On 2020-12-09 11:42:10, Tushar Sugandhi wrote:
> The IMA hook ima_measure_critical_data() does not support a way to
> specify the source of the critical data provider. Thus, the data
> measurement cannot be constrained based on the data source label
> in the IMA policy.
>
> Extend the IMA hook ima_measure_critical_data() to support passing
> the data source label as an input parameter, so that the policy rule can
> be used to limit the measurements based on the label.
>
> Signed-off-by: Tushar Sugandhi <tusharsu@xxxxxxxxxxxxxxxxxxx>
Reviewed-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxxx>
Tyler
> ---
> include/linux/ima.h | 6 ++++--
> security/integrity/ima/ima_main.c | 11 ++++++++---
> 2 files changed, 12 insertions(+), 5 deletions(-)
>
> diff --git a/include/linux/ima.h b/include/linux/ima.h
> index 675f54db6264..6434287a81cd 100644
> --- a/include/linux/ima.h
> +++ b/include/linux/ima.h
> @@ -30,7 +30,8 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size,
> extern void ima_post_path_mknod(struct dentry *dentry);
> extern int ima_file_hash(struct file *file, char *buf, size_t buf_size);
> extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size);
> -extern void ima_measure_critical_data(const char *event_name,
> +extern void ima_measure_critical_data(const char *event_data_source,
> + const char *event_name,
> const void *buf, int buf_len,
> bool measure_buf_hash);
>
> @@ -125,7 +126,8 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size)
> }
>
> static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {}
> -static inline void ima_measure_critical_data(const char *event_name,
> +static inline void ima_measure_critical_data(const char *event_data_source,
> + const char *event_name,
> const void *buf, int buf_len,
> bool measure_buf_hash) {}
> #endif /* CONFIG_IMA */
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index ae59f4a4dd70..7c633901f441 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -924,6 +924,7 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
>
> /**
> * ima_measure_critical_data - measure kernel integrity critical data
> + * @event_data_source: kernel data source being measured
> * @event_name: event name to be used for the buffer entry
> * @buf: pointer to buffer containing data to measure
> * @buf_len: length of buffer(in bytes)
> @@ -932,6 +933,9 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
> * Measure the kernel subsystem data, critical to the integrity of the kernel,
> * into the IMA log and extend the @pcr.
> *
> + * Use @event_data_source to describe the kernel data source for the buffer
> + * being measured.
> + *
> * Use @event_name to describe the state/buffer data change.
> * Examples of critical data (buf) could be kernel in-memory r/o structures,
> * hash of the memory structures, or data that represents subsystem state
> @@ -944,17 +948,18 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
> *
> * The data (buf) can only be measured, not appraised.
> */
> -void ima_measure_critical_data(const char *event_name,
> +void ima_measure_critical_data(const char *event_data_source,
> + const char *event_name,
> const void *buf, int buf_len,
> bool measure_buf_hash)
> {
> - if (!event_name || !buf || !buf_len) {
> + if (!event_name || !event_data_source || !buf || !buf_len) {
> pr_err("Invalid arguments passed to %s().\n", __func__);
> return;
> }
>
> process_buffer_measurement(NULL, buf, buf_len, event_name,
> - CRITICAL_DATA, 0, NULL,
> + CRITICAL_DATA, 0, event_data_source,
> measure_buf_hash);
> }
>
> --
> 2.17.1
>
