB0mCQE/2nvLRLV89bqD5RWPh0/bKuhZSZAhoSJAb+Zs6sDKK mJEiMmEwRxPU5kYyb2e2UTOq+xY6mVHR7Ti/fXn4= Subject: Re: [PATCH 2/2] SELinux: Measure state and hash of policy using IMA To: Stephen Smalley Cc: Mimi Zohar , Casey Schaufler , Tyler Hicks , tusharsu@linux.microsoft.com, sashal@kernel.org, James Morris , linux-integrity@vger.kernel.org, SElinux list , LSM List , linux-kernel , paul Moore References: <20200813170707.2659-1-nramas@linux.microsoft.com> <20200813170707.2659-3-nramas@linux.microsoft.com> <5f738fd8-fe28-5358-b3d8-b671b45caa7f@gmail.com> <7315b7e8-2c53-2555-bc2e-aae42e16aaa2@linux.microsoft.com> From: Lakshmi Ramasubramanian Message-ID: Date: Thu, 13 Aug 2020 11:03:04 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 8/13/20 10:58 AM, Stephen Smalley wrote: > On Thu, Aug 13, 2020 at 1:52 PM Lakshmi Ramasubramanian > wrote: >> >> On 8/13/20 10:42 AM, Stephen Smalley wrote: >> >>>> diff --git a/security/selinux/measure.c b/security/selinux/measure.c >>>> new file mode 100644 >>>> index 000000000000..f21b7de4e2ae >>>> --- /dev/null >>>> +++ b/security/selinux/measure.c >>>> @@ -0,0 +1,204 @@ >>>> +static int selinux_hash_buffer(void *buf, size_t buf_len, >>>> + void **buf_hash, int *buf_hash_len) >>>> +{ >>>> + struct crypto_shash *tfm; >>>> + struct shash_desc *desc = NULL; >>>> + void *digest = NULL; >>>> + int desc_size; >>>> + int digest_size; >>>> + int ret = 0; >>>> + >>>> + tfm = crypto_alloc_shash("sha256", 0, 0); >>>> + if (IS_ERR(tfm)) >>>> + return PTR_ERR(tfm); >>> Can we make the algorithm selectable via kernel parameter and/or writing >>> to a new selinuxfs node? >> >> I can add a kernel parameter to select this hash algorithm. > > Also can we provide a Kconfig option for the default value like IMA does? > Would we need both - Kconfig and kernel param? The other option is to provide an IMA function to return the current hash algorithm used for measurement. That way a consistent hash algorithm can be employed by both IMA and the callers. Would that be better? -lakshmi