lkml.org 
[lkml]   [2020]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v5 6/7] IMA: add critical_data to the built-in policy rules
From
Date
Hi Lakshmi, Tushar,

This patch defines a new critical_data builtin policy. Please update
the Subject line.

On Sun, 2020-11-01 at 14:26 -0800, Tushar Sugandhi wrote:
> From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
>
> The IMA hook to measure kernel critical data, namely
> ima_measure_critical_data(), could be called before a custom IMA policy
> is loaded. For example, SELinux calls ima_measure_critical_data() to
> measure its state and policy when they are initialized. This occurs
> before a custom IMA policy is loaded, and hence IMA hook will not
> measure the data. A built-in policy is therefore needed to measure
> critical data provided by callers before a custom IMA policy is loaded.

^Define a new critical data builtin policy to allow measuring early
kernel integrity critical data before a custom IMA policy is loaded.

Either remove the references to SELinux or move this patch after the
subsequent patch which measures SELinux critical data.

>
> Add CRITICAL_DATA to built-in IMA rules if the kernel command line
> contains "ima_policy=critical_data". Set the IMA template for this rule
> to "ima-buf" since ima_measure_critical_data() measures a buffer.
>
> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>

> ---
> security/integrity/ima/ima_policy.c | 32 +++++++++++++++++++++++++++++
> 1 file changed, 32 insertions(+)
>
> diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> index ec99e0bb6c6f..dc8fe969d3fe 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c

> @@ -875,6 +884,29 @@ void __init ima_init_policy(void)
> ARRAY_SIZE(default_appraise_rules),
> IMA_DEFAULT_POLICY);
>
> + if (ima_use_critical_data) {
> + template = lookup_template_desc("ima-buf");
> + if (!template) {
> + ret = -EINVAL;
> + goto out;
> + }
> +
> + ret = template_desc_init_fields(template->fmt,
> + &(template->fields),
> + &(template->num_fields));

The default IMA template when measuring buffer data is "ima_buf". Is
there a reason for allocating and initializing it here and not
deferring it until process_buffer_measurement()?

thanks,

Mimi

> + if (ret)
> + goto out;
> +
> + critical_data_rules[0].template = template;
> + add_rules(critical_data_rules,
> + ARRAY_SIZE(critical_data_rules),
> + IMA_DEFAULT_POLICY);
> + }
> +
> +out:
> + if (ret)
> + pr_err("%s failed, result: %d\n", __func__, ret);
> +
> ima_update_policy_flag();
> }
>


\
 
 \ /
  Last update: 2020-11-06 16:25    [W:0.182 / U:0.808 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site