ima: always measure and audit files in policy
All files matching a "measure" rule must be included in the IMA measurement list, even when the file hash cannot be calculated. Similarly, all files matching an "audit" rule must be audited, even when the file hash can not be calculated. The file data hash field contained in the IMA measurement list template data will contain 0's instead of the actual file hash digest. Note: In general, adding, deleting or in anyway changing which files are included in the IMA measurement list is not a good idea, as it might result in not being able to unseal trusted keys sealed to a specific TPM PCR value. This patch not only adds file measurements that were not previously measured, but specifies that the file hash value for these files will be 0's. As the IMA measurement list ordering is not consistent from one boot to the next, it is unlikely that anyone is sealing keys based on the IMA measurement list. Remote attestation servers should be able to process these new measurement records, but might complain about these unknown records. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Reviewed-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
This commit is contained in:
parent
2068626d13
commit
f3cc6b25dc
|
@ -199,42 +199,59 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
|
||||||
struct inode *inode = file_inode(file);
|
struct inode *inode = file_inode(file);
|
||||||
const char *filename = file->f_path.dentry->d_name.name;
|
const char *filename = file->f_path.dentry->d_name.name;
|
||||||
int result = 0;
|
int result = 0;
|
||||||
|
int length;
|
||||||
|
void *tmpbuf;
|
||||||
|
u64 i_version;
|
||||||
struct {
|
struct {
|
||||||
struct ima_digest_data hdr;
|
struct ima_digest_data hdr;
|
||||||
char digest[IMA_MAX_DIGEST_SIZE];
|
char digest[IMA_MAX_DIGEST_SIZE];
|
||||||
} hash;
|
} hash;
|
||||||
|
|
||||||
if (!(iint->flags & IMA_COLLECTED)) {
|
if (iint->flags & IMA_COLLECTED)
|
||||||
u64 i_version = file_inode(file)->i_version;
|
goto out;
|
||||||
|
|
||||||
if (file->f_flags & O_DIRECT) {
|
/*
|
||||||
audit_cause = "failed(directio)";
|
* Dectecting file change is based on i_version. On filesystems
|
||||||
result = -EACCES;
|
* which do not support i_version, support is limited to an initial
|
||||||
goto out;
|
* measurement/appraisal/audit.
|
||||||
}
|
*/
|
||||||
|
i_version = file_inode(file)->i_version;
|
||||||
|
hash.hdr.algo = algo;
|
||||||
|
|
||||||
hash.hdr.algo = algo;
|
/* Initialize hash digest to 0's in case of failure */
|
||||||
|
memset(&hash.digest, 0, sizeof(hash.digest));
|
||||||
|
|
||||||
result = (!buf) ? ima_calc_file_hash(file, &hash.hdr) :
|
if (buf)
|
||||||
ima_calc_buffer_hash(buf, size, &hash.hdr);
|
result = ima_calc_buffer_hash(buf, size, &hash.hdr);
|
||||||
if (!result) {
|
else
|
||||||
int length = sizeof(hash.hdr) + hash.hdr.length;
|
result = ima_calc_file_hash(file, &hash.hdr);
|
||||||
void *tmpbuf = krealloc(iint->ima_hash, length,
|
|
||||||
GFP_NOFS);
|
if (result && result != -EBADF && result != -EINVAL)
|
||||||
if (tmpbuf) {
|
goto out;
|
||||||
iint->ima_hash = tmpbuf;
|
|
||||||
memcpy(iint->ima_hash, &hash, length);
|
length = sizeof(hash.hdr) + hash.hdr.length;
|
||||||
iint->version = i_version;
|
tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS);
|
||||||
iint->flags |= IMA_COLLECTED;
|
if (!tmpbuf) {
|
||||||
} else
|
result = -ENOMEM;
|
||||||
result = -ENOMEM;
|
goto out;
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
iint->ima_hash = tmpbuf;
|
||||||
|
memcpy(iint->ima_hash, &hash, length);
|
||||||
|
iint->version = i_version;
|
||||||
|
|
||||||
|
/* Possibly temporary failure due to type of read (eg. O_DIRECT) */
|
||||||
|
if (!result)
|
||||||
|
iint->flags |= IMA_COLLECTED;
|
||||||
out:
|
out:
|
||||||
if (result)
|
if (result) {
|
||||||
|
if (file->f_flags & O_DIRECT)
|
||||||
|
audit_cause = "failed(directio)";
|
||||||
|
|
||||||
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
|
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
|
||||||
filename, "collect_data", audit_cause,
|
filename, "collect_data", audit_cause,
|
||||||
result, 0);
|
result, 0);
|
||||||
|
}
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -278,7 +295,7 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
|
||||||
}
|
}
|
||||||
|
|
||||||
result = ima_store_template(entry, violation, inode, filename, pcr);
|
result = ima_store_template(entry, violation, inode, filename, pcr);
|
||||||
if (!result || result == -EEXIST) {
|
if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {
|
||||||
iint->flags |= IMA_MEASURED;
|
iint->flags |= IMA_MEASURED;
|
||||||
iint->measured_pcrs |= (0x1 << pcr);
|
iint->measured_pcrs |= (0x1 << pcr);
|
||||||
}
|
}
|
||||||
|
|
|
@ -441,6 +441,16 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
|
||||||
loff_t i_size;
|
loff_t i_size;
|
||||||
int rc;
|
int rc;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* For consistency, fail file's opened with the O_DIRECT flag on
|
||||||
|
* filesystems mounted with/without DAX option.
|
||||||
|
*/
|
||||||
|
if (file->f_flags & O_DIRECT) {
|
||||||
|
hash->length = hash_digest_size[ima_hash_algo];
|
||||||
|
hash->algo = ima_hash_algo;
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
i_size = i_size_read(file_inode(file));
|
i_size = i_size_read(file_inode(file));
|
||||||
|
|
||||||
if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
|
if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
|
||||||
|
|
|
@ -235,11 +235,8 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
|
||||||
hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
|
hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
|
||||||
|
|
||||||
rc = ima_collect_measurement(iint, file, buf, size, hash_algo);
|
rc = ima_collect_measurement(iint, file, buf, size, hash_algo);
|
||||||
if (rc != 0) {
|
if (rc != 0 && rc != -EBADF && rc != -EINVAL)
|
||||||
if (file->f_flags & O_DIRECT)
|
|
||||||
rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES;
|
|
||||||
goto out_digsig;
|
goto out_digsig;
|
||||||
}
|
|
||||||
|
|
||||||
if (!pathbuf) /* ima_rdwr_violation possibly pre-fetched */
|
if (!pathbuf) /* ima_rdwr_violation possibly pre-fetched */
|
||||||
pathname = ima_d_path(&file->f_path, &pathbuf, filename);
|
pathname = ima_d_path(&file->f_path, &pathbuf, filename);
|
||||||
|
@ -247,12 +244,14 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
|
||||||
if (action & IMA_MEASURE)
|
if (action & IMA_MEASURE)
|
||||||
ima_store_measurement(iint, file, pathname,
|
ima_store_measurement(iint, file, pathname,
|
||||||
xattr_value, xattr_len, pcr);
|
xattr_value, xattr_len, pcr);
|
||||||
if (action & IMA_APPRAISE_SUBMASK)
|
if (rc == 0 && (action & IMA_APPRAISE_SUBMASK))
|
||||||
rc = ima_appraise_measurement(func, iint, file, pathname,
|
rc = ima_appraise_measurement(func, iint, file, pathname,
|
||||||
xattr_value, xattr_len, opened);
|
xattr_value, xattr_len, opened);
|
||||||
if (action & IMA_AUDIT)
|
if (action & IMA_AUDIT)
|
||||||
ima_audit_measurement(iint, pathname);
|
ima_audit_measurement(iint, pathname);
|
||||||
|
|
||||||
|
if ((file->f_flags & O_DIRECT) && (iint->flags & IMA_PERMIT_DIRECTIO))
|
||||||
|
rc = 0;
|
||||||
out_digsig:
|
out_digsig:
|
||||||
if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG) &&
|
if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG) &&
|
||||||
!(iint->flags & IMA_NEW_FILE))
|
!(iint->flags & IMA_NEW_FILE))
|
||||||
|
|
Loading…
Reference in New Issue