This patch introduces two new files in the securityfs filesystem: digest_list_data, loads a digest list from the specified path, if it is in the compact format, or loads a digest list converted by the user space parser; digests_count: shows the number of digests stored in the ima_digests_htable hash table.
Signed-off-by: Roberto Sassu <[email protected]> --- include/linux/fs.h | 1 + security/integrity/ima/ima_fs.c | 44 ++++++++++++++++++++++++++++++++- 2 files changed, 44 insertions(+), 1 deletion(-) diff --git a/include/linux/fs.h b/include/linux/fs.h index f7fdfe93e25d..0591a3c3cc2f 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2921,6 +2921,7 @@ extern int do_pipe_flags(int *, int); id(KEXEC_INITRAMFS, kexec-initramfs) \ id(POLICY, security-policy) \ id(X509_CERTIFICATE, x509-certificate) \ + id(DIGEST_LIST, digest-list) \ id(MAX_ID, ) #define __fid_enumify(ENUM, dummy) READING_ ## ENUM, diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index 0f503b7cd396..b02b9a447d56 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -24,6 +24,7 @@ #include <linux/vmalloc.h> #include "ima.h" +#include "ima_digest_list.h" static DEFINE_MUTEX(ima_write_mutex); @@ -34,6 +35,8 @@ static struct dentry *ascii_runtime_measurements; static struct dentry *runtime_measurements_count; static struct dentry *violations; static struct dentry *ima_policy; +static struct dentry *digests_count; +static struct dentry *digest_list_data; bool ima_canonical_fmt; static int __init default_canonical_fmt_setup(char *str) @@ -58,6 +61,10 @@ static ssize_t ima_show_htable_value(struct file *filp, char __user *buf, val = &ima_htable.violations; else if (filp->f_path.dentry == runtime_measurements_count) val = &ima_htable.len; +#ifdef CONFIG_IMA_DIGEST_LIST + else if (filp->f_path.dentry == digests_count) + val = &ima_digests_htable.len; +#endif len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val)); return simple_read_from_buffer(buf, count, ppos, tmpbuf, len); @@ -296,6 +303,9 @@ static ssize_t ima_read_file(char *path, enum kernel_read_file_id file_id) pr_debug("rule: %s\n", p); rc = ima_parse_add_rule(p); break; + case READING_DIGEST_LIST: + rc = ima_parse_compact_list(size, data); + break; default: break; } @@ -319,6 +329,10 @@ static ssize_t ima_write_data(struct file *file, const char __user *buf, char *data; ssize_t result; struct dentry *dentry = file_dentry(file); + enum kernel_read_file_id id = READING_POLICY; + + if (dentry == digest_list_data) + id = READING_DIGEST_LIST; /* No partial writes. */ result = -EINVAL; @@ -345,7 +359,7 @@ static ssize_t ima_write_data(struct file *file, const char __user *buf, goto out_free; if (data[0] == '/') { - result = ima_read_file(data, READING_POLICY); + result = ima_read_file(data, id); } else if (dentry == ima_policy) { if (ima_appraise & IMA_APPRAISE_POLICY) { pr_err("signed policy file (specified as an absolute pathname) required\n"); @@ -357,6 +371,11 @@ static ssize_t ima_write_data(struct file *file, const char __user *buf, } else { result = ima_parse_add_rule(data); } + } else if (dentry == digest_list_data) { + if (ima_check_current_is_parser()) + result = ima_parse_compact_list(datalen, data); + else + result = -EACCES; } else { pr_err("Unknown data type\n"); result = -EINVAL; @@ -373,6 +392,7 @@ static ssize_t ima_write_data(struct file *file, const char __user *buf, enum ima_fs_flags { IMA_POLICY_BUSY, + IMA_DIGEST_LIST_DATA_BUSY, IMA_FS_BUSY, }; @@ -382,6 +402,8 @@ static enum ima_fs_flags ima_get_dentry_flag(struct dentry *dentry) if (dentry == ima_policy) flag = IMA_POLICY_BUSY; + else if (dentry == digest_list_data) + flag = IMA_DIGEST_LIST_DATA_BUSY; return flag; } @@ -412,6 +434,8 @@ static int ima_open_data_upload(struct inode *inode, struct file *filp) read_allowed = true; seq_ops = &ima_policy_seqops; #endif + } else if (dentry == digest_list_data) { + ima_set_parser(current); } if (!(filp->f_flags & O_WRONLY)) { @@ -444,6 +468,9 @@ static int ima_release_data_upload(struct inode *inode, struct file *file) if ((file->f_flags & O_ACCMODE) == O_RDONLY) return seq_release(inode, file); + if (dentry == digest_list_data) + ima_set_parser(NULL); + if (dentry != ima_policy) { clear_bit(flag, &ima_fs_flags); return 0; @@ -529,8 +556,23 @@ int __init ima_fs_init(void) if (IS_ERR(ima_policy)) goto out; +#ifdef CONFIG_IMA_DIGEST_LIST + digests_count = securityfs_create_file("digests_count", + S_IRUSR | S_IRGRP, ima_dir, + NULL, &ima_htable_value_ops); + if (IS_ERR(digests_count)) + goto out; + + digest_list_data = securityfs_create_file("digest_list_data", S_IWUSR, + ima_dir, NULL, + &ima_data_upload_ops); + if (IS_ERR(digest_list_data)) + goto out; +#endif return 0; out: + securityfs_remove(digest_list_data); + securityfs_remove(digests_count); securityfs_remove(violations); securityfs_remove(runtime_measurements_count); securityfs_remove(ascii_runtime_measurements); -- 2.17.1
