lkml.org 
[lkml]   [2019]   [Oct]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v9 5/8] ima: make process_buffer_measurement() generic
From
Date
On Wed, 2019-10-30 at 08:22 -0700, Lakshmi Ramasubramanian wrote:
> On 10/23/19 8:47 PM, Nayna Jain wrote:
>
> Hi Nayna,
>
> > process_buffer_measurement() is limited to measuring the kexec boot
> > command line. This patch makes process_buffer_measurement() more
> > generic, allowing it to measure other types of buffer data (e.g.
> > blacklisted binary hashes or key hashes).
>
> Now that process_buffer_measurement() is being made generic to measure
> any buffer, it would be good to add a tag to indicate what type of
> buffer is being measured.
>
> For example, if the buffer is kexec command line the log could look like:
>
> "kexec_cmdline: <command line data>"
>
> Similarly, if the buffer is blacklisted binary hash:
>
> "blacklist hash: <data>".
>
> If the buffer is key hash:
>
> "<name of the keyring>: key data".
>
> This would greatly help the consumer of the IMA log to know the type of
> data represented in each IMA log entry.

Both the existing kexec command line and the new blacklist buffer
measurement pass that information in the eventname.   The [PATCH 7/8]
"ima: check against blacklisted hashes for files with modsig" patch
description includes an example.

Mimi

\
 
 \ /
  Last update: 2019-10-30 17:36    [W:0.070 / U:0.860 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site