Commit fdf90729 authored by Mimi Zohar's avatar Mimi Zohar Committed by Rusty Russell
Browse files

ima: support new kernel module syscall 



With the addition of the new kernel module syscall, which defines two
arguments - a file descriptor to the kernel module and a pointer to a NULL
terminated string of module arguments - it is now possible to measure and
appraise kernel modules like any other file on the file system.

This patch adds support to measure and appraise kernel modules in an
extensible and consistent manner.

To support filesystems without extended attribute support, additional
patches could pass the signature as the first parameter.

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
parent 1625cee5

Documentation/ABI/testing/ima_policy

+2 −1
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ Description: 
			lsm:	[[subj_user=] [subj_role=] [subj_type=]

				 [obj_user=] [obj_role=] [obj_type=]]



		base: 	func:= [BPRM_CHECK][FILE_MMAP][FILE_CHECK]

		base: 	func:= [BPRM_CHECK][FILE_MMAP][FILE_CHECK][MODULE_CHECK]

			mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]

			fsmagic:= hex value

			uid:= decimal value
@@ -53,6 +53,7 @@ Description: 
			measure func=BPRM_CHECK

			measure func=FILE_MMAP mask=MAY_EXEC

			measure func=FILE_CHECK mask=MAY_READ uid=0

			measure func=MODULE_CHECK uid=0

			appraise fowner=0



		The default policy measures all executables in bprm_check,

include/linux/ima.h

+6 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ extern int ima_bprm_check(struct linux_binprm *bprm); 
extern int ima_file_check(struct file *file, int mask);

extern void ima_file_free(struct file *file);

extern int ima_file_mmap(struct file *file, unsigned long prot);

extern int ima_module_check(struct file *file);



#else

static inline int ima_bprm_check(struct linux_binprm *bprm)
@@ -40,6 +41,11 @@ static inline int ima_file_mmap(struct file *file, unsigned long prot) 
	return 0;

}



static inline int ima_module_check(struct file *file)

{

	return 0;

}



#endif /* CONFIG_IMA_H */



#ifdef CONFIG_IMA_APPRAISE

security/integrity/ima/ima.h

+1 −1
Original line number Diff line number Diff line
@@ -127,7 +127,7 @@ struct integrity_iint_cache *integrity_iint_insert(struct inode *inode); 
struct integrity_iint_cache *integrity_iint_find(struct inode *inode);



/* IMA policy related functions */

enum ima_hooks { FILE_CHECK = 1, FILE_MMAP, BPRM_CHECK, POST_SETATTR };

enum ima_hooks { FILE_CHECK = 1, FILE_MMAP, BPRM_CHECK, MODULE_CHECK, POST_SETATTR };



int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,

		     int flags);

security/integrity/ima/ima_api.c

+2 −2
Original line number Diff line number Diff line
@@ -100,12 +100,12 @@ err_out: 
 * ima_get_action - appraise & measure decision based on policy.

 * @inode: pointer to inode to measure

 * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE)

 * @function: calling function (FILE_CHECK, BPRM_CHECK, FILE_MMAP)

 * @function: calling function (FILE_CHECK, BPRM_CHECK, FILE_MMAP, MODULE_CHECK)

 *

 * The policy is defined in terms of keypairs:

 * 		subj=, obj=, type=, func=, mask=, fsmagic=

 *	subj,obj, and type: are LSM specific.

 * 	func: FILE_CHECK | BPRM_CHECK | FILE_MMAP

 * 	func: FILE_CHECK | BPRM_CHECK | FILE_MMAP | MODULE_CHECK

 * 	mask: contains the permission mask

 *	fsmagic: hex value

 *

security/integrity/ima/ima_main.c

+21 −0
Original line number Diff line number Diff line
@@ -280,6 +280,27 @@ int ima_file_check(struct file *file, int mask) 
}

EXPORT_SYMBOL_GPL(ima_file_check);



/**

 * ima_module_check - based on policy, collect/store/appraise measurement.

 * @file: pointer to the file to be measured/appraised

 *

 * Measure/appraise kernel modules based on policy.

 *

 * Always return 0 and audit dentry_open failures.

 * Return code is based upon measurement appraisal.

 */

int ima_module_check(struct file *file)

{

	int rc;



	if (!file)

		rc = INTEGRITY_UNKNOWN;

	else

		rc = process_measurement(file, file->f_dentry->d_name.name,

					 MAY_EXEC, MODULE_CHECK);

	return (ima_appraise & IMA_APPRAISE_ENFORCE) ? rc : 0;

}



static int __init init_ima(void)

{

	int error;

CRA Git | Maintained and supported by SUSTech CRA and CCSE