Received: by 2002:a05:6a10:f347:0:0:0:0 with SMTP id d7csp1859255pxu; Sun, 13 Dec 2020 05:48:14 -0800 (PST) X-Google-Smtp-Source: ABdhPJxHWAA2CeCGTI3/rsTeJz9bMkN2z4XZs0cF3evk8G2dOhtvqYHYw9WcQJ278yIZm2UBq+5H X-Received: by 2002:a17:906:eb49:: with SMTP id mc9mr18195818ejb.487.1607867294621; Sun, 13 Dec 2020 05:48:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1607867294; cv=none; d=google.com; s=arc-20160816; b=LK7lJcBQpHCTuofcErvtkyXmY4DIZ88BSdB4uVrWzNGxjbUhyow0rFPxrUvFJNknME 2GhU6kjcwvgyv8wCKf4a6lXYU6datIqmDPotWwr/tRLFgb6fnQf1E6rq+bcfwnInsHMP SZWVmPNaifyImwTrdliXJNLl5H67S/61zuB9OpZ5Ld11f7StDR3UWS8JatVwxZe6/BYD b03h3XL8kFSZq4DdQaP81fx7kDMee9Ybvkn2tnIYfC3W3WQobDMczfovMhvlwdCkmCNB NqkeF3MNIh5Q0j3283cVoZamAnwbuBp+1EfaoqNEWzUgJht3T2QPftIjHCftOuU/0C98 JvkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:references:in-reply-to:message-id:date:subject :cc:to:from:dkim-signature:dkim-filter; bh=MM3ClDqEP+SzUBB8BN8JUnd+31NPdgl7RcDy+xWWqKE=; b=t085eUxzhpdsl+27smP7gW/mlNxYEIboIdMeK9wym28Q/KzElOjHyxzmZFqA1nP0NO aUihpzKKzyYjnSWjphGOCMRiNxW4l+DgxgG24nkTq71nqsul8Td8LSLSGFGKNHXThUzv yj7sckkXwfqu+OaGzVn0JInU/fnswbz+SDcOASHd3P96vuSe42+Th1uX0ouLWbPAsIeB ec2R6581eCszziBsnM+/PP9CUjmxzBobE2/FP0RNrvNNQnJyEQI6z5jmLN3LKda9iaLa JLBzyKdMgirivzhXJv9NQxzHurHRNDNauukyssvA/9Zf8GllVcWGYWeQxMkQv0aYWeWx gUCw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=Snfg9emc; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id z16si840582ejw.548.2020.12.13.05.47.51; Sun, 13 Dec 2020 05:48:14 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=Snfg9emc; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2407226AbgLLAAa (ORCPT + 99 others); Fri, 11 Dec 2020 19:00:30 -0500 Received: from linux.microsoft.com ([13.77.154.182]:54886 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2437540AbgLKX7m (ORCPT ); Fri, 11 Dec 2020 18:59:42 -0500 Received: from tusharsu-Ubuntu.lan (c-71-197-163-6.hsd1.wa.comcast.net [71.197.163.6]) by linux.microsoft.com (Postfix) with ESMTPSA id 7720220B718B; Fri, 11 Dec 2020 15:58:22 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 7720220B718B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1607731102; bh=MM3ClDqEP+SzUBB8BN8JUnd+31NPdgl7RcDy+xWWqKE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Snfg9emcanInVSinf/C0GEyNw1+SPQgDhpj3YZLDy6krAtcaCsUBtBgCkbRdJMwGf czZCS7CL4FcBw5LSERnVFtkR5PqSP1nEujXDPm0pqpvpo3cg897BS+u92tEEC0pX0e CIo41ej/gTISk05j1yV1xRBFgU6Iu2XShLSRWIxM= From: Tushar Sugandhi To: zohar@linux.ibm.com, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Cc: tyhicks@linux.microsoft.com, sashal@kernel.org, jmorris@namei.org, nramas@linux.microsoft.com, linux-integrity@vger.kernel.org, selinux@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dm-devel@redhat.com Subject: [PATCH v8 6/8] IMA: extend critical data hook to limit the measurement based on a label Date: Fri, 11 Dec 2020 15:58:05 -0800 Message-Id: <20201211235807.30815-7-tusharsu@linux.microsoft.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201211235807.30815-1-tusharsu@linux.microsoft.com> References: <20201211235807.30815-1-tusharsu@linux.microsoft.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The IMA hook ima_measure_critical_data() does not support a way to specify the source of the critical data provider. Thus, the data measurement cannot be constrained based on the data source label in the IMA policy. Extend the IMA hook ima_measure_critical_data() to support passing the data source label as an input parameter, so that the policy rule can be used to limit the measurements based on the label. Signed-off-by: Tushar Sugandhi Reviewed-by: Tyler Hicks --- include/linux/ima.h | 6 ++++-- security/integrity/ima/ima_main.c | 11 ++++++++--- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/include/linux/ima.h b/include/linux/ima.h index 675f54db6264..6434287a81cd 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -30,7 +30,8 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size, extern void ima_post_path_mknod(struct dentry *dentry); extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); -extern void ima_measure_critical_data(const char *event_name, +extern void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash); @@ -125,7 +126,8 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) } static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} -static inline void ima_measure_critical_data(const char *event_name, +static inline void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash) {} #endif /* CONFIG_IMA */ diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index dff4bce4fb09..cc828ba00790 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -924,6 +924,7 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) /** * ima_measure_critical_data - measure kernel integrity critical data + * @event_data_source: kernel data source being measured * @event_name: event name to be used for the buffer entry * @buf: pointer to buffer containing data to measure * @buf_len: length of buffer(in bytes) @@ -932,6 +933,9 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) * Measure the kernel subsystem data, critical to the integrity of the kernel, * into the IMA log and extend the @pcr. * + * Use @event_data_source to describe the kernel data source for the buffer + * being measured. + * * Use @event_name to describe the state/buffer data change. * Examples of critical data (@buf) could be various data structures, * policies, and states stored in kernel memory that can impact the integrity @@ -944,15 +948,16 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) * * The data (@buf) can only be measured, not appraised. */ -void ima_measure_critical_data(const char *event_name, +void ima_measure_critical_data(const char *event_data_source, + const char *event_name, const void *buf, int buf_len, bool measure_buf_hash) { - if (!event_name || !buf || !buf_len) + if (!event_name || !event_data_source || !buf || !buf_len) return; process_buffer_measurement(NULL, buf, buf_len, event_name, - CRITICAL_DATA, 0, NULL, + CRITICAL_DATA, 0, event_data_source, measure_buf_hash); } -- 2.17.1