[RFC][PATCH v3 09/10] ima: Use digest caches for measurement
From: Roberto Sassu
Date: Thu Sep 05 2024 - 11:28:50 EST
From: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
Introduce a new measurement style using digest caches, which can be
performed exclusively on non-standard PCRs, to avoid ambiguity.
While a measurement on the standard PCR means that a file was accessed and
had the measured data, a measurement with the digest cache means only that
the calculated file digest was not found in any of the measured digest
lists (any digest list used for the search must be measured, otherwise IMA
wouldn't use it).
The new measurement style does not tell: whether or not the file was
actually accessed (since its measurement is skipped even if it was); in
which sequence files were accessed. So, one has to guess that the system
might have possibly accessed any of the files whose digest is in the
measured digest lists, in any order.
However, it has the following benefits: the IMA measurement list can be
much shorter, system performance can be much better due to less PCR extend
operations (see the performance evaluation in the Integrity Digest Cache
documentation); the PCR can be predictable as long as the set of measured
digest lists does not change (which obviously happens during software
updates).
The PCR can be predictable because the Integrity Digest Cache has a
prefetching mechanism that reads digest lists in a deterministic order,
until it finds the digest list containing the digest calculated by IMA from
an accessed file. If IMA measures digest lists, the PCR is extended in a
deterministic order too.
Predictable PCR means that a TPM key can be made dependent on specific PCR
values (or a OR of them, depending on the key policy). Accessing a file
with an unknown digest immediately makes that TPM key unusable, requiring a
reboot to use it again.
This mechanism can be used for the so called implicit remote attestation,
where the ability of a system to respond to challenges based on the private
part of the TPM key means that the system has the expected PCR values
(which would mean that the integrity of the system is ok). This is opposed
to the explicit remote attestation, where a system has to send all its
measurements, to prove to a remote party about its integrity.
Call the newly introduced function ima_digest_cache_load_verified_usage()
to retrieve the verified usage from the digest cache containing the
calculated digest of the file being accessed (if it is found), and AND it
with the policy usage.
If the AND result has the IMA_DIGEST_CACHE_MEASURE_DATA flag set, behave as
if the file was successfully added to the IMA measurement list (i.e. set
the IMA_MEASURED flag and the PCR flag from the value specified in the
matching policy rule), but actually don't do it.
Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
---
security/integrity/ima/ima.h | 3 ++-
security/integrity/ima/ima_api.c | 15 ++++++++++++++-
security/integrity/ima/ima_main.c | 8 ++++++--
3 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index b2ef37a11b65..c915339dd0d4 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -389,7 +389,8 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
const unsigned char *filename,
struct evm_ima_xattr_data *xattr_value,
int xattr_len, const struct modsig *modsig, int pcr,
- struct ima_template_desc *template_desc);
+ struct ima_template_desc *template_desc,
+ u64 allowed_usage);
int process_buffer_measurement(struct mnt_idmap *idmap,
struct inode *inode, const void *buf, int size,
const char *eventname, enum ima_hooks func,
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index b44cf7d9fbcb..530c5bcc115e 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -351,7 +351,8 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
const unsigned char *filename,
struct evm_ima_xattr_data *xattr_value,
int xattr_len, const struct modsig *modsig, int pcr,
- struct ima_template_desc *template_desc)
+ struct ima_template_desc *template_desc,
+ u64 allowed_usage)
{
static const char op[] = "add_template_measure";
static const char audit_cause[] = "ENOMEM";
@@ -375,6 +376,18 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
if (iint->measured_pcrs & (0x1 << pcr) && !modsig)
return;
+ /*
+ * If digest cache usage was authorized with the IMA policy, the digest
+ * list the digest cache was populated from was measured, and the file
+ * digest was found in the digest cache, mark the file as successfully
+ * measured.
+ */
+ if (allowed_usage & IMA_DIGEST_CACHE_MEASURE_DATA) {
+ iint->flags |= IMA_MEASURED;
+ iint->measured_pcrs |= (0x1 << pcr);
+ return;
+ }
+
result = ima_alloc_init_template(&event_data, &entry, template_desc);
if (result < 0) {
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 97ece2abb0b9..3b34bfa5c891 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -225,7 +225,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
bool violation_check;
enum hash_algo hash_algo;
unsigned int allowed_algos = 0;
- u64 policy_usage = 0ULL;
+ u64 policy_usage = 0ULL, verified_usage = 0ULL;
if (!ima_policy_flag || !S_ISREG(inode->i_mode))
return 0;
@@ -385,10 +385,14 @@ static int process_measurement(struct file *file, const struct cred *cred,
if (!pathbuf) /* ima_rdwr_violation possibly pre-fetched */
pathname = ima_d_path(&file->f_path, &pathbuf, filename);
+ verified_usage = ima_digest_cache_load_verified_usage(file_dentry(file),
+ iint);
+
if (action & IMA_MEASURE)
ima_store_measurement(iint, file, pathname,
xattr_value, xattr_len, modsig, pcr,
- template_desc);
+ template_desc,
+ (policy_usage & verified_usage));
if (rc == 0 && (action & IMA_APPRAISE_SUBMASK)) {
rc = ima_check_blacklist(iint, modsig, pcr);
if (rc != -EPERM) {
--
2.34.1