From patchwork Fri May 10 22:32:26 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prakhar Srivastava X-Patchwork-Id: 10939641 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 087C6912 for ; Fri, 10 May 2019 22:32:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EBE081FF1E for ; Fri, 10 May 2019 22:32:56 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DFB481FF2D; Fri, 10 May 2019 22:32:56 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4902B1FF1E for ; Fri, 10 May 2019 22:32:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727828AbfEJWcp (ORCPT ); Fri, 10 May 2019 18:32:45 -0400 Received: from mail-pg1-f196.google.com ([209.85.215.196]:40738 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726839AbfEJWco (ORCPT ); Fri, 10 May 2019 18:32:44 -0400 Received: by mail-pg1-f196.google.com with SMTP id d31so3651115pgl.7; Fri, 10 May 2019 15:32:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=FwAAmLcH+s5ZzGkBypF7IB+h+fV8RUi6+x5FryDeaRc=; b=MyFxBNbTJrklt27JHMuc+0WhAdVJDIiI5IiSQpqka7kY0+fxvNU84XhesVwLavjwq/ BF4HY+mlb0aJADPjrIccRFtwQoTRDSZHWrmE6INSqxTtyKa4rOhSQWGdCBRHFzowYwoM rpmCA+a7idxqHBMlMBsvI0WiiYz3Q48FftD4UGuhTAGPXlnh0k4YzbdGbimZeNfC1gUZ e1WpKX+5yGqOR4GttOAPcx144W3uvmdFabj4xUCZhCMtqcKaexYRDy1qFp4b7VUbpQaR lMfYeLS2lxFmK3hLcL/NdVFl/uNFutoKqK7ESO+2aPbOAjKkl/e9e9ac+sl/3gZGGP8+ v0Sg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=FwAAmLcH+s5ZzGkBypF7IB+h+fV8RUi6+x5FryDeaRc=; b=CQbfQZocZcvG+WePFU0hOpm/BUkHDu+/Fjci6GfPk2SuSwmudi76K4Xh0yoLPVBnoe 6mtUHd11H+//zldfd933kDkVyRT9Xr4H/xUYScXUBJo++aKl8RaHvPgL8w+HRBCNv+zs mprGLvAoelDwNzJwFqYd3l9a6oaLmL4Cz4remlVS1mKiZigp+AHikWW6RGmQdeqkjavM C5we2AIGW9ENu++sTQwYGpoCHxr1WtfgrGPykMTjWwrataAhDwGyt1R1YS9BC/y092S3 iRbt4vjAL6XjzKEIR8GONBwyPB88q0bcVzt+Bl27yiRwgh/ht9v9laxcWoO08fH35hUP xpiQ== X-Gm-Message-State: APjAAAUB9Zf4gKfMSc60fnoYqfUXVkwLRkztm/bQWlMT3Grx2tZ//wmV ohs9y2yYCcqwKLBWoWyRehZ939EHODw= X-Google-Smtp-Source: APXvYqzVLJu1V/2EbPQSqCzR7Yj0gGXxFJiNpPJtQQ8NSNw0uKze8oqqLB6phaX4KdLvqqelNG8VpA== X-Received: by 2002:aa7:9a8c:: with SMTP id w12mr17308029pfi.187.1557527563161; Fri, 10 May 2019 15:32:43 -0700 (PDT) Received: from prsriva-linux.corp.microsoft.com ([2001:4898:80e8:a:1d1b:db59:93e9:eab5]) by smtp.gmail.com with ESMTPSA id g72sm16907374pfg.63.2019.05.10.15.32.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 May 2019 15:32:42 -0700 (PDT) From: Prakhar Srivastava X-Google-Original-From: Prakhar Srivastava To: linux-integrity@vger.kernel.org, inux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: zohar@linux.ibm.com, ebiederm@xmission.com, vgoyal@redhat.com, prsriva@microsoft.com, Prakhar Srivastava Subject: [PATCH 1/3 v5] add a new ima hook and policy to measure the cmdline Date: Fri, 10 May 2019 15:32:26 -0700 Message-Id: <20190510223228.9966-2-prsriva02@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190510223228.9966-1-prsriva02@gmail.com> References: <20190510223228.9966-1-prsriva02@gmail.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Prakhar Srivastava For this reason, this patch adds support for measuring these parameters during kexec. To achive this, a new ima policy and hook id, defined KEXEC_CMDLINE and ima_kexec_cmdline respectively, are added. Signed-off-by: Prakhar Srivastava --- Documentation/ABI/testing/ima_policy | 1 + include/linux/ima.h | 2 + security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_api.c | 1 + security/integrity/ima/ima_main.c | 84 ++++++++++++++++++++++++++++ security/integrity/ima/ima_policy.c | 9 +++ 6 files changed, 98 insertions(+) diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy index 74c6702de74e..62e7cd687e9c 100644 --- a/Documentation/ABI/testing/ima_policy +++ b/Documentation/ABI/testing/ima_policy @@ -29,6 +29,7 @@ Description: base: func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK] [FIRMWARE_CHECK] [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK] + [KEXEC_CMDLINE] mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] [[^]MAY_EXEC] fsmagic:= hex value diff --git a/include/linux/ima.h b/include/linux/ima.h index dc12fbcf484c..2e2c77280be8 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -26,6 +26,7 @@ extern int ima_read_file(struct file *file, enum kernel_read_file_id id); extern int ima_post_read_file(struct file *file, void *buf, loff_t size, enum kernel_read_file_id id); extern void ima_post_path_mknod(struct dentry *dentry); +extern void ima_kexec_cmdline(const void *buf, int size); #ifdef CONFIG_IMA_KEXEC extern void ima_add_kexec_buffer(struct kimage *image); @@ -92,6 +93,7 @@ static inline void ima_post_path_mknod(struct dentry *dentry) return; } +static inline void ima_kexec_cmdline(const void *buf, int size) {} #endif /* CONFIG_IMA */ #ifndef CONFIG_IMA_KEXEC diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index d213e835c498..226a26d8de09 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -184,6 +184,7 @@ static inline unsigned long ima_hash_key(u8 *digest) hook(KEXEC_KERNEL_CHECK) \ hook(KEXEC_INITRAMFS_CHECK) \ hook(POLICY_CHECK) \ + hook(KEXEC_CMDLINE) \ hook(MAX_CHECK) #define __ima_hook_enumify(ENUM) ENUM, diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index c7505fb122d4..800d965232e5 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -169,6 +169,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, * subj=, obj=, type=, func=, mask=, fsmagic= * subj,obj, and type: are LSM specific. * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK + * | KEXEC_CMDLINE * mask: contains the permission mask * fsmagic: hex value * diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 357edd140c09..1d186bda25fe 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -576,6 +576,90 @@ int ima_load_data(enum kernel_load_data_id id) return 0; } +/* + * process_buffer_measurement - Measure the buffer passed to ima log. + * (Instead of using the file hash use the buffer hash). + * @buf - The buffer that needs to be added to the log + * @size - size of buffer(in bytes) + * @eventname - event name to be used for buffer. + * + * The buffer passed is added to the ima log. + * + * On success return 0. + * On error cases surface errors from ima calls. + */ +static int process_buffer_measurement(const void *buf, int size, + const char *eventname, const struct cred *cred, + u32 secid) +{ + int ret = 0; + struct ima_template_entry *entry = NULL; + struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; + struct ima_event_data event_data = {iint, NULL, NULL, + NULL, 0, NULL}; + struct { + struct ima_digest_data hdr; + char digest[IMA_MAX_DIGEST_SIZE]; + } hash; + int violation = 0; + int pcr = CONFIG_IMA_MEASURE_PCR_IDX; + int action = 0; + + action = ima_get_action(NULL, cred, secid, 0, KEXEC_CMDLINE, &pcr); + if (!(action & IMA_AUDIT) && !(action & IMA_MEASURE)) + goto out; + + memset(iint, 0, sizeof(*iint)); + memset(&hash, 0, sizeof(hash)); + + event_data.filename = eventname; + + iint->ima_hash = &hash.hdr; + iint->ima_hash->algo = ima_hash_algo; + iint->ima_hash->length = hash_digest_size[ima_hash_algo]; + + ret = ima_calc_buffer_hash(buf, size, iint->ima_hash); + if (ret < 0) + goto out; + + ret = ima_alloc_init_template(&event_data, &entry); + if (ret < 0) + goto out; + + if (action & IMA_MEASURE) + ret = ima_store_template(entry, violation, NULL, buf, pcr); + + if (action & IMA_AUDIT) + ima_audit_measurement(iint, event_data.filename); + + if (ret < 0) { + ima_free_template_entry(entry); + goto out; + } + +out: + return ret; +} + +/** + * ima_kexec_cmdline - based on policy, store kexec cmdline args + * @buf: pointer to buffer + * @size: size of buffer + * + * Buffers can only be measured, not appraised. + */ +void ima_kexec_cmdline(const void *buf, int size) +{ + u32 secid; + + if (buf && size != 0) { + security_task_getsecid(current, &secid); + process_buffer_measurement(buf, size, "kexec-cmdline", + current_cred(), secid); + } +} + + static int __init init_ima(void) { int error; diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index e0cc323f948f..413e5921b248 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -291,6 +291,13 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, { int i; + /* only incase of KEXEC_CMDLINE, inode is NULL */ + if (func == KEXEC_CMDLINE) { + if ((rule->flags & IMA_FUNC) && + (rule->func == func) && (!inode)) + return true; + return false; + } if ((rule->flags & IMA_FUNC) && (rule->func != func && func != POST_SETATTR)) return false; @@ -869,6 +876,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) entry->func = KEXEC_INITRAMFS_CHECK; else if (strcmp(args[0].from, "POLICY_CHECK") == 0) entry->func = POLICY_CHECK; + else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0) + entry->func = KEXEC_CMDLINE; else result = -EINVAL; if (!result) From patchwork Fri May 10 22:32:27 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prakhar Srivastava X-Patchwork-Id: 10939643 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3989392A for ; Fri, 10 May 2019 22:33:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 284A61FF1E for ; Fri, 10 May 2019 22:33:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1C1C91FF2D; Fri, 10 May 2019 22:33:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 890A81FF1E for ; Fri, 10 May 2019 22:33:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728033AbfEJWc4 (ORCPT ); Fri, 10 May 2019 18:32:56 -0400 Received: from mail-pf1-f196.google.com ([209.85.210.196]:41720 "EHLO mail-pf1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727814AbfEJWcp (ORCPT ); Fri, 10 May 2019 18:32:45 -0400 Received: by mail-pf1-f196.google.com with SMTP id l132so3923454pfc.8; Fri, 10 May 2019 15:32:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=GbEXwJMOtDQCCWFKbIVF5kC5vfVIQcIDsT/50hWcZh8=; b=r1fdDXIzYcrBPoSBP9WfJyjDYuhPJV+VgznFwlHrLVUR8b5oxa7wxkxfFIJFsJQWuA 2NrDJUahkOXB9W0JuXZ4bos3nKeE8fbLdsm3wQdTxHxv9mAb9xm63e84vIt4l+dDQaZD jxbi1BPUimFHFZL5n4KObwnfHWNThfv8SOeBk2YeKxbaW3mapt8EmS5vezxPGIwKsIXG 5elxNb+o19cPE3c8eSSA72LLZ923ZAICgZlOQbRz+uUZnUNF26OectUoSfMVZm6KKIFL 3PpbgoyUwDKsgt7LBzgCP6jmxVrrl7b1jhcu65Ct7O3DYCchcGtewegSab8NDQsWD20c ru0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=GbEXwJMOtDQCCWFKbIVF5kC5vfVIQcIDsT/50hWcZh8=; b=m1LzZW/UyPcrKAs/mncqPk91WCMAzw6lWWuahvc3cRyf623SDJ6Ty6JuvubJt4a++K C5CkNJeDHGaL9HTDKgZP7Wl3fKhOUQ9ncwgq80iA/yuVrKYtePvLik1kcVN9VLTtcbjg IJoJJxbN+gaEs/cXzgvImmhM5cQgpI7qZMhB1NboD9PTa2/ZRKaX83GtltpvRPp3SJHw enycEPHu12xmBEghvk555EWBA1hfdFHxk1OslOdPWt0FklleVFl3scnNZCAFWo9L+0ZR eY5tHaMeZoqhkKM1RD4v5AZ/v6ClVYXdSpAmnjfH9sXWJ5IeKmEXglFDoQYk0A1PJ7kM Dyow== X-Gm-Message-State: APjAAAXqt2e59hsWJVDWliFd8ZdGCPhoFhpPt0LaF3BJVS9rbgDt/vX3 QwKagwGHpqhMe7M9P1OA/9IsWmjFoMo= X-Google-Smtp-Source: APXvYqy8pJcdJjNZja56wBzpWMfjAsOwf1ifL80e9RfHT6w4oQ6pwktnhPDDaZ78oAUL/HacPWt15g== X-Received: by 2002:a63:1555:: with SMTP id 21mr16686114pgv.204.1557527563943; Fri, 10 May 2019 15:32:43 -0700 (PDT) Received: from prsriva-linux.corp.microsoft.com ([2001:4898:80e8:a:1d1b:db59:93e9:eab5]) by smtp.gmail.com with ESMTPSA id g72sm16907374pfg.63.2019.05.10.15.32.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 May 2019 15:32:43 -0700 (PDT) From: Prakhar Srivastava X-Google-Original-From: Prakhar Srivastava To: linux-integrity@vger.kernel.org, inux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: zohar@linux.ibm.com, ebiederm@xmission.com, vgoyal@redhat.com, prsriva@microsoft.com, Prakhar Srivastava Subject: [PATCH 2/3 v5] add a new template field buf to contain the buffer Date: Fri, 10 May 2019 15:32:27 -0700 Message-Id: <20190510223228.9966-3-prsriva02@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190510223228.9966-1-prsriva02@gmail.com> References: <20190510223228.9966-1-prsriva02@gmail.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Prakhar Srivastava The buffer(cmdline args) added to the ima log cannot be attested without having the actual buffer. Thus to make the measured buffer available to stroe/read a new ima temaplate (buf) is added. The cmdline args used for soft reboot can then be read and attested later. The patch adds a new template field buf to store/read the buffer used while measuring kexec_cmdline args in the [PATCH 1/2 v5]: "add a new ima hook and policy to measure the cmdline". Signed-off-by: Prakhar Srivastava --- security/integrity/ima/ima_main.c | 23 +++++++++++++++++++++++ security/integrity/ima/ima_template.c | 2 ++ security/integrity/ima/ima_template_lib.c | 21 +++++++++++++++++++++ security/integrity/ima/ima_template_lib.h | 4 ++++ security/integrity/integrity.h | 1 + 5 files changed, 51 insertions(+) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 1d186bda25fe..ca12885ca241 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -605,10 +605,32 @@ static int process_buffer_measurement(const void *buf, int size, int pcr = CONFIG_IMA_MEASURE_PCR_IDX; int action = 0; + struct buffer_xattr { + enum evm_ima_xattr_type type; + u16 buf_length; + unsigned char buf[0]; + }; + struct buffer_xattr *buffer_event_data = NULL; + int alloc_length = 0; + action = ima_get_action(NULL, cred, secid, 0, KEXEC_CMDLINE, &pcr); if (!(action & IMA_AUDIT) && !(action & IMA_MEASURE)) goto out; + alloc_length = sizeof(struct buffer_xattr) + size; + buffer_event_data = kzalloc(alloc_length, GFP_KERNEL); + if (!buffer_event_data) { + ret = -ENOMEM; + goto out; + } + + buffer_event_data->type = IMA_XATTR_BUFFER; + buffer_event_data->buf_length = size; + memcpy(buffer_event_data->buf, buf, size); + + event_data.xattr_value = (struct evm_ima_xattr_data *)buffer_event_data; + event_data.xattr_len = alloc_length; + memset(iint, 0, sizeof(*iint)); memset(&hash, 0, sizeof(hash)); @@ -638,6 +660,7 @@ static int process_buffer_measurement(const void *buf, int size, } out: + kfree(buffer_event_data); return ret; } diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c index b631b8bc7624..a76d1c04162a 100644 --- a/security/integrity/ima/ima_template.c +++ b/security/integrity/ima/ima_template.c @@ -43,6 +43,8 @@ static const struct ima_template_field supported_fields[] = { .field_show = ima_show_template_string}, {.field_id = "sig", .field_init = ima_eventsig_init, .field_show = ima_show_template_sig}, + {.field_id = "buf", .field_init = ima_eventbuf_init, + .field_show = ima_show_template_buf}, }; #define MAX_TEMPLATE_NAME_LEN 15 diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c index 513b457ae900..95a827f42c18 100644 --- a/security/integrity/ima/ima_template_lib.c +++ b/security/integrity/ima/ima_template_lib.c @@ -162,6 +162,11 @@ void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); } +void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, + struct ima_field_data *field_data) +{ + ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); +} /** * ima_parse_buf() - Parses lengths and data from an input buffer * @bufstartp: Buffer start address. @@ -389,3 +394,19 @@ int ima_eventsig_init(struct ima_event_data *event_data, return ima_write_template_field_data(xattr_value, event_data->xattr_len, DATA_FMT_HEX, field_data); } + +/* + * ima_eventbuf_init - include the buffer(kexec-cmldine) as part of the + * template data. + */ +int ima_eventbuf_init(struct ima_event_data *event_data, + struct ima_field_data *field_data) +{ + struct evm_ima_xattr_data *xattr_value = event_data->xattr_value; + + if ((!xattr_value) || (xattr_value->type != IMA_XATTR_BUFFER)) + return 0; + + return ima_write_template_field_data(xattr_value, event_data->xattr_len, + DATA_FMT_HEX, field_data); +} diff --git a/security/integrity/ima/ima_template_lib.h b/security/integrity/ima/ima_template_lib.h index 6a3d8b831deb..12f1a8578b31 100644 --- a/security/integrity/ima/ima_template_lib.h +++ b/security/integrity/ima/ima_template_lib.h @@ -29,6 +29,8 @@ void ima_show_template_string(struct seq_file *m, enum ima_show_type show, struct ima_field_data *field_data); void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, struct ima_field_data *field_data); +void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, + struct ima_field_data *field_data); int ima_parse_buf(void *bufstartp, void *bufendp, void **bufcurp, int maxfields, struct ima_field_data *fields, int *curfields, unsigned long *len_mask, int enforce_mask, char *bufname); @@ -42,4 +44,6 @@ int ima_eventname_ng_init(struct ima_event_data *event_data, struct ima_field_data *field_data); int ima_eventsig_init(struct ima_event_data *event_data, struct ima_field_data *field_data); +int ima_eventbuf_init(struct ima_event_data *event_data, + struct ima_field_data *field_data); #endif /* __LINUX_IMA_TEMPLATE_LIB_H */ diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 7de59f44cba3..14ef904f091d 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -74,6 +74,7 @@ enum evm_ima_xattr_type { EVM_IMA_XATTR_DIGSIG, IMA_XATTR_DIGEST_NG, EVM_XATTR_PORTABLE_DIGSIG, + IMA_XATTR_BUFFER, IMA_XATTR_LAST }; From patchwork Fri May 10 22:32:28 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prakhar Srivastava X-Patchwork-Id: 10939639 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0C26992A for ; Fri, 10 May 2019 22:32:54 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EBE2B1FF1E for ; Fri, 10 May 2019 22:32:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DD7F21FF2D; Fri, 10 May 2019 22:32:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 972B51FF1E for ; Fri, 10 May 2019 22:32:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726839AbfEJWcq (ORCPT ); Fri, 10 May 2019 18:32:46 -0400 Received: from mail-pg1-f196.google.com ([209.85.215.196]:41788 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727879AbfEJWcp (ORCPT ); Fri, 10 May 2019 18:32:45 -0400 Received: by mail-pg1-f196.google.com with SMTP id z3so3649415pgp.8; Fri, 10 May 2019 15:32:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=RKmOBQf5IncjEXCWsVLHLC0KbVC3GdgkUervdoFVPcA=; b=V/5bCc1jNN11FgSQ6PXDu16MySi4h9zjlLPsMQBuyaGNZv2vO3QLKd5B71zdftRIFf TWkFHD4JIbrM2wZJxvv28RVzSrxx1A6FdlyDtESPEKUmjWq+HHHz1GuHbFqxxjHIhMkL WLzjn/WQzrqv1wjNJQzrze9qFCPSVysgQrQjJWaTl5Y2UgGv7zSJXqBrSiaL0iyIuCzK omhDk1jb69/T8VieGuzgZL33YHaNHQ5uzAQ3lC5c9DXYUxhnrOZ0YielK1+RX8LHoq0C +IvtCkEmVxMCCSbP1uZeVzqHY7m80KUciviHsYZoZdBLrxih1USJRiGn0Rq6xOGUSDIU FWwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=RKmOBQf5IncjEXCWsVLHLC0KbVC3GdgkUervdoFVPcA=; b=atBvqQcYoyzgyRzMVEhR92D/+dAD4xS7fwwywjrEB/Iw6NWkNl5UQ+2197a9G0tbXX NTjpjK6hS8nuG+IHL5AZiWul/D1lqxuxVI4lQIbQfx2kCwWDKkubNCPd8kTRw3jmlNk1 6U8/ZMHxTQ7nivy6KsMyddn4W8k/7xvFXkLdZZVlTW2iXHT7LoYPJsQ/q8JvewxvlnY2 sQYZuuKLiQdILAjNayKYnB9Yz7HGkxKiveK4t3vhzuMy41H+PBCZTHF/d98BNIkn3wFz jKVwbQyMtTiGt2hX4BKLID11JIoKN65LztFxMXdJYtOcm1p2SykcbA8bDt+1klmFdn70 zk1Q== X-Gm-Message-State: APjAAAUiXK9fuVy02LVQFeLKoWreWchIg0mI9UFPsqbq9W5Mc+0HlY/W on3ceBRKFnbemtruVJ7uU6bp6qK3nn0= X-Google-Smtp-Source: APXvYqxJTHGwD0t57MAis7J0+KT+YNo/NTvosz7eoJLCzQ1JxTt1BSJ2Cl0Qxuy5U2QG9WWobQ3vYw== X-Received: by 2002:a62:6444:: with SMTP id y65mr17653467pfb.148.1557527564828; Fri, 10 May 2019 15:32:44 -0700 (PDT) Received: from prsriva-linux.corp.microsoft.com ([2001:4898:80e8:a:1d1b:db59:93e9:eab5]) by smtp.gmail.com with ESMTPSA id g72sm16907374pfg.63.2019.05.10.15.32.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 May 2019 15:32:44 -0700 (PDT) From: Prakhar Srivastava X-Google-Original-From: Prakhar Srivastava To: linux-integrity@vger.kernel.org, inux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: zohar@linux.ibm.com, ebiederm@xmission.com, vgoyal@redhat.com, prsriva@microsoft.com, Prakhar Srivastava Subject: [PATCH 3/3 v5] call ima_kexec_cmdline from kexec_file_load path Date: Fri, 10 May 2019 15:32:28 -0700 Message-Id: <20190510223228.9966-4-prsriva02@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190510223228.9966-1-prsriva02@gmail.com> References: <20190510223228.9966-1-prsriva02@gmail.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Prakhar Srivastava Signed-off-by: Prakhar Srivastava --- kernel/kexec_file.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index f1d0e00a3971..e779bcf674a0 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -241,6 +241,8 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, ret = -EINVAL; goto out; } + + ima_kexec_cmdline(image->cmdline_buf, image->cmdline_buf_len - 1); } /* Call arch image load handlers */