IMA: add support to measure buffer data hash

The original IMA buffer data measurement sizes were small (e.g.  boot
command line), but the new buffer data measurement use cases have data
sizes that are a lot larger.  Just as IMA measures the file data hash,
not the file data, IMA should similarly support the option for measuring
buffer data hash.

Introduce a boolean parameter to support measuring buffer data hash,
which would be much smaller, instead of the buffer itself.

Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index e5622ce8cbb1e05419af4b7c4f8e43e1806ae020..0b463451583943e1a63e58b859a65f0e36b69a91 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -268,7 +268,8 @@ void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
                           struct ima_template_desc *template_desc);
 void process_buffer_measurement(struct inode *inode, const void *buf, int size,
                                const char *eventname, enum ima_hooks func,
-                               int pcr, const char *func_data);
+                               int pcr, const char *func_data,
+                               bool buf_hash);
 void ima_audit_measurement(struct integrity_iint_cache *iint,
                           const unsigned char *filename);
 int ima_alloc_init_template(struct ima_event_data *event_data,

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 8361941ee0a12120b6a154f29fbbc6b8802cd77e..46ffa38bab1274ec0295dc4a1570af8023b45334 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -352,7 +352,7 @@ int ima_check_blacklist(struct integrity_iint_cache *iint,
                if ((rc == -EPERM) && (iint->flags & IMA_MEASURE))
                        process_buffer_measurement(NULL, digest, digestsize,
                                                   "blacklisted-hash", NONE,
-                                                  pcr, NULL);
+                                                  pcr, NULL, false);
        }
 
        return rc;

diff --git a/security/integrity/ima/ima_asymmetric_keys.c b/security/integrity/ima/ima_asymmetric_keys.c
index 1c68c500c26ff20d1c85ae11323d691709a0777c..a740957939369ac2b9b6c2d20c4a0430c5d769b0 100644 (file)
--- a/security/integrity/ima/ima_asymmetric_keys.c
+++ b/security/integrity/ima/ima_asymmetric_keys.c
@@ -60,5 +60,5 @@ void ima_post_key_create_or_update(struct key *keyring, struct key *key,
         */
        process_buffer_measurement(NULL, payload, payload_len,
                                   keyring->description, KEY_CHECK, 0,
-                                  keyring->description);
+                                  keyring->description, false);
 }

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 0c645699c7fb99390315c0b2013761fd6bfc2efe..250e52114230c3ccc4cbb3553a5d63fcb6d8cb71 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -809,7 +809,7 @@ int ima_post_load_data(char *buf, loff_t size,
 }
 
 /*
- * process_buffer_measurement - Measure the buffer to ima log.
+ * process_buffer_measurement - Measure the buffer or the buffer data hash
  * @inode: inode associated with the object being measured (NULL for KEY_CHECK)
  * @buf: pointer to the buffer that needs to be added to the log.
  * @size: size of buffer(in bytes).
@@ -817,12 +817,14 @@ int ima_post_load_data(char *buf, loff_t size,
  * @func: IMA hook
  * @pcr: pcr to extend the measurement
  * @func_data: func specific data, may be NULL
+ * @buf_hash: measure buffer data hash
  *
- * Based on policy, the buffer is measured into the ima log.
+ * Based on policy, either the buffer data or buffer data hash is measured
  */
 void process_buffer_measurement(struct inode *inode, const void *buf, int size,
                                const char *eventname, enum ima_hooks func,
-                               int pcr, const char *func_data)
+                               int pcr, const char *func_data,
+                               bool buf_hash)
 {
        int ret = 0;
        const char *audit_cause = "ENOMEM";
@@ -837,6 +839,8 @@ void process_buffer_measurement(struct inode *inode, const void *buf, int size,
                struct ima_digest_data hdr;
                char digest[IMA_MAX_DIGEST_SIZE];
        } hash = {};
+       char digest_hash[IMA_MAX_DIGEST_SIZE];
+       int digest_hash_len = hash_digest_size[ima_hash_algo];
        int violation = 0;
        int action = 0;
        u32 secid;
@@ -879,13 +883,27 @@ void process_buffer_measurement(struct inode *inode, const void *buf, int size,
                goto out;
        }
 
+       if (buf_hash) {
+               memcpy(digest_hash, hash.hdr.digest, digest_hash_len);
+
+               ret = ima_calc_buffer_hash(digest_hash, digest_hash_len,
+                                          iint.ima_hash);
+               if (ret < 0) {
+                       audit_cause = "hashing_error";
+                       goto out;
+               }
+
+               event_data.buf = digest_hash;
+               event_data.buf_len = digest_hash_len;
+       }
+
        ret = ima_alloc_init_template(&event_data, &entry, template);
        if (ret < 0) {
                audit_cause = "alloc_entry";
                goto out;
        }
 
-       ret = ima_store_template(entry, violation, NULL, buf, pcr);
+       ret = ima_store_template(entry, violation, NULL, event_data.buf, pcr);
        if (ret < 0) {
                audit_cause = "store_entry";
                ima_free_template_entry(entry);
@@ -920,7 +938,8 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
                return;
 
        process_buffer_measurement(file_inode(f.file), buf, size,
-                                  "kexec-cmdline", KEXEC_CMDLINE, 0, NULL);
+                                  "kexec-cmdline", KEXEC_CMDLINE, 0, NULL,
+                                  false);
        fdput(f);
 }
 

diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c
index 69a8626a35c0ebefc332edfff10aa5a0094193c3..c2f2ad34f9b7239d9438185ef60428f9b042e327 100644 (file)
--- a/security/integrity/ima/ima_queue_keys.c
+++ b/security/integrity/ima/ima_queue_keys.c
@@ -162,7 +162,8 @@ void ima_process_queued_keys(void)
                                                   entry->payload_len,
                                                   entry->keyring_name,
                                                   KEY_CHECK, 0,
-                                                  entry->keyring_name);
+                                                  entry->keyring_name,
+                                                  false);
                list_del(&entry->list);
                ima_free_key_entry(entry);
        }