From patchwork Fri May 10 22:37:42 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prakhar Srivastava X-Patchwork-Id: 10939669 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id F0CD4912 for ; Fri, 10 May 2019 22:38:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DEE011FF40 for ; Fri, 10 May 2019 22:38:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D34441FF60; Fri, 10 May 2019 22:38:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 393BF1FF40 for ; Fri, 10 May 2019 22:38:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728035AbfEJWh7 (ORCPT ); Fri, 10 May 2019 18:37:59 -0400 Received: from mail-pg1-f195.google.com ([209.85.215.195]:41104 "EHLO mail-pg1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726875AbfEJWh6 (ORCPT ); Fri, 10 May 2019 18:37:58 -0400 Received: by mail-pg1-f195.google.com with SMTP id z3so3654068pgp.8; Fri, 10 May 2019 15:37:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=e1vSiCdUVKh9pomgrsWeaE92mMm3stHN786AFawSpZE=; b=oGXftfG/vw5kINI2V2f27Fe9gEYqCyXUrP5naMz78VuO6h3eLcmHOBWCAuAApvPDft /nVm8gbs3e3wfIsoPguZXelbHZA8oHNN3wVCeVCAf2mIlOxqkiDKX8958lZrPr30QGAh yRnMcOQZipcE6F5RB3aN8z/Sb9Zkd/WdYQHkQTPb6cdRb7a1hM0bDnksdeuVPY5kwGBA dFSbsur9+B5Hn+JVs3anl/FelwXk871W//XR6ePXBTc0FVTmqZ+Udppo0LR2BF5+aX28 XuANk3wMq5XGs7nqtQDLBi4A55OFArXrsALn4hmovLidMurK+3Lx6KbjLBMDSS537kqj DibA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=e1vSiCdUVKh9pomgrsWeaE92mMm3stHN786AFawSpZE=; b=Ch1HJY5rcnBa3MvNseVR23cQnLys1uFPpUGw6ieJfCzGfUapnt2iojk459//rBJ4N6 C4z6dFi9OR4Aw9YmB2W28BLY6uz7/UuUlCb9ox82cWbb67OGfhsdUtdGdBAxA9le0QQm F3/AKovFuoTHWq7GIQRF6cuo2+urHzUEvOu+oN02nhBiGLmpDz9a9gmvekEnW+8eFzLu 7HwSkay7rAOdJvrauoHrCyTFeCdWEJA9vLNqxM2/9p2JkcK/cKE5TmailEDprx+pm7V8 FZzcix1MFKkmmNcQwUSIXo4sPCoukWev7b1ZMFB9FsJV3btdLzhD5T3+yOE/+SDzrInQ VnIQ== X-Gm-Message-State: APjAAAXtdbIeFH9kGgh/kd2X9Jca4oIPz0s3m22efsNn777uV1cFTKEK yZQ9vnAhPY6LhqdMHPHJ2Cmx67HrqnY= X-Google-Smtp-Source: APXvYqySTfk5PEjVljusqRrmaby8FD74Gubc14xQ8zoqMs+ClI/CZFuXC6Mm6tvPE+PEP1xWIkE4CQ== X-Received: by 2002:a63:b48:: with SMTP id a8mr15816474pgl.368.1557527877170; Fri, 10 May 2019 15:37:57 -0700 (PDT) Received: from prsriva-linux.corp.microsoft.com ([2001:4898:80e8:a:1d1b:db59:93e9:eab5]) by smtp.gmail.com with ESMTPSA id r74sm12459430pfa.71.2019.05.10.15.37.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 May 2019 15:37:56 -0700 (PDT) From: Prakhar Srivastava X-Google-Original-From: Prakhar Srivastava To: linux-integrity@vger.kernel.org, inux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: zohar@linux.ibm.com, ebiederm@xmission.com, vgoyal@redhat.com, prsriva@microsoft.com, Prakhar Srivastava Subject: [PATCH 1/3 v5] add a new ima hook and policy to measure the cmdline Date: Fri, 10 May 2019 15:37:42 -0700 Message-Id: <20190510223744.10154-2-prsriva02@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190510223744.10154-1-prsriva02@gmail.com> References: <20190510223744.10154-1-prsriva02@gmail.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Prakhar Srivastava For secure boot attestation, it is necessary to measure the kernel command line and the kernel version. For cold boot, the boot loader can be enhanced to measure these parameters. However, for attestation across soft reboot boundary, these values also need to be measured during kexec. For this reason, this patch adds support for measuring these parameters during kexec. To achive this, a new ima policy and hook id, defined KEXEC_CMDLINE and ima_kexec_cmdline respectively, are added. Signed-off-by: Prakhar Srivastava --- Documentation/ABI/testing/ima_policy | 1 + include/linux/ima.h | 2 + security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_api.c | 1 + security/integrity/ima/ima_main.c | 84 ++++++++++++++++++++++++++++ security/integrity/ima/ima_policy.c | 9 +++ 6 files changed, 98 insertions(+) diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy index 74c6702de74e..62e7cd687e9c 100644 --- a/Documentation/ABI/testing/ima_policy +++ b/Documentation/ABI/testing/ima_policy @@ -29,6 +29,7 @@ Description: base: func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK] [FIRMWARE_CHECK] [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK] + [KEXEC_CMDLINE] mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] [[^]MAY_EXEC] fsmagic:= hex value diff --git a/include/linux/ima.h b/include/linux/ima.h index dc12fbcf484c..2e2c77280be8 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -26,6 +26,7 @@ extern int ima_read_file(struct file *file, enum kernel_read_file_id id); extern int ima_post_read_file(struct file *file, void *buf, loff_t size, enum kernel_read_file_id id); extern void ima_post_path_mknod(struct dentry *dentry); +extern void ima_kexec_cmdline(const void *buf, int size); #ifdef CONFIG_IMA_KEXEC extern void ima_add_kexec_buffer(struct kimage *image); @@ -92,6 +93,7 @@ static inline void ima_post_path_mknod(struct dentry *dentry) return; } +static inline void ima_kexec_cmdline(const void *buf, int size) {} #endif /* CONFIG_IMA */ #ifndef CONFIG_IMA_KEXEC diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index d213e835c498..226a26d8de09 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -184,6 +184,7 @@ static inline unsigned long ima_hash_key(u8 *digest) hook(KEXEC_KERNEL_CHECK) \ hook(KEXEC_INITRAMFS_CHECK) \ hook(POLICY_CHECK) \ + hook(KEXEC_CMDLINE) \ hook(MAX_CHECK) #define __ima_hook_enumify(ENUM) ENUM, diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index c7505fb122d4..800d965232e5 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -169,6 +169,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, * subj=, obj=, type=, func=, mask=, fsmagic= * subj,obj, and type: are LSM specific. * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK + * | KEXEC_CMDLINE * mask: contains the permission mask * fsmagic: hex value * diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 357edd140c09..1d186bda25fe 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -576,6 +576,90 @@ int ima_load_data(enum kernel_load_data_id id) return 0; } +/* + * process_buffer_measurement - Measure the buffer passed to ima log. + * (Instead of using the file hash use the buffer hash). + * @buf - The buffer that needs to be added to the log + * @size - size of buffer(in bytes) + * @eventname - event name to be used for buffer. + * + * The buffer passed is added to the ima log. + * + * On success return 0. + * On error cases surface errors from ima calls. + */ +static int process_buffer_measurement(const void *buf, int size, + const char *eventname, const struct cred *cred, + u32 secid) +{ + int ret = 0; + struct ima_template_entry *entry = NULL; + struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; + struct ima_event_data event_data = {iint, NULL, NULL, + NULL, 0, NULL}; + struct { + struct ima_digest_data hdr; + char digest[IMA_MAX_DIGEST_SIZE]; + } hash; + int violation = 0; + int pcr = CONFIG_IMA_MEASURE_PCR_IDX; + int action = 0; + + action = ima_get_action(NULL, cred, secid, 0, KEXEC_CMDLINE, &pcr); + if (!(action & IMA_AUDIT) && !(action & IMA_MEASURE)) + goto out; + + memset(iint, 0, sizeof(*iint)); + memset(&hash, 0, sizeof(hash)); + + event_data.filename = eventname; + + iint->ima_hash = &hash.hdr; + iint->ima_hash->algo = ima_hash_algo; + iint->ima_hash->length = hash_digest_size[ima_hash_algo]; + + ret = ima_calc_buffer_hash(buf, size, iint->ima_hash); + if (ret < 0) + goto out; + + ret = ima_alloc_init_template(&event_data, &entry); + if (ret < 0) + goto out; + + if (action & IMA_MEASURE) + ret = ima_store_template(entry, violation, NULL, buf, pcr); + + if (action & IMA_AUDIT) + ima_audit_measurement(iint, event_data.filename); + + if (ret < 0) { + ima_free_template_entry(entry); + goto out; + } + +out: + return ret; +} + +/** + * ima_kexec_cmdline - based on policy, store kexec cmdline args + * @buf: pointer to buffer + * @size: size of buffer + * + * Buffers can only be measured, not appraised. + */ +void ima_kexec_cmdline(const void *buf, int size) +{ + u32 secid; + + if (buf && size != 0) { + security_task_getsecid(current, &secid); + process_buffer_measurement(buf, size, "kexec-cmdline", + current_cred(), secid); + } +} + + static int __init init_ima(void) { int error; diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index e0cc323f948f..413e5921b248 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -291,6 +291,13 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, { int i; + /* only incase of KEXEC_CMDLINE, inode is NULL */ + if (func == KEXEC_CMDLINE) { + if ((rule->flags & IMA_FUNC) && + (rule->func == func) && (!inode)) + return true; + return false; + } if ((rule->flags & IMA_FUNC) && (rule->func != func && func != POST_SETATTR)) return false; @@ -869,6 +876,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) entry->func = KEXEC_INITRAMFS_CHECK; else if (strcmp(args[0].from, "POLICY_CHECK") == 0) entry->func = POLICY_CHECK; + else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0) + entry->func = KEXEC_CMDLINE; else result = -EINVAL; if (!result) From patchwork Fri May 10 22:37:43 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prakhar Srivastava X-Patchwork-Id: 10939673 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A600414B6 for ; Fri, 10 May 2019 22:38:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 95B0A1FF40 for ; Fri, 10 May 2019 22:38:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 88B191FF60; Fri, 10 May 2019 22:38:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F291E1FF40 for ; Fri, 10 May 2019 22:38:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728049AbfEJWiJ (ORCPT ); Fri, 10 May 2019 18:38:09 -0400 Received: from mail-pf1-f194.google.com ([209.85.210.194]:44578 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728034AbfEJWh7 (ORCPT ); Fri, 10 May 2019 18:37:59 -0400 Received: by mail-pf1-f194.google.com with SMTP id g9so3920708pfo.11; Fri, 10 May 2019 15:37:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=GbEXwJMOtDQCCWFKbIVF5kC5vfVIQcIDsT/50hWcZh8=; b=TcYtPFcqmJM5QCzQKdsaHDVEOJVlJsX8wGV6kBbxVG1qyVufYDlFsKa+5kbCFWpyiX +vDk+LPCnpCb0V7VjQUQ4BSNPWmLKTTmFR/YPfCLvi0PpCkPDlRJLe4n507fxvyWKt+V 2rcKmVPrwZxof4OON99Q5rdbD/as/e5Phixk30dNrSL6aTsEA7/XrBT2VOPzOfBq7+kK /9gAK35rqAoUxT2O1HFZiJndYHP8tRrKxVjAfbGsbA3MT/O1Vx9q72VVlZRfyaHr1mdX rZPoEDo8A6CY3hP4azFcHzWNKLJHDq3sVvqbt3pVP62ZRU42OudeXsSF2hp4WmFHC2CJ wfcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=GbEXwJMOtDQCCWFKbIVF5kC5vfVIQcIDsT/50hWcZh8=; b=TA5Sz8JvE/h/fI6EOmx94LXYkpL7dh6uLRNSSpYFJG6DAlnSXsuwa5kl3XfYjscIS2 BFFm8BbwIxAD90F5kvEVUNqGz+bjZz+/l4bP8+3oSRcF6bVbdaOg2Yoyyh9MrKuxShr8 N8tRltabI8F8As7+J/2imY+NKHR9q5cdm+b9UxG8xnTNsHM0Tcy5qBDdW8ZL1oO8Q1HE Xxq7MgrGmQTHjr/qRzIPm/HuNF/ocvzsrLzku3FRY4Y7ztmmoqyprBJLTiAvh8TdhVke 70za7ZcTsSlo1WGKyaEiI6wg4F9C5XzXqXRKGzIZwzkoAeA3F3M47X6DaAg964RYvMWN 9evg== X-Gm-Message-State: APjAAAWX+XHn2GwjSaSlsCbyTZyUe5ef37NYJ9d7Hnq7a/cGAE+OFo2w TaywDO7EYjpu5txzqTPsPaUYnIW3NW0= X-Google-Smtp-Source: APXvYqzjJr3YdkryE0ilpepGw2WGiwS81groppM5Cqsc9tuG0zvHKdptuh9wsuTjGf1+YgH11wSDGQ== X-Received: by 2002:a65:5106:: with SMTP id f6mr16800600pgq.253.1557527878069; Fri, 10 May 2019 15:37:58 -0700 (PDT) Received: from prsriva-linux.corp.microsoft.com ([2001:4898:80e8:a:1d1b:db59:93e9:eab5]) by smtp.gmail.com with ESMTPSA id r74sm12459430pfa.71.2019.05.10.15.37.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 May 2019 15:37:57 -0700 (PDT) From: Prakhar Srivastava X-Google-Original-From: Prakhar Srivastava To: linux-integrity@vger.kernel.org, inux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: zohar@linux.ibm.com, ebiederm@xmission.com, vgoyal@redhat.com, prsriva@microsoft.com, Prakhar Srivastava Subject: [PATCH 2/3 v5] add a new template field buf to contain the buffer Date: Fri, 10 May 2019 15:37:43 -0700 Message-Id: <20190510223744.10154-3-prsriva02@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190510223744.10154-1-prsriva02@gmail.com> References: <20190510223744.10154-1-prsriva02@gmail.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Prakhar Srivastava The buffer(cmdline args) added to the ima log cannot be attested without having the actual buffer. Thus to make the measured buffer available to stroe/read a new ima temaplate (buf) is added. The cmdline args used for soft reboot can then be read and attested later. The patch adds a new template field buf to store/read the buffer used while measuring kexec_cmdline args in the [PATCH 1/2 v5]: "add a new ima hook and policy to measure the cmdline". Signed-off-by: Prakhar Srivastava --- security/integrity/ima/ima_main.c | 23 +++++++++++++++++++++++ security/integrity/ima/ima_template.c | 2 ++ security/integrity/ima/ima_template_lib.c | 21 +++++++++++++++++++++ security/integrity/ima/ima_template_lib.h | 4 ++++ security/integrity/integrity.h | 1 + 5 files changed, 51 insertions(+) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 1d186bda25fe..ca12885ca241 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -605,10 +605,32 @@ static int process_buffer_measurement(const void *buf, int size, int pcr = CONFIG_IMA_MEASURE_PCR_IDX; int action = 0; + struct buffer_xattr { + enum evm_ima_xattr_type type; + u16 buf_length; + unsigned char buf[0]; + }; + struct buffer_xattr *buffer_event_data = NULL; + int alloc_length = 0; + action = ima_get_action(NULL, cred, secid, 0, KEXEC_CMDLINE, &pcr); if (!(action & IMA_AUDIT) && !(action & IMA_MEASURE)) goto out; + alloc_length = sizeof(struct buffer_xattr) + size; + buffer_event_data = kzalloc(alloc_length, GFP_KERNEL); + if (!buffer_event_data) { + ret = -ENOMEM; + goto out; + } + + buffer_event_data->type = IMA_XATTR_BUFFER; + buffer_event_data->buf_length = size; + memcpy(buffer_event_data->buf, buf, size); + + event_data.xattr_value = (struct evm_ima_xattr_data *)buffer_event_data; + event_data.xattr_len = alloc_length; + memset(iint, 0, sizeof(*iint)); memset(&hash, 0, sizeof(hash)); @@ -638,6 +660,7 @@ static int process_buffer_measurement(const void *buf, int size, } out: + kfree(buffer_event_data); return ret; } diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c index b631b8bc7624..a76d1c04162a 100644 --- a/security/integrity/ima/ima_template.c +++ b/security/integrity/ima/ima_template.c @@ -43,6 +43,8 @@ static const struct ima_template_field supported_fields[] = { .field_show = ima_show_template_string}, {.field_id = "sig", .field_init = ima_eventsig_init, .field_show = ima_show_template_sig}, + {.field_id = "buf", .field_init = ima_eventbuf_init, + .field_show = ima_show_template_buf}, }; #define MAX_TEMPLATE_NAME_LEN 15 diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c index 513b457ae900..95a827f42c18 100644 --- a/security/integrity/ima/ima_template_lib.c +++ b/security/integrity/ima/ima_template_lib.c @@ -162,6 +162,11 @@ void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); } +void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, + struct ima_field_data *field_data) +{ + ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); +} /** * ima_parse_buf() - Parses lengths and data from an input buffer * @bufstartp: Buffer start address. @@ -389,3 +394,19 @@ int ima_eventsig_init(struct ima_event_data *event_data, return ima_write_template_field_data(xattr_value, event_data->xattr_len, DATA_FMT_HEX, field_data); } + +/* + * ima_eventbuf_init - include the buffer(kexec-cmldine) as part of the + * template data. + */ +int ima_eventbuf_init(struct ima_event_data *event_data, + struct ima_field_data *field_data) +{ + struct evm_ima_xattr_data *xattr_value = event_data->xattr_value; + + if ((!xattr_value) || (xattr_value->type != IMA_XATTR_BUFFER)) + return 0; + + return ima_write_template_field_data(xattr_value, event_data->xattr_len, + DATA_FMT_HEX, field_data); +} diff --git a/security/integrity/ima/ima_template_lib.h b/security/integrity/ima/ima_template_lib.h index 6a3d8b831deb..12f1a8578b31 100644 --- a/security/integrity/ima/ima_template_lib.h +++ b/security/integrity/ima/ima_template_lib.h @@ -29,6 +29,8 @@ void ima_show_template_string(struct seq_file *m, enum ima_show_type show, struct ima_field_data *field_data); void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, struct ima_field_data *field_data); +void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, + struct ima_field_data *field_data); int ima_parse_buf(void *bufstartp, void *bufendp, void **bufcurp, int maxfields, struct ima_field_data *fields, int *curfields, unsigned long *len_mask, int enforce_mask, char *bufname); @@ -42,4 +44,6 @@ int ima_eventname_ng_init(struct ima_event_data *event_data, struct ima_field_data *field_data); int ima_eventsig_init(struct ima_event_data *event_data, struct ima_field_data *field_data); +int ima_eventbuf_init(struct ima_event_data *event_data, + struct ima_field_data *field_data); #endif /* __LINUX_IMA_TEMPLATE_LIB_H */ diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 7de59f44cba3..14ef904f091d 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -74,6 +74,7 @@ enum evm_ima_xattr_type { EVM_IMA_XATTR_DIGSIG, IMA_XATTR_DIGEST_NG, EVM_XATTR_PORTABLE_DIGSIG, + IMA_XATTR_BUFFER, IMA_XATTR_LAST }; From patchwork Fri May 10 22:37:44 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prakhar Srivastava X-Patchwork-Id: 10939671 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6325114B6 for ; Fri, 10 May 2019 22:38:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 514D21FF40 for ; Fri, 10 May 2019 22:38:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 45BBA1FF60; Fri, 10 May 2019 22:38:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E78641FF40 for ; Fri, 10 May 2019 22:38:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728047AbfEJWiE (ORCPT ); Fri, 10 May 2019 18:38:04 -0400 Received: from mail-pf1-f194.google.com ([209.85.210.194]:34786 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728049AbfEJWh7 (ORCPT ); Fri, 10 May 2019 18:37:59 -0400 Received: by mail-pf1-f194.google.com with SMTP id n19so3944198pfa.1; Fri, 10 May 2019 15:37:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=pYzIDdOTRwO65NdizYfpyEQ5dTtiEK69uQtVOuzEYqI=; b=UUQhdumzD9b5p2zhHSlGdfcKIBwD6/zTIi+Swjo4qnscsSfa7EHxRwWneSwXNWFNIS Xfq9mRFm6jf3OumMOcoGkYLqOCFexT42JZ6Nll4EnYURL2W0OiOYgSW1bxmwkEs41Gsy k5jLbVUUSY1HkA6ILWuFXhNcWtF+6kU8SA8d1E/NSEkoxG6yLomMi+PFUmJZU4hhuKGz rf198bOnrBJnITupC99aoANMsnRDaNxo8xV4o4TUMQrtK+tvybKPAzFK+6kR5dKgrIMw 2dlQM6gGQR80LmGPyBBYoW76tVB2QXnKhRK7AUJk97dpzBS1WKjqefOj84n5POSQ0JN4 tf5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=pYzIDdOTRwO65NdizYfpyEQ5dTtiEK69uQtVOuzEYqI=; b=CZk/zA8NO5UM889h5LXeRs/GfHDErezLeJxdjUKd8lFrjfi2JmnjceadCjb2uT4QKw nJtAZ4zOqgT8RPQOp7smOjycCFTQjgEJ1GRB8wM08MdVN75mAi3TSRmW7sPQGmTQdsUR T9f7hGkVo2rqW+aLFFg7LenVeNFvNUoRLsKayhpOxYaPN4kZNqykqZmHrN8TdHF4hL+t PaXjJnN8A9NgVyxvraOv+gRbZefExrWKgTEIo+fOoRTu56d1tB+DEWp2/BooY5LjKWoc fkeF6utvuJAe1460YUg7j6UjAB4PO5drWYnQUOXY7EWqTIgvsuYPiglr4sdXQXC2bZu5 7J6g== X-Gm-Message-State: APjAAAUHn8HEeKUDhe5AZx+0uWwCMTeB8Zs9kenXYnqvdVfUHgkJQ5EB 81SspVETPWbZJSVMBRxzmT/vyVCZokM= X-Google-Smtp-Source: APXvYqxrdDf0YONK+/+mdOzYixpMoTJODFTIHOMdzCJ3pwx4Ds4toOexA6ae1KE1KfganUQbRnP5ow== X-Received: by 2002:a65:4649:: with SMTP id k9mr16733096pgr.239.1557527878915; Fri, 10 May 2019 15:37:58 -0700 (PDT) Received: from prsriva-linux.corp.microsoft.com ([2001:4898:80e8:a:1d1b:db59:93e9:eab5]) by smtp.gmail.com with ESMTPSA id r74sm12459430pfa.71.2019.05.10.15.37.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 May 2019 15:37:58 -0700 (PDT) From: Prakhar Srivastava X-Google-Original-From: Prakhar Srivastava To: linux-integrity@vger.kernel.org, inux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: zohar@linux.ibm.com, ebiederm@xmission.com, vgoyal@redhat.com, prsriva@microsoft.com, Prakhar Srivastava Subject: [PATCH 3/3 v5] call ima_kexec_cmdline from kexec_file_load path Date: Fri, 10 May 2019 15:37:44 -0700 Message-Id: <20190510223744.10154-4-prsriva02@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190510223744.10154-1-prsriva02@gmail.com> References: <20190510223744.10154-1-prsriva02@gmail.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Prakhar Srivastava To measure the cmldine args used in case of soft reboot. Call the ima hook defined in [PATCH 1/3 v5]:"add a new ima hook and policy to measure the cmdline" Signed-off-by: Prakhar Srivastava --- kernel/kexec_file.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index f1d0e00a3971..e779bcf674a0 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -241,6 +241,8 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, ret = -EINVAL; goto out; } + + ima_kexec_cmdline(image->cmdline_buf, image->cmdline_buf_len - 1); } /* Call arch image load handlers */