Commit c7d09367 authored by Mimi Zohar's avatar Mimi Zohar Committed by Linus Torvalds

ima: support restoring multiple template formats

The configured IMA measurement list template format can be replaced at
runtime on the boot command line, including a custom template format.
This patch adds support for restoring a measuremement list containing
multiple builtin/custom template formats.

Link: http://lkml.kernel.org/r/1480554346-29071-9-git-send-email-zohar@linux.vnet.ibm.comSigned-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: default avatarDmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andreas Steffen <andreas.steffen@strongswan.org>
Cc: Josh Sklar <sklar@linux.vnet.ibm.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Stewart Smith <stewart@linux.vnet.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 3f23d624
...@@ -155,9 +155,14 @@ static int template_desc_init_fields(const char *template_fmt, ...@@ -155,9 +155,14 @@ static int template_desc_init_fields(const char *template_fmt,
{ {
const char *template_fmt_ptr; const char *template_fmt_ptr;
struct ima_template_field *found_fields[IMA_TEMPLATE_NUM_FIELDS_MAX]; struct ima_template_field *found_fields[IMA_TEMPLATE_NUM_FIELDS_MAX];
int template_num_fields = template_fmt_size(template_fmt); int template_num_fields;
int i, len; int i, len;
if (num_fields && *num_fields > 0) /* already initialized? */
return 0;
template_num_fields = template_fmt_size(template_fmt);
if (template_num_fields > IMA_TEMPLATE_NUM_FIELDS_MAX) { if (template_num_fields > IMA_TEMPLATE_NUM_FIELDS_MAX) {
pr_err("format string '%s' contains too many fields\n", pr_err("format string '%s' contains too many fields\n",
template_fmt); template_fmt);
...@@ -236,6 +241,34 @@ int __init ima_init_template(void) ...@@ -236,6 +241,34 @@ int __init ima_init_template(void)
return result; return result;
} }
static struct ima_template_desc *restore_template_fmt(char *template_name)
{
struct ima_template_desc *template_desc = NULL;
int ret;
ret = template_desc_init_fields(template_name, NULL, NULL);
if (ret < 0) {
pr_err("attempting to initialize the template \"%s\" failed\n",
template_name);
goto out;
}
template_desc = kzalloc(sizeof(*template_desc), GFP_KERNEL);
if (!template_desc)
goto out;
template_desc->name = "";
template_desc->fmt = kstrdup(template_name, GFP_KERNEL);
if (!template_desc->fmt)
goto out;
spin_lock(&template_list);
list_add_tail_rcu(&template_desc->list, &defined_templates);
spin_unlock(&template_list);
out:
return template_desc;
}
static int ima_restore_template_data(struct ima_template_desc *template_desc, static int ima_restore_template_data(struct ima_template_desc *template_desc,
void *template_data, void *template_data,
int template_data_size, int template_data_size,
...@@ -373,10 +406,23 @@ int ima_restore_measurement_list(loff_t size, void *buf) ...@@ -373,10 +406,23 @@ int ima_restore_measurement_list(loff_t size, void *buf)
break; break;
} }
/* get template format */
template_desc = lookup_template_desc(template_name); template_desc = lookup_template_desc(template_name);
if (!template_desc) { if (!template_desc) {
pr_err("template \"%s\" not found\n", template_name); template_desc = restore_template_fmt(template_name);
if (!template_desc)
break;
}
/*
* Only the running system's template format is initialized
* on boot. As needed, initialize the other template formats.
*/
ret = template_desc_init_fields(template_desc->fmt,
&(template_desc->fields),
&(template_desc->num_fields));
if (ret < 0) {
pr_err("attempting to restore the template fmt \"%s\" \
failed\n", template_desc->fmt);
ret = -EINVAL; ret = -EINVAL;
break; break;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment