Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 86b4da8c authored by Prakhar Srivastava's avatar Prakhar Srivastava Committed by Mimi Zohar
Browse files

IMA: Define a new template field buf 



A buffer(kexec boot command line arguments) measured into IMA
measuremnt list cannot be appraised, without already being
aware of the buffer contents. Since hashes are non-reversible,
raw buffer is needed for validation or regenerating hash for
appraisal/attestation.

Add support to store/read the buffer contents in HEX.
The kexec cmdline hash is stored in the "d-ng" field of the
template data.  It can be verified using
sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements |
  grep  kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum

- Add two new fields to ima_event_data to hold the buf and
buf_len
- Add a new template field 'buf' to be used to store/read
the buffer data.
- Updated process_buffer_meaurement to add the buffer to
ima_event_data. process_buffer_measurement added in
"Define a new IMA hook to measure the boot command line
 arguments"
- Add a new template policy name ima-buf to represent
'd-ng|n-ng|buf'

Signed-off-by: default avatarPrakhar Srivastava <prsriva02@gmail.com>
Reviewed-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: default avatarJames Morris <jamorris@linux.microsoft.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent b0935123

Documentation/security/IMA-templates.rst

+4 −3
Original line number Diff line number Diff line
@@ -69,15 +69,16 @@ descriptors by adding their identifier to the format string 
   algorithm (field format: [<hash algo>:]digest, where the digest

   prefix is shown only if the hash algorithm is not SHA1 or MD5);

 - 'n-ng': the name of the event, without size limitations;

 - 'sig': the file signature.

 - 'sig': the file signature;

 - 'buf': the buffer data that was used to generate the hash without size limitations;





Below, there is the list of defined template descriptors:



 - "ima": its format is ``d|n``;

 - "ima-ng" (default): its format is ``d-ng|n-ng``;

 - "ima-sig": its format is ``d-ng|n-ng|sig``.



 - "ima-sig": its format is ``d-ng|n-ng|sig``;

 - "ima-buf": its format is ``d-ng|n-ng|buf``;





Use

security/integrity/ima/ima.h

+2 −0
Original line number Diff line number Diff line
@@ -65,6 +65,8 @@ struct ima_event_data { 
	struct evm_ima_xattr_data *xattr_value;

	int xattr_len;

	const char *violation;

	const void *buf;

	int buf_len;

};



/* IMA template field data definition */

security/integrity/ima/ima_main.c

+3 −1
Original line number Diff line number Diff line
@@ -627,7 +627,9 @@ static void process_buffer_measurement(const void *buf, int size, 
	struct ima_template_entry *entry = NULL;

	struct integrity_iint_cache iint = {};

	struct ima_event_data event_data = {.iint = &iint,

					    .filename = eventname};

					    .filename = eventname,

					    .buf = buf,

					    .buf_len = size};

	struct ima_template_desc *template_desc = NULL;

	struct {

		struct ima_digest_data hdr;

security/integrity/ima/ima_template.c

+3 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ static struct ima_template_desc builtin_templates[] = { 
	{.name = IMA_TEMPLATE_IMA_NAME, .fmt = IMA_TEMPLATE_IMA_FMT},

	{.name = "ima-ng", .fmt = "d-ng|n-ng"},

	{.name = "ima-sig", .fmt = "d-ng|n-ng|sig"},

	{.name = "ima-buf", .fmt = "d-ng|n-ng|buf"},

	{.name = "", .fmt = ""},	/* placeholder for a custom format */

};
@@ -43,6 +44,8 @@ static const struct ima_template_field supported_fields[] = { 
	 .field_show = ima_show_template_string},

	{.field_id = "sig", .field_init = ima_eventsig_init,

	 .field_show = ima_show_template_sig},

	{.field_id = "buf", .field_init = ima_eventbuf_init,

	 .field_show = ima_show_template_buf},

};

#define MAX_TEMPLATE_NAME_LEN 15

security/integrity/ima/ima_template_lib.c

+21 −0
Original line number Diff line number Diff line
@@ -162,6 +162,12 @@ void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, 
	ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data);

}



void ima_show_template_buf(struct seq_file *m, enum ima_show_type show,

			   struct ima_field_data *field_data)

{

	ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data);

}



/**

 * ima_parse_buf() - Parses lengths and data from an input buffer

 * @bufstartp:       Buffer start address.
@@ -389,3 +395,18 @@ int ima_eventsig_init(struct ima_event_data *event_data, 
	return ima_write_template_field_data(xattr_value, event_data->xattr_len,

					     DATA_FMT_HEX, field_data);

}



/*

 *  ima_eventbuf_init - include the buffer(kexec-cmldine) as part of the

 *  template data.

 */

int ima_eventbuf_init(struct ima_event_data *event_data,

		      struct ima_field_data *field_data)

{

	if ((!event_data->buf) || (event_data->buf_len == 0))

		return 0;



	return ima_write_template_field_data(event_data->buf,

					     event_data->buf_len, DATA_FMT_HEX,

					     field_data);

}