Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 15588227 authored by Thiago Jung Bauermann's avatar Thiago Jung Bauermann Committed by Mimi Zohar
Browse files

ima: Collect modsig 



Obtain the modsig and calculate its corresponding hash in
ima_collect_measurement().

Signed-off-by: default avatarThiago Jung Bauermann <bauerman@linux.ibm.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 39b07096

security/integrity/ima/ima.h

+7 −1
Original line number Diff line number Diff line
@@ -207,7 +207,7 @@ int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid, 
int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);

int ima_collect_measurement(struct integrity_iint_cache *iint,

			    struct file *file, void *buf, loff_t size,

			    enum hash_algo algo);

			    enum hash_algo algo, struct modsig *modsig);

void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,

			   const unsigned char *filename,

			   struct evm_ima_xattr_data *xattr_value,
@@ -311,6 +311,7 @@ static inline int ima_read_xattr(struct dentry *dentry, 
bool ima_hook_supports_modsig(enum ima_hooks func);

int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len,

		    struct modsig **modsig);

void ima_collect_modsig(struct modsig *modsig, const void *buf, loff_t size);

void ima_free_modsig(struct modsig *modsig);

#else

static inline bool ima_hook_supports_modsig(enum ima_hooks func)
@@ -324,6 +325,11 @@ static inline int ima_read_modsig(enum ima_hooks func, const void *buf, 
	return -EOPNOTSUPP;

}



static inline void ima_collect_modsig(struct modsig *modsig, const void *buf,

				      loff_t size)

{

}



static inline void ima_free_modsig(struct modsig *modsig)

{

}

security/integrity/ima/ima_api.c

+4 −1
Original line number Diff line number Diff line
@@ -205,7 +205,7 @@ int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid, 
 */

int ima_collect_measurement(struct integrity_iint_cache *iint,

			    struct file *file, void *buf, loff_t size,

			    enum hash_algo algo)

			    enum hash_algo algo, struct modsig *modsig)

{

	const char *audit_cause = "failed";

	struct inode *inode = file_inode(file);
@@ -252,6 +252,9 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, 
	memcpy(iint->ima_hash, &hash, length);

	iint->version = i_version;



	if (modsig)

		ima_collect_modsig(modsig, buf, size);



	/* Possibly temporary failure due to type of read (eg. O_DIRECT) */

	if (!result)

		iint->flags |= IMA_COLLECTED;

security/integrity/ima/ima_appraise.c

+1 −1
Original line number Diff line number Diff line
@@ -435,7 +435,7 @@ void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file) 
	    !(iint->flags & IMA_HASH))

		return;



	rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo);

	rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo, NULL);

	if (rc < 0)

		return;

security/integrity/ima/ima_main.c

+1 −1
Original line number Diff line number Diff line
@@ -314,7 +314,7 @@ static int process_measurement(struct file *file, const struct cred *cred, 


	hash_algo = ima_get_hash_algo(xattr_value, xattr_len);



	rc = ima_collect_measurement(iint, file, buf, size, hash_algo);

	rc = ima_collect_measurement(iint, file, buf, size, hash_algo, modsig);

	if (rc != 0 && rc != -EBADF && rc != -EINVAL)

		goto out_locked;

security/integrity/ima/ima_modsig.c

+47 −1
Original line number Diff line number Diff line
@@ -17,6 +17,19 @@ 


struct modsig {

	struct pkcs7_message *pkcs7_msg;



	enum hash_algo hash_algo;



	/* This digest will go in the 'd-modsig' field of the IMA template. */

	const u8 *digest;

	u32 digest_size;



	/*

	 * This is what will go to the measurement list if the template requires

	 * storing the signature.

	 */

	int raw_pkcs7_len;

	u8 raw_pkcs7[];

};



/**
@@ -71,7 +84,8 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len, 
	sig_len = be32_to_cpu(sig->sig_len);

	buf_len -= sig_len + sizeof(*sig);



	hdr = kmalloc(sizeof(*hdr), GFP_KERNEL);

	/* Allocate sig_len additional bytes to hold the raw PKCS#7 data. */

	hdr = kzalloc(sizeof(*hdr) + sig_len, GFP_KERNEL);

	if (!hdr)

		return -ENOMEM;
@@ -81,11 +95,43 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len, 
		return PTR_ERR(hdr->pkcs7_msg);

	}



	memcpy(hdr->raw_pkcs7, buf + buf_len, sig_len);

	hdr->raw_pkcs7_len = sig_len;



	/* We don't know the hash algorithm yet. */

	hdr->hash_algo = HASH_ALGO__LAST;



	*modsig = hdr;



	return 0;

}



/**

 * ima_collect_modsig - Calculate the file hash without the appended signature.

 *

 * Since the modsig is part of the file contents, the hash used in its signature

 * isn't the same one ordinarily calculated by IMA. Therefore PKCS7 code

 * calculates a separate one for signature verification.

 */

void ima_collect_modsig(struct modsig *modsig, const void *buf, loff_t size)

{

	int rc;



	/*

	 * Provide the file contents (minus the appended sig) so that the PKCS7

	 * code can calculate the file hash.

	 */

	size -= modsig->raw_pkcs7_len + strlen(MODULE_SIG_STRING) +

		sizeof(struct module_signature);

	rc = pkcs7_supply_detached_data(modsig->pkcs7_msg, buf, size);

	if (rc)

		return;



	/* Ask the PKCS7 code to calculate the file hash. */

	rc = pkcs7_get_digest(modsig->pkcs7_msg, &modsig->digest,

			      &modsig->digest_size, &modsig->hash_algo);

}



int ima_modsig_verify(struct key *keyring, const struct modsig *modsig)

{

	return verify_pkcs7_message_sig(NULL, 0, modsig->pkcs7_msg, keyring,