• Prakhar Srivastava's avatar
    IMA: Define a new template field buf · 86b4da8c
    Prakhar Srivastava authored
    A buffer(kexec boot command line arguments) measured into IMA
    measuremnt list cannot be appraised, without already being
    aware of the buffer contents. Since hashes are non-reversible,
    raw buffer is needed for validation or regenerating hash for
    appraisal/attestation.
    
    Add support to store/read the buffer contents in HEX.
    The kexec cmdline hash is stored in the "d-ng" field of the
    template data.  It can be verified using
    sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements |
      grep  kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum
    
    - Add two new fields to ima_event_data to hold the buf and
    buf_len
    - Add a new template field 'buf' to be used to store/read
    the buffer data.
    - Updated process_buffer_meaurement to add the buffer to
    ima_event_data. process_buffer_measurement added in
    "Define a new IMA hook to measure the boot command line
     arguments"
    - Add a new template policy name ima-buf to represent
    'd-ng|n-ng|buf'
    Signed-off-by: default avatarPrakhar Srivastava <prsriva02@gmail.com>
    Reviewed-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
    Reviewed-by: default avatarJames Morris <jamorris@linux.microsoft.com>
    Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    86b4da8c
IMA-templates.rst 4.46 KB