#ifdef CONFIG_IMA
extern int ima_bprm_check(struct linux_binprm *bprm);
extern int ima_file_check(struct file *file, int mask, int opened);
@@ -29,7 +23,7 @@ extern int ima_read_file(struct file *file, enum
kernel_read_file_id id);
extern int ima_post_read_file(struct file *file, void *buf, loff_t
size,
enum kernel_read_file_id id);
extern void ima_post_path_mknod(struct dentry *dentry);
-extern void ima_buffer_check(const void *buff, int size, enum
buffer_id id);
+extern void ima_buffer_check(const void *buff, int size, char
*eventname);
#ifdef CONFIG_IMA_KEXEC
extern void ima_add_kexec_buffer(struct kimage *image);
#endif
@@ -72,7 +66,7 @@ static inline void ima_post_path_mknod(struct dentry
*dentry)
}
static inline void ima_buffer_check(const void *buff, int size,
- enum buffer_id id)
+ char *eventname)
{
return;
}
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index b118735fea9d..2a5234eb4b28 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -182,6 +182,9 @@ kimage_file_prepare_segments(struct kimage *image,
int kernel_fd, int initrd_fd,
ret = -EINVAL;
goto out;
}
+
+ ima_buffer_check(image->cmdline_buf, cmdline_len - 1,
+ "kexec_cmdline");
}
/* Call arch image load handlers */
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index b71f2f6f7421..fcade3c103ed 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -181,8 +181,8 @@ enum ima_hooks {
FIRMWARE_CHECK,
KEXEC_KERNEL_CHECK,
KEXEC_INITRAMFS_CHECK,
- BUFFER_CHECK,
POLICY_CHECK,
+ BUFFER_CHECK,
MAX_CHECK
};
diff --git a/security/integrity/ima/ima_main.c
b/security/integrity/ima/ima_main.c
index 6408cadaadbb..da82c705a5ed 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -160,8 +160,7 @@ void ima_file_free(struct file *file)
* (Instead of using the file hash the buffer hash is used).
* @buff - The buffer that needs to be added to the log
* @size - size of buffer(in bytes)
- * @id - buffer id, this is differentiator for the various buffers
- * that can be measured.
+ * @id - eventname, event name to be used for buffer measurement.
*
* The buffer passed is added to the ima logs.
* If the sig template is used, then the sig field contains the buffer.
@@ -170,7 +169,7 @@ void ima_file_free(struct file *file)
* On error cases surface errors from ima calls.
*/
static int process_buffer_measurement(const void *buff, int size,
- enum buffer_id id)
+ char *eventname)
{
int ret = -EINVAL;
struct ima_template_entry *entry = NULL;
@@ -185,23 +184,13 @@ static int process_buffer_measurement(const void
*buff, int size,
int violation = 0;
int pcr = CONFIG_IMA_MEASURE_PCR_IDX;
- if (!buff || size == 0)
+ if (!buff || size == 0 || !eventname)
goto err_out;
if (ima_get_action(NULL, 0, BUFFER_CHECK, &pcr) != IMA_MEASURE)
goto err_out;
- switch (buffer_id) {
- case KERNEL_VERSION:
- name = "Kernel-version";
- break;
- case KEXEC_CMDLINE:
- name = "Kexec-cmdline";
- break;
- default:
- goto err_out;
- }
-
+ name = eventname;
memset(iint, 0, sizeof(*iint));
memset(&hash, 0, sizeof(hash));
@@ -452,15 +441,16 @@ int ima_read_file(struct file *file, enum
kernel_read_file_id read_id)
* ima_buffer_check - based on policy, collect & store buffer
measurement
* @buf: pointer to buffer
* @size: size of buffer
- * @buffer_id: caller identifier
+ * @eventname: caller identifier
*
* Buffers can only be measured, not appraised. The buffer identifier
- * is used as the measurement list entry name (eg. boot_cmdline).
+ * is used as the measurement list entry name (eg. boot_cmdline,
+ * kernel_version).
*/
-void ima_buffer_check(const void *buf, int size, enum buffer_id id)
+void ima_buffer_check(const void *buf, int size, char *eventname)
{
- if (buf && size != 0)
- process_buffer_measurement(buf, size, id);
+ if (buf && size != 0 && eventname)
+ process_buffer_measurement(buf, size, eventname);
return;
}