@@ -163,6 +163,8 @@ bool ima_template_has_modsig(const struct ima_template_desc *ima_template);
int ima_restore_measurement_entry(struct ima_template_entry *entry);
int ima_restore_measurement_list(loff_t bufsize, void *buf);
int ima_measurements_show(struct seq_file *m, void *v);
+void ima_measurements_suspend(void);
+void ima_measurements_resume(void);
unsigned long ima_get_binary_runtime_size(void);
int ima_init_template(void);
void ima_init_template_list(void);
@@ -44,6 +44,11 @@ struct ima_h_table ima_htable = {
*/
static DEFINE_MUTEX(ima_extend_list_mutex);
+/*
+ * Used internally by the kernel to suspend-resume ima measurements.
+ */
+static atomic_t suspend_ima_measurements;
+
/* lookup up the digest value in the hash table, and return the entry */
static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value,
int pcr)
@@ -148,6 +153,20 @@ static int ima_pcr_extend(struct tpm_digest *digests_arg, int pcr)
return result;
}
+void ima_measurements_suspend(void)
+{
+ mutex_lock(&ima_extend_list_mutex);
+ atomic_set(&suspend_ima_measurements, 1);
+ mutex_unlock(&ima_extend_list_mutex);
+}
+
+void ima_measurements_resume(void)
+{
+ mutex_lock(&ima_extend_list_mutex);
+ atomic_set(&suspend_ima_measurements, 0);
+ mutex_unlock(&ima_extend_list_mutex);
+}
+
/*
* Add template entry to the measurement list and hash table, and
* extend the pcr.
The IMA subsystem needs to provide a mechanism to suspend or resume measurements. This functionality is needed to temporarily halt the recording of IMA measurements during certain system operations. Add functions ima_measurements_suspend() and ima_measurements_resume() functions to set and reset the suspend_ima_measurements variable, respectively, to suspend/resume IMA measurements. Use ima_extend_list_mutex to ensure that the operations are thread-safe. Note: Use ima_measurements_suspend() and ima_measurements_resume() in pairs to avoid indefinitely suspending IMA measurements. Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> --- security/integrity/ima/ima.h | 2 ++ security/integrity/ima/ima_queue.c | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+)