Commit 5808611c authored by Lakshmi Ramasubramanian's avatar Lakshmi Ramasubramanian Committed by Mimi Zohar
Browse files

IMA: Add KEY_CHECK func to measure keys 



Measure keys loaded onto any keyring.

This patch defines a new IMA policy func namely KEY_CHECK to
measure keys. Updated ima_match_rules() to check for KEY_CHECK
and ima_parse_rule() to handle KEY_CHECK.

Signed-off-by: default avatarLakshmi Ramasubramanian <nramas@linux.microsoft.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent c5563bad

Documentation/ABI/testing/ima_policy

+5 −1
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ Description: 
		base: 	func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]

				[FIRMWARE_CHECK]

				[KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]

				[KEXEC_CMDLINE]

				[KEXEC_CMDLINE] [KEY_CHECK]

			mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]

			       [[^]MAY_EXEC]

			fsmagic:= hex value
@@ -113,3 +113,7 @@ Description: 
		Example of appraise rule allowing modsig appended signatures:



			appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig



		Example of measure rule using KEY_CHECK to measure all keys:



			measure func=KEY_CHECK

security/integrity/ima/ima.h

+1 −0
Original line number Diff line number Diff line
@@ -193,6 +193,7 @@ static inline unsigned long ima_hash_key(u8 *digest) 
	hook(KEXEC_INITRAMFS_CHECK)	\

	hook(POLICY_CHECK)		\

	hook(KEXEC_CMDLINE)		\

	hook(KEY_CHECK)			\

	hook(MAX_CHECK)

#define __ima_hook_enumify(ENUM)	ENUM,

security/integrity/ima/ima_policy.c

+3 −1
Original line number Diff line number Diff line
@@ -373,7 +373,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, 
{

	int i;



	if (func == KEXEC_CMDLINE) {

	if ((func == KEXEC_CMDLINE) || (func == KEY_CHECK)) {

		if ((rule->flags & IMA_FUNC) && (rule->func == func))

			return true;

		return false;
@@ -997,6 +997,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) 
				entry->func = POLICY_CHECK;

			else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0)

				entry->func = KEXEC_CMDLINE;

			else if (strcmp(args[0].from, "KEY_CHECK") == 0)

				entry->func = KEY_CHECK;

			else

				result = -EINVAL;

			if (!result)

CRA Git | Maintained and supported by SUSTech CRA and CCSE