From patchwork Tue Feb 15 12:40:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 12747011 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C7CAC41535 for ; Tue, 15 Feb 2022 12:41:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237616AbiBOMlx (ORCPT ); Tue, 15 Feb 2022 07:41:53 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:50058 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237763AbiBOMlv (ORCPT ); Tue, 15 Feb 2022 07:41:51 -0500 Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B2FB213FA5; Tue, 15 Feb 2022 04:41:40 -0800 (PST) Received: from fraeml714-chm.china.huawei.com (unknown [172.18.147.201]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4JygZx5Kb4z6809v; Tue, 15 Feb 2022 20:37:13 +0800 (CST) Received: from roberto-ThinkStation-P620.huawei.com (10.204.63.22) by fraeml714-chm.china.huawei.com (10.206.15.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.21; Tue, 15 Feb 2022 13:41:37 +0100 From: Roberto Sassu To: , , , , , , CC: , , , , , , Roberto Sassu Subject: [PATCH v2 0/6] bpf-lsm: Extend interoperability with IMA Date: Tue, 15 Feb 2022 13:40:36 +0100 Message-ID: <20220215124042.186506-1-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-Originating-IP: [10.204.63.22] X-ClientProxiedBy: lhreml753-chm.china.huawei.com (10.201.108.203) To fraeml714-chm.china.huawei.com (10.206.15.33) X-CFilter-Loop: Reflected Precedence: bulk List-ID: Extend the interoperability with IMA, to give wider flexibility for the implementation of integrity-focused LSMs based on eBPF. Patch 1 fixes some style issues. Patches 2-4 gives the ability to eBPF-based LSMs to take advantage of the measurement capability of IMA without needing to setup a policy in IMA (those LSMs might implement the policy capability themselves). Patches 5-6 allows eBPF-based LSMs to evaluate files read by the kernel. Changelog v1: - Modify ima_file_hash() only and allow the usage of the function with the modified behavior by eBPF-based LSMs through the new function bpf_ima_file_hash() (suggested by Mimi) - Make bpf_lsm_kernel_read_file() sleepable so that bpf_ima_inode_hash() and bpf_ima_file_hash() can be called inside the implementation of eBPF-based LSMs for this hook Roberto Sassu (6): ima: Fix documentation-related warnings in ima_main.c ima: Always return a file measurement in ima_file_hash() bpf-lsm: Introduce new helper bpf_ima_file_hash() selftests/bpf: Add test for bpf_ima_file_hash() bpf-lsm: Make bpf_lsm_kernel_read_file() as sleepable selftests/bpf: Add test for bpf_lsm_kernel_read_file() include/uapi/linux/bpf.h | 11 +++++ kernel/bpf/bpf_lsm.c | 21 +++++++++ security/integrity/ima/ima_main.c | 47 ++++++++++++------- tools/include/uapi/linux/bpf.h | 11 +++++ tools/testing/selftests/bpf/ima_setup.sh | 2 + .../selftests/bpf/prog_tests/test_ima.c | 30 ++++++++++-- tools/testing/selftests/bpf/progs/ima.c | 34 ++++++++++++-- 7 files changed, 132 insertions(+), 24 deletions(-)