IMA: Define a new template field buf
A buffer(kexec boot command line arguments) measured into IMA measuremnt list cannot be appraised, without already being aware of the buffer contents. Since hashes are non-reversible, raw buffer is needed for validation or regenerating hash for appraisal/attestation. Add support to store/read the buffer contents in HEX. The kexec cmdline hash is stored in the "d-ng" field of the template data. It can be verified using sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements | grep kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum - Add two new fields to ima_event_data to hold the buf and buf_len - Add a new template field 'buf' to be used to store/read the buffer data. - Updated process_buffer_meaurement to add the buffer to ima_event_data. process_buffer_measurement added in "Define a new IMA hook to measure the boot command line arguments" - Add a new template policy name ima-buf to represent 'd-ng|n-ng|buf' Signed-off-by:Prakhar Srivastava <prsriva02@gmail.com> Reviewed-by:
Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by:
James Morris <jamorris@linux.microsoft.com> Signed-off-by:
Mimi Zohar <zohar@linux.ibm.com>
Showing
- Documentation/security/IMA-templates.rst 4 additions, 3 deletionsDocumentation/security/IMA-templates.rst
- security/integrity/ima/ima.h 2 additions, 0 deletionssecurity/integrity/ima/ima.h
- security/integrity/ima/ima_main.c 3 additions, 1 deletionsecurity/integrity/ima/ima_main.c
- security/integrity/ima/ima_template.c 3 additions, 0 deletionssecurity/integrity/ima/ima_template.c
- security/integrity/ima/ima_template_lib.c 21 additions, 0 deletionssecurity/integrity/ima/ima_template_lib.c
- security/integrity/ima/ima_template_lib.h 4 additions, 0 deletionssecurity/integrity/ima/ima_template_lib.h
Loading
Please register or sign in to comment