Received: by 2002:a05:6a10:f347:0:0:0:0 with SMTP id d7csp1716354pxu; Tue, 24 Nov 2020 07:17:04 -0800 (PST) X-Google-Smtp-Source: ABdhPJwvmg18uqbaEIhNUd9PpW6CrmSMXDkfMgeF55UfVF0mxAi5GkRhmj5IsVyajXHcqLqWp/Xq X-Received: by 2002:a17:906:6d1:: with SMTP id v17mr4620437ejb.395.1606231023940; Tue, 24 Nov 2020 07:17:03 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1606231023; cv=none; d=google.com; s=arc-20160816; b=mqBy45P+Aq7jDmN3kAzfXFthWSZ4nO3fZA39fBHUvTCWDtsmoL60+E4d/B1XsdaYB7 S6OJYNnvn6/g9IdnYCCdkhMLIeh9qY1DORuSe+v8CNGcG7wabKZq27EIuJXSVygVI+xx +qVgBNf8lC+ZibZ5bIiAISsIDW6qlYuFKBUI+PuRO6LDlyRGQ6Q4co1TosE7h8KLuMEZ M/BWPn9ShJ6VsNk0B09ebdemSiwQY+KPSONC0a8vrPNPb7fWDEm9HfMKpkLhyeF858Hp Q/u4evt7Z5Ht2HDoC2gnYXj6g8GxYxiU/3fgCpLvdbH/mv4Qv+qn28Sm/hwj/T0erQmc CpcA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=zo/eh4ktsJrvBJDhlleePdIuf6jkuW1NUUnewCNp2aA=; b=wRTRUCoGcz1RSc0WO8sFsfVQ4yzcxgmf4XD9vnRyrQokoQ2azvPoh+YQ3AsczWBJuO ZZQOc/FPN74fjT4G0M02oMgPZWScEh9lxl+rqhmTayRAosvGdffnNUdFJjfMB1fgFj6g hUN12WtSH6sTrALrn6ZiFBebQfCZeFh2sS8KxBLOejZBPBK7RE/EW9lggU1HeHpEWkQS Ipw9nf3Ah/NVVv8Sr5hui9WIFP6/9o9Oz1R2jkB+NhkQBZMYZyKQ8mrhmCkMjEj7NLAe ZqyUcvZKZmWXxhelfKiRYp2yZXqqcm33EFIBmlwxyAeu9T8uJ+r/Dtnzfs+EOe7b+Rqx wc3A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=S32ef2Bv; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id t17si8738153edq.418.2020.11.24.07.16.41; Tue, 24 Nov 2020 07:17:03 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=S32ef2Bv; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389629AbgKXPMZ (ORCPT + 99 others); Tue, 24 Nov 2020 10:12:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49818 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732490AbgKXPMP (ORCPT ); Tue, 24 Nov 2020 10:12:15 -0500 Received: from mail-wr1-x444.google.com (mail-wr1-x444.google.com [IPv6:2a00:1450:4864:20::444]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B5C8FC061A4D for ; Tue, 24 Nov 2020 07:12:13 -0800 (PST) Received: by mail-wr1-x444.google.com with SMTP id m6so22658803wrg.7 for ; Tue, 24 Nov 2020 07:12:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=zo/eh4ktsJrvBJDhlleePdIuf6jkuW1NUUnewCNp2aA=; b=S32ef2BvvdYvJXT+dX/Sz/zKAStOA6HlrzJx5QZH8K5801QaZ5/FQXnZtciyBb/7Zm X3xhA/pIpPCD8MLVwrPc47UFcnmABqySOsW6HgVxn5Rbjk3OIxPn5wVsWSfYCqrrhgxn RFEY10+OSbJS2t8gVKAdgBxSABPT1j2NsIFLw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=zo/eh4ktsJrvBJDhlleePdIuf6jkuW1NUUnewCNp2aA=; b=OfkG+ndq5U6u+zjIzuB4Ls+gtS69b0Oh6LO7AR0M8iNg+5+4o+kDfM9yjHGaDT7pZq GIT85IQo29tDEdFtUmLT/WkshC3JQcK5a9SDO7Mzg6QsGAHgV0DCbmoQm8yZKr8MRVO1 8P9O+Nr99svjQB7VW+X3azSnEkcVEpyfg6LT/ATl3JHg7N5Sgh22vU4gtHu8X9Zx4NIg K41rcCBo2JFQxWwtwp+2o2sjRQ61dBi7szM+56qhMPRh1yU7SJ4YST6VWCGYbyLr+FWw YPndN/2YXNUO/+LYOLe4UivHSzhvh+R45Y5XxG4L6/M+T5468W2PB2IVqqj+N+fqSl+6 Cb9w== X-Gm-Message-State: AOAM533Xfk5ummX6NvSiTfUA3gT3PbXQeaigWJsATT9eu9J2/ef76nJ5 C9frFGeglH6yRQgoV7ZJopg5ng== X-Received: by 2002:a5d:5604:: with SMTP id l4mr5677722wrv.127.1606230732372; Tue, 24 Nov 2020 07:12:12 -0800 (PST) Received: from kpsingh.c.googlers.com.com (203.75.199.104.bc.googleusercontent.com. [104.199.75.203]) by smtp.gmail.com with ESMTPSA id g131sm6353127wma.35.2020.11.24.07.12.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Nov 2020 07:12:11 -0800 (PST) From: KP Singh To: James Morris , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-security-module@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Florent Revest , Brendan Jackman , Mimi Zohar Subject: [PATCH bpf-next v3 0/3] Implement bpf_ima_inode_hash Date: Tue, 24 Nov 2020 15:12:07 +0000 Message-Id: <20201124151210.1081188-1-kpsingh@chromium.org> X-Mailer: git-send-email 2.29.2.454.gaff20da3a2-goog MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: KP Singh # v2 -> v3 - Fixed an issue pointed out by Alexei, the helper should only be exposed to sleepable hooks. - Update the selftests to constrain the IMA policy udpate to a loopback filesystem specifically created for the test. Also, split this out from the LSM test. I dropped the Ack from this last patch since this is a re-write. KP Singh (3): ima: Implement ima_inode_hash bpf: Add a BPF helper for getting the IMA hash of an inode bpf: Add a selftest for bpf_ima_inode_hash include/linux/ima.h | 6 ++ include/uapi/linux/bpf.h | 11 +++ kernel/bpf/bpf_lsm.c | 26 ++++++ scripts/bpf_helpers_doc.py | 2 + security/integrity/ima/ima_main.c | 78 ++++++++++++------ tools/include/uapi/linux/bpf.h | 11 +++ tools/testing/selftests/bpf/config | 4 + tools/testing/selftests/bpf/ima_setup.sh | 80 +++++++++++++++++++ .../selftests/bpf/prog_tests/test_ima.c | 74 +++++++++++++++++ tools/testing/selftests/bpf/progs/ima.c | 28 +++++++ 10 files changed, 296 insertions(+), 24 deletions(-) create mode 100644 tools/testing/selftests/bpf/ima_setup.sh create mode 100644 tools/testing/selftests/bpf/prog_tests/test_ima.c create mode 100644 tools/testing/selftests/bpf/progs/ima.c -- 2.29.2.454.gaff20da3a2-goog