ima: Define new template fields iuid and igid

This patch defines the new template fields iuid and igid, which include
respectively the inode UID and GID. For idmapped mounts, still the original
UID and GID are provided.

These fields can be used to verify the EVM portable signature, if it was
included with the template fields sig or evmsig.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/Documentation/security/IMA-templates.rst b/Documentation/security/IMA-templates.rst
index 9f3e86ab028a45cfd0faa81ec4299d483d288070..bf8ce4cf5878ac7585b0645a2d23a834dcc77650 100644 (file)
--- a/Documentation/security/IMA-templates.rst
+++ b/Documentation/security/IMA-templates.rst
@@ -75,6 +75,8 @@ descriptors by adding their identifier to the format string
  - 'modsig' the appended file signature;
  - 'buf': the buffer data that was used to generate the hash without size limitations;
  - 'evmsig': the EVM portable signature;
+ - 'iuid': the inode UID;
+ - 'igid': the inode GID;
 
 
 Below, there is the list of defined template descriptors:

diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
index 7a60848c04a54ef71ab1af82886066f91c8b1391..a5ecd9e2581bdb2a2a40c78e3ad0c909ffaeb8ae 100644 (file)
--- a/security/integrity/ima/ima_template.c
+++ b/security/integrity/ima/ima_template.c
@@ -47,6 +47,10 @@ static const struct ima_template_field supported_fields[] = {
         .field_show = ima_show_template_sig},
        {.field_id = "evmsig", .field_init = ima_eventevmsig_init,
         .field_show = ima_show_template_sig},
+       {.field_id = "iuid", .field_init = ima_eventinodeuid_init,
+        .field_show = ima_show_template_uint},
+       {.field_id = "igid", .field_init = ima_eventinodegid_init,
+        .field_show = ima_show_template_uint},
 };
 
 /*

diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
index f23296c33da14262da7ec977da8a741a976deda6..87b40f391739fa23d09b4b1bb1b82a0f9d4d1479 100644 (file)
--- a/security/integrity/ima/ima_template_lib.c
+++ b/security/integrity/ima/ima_template_lib.c
@@ -551,3 +551,48 @@ int ima_eventevmsig_init(struct ima_event_data *event_data,
        kfree(xattr_data);
        return rc;
 }
+
+static int ima_eventinodedac_init_common(struct ima_event_data *event_data,
+                                        struct ima_field_data *field_data,
+                                        bool get_uid)
+{
+       unsigned int id;
+
+       if (!event_data->file)
+               return 0;
+
+       if (get_uid)
+               id = i_uid_read(file_inode(event_data->file));
+       else
+               id = i_gid_read(file_inode(event_data->file));
+
+       if (ima_canonical_fmt) {
+               if (sizeof(id) == sizeof(u16))
+                       id = cpu_to_le16(id);
+               else
+                       id = cpu_to_le32(id);
+       }
+
+       return ima_write_template_field_data((void *)&id, sizeof(id),
+                                            DATA_FMT_UINT, field_data);
+}
+
+/*
+ *  ima_eventinodeuid_init - include the inode UID as part of the template
+ *  data
+ */
+int ima_eventinodeuid_init(struct ima_event_data *event_data,
+                          struct ima_field_data *field_data)
+{
+       return ima_eventinodedac_init_common(event_data, field_data, true);
+}
+
+/*
+ *  ima_eventinodegid_init - include the inode GID as part of the template
+ *  data
+ */
+int ima_eventinodegid_init(struct ima_event_data *event_data,
+                          struct ima_field_data *field_data)
+{
+       return ima_eventinodedac_init_common(event_data, field_data, false);
+}

diff --git a/security/integrity/ima/ima_template_lib.h b/security/integrity/ima/ima_template_lib.h
index 54b67c80b3155333719ebdf94d201656934180fa..b0aaf109f386e2e82dbdbea16cb0ecf7dc6933a2 100644 (file)
--- a/security/integrity/ima/ima_template_lib.h
+++ b/security/integrity/ima/ima_template_lib.h
@@ -50,4 +50,8 @@ int ima_eventmodsig_init(struct ima_event_data *event_data,
                         struct ima_field_data *field_data);
 int ima_eventevmsig_init(struct ima_event_data *event_data,
                         struct ima_field_data *field_data);
+int ima_eventinodeuid_init(struct ima_event_data *event_data,
+                          struct ima_field_data *field_data);
+int ima_eventinodegid_init(struct ima_event_data *event_data,
+                          struct ima_field_data *field_data);
 #endif /* __LINUX_IMA_TEMPLATE_LIB_H */