IMA: Call workqueue functions to measure queued keys (450d0fd5) · Commits · 戴 / test

Measuring keys requires a custom IMA policy to be loaded. Keys should be queued for measurement if a custom IMA policy is not yet loaded. Keys queued for measurement, if any, should be processed when a custom policy is loaded. This patch updates the IMA hook function ima_post_key_create_or_update() to queue the key if a custom IMA policy has not yet been loaded. And, ima_update_policy() function, which is called when a custom IMA policy is loaded, is updated to process queued keys. Signed-off-by:

Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Signed-off-by:

Mimi Zohar <zohar@linux.ibm.com>

security/integrity/ima/ima_asymmetric_keys.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -30,6 +30,8 @@ void ima_post_key_create_or_update(struct key keyring, struct key key,
		const void *payload, size_t payload_len,
		unsigned long flags, bool create)
		{
		bool queued = false;

		/* Only asymmetric keys are handled by this hook. */
		if (key->type != &key_type_asymmetric)
		return;
		@@ -37,6 +39,12 @@ void ima_post_key_create_or_update(struct key keyring, struct key key,
		if (!payload \|\| (payload_len == 0))
		return;

		if (ima_should_queue_key())
		queued = ima_queue_key(keyring, payload, payload_len);

		if (queued)
		return;

		/*
		* keyring->description points to the name of the keyring
		* (such as ".builtin_trusted_keys", ".ima", etc.) to

security/integrity/ima/ima_policy.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -809,6 +809,9 @@ void ima_update_policy(void)
		kfree(arch_policy_entry);
		}
		ima_update_policy_flag();

		/* Custom IMA policy has been loaded */
		ima_process_queued_keys();
		}

		/* Keep the enumeration in sync with the policy_tokens! */

Admin message