Commit 8b681508 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'next-integrity' of... 

Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull integrity updates from Mimi Zohar:
 "Bug fixes, code clean up, and new features:

   - IMA policy rules can be defined in terms of LSM labels, making the
     IMA policy dependent on LSM policy label changes, in particular LSM
     label deletions. The new environment, in which IMA-appraisal is
     being used, frequently updates the LSM policy and permits LSM label
     deletions.

   - Prevent an mmap'ed shared file opened for write from also being
     mmap'ed execute. In the long term, making this and other similar
     changes at the VFS layer would be preferable.

   - The IMA per policy rule template format support is needed for a
     couple of new/proposed features (eg. kexec boot command line
     measurement, appended signatures, and VFS provided file hashes).

   - Other than the "boot-aggregate" record in the IMA measuremeent
     list, all other measurements are of file data. Measuring and
     storing the kexec boot command line in the IMA measurement list is
     the first buffer based measurement included in the measurement
     list"

* 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  integrity: Introduce struct evm_xattr
  ima: Update MAX_TEMPLATE_NAME_LEN to fit largest reasonable definition
  KEXEC: Call ima_kexec_cmdline to measure the boot command line args
  IMA: Define a new template field buf
  IMA: Define a new hook to measure the kexec boot command line arguments
  IMA: support for per policy rule template formats
  integrity: Fix __integrity_init_keyring() section mismatch
  ima: Use designated initializers for struct ima_event_data
  ima: use the lsm policy update notifier
  LSM: switch to blocking policy update notifiers
  x86/ima: fix the Kconfig dependency for IMA_ARCH_POLICY
  ima: Make arch_policy_entry static
  ima: prevent a file already mmap'ed write to be mmap'ed execute
  x86/ima: check EFI SetupMode too
parents 0f75ef6a 650b29db

Documentation/ABI/testing/ima_policy

+4 −2
Original line number Diff line number Diff line
@@ -24,11 +24,11 @@ Description: 
				[euid=] [fowner=] [fsname=]]

			lsm:	[[subj_user=] [subj_role=] [subj_type=]

				 [obj_user=] [obj_role=] [obj_type=]]

			option:	[[appraise_type=]] [permit_directio]



			option:	[[appraise_type=]] [template=] [permit_directio]

		base: 	func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]

				[FIRMWARE_CHECK]

				[KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]

				[KEXEC_CMDLINE]

			mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]

			       [[^]MAY_EXEC]

			fsmagic:= hex value
@@ -38,6 +38,8 @@ Description: 
			fowner:= decimal value

		lsm:  	are LSM specific

		option:	appraise_type:= [imasig]

			template:= name of a defined IMA template type

			(eg, ima-ng). Only valid when action is "measure".

			pcr:= decimal value



		default policy:

Documentation/security/IMA-templates.rst

+4 −3
Original line number Diff line number Diff line
@@ -69,15 +69,16 @@ descriptors by adding their identifier to the format string 
   algorithm (field format: [<hash algo>:]digest, where the digest

   prefix is shown only if the hash algorithm is not SHA1 or MD5);

 - 'n-ng': the name of the event, without size limitations;

 - 'sig': the file signature.

 - 'sig': the file signature;

 - 'buf': the buffer data that was used to generate the hash without size limitations;





Below, there is the list of defined template descriptors:



 - "ima": its format is ``d|n``;

 - "ima-ng" (default): its format is ``d-ng|n-ng``;

 - "ima-sig": its format is ``d-ng|n-ng|sig``.



 - "ima-sig": its format is ``d-ng|n-ng|sig``;

 - "ima-buf": its format is ``d-ng|n-ng|buf``;





Use

arch/x86/kernel/ima_arch.c

+10 −2
Original line number Diff line number Diff line
@@ -11,10 +11,11 @@ extern struct boot_params boot_params; 
static enum efi_secureboot_mode get_sb_mode(void)

{

	efi_char16_t efi_SecureBoot_name[] = L"SecureBoot";

	efi_char16_t efi_SetupMode_name[] = L"SecureBoot";

	efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;

	efi_status_t status;

	unsigned long size;

	u8 secboot;

	u8 secboot, setupmode;



	size = sizeof(secboot);
@@ -36,7 +37,14 @@ static enum efi_secureboot_mode get_sb_mode(void) 
		return efi_secureboot_mode_unknown;

	}



	if (secboot == 0) {

	size = sizeof(setupmode);

	status = efi.get_variable(efi_SetupMode_name, &efi_variable_guid,

				  NULL, &size, &setupmode);



	if (status != EFI_SUCCESS)	/* ignore unknown SetupMode */

		setupmode = 0;



	if (secboot == 0 || setupmode == 1) {

		pr_info("ima: secureboot mode disabled\n");

		return efi_secureboot_mode_disabled;

	}

drivers/infiniband/core/device.c

+3 −3
Original line number Diff line number Diff line
@@ -2520,7 +2520,7 @@ static int __init ib_core_init(void) 
		goto err_mad;

	}



	ret = register_lsm_notifier(&ibdev_lsm_nb);

	ret = register_blocking_lsm_notifier(&ibdev_lsm_nb);

	if (ret) {

		pr_warn("Couldn't register LSM notifier. ret %d\n", ret);

		goto err_sa;
@@ -2539,7 +2539,7 @@ static int __init ib_core_init(void) 
	return 0;



err_compat:

	unregister_lsm_notifier(&ibdev_lsm_nb);

	unregister_blocking_lsm_notifier(&ibdev_lsm_nb);

err_sa:

	ib_sa_cleanup();

err_mad:
@@ -2565,7 +2565,7 @@ static void __exit ib_core_cleanup(void) 
	nldev_exit();

	rdma_nl_unregister(RDMA_NL_LS);

	unregister_pernet_device(&rdma_dev_net_ops);

	unregister_lsm_notifier(&ibdev_lsm_nb);

	unregister_blocking_lsm_notifier(&ibdev_lsm_nb);

	ib_sa_cleanup();

	ib_mad_cleanup();

	addr_cleanup();

include/linux/ima.h

+2 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ extern int ima_read_file(struct file *file, enum kernel_read_file_id id); 
extern int ima_post_read_file(struct file *file, void *buf, loff_t size,

			      enum kernel_read_file_id id);

extern void ima_post_path_mknod(struct dentry *dentry);

extern void ima_kexec_cmdline(const void *buf, int size);



#ifdef CONFIG_IMA_KEXEC

extern void ima_add_kexec_buffer(struct kimage *image);
@@ -89,6 +90,7 @@ static inline void ima_post_path_mknod(struct dentry *dentry) 
	return;

}



static inline void ima_kexec_cmdline(const void *buf, int size) {}

#endif /* CONFIG_IMA */



#ifndef CONFIG_IMA_KEXEC

CRA Git | Maintained and supported by SUSTech CRA and CCSE