Re: [PATCH v7 6/8] IMA: extend critical data hook to limit the measurement based on a label

[Tyler Hicks]

On 2020-12-09 11:42:10, Tushar Sugandhi wrote:
> The IMA hook ima_measure_critical_data() does not support a way to
> specify the source of the critical data provider. Thus, the data
> measurement cannot be constrained based on the data source label
> in the IMA policy.
> 
> Extend the IMA hook ima_measure_critical_data() to support passing 
> the data source label as an input parameter, so that the policy rule can
> be used to limit the measurements based on the label.
> 
> Signed-off-by: Tushar Sugandhi <tusharsu@xxxxxxxxxxxxxxxxxxx>

Reviewed-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxxx>

Tyler

> ---
>  include/linux/ima.h               |  6 ++++--
>  security/integrity/ima/ima_main.c | 11 ++++++++---
>  2 files changed, 12 insertions(+), 5 deletions(-)
> 
> diff --git a/include/linux/ima.h b/include/linux/ima.h
> index 675f54db6264..6434287a81cd 100644
> --- a/include/linux/ima.h
> +++ b/include/linux/ima.h
> @@ -30,7 +30,8 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size,
>  extern void ima_post_path_mknod(struct dentry *dentry);
>  extern int ima_file_hash(struct file *file, char *buf, size_t buf_size);
>  extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size);
> -extern void ima_measure_critical_data(const char *event_name,
> +extern void ima_measure_critical_data(const char *event_data_source,
> +				      const char *event_name,
>  				      const void *buf, int buf_len,
>  				      bool measure_buf_hash);
>  
> @@ -125,7 +126,8 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size)
>  }
>  
>  static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {}
> -static inline void ima_measure_critical_data(const char *event_name,
> +static inline void ima_measure_critical_data(const char *event_data_source,
> +					     const char *event_name,
>  					     const void *buf, int buf_len,
>  					     bool measure_buf_hash) {}
>  #endif /* CONFIG_IMA */
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index ae59f4a4dd70..7c633901f441 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -924,6 +924,7 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
>  
>  /**
>   * ima_measure_critical_data - measure kernel integrity critical data
> + * @event_data_source: kernel data source being measured
>   * @event_name: event name to be used for the buffer entry
>   * @buf: pointer to buffer containing data to measure
>   * @buf_len: length of buffer(in bytes)
> @@ -932,6 +933,9 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
>   * Measure the kernel subsystem data, critical to the integrity of the kernel,
>   * into the IMA log and extend the @pcr.
>   *
> + * Use @event_data_source to describe the kernel data source for the buffer
> + * being measured.
> + *
>   * Use @event_name to describe the state/buffer data change.
>   * Examples of critical data (buf) could be kernel in-memory r/o structures,
>   * hash of the memory structures, or data that represents subsystem state
> @@ -944,17 +948,18 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
>   *
>   * The data (buf) can only be measured, not appraised.
>   */
> -void ima_measure_critical_data(const char *event_name,
> +void ima_measure_critical_data(const char *event_data_source,
> +			       const char *event_name,
>  			       const void *buf, int buf_len,
>  			       bool measure_buf_hash)
>  {
> -	if (!event_name || !buf || !buf_len) {
> +	if (!event_name || !event_data_source || !buf || !buf_len) {
>  		pr_err("Invalid arguments passed to %s().\n", __func__);
>  		return;
>  	}
>  
>  	process_buffer_measurement(NULL, buf, buf_len, event_name,
> -				   CRITICAL_DATA, 0, NULL,
> +				   CRITICAL_DATA, 0, event_data_source,
>  				   measure_buf_hash);
>  }
>  
> -- 
> 2.17.1
>