lkml.org 
[lkml]   [2021]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH 0/3] support for duplicate measurement of integrity critical data
    Date
    IMA does not measure duplicate buffer data since TPM extend is a very
    expensive operation. However, in some cases for integrity critical
    data, the measurement of duplicate data is necessary to accurately
    determine the current state of the system. Eg, SELinux state changing
    from 'audit', to 'enforcing', and back to 'audit' again. In this
    example, currently, IMA will not measure the last state change to
    'audit'. This limits the ability of attestation services to accurately
    determine the current state of the integrity critical data on the
    system.

    This series addresses this gap by providing the ability to measure
    duplicate entries for integrity critical data, driven by policy.

    This series is based on the following repo/branch/commit:
    repo: https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
    branch: next-integrity-testing
    commit b3f82afc1041 ("IMA: Measure kernel version in early boot")

    Tushar Sugandhi (3):
    IMA: add policy condition to measure duplicate critical data
    IMA: update functions to read allow_dup policy condition
    IMA: add support to measure duplicate buffer for critical data hook

    Documentation/ABI/testing/ima_policy | 4 +++-
    security/integrity/ima/ima.h | 8 +++----
    security/integrity/ima/ima_api.c | 15 +++++++------
    security/integrity/ima/ima_appraise.c | 2 +-
    security/integrity/ima/ima_init.c | 2 +-
    security/integrity/ima/ima_main.c | 9 ++++----
    security/integrity/ima/ima_policy.c | 31 ++++++++++++++++++++++++---
    security/integrity/ima/ima_queue.c | 5 +++--
    8 files changed, 54 insertions(+), 22 deletions(-)

    --
    2.17.1

    \
     
     \ /
      Last update: 2021-01-30 11:19    [W:4.001 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site