ima: new templates management mechanism

	- description of the kernel key retention service.

tomoyo.txt

	- documentation on the TOMOYO Linux Security Module.

IMA-templates.txt

	- documentation on the template management mechanism for IMA.

                       IMA Template Management Mechanism

==== INTRODUCTION ====

The original 'ima' template is fixed length, containing the filedata hash

and pathname. The filedata hash is limited to 20 bytes (md5/sha1).

The pathname is a null terminated string, limited to 255 characters.

To overcome these limitations and to add additional file metadata, it is

necessary to extend the current version of IMA by defining additional

templates. For example, information that could be possibly reported are

the inode UID/GID or the LSM labels either of the inode and of the process

that is accessing it.

However, the main problem to introduce this feature is that, each time

a new template is defined, the functions that generate and display

the measurements list would include the code for handling a new format

and, thus, would significantly grow over the time.

The proposed solution solves this problem by separating the template

management from the remaining IMA code. The core of this solution is the

definition of two new data structures: a template descriptor, to determine

which information should be included in the measurement list; a template

field, to generate and display data of a given type.

Managing templates with these structures is very simple. To support

a new data type, developers define the field identifier and implement

two functions, init() and show(), respectively to generate and display

measurement entries. Defining a new template descriptor requires

specifying the template format, a string of field identifiers separated

by the '|' character. While in the current implementation it is possible

to define new template descriptors only by adding their definition in the

template specific code (ima_template.c), in a future version it will be

possible to register a new template on a running kernel by supplying to IMA

the desired format string. In this version, IMA initializes at boot time

all defined template descriptors by translating the format into an array

of template fields structures taken from the set of the supported ones.

After the initialization step, IMA will call ima_alloc_init_template()

(new function defined within the patches for the new template management

mechanism) to generate a new measurement entry by using the template

descriptor chosen through the kernel configuration or through the newly

introduced 'ima_template=' kernel command line parameter. It is during this

phase that the advantages of the new architecture are clearly shown:

the latter function will not contain specific code to handle a given template

but, instead, it simply calls the init() method of the template fields

associated to the chosen template descriptor and store the result (pointer

to allocated data and data length) in the measurement entry structure.

The same mechanism is employed to display measurements entries.

The functions ima[_ascii]_measurements_show() retrieve, for each entry,

the template descriptor used to produce that entry and call the show()

method for each item of the array of template fields structures.

==== SUPPORTED TEMPLATE FIELDS AND DESCRIPTORS ====

In the following, there is the list of supported template fields

('<identifier>': description), that can be used to define new template

descriptors by adding their identifier to the format string

(support for more data types will be added later):

 - 'd': the digest of the event (i.e. the digest of a measured file),

        calculated with the SHA1 or MD5 hash algorithm;

 - 'n': the name of the event (i.e. the file name), with size up to 255 bytes;

 - 'd-ng': the digest of the event, calculated with an arbitrary hash

           algorithm (field format: [<hash algo>:]digest, where the digest

           prefix is shown only if the hash algorithm is not SHA1 or MD5);

 - 'n-ng': the name of the event, without size limitations.

Below, there is the list of defined template descriptors:

 - "ima": its format is 'd|n';

 - "ima-ng" (default): its format is 'd-ng|n-ng'.

==== USE ====

To specify the template descriptor to be used to generate measurement entries,

currently the following methods are supported:

 - select a template descriptor among those supported in the kernel

   configuration ('ima-ng' is the default choice);

 - specify a template descriptor name from the kernel command line through

   the 'ima_template=' parameter.

obj-$(CONFIG_IMA) += ima.o

ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \

	 ima_policy.o

	 ima_policy.o ima_template.o

ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o

#define IMA_HASH_BITS 9

#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)

#define IMA_TEMPLATE_FIELD_ID_MAX_LEN	16

#define IMA_TEMPLATE_NUM_FIELDS_MAX	15

/* set during initialization */

extern int ima_initialized;

extern int ima_used_chip;

extern int ima_hash_algo;

extern int ima_appraise;

/* IMA template field data definition */

struct ima_field_data {

	u8 *data;

	u32 len;

};

/* IMA template field definition */

struct ima_template_field {

	const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];

	int (*field_init) (struct integrity_iint_cache *iint, struct file *file,

			   const unsigned char *filename,

			   struct ima_field_data *field_data);

	void (*field_show) (struct seq_file *m, enum ima_show_type show,

			    struct ima_field_data *field_data);

};

/* IMA template descriptor definition */

struct ima_template_desc {

	char *name;

	char *fmt;

	int num_fields;

	struct ima_template_field **fields;

};

/* IMA inode template definition */

struct ima_template_data {

	u8 digest[IMA_DIGEST_SIZE];	/* sha1/md5 measurement hash */

		       const char *op, const char *cause);

int ima_init_crypto(void);

int ima_init_template(void);

/*

 * used to protect h_table and sha_table

 */

	rc = ima_init_crypto();

	if (rc)

		return rc;

	rc = ima_init_template();

	if (rc != 0)

		return rc;

	ima_add_boot_aggregate();	/* boot aggregate must be first entry */

	ima_init_policy();