1. 25 Oct, 2013 19 commits
    • Roberto Sassu's avatar
      ima: switch to new template management mechanism · a71dc65d
      Roberto Sassu authored
      This patch performs the switch to the new template mechanism by modifying
      the functions ima_alloc_init_template(), ima_measurements_show() and
      ima_ascii_measurements_show(). The old function ima_template_show() was
      removed as it is no longer needed. Also, if the template descriptor used
      to generate a measurement entry is not 'ima', the whole length of field
      data stored for an entry is provided before the data itself through the
      binary_runtime_measurement interface.
      
      Changelog:
      - unnecessary to use strncmp() (Mimi Zohar)
      - create new variable 'field' in ima_alloc_init_template() (Roberto Sassu)
      - use GFP_NOFS flag in ima_alloc_init_template() (Roberto Sassu)
      - new variable 'num_fields' in ima_store_template() (Roberto Sassu,
        proposed by Mimi Zohar)
      - rename ima_calc_buffer_hash/template_hash() to ima_calc_field_array_hash(),
        something more generic (Mimi, requested by Dmitry)
      - sparse error fix - Fengguang Wu
      - fix lindent warnings
      - always include the field length in the template data length
      - include the template field length variable size in the template data length
      - include both the template field data and field length in the template digest
        calculation. Simplifies verifying the template digest. (Mimi)
      Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      a71dc65d
    • Roberto Sassu's avatar
      ima: define new template ima-ng and template fields d-ng and n-ng · 4d7aeee7
      Roberto Sassu authored
      This patch adds support for the new template 'ima-ng', whose format
      is defined as 'd-ng|n-ng'.  These new field definitions remove the
      size limitations of the original 'ima' template.  Further, the 'd-ng'
      field prefixes the inode digest with the hash algorithim, when
      displaying the new larger digest sizes.
      
      Change log:
      - scripts/Lindent fixes  - Mimi
      - "always true comparison" - reported by Fengguang Wu, resolved Dmitry
      - initialize hash_algo variable to HASH_ALGO__LAST
      - always prefix digest with hash algorithm - Mimi
      Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      4d7aeee7
    • Roberto Sassu's avatar
      ima: define template fields library and new helpers · 3ce1217d
      Roberto Sassu authored
      This patch defines a library containing two initial template fields,
      inode digest (d) and file name (n), the 'ima' template descriptor,
      whose format is 'd|n', and two helper functions,
      ima_write_template_field_data() and ima_show_template_field_data().
      
      Changelog:
      - replace ima_eventname_init() parameter NULL checking with BUG_ON.
        (suggested by Mimi)
      - include "new template fields for inode digest (d) and file name (n)"
        definitions to fix a compiler warning.  - Mimi
      - unnecessary to prefix static function names with 'ima_'. remove
        prefix to resolve Lindent formatting changes. - Mimi
      - abbreviated/removed inline comments - Mimi
      - always send the template field length - Mimi
      Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      3ce1217d
    • Roberto Sassu's avatar
      ima: new templates management mechanism · adf53a77
      Roberto Sassu authored
      The original 'ima' template is fixed length, containing the filedata hash
      and pathname.  The filedata hash is limited to 20 bytes (md5/sha1).  The
      pathname is a null terminated string, limited to 255 characters.  To
      overcome these limitations and to add additional file metadata, it is
      necessary to extend the current version of IMA by defining additional
      templates.
      
      The main reason to introduce this feature is that, each time a new
      template is defined, the functions that generate and display the
      measurement list would include the code for handling a new format and,
      thus, would significantly grow over time.
      
      This patch set solves this problem by separating the template management
      from the remaining IMA code. The core of this solution is the definition
      of two new data structures: a template descriptor, to determine which
      information should be included in the measurement list, and a template
      field, to generate and display data of a given type.
      
      To define a new template field, developers define the field identifier
      and implement two functions, init() and show(), respectively to generate
      and display measurement entries.  Initially, this patch set defines the
      following template fields (support for additional data types will be
      added later):
       - 'd': the digest of the event (i.e. the digest of a measured file),
              calculated with the SHA1 or MD5 hash algorithm;
       - 'n': the name of the event (i.e. the file name), with size up to
              255 bytes;
       - 'd-ng': the digest of the event, calculated with an arbitrary hash
                 algorithm (field format: [<hash algo>:]digest, where the digest
                 prefix is shown only if the hash algorithm is not SHA1 or MD5);
       - 'n-ng': the name of the event, without size limitations.
      
      Defining a new template descriptor requires specifying the template format,
      a string of field identifiers separated by the '|' character.  This patch
      set defines the following template descriptors:
       - "ima": its format is 'd|n';
       - "ima-ng" (default): its format is 'd-ng|n-ng'
      
      Further details about the new template architecture can be found in
      Documentation/security/IMA-templates.txt.
      
      Changelog:
      - don't defer calling ima_init_template() - Mimi
      - don't define ima_lookup_template_desc() until used - Mimi
      - squashed with documentation patch - Mimi
      Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      adf53a77
    • Roberto Sassu's avatar
      ima: define new function ima_alloc_init_template() to API · 7bc5f447
      Roberto Sassu authored
      Instead of allocating and initializing the template entry from multiple
      places (eg. boot aggregate, violation, and regular measurements), this
      patch defines a new function called ima_alloc_init_template().  The new
      function allocates and initializes the measurement entry with the inode
      digest and the filename.
      
      In respect to the current behavior, it truncates the file name passed
      in the 'filename' argument if the latter's size is greater than 255 bytes
      and the passed file descriptor is NULL.
      
      Changelog:
      - initialize 'hash' variable for non TPM case - Mimi
      - conform to expectation for 'iint' to be defined as a pointer. - Mimi
      - add missing 'file' dependency for recalculating file hash. - Mimi
      Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      7bc5f447
    • Roberto Sassu's avatar
      ima: pass the filename argument up to ima_add_template_entry() · 9803d413
      Roberto Sassu authored
      Pass the filename argument to ima_add_template_entry() in order to
      eliminate a dependency on template specific data (third argument of
      integrity_audit_msg).
      
      This change is required because, with the new template management
      mechanism, the generation of a new measurement entry will be performed
      by new specific functions (introduced in next patches) and the current IMA
      code will not be aware anymore of how data is stored in the entry payload.
      Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      9803d413
    • Roberto Sassu's avatar
      ima: pass the file descriptor to ima_add_violation() · 7d802a22
      Roberto Sassu authored
      Pass the file descriptor instead of the inode to ima_add_violation(),
      to make the latter consistent with ima_store_measurement() in
      preparation for the new template architecture.
      Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      7d802a22
    • Dmitry Kasatkin's avatar
      ima: ima_calc_boot_agregate must use SHA1 · 09ef5435
      Dmitry Kasatkin authored
      With multiple hash algorithms, ima_hash_tfm is no longer guaranteed to be sha1.
      Need to force to use sha1.
      
      Changelog:
      - pass ima_digest_data to ima_calc_boot_aggregate() instead of char *
        (Roberto Sassu);
      - create an ima_digest_data structure in ima_add_boot_aggregate()
        (Roberto Sassu);
      - pass hash->algo to ima_alloc_tfm() (Roberto Sassu, reported by Dmitry).
      - "move hash definition in ima_add_boot_aggregate()" commit hunk to here.
      - sparse warning fix - Fengguang Wu
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      09ef5435
    • Dmitry Kasatkin's avatar
      ima: support arbitrary hash algorithms in ima_calc_buffer_hash · ea593993
      Dmitry Kasatkin authored
      ima_calc_buffer_hash will be used with different hash algorithms.
      This patch provides support for arbitrary hash algorithms in
      ima_calc_buffer_hash.
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      ea593993
    • Dmitry Kasatkin's avatar
      ima: provide dedicated hash algo allocation function · 723326b9
      Dmitry Kasatkin authored
      This patch provides dedicated hash algo allocation and
      deallocation function which can be used by different clients.
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      723326b9
    • Mimi Zohar's avatar
      ima: differentiate between template hash and file data hash sizes · 140d8022
      Mimi Zohar authored
      The TPM v1.2 limits the template hash size to 20 bytes.  This
      patch differentiates between the template hash size, as defined
      in the ima_template_entry, and the file data hash size, as
      defined in the ima_template_data.  Subsequent patches add support
      for different file data hash algorithms.
      
      Change log:
      - hash digest definition in ima_store_template() should be TPM_DIGEST_SIZE
      Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
      140d8022
    • Dmitry Kasatkin's avatar
      ima: use dynamically allocated hash storage · a35c3fb6
      Dmitry Kasatkin authored
      For each inode in the IMA policy, an iint is allocated.  To support
      larger hash digests, the iint digest size changed from 20 bytes to
      the maximum supported hash digest size.  Instead of allocating the
      maximum size, which most likely is not needed, this patch dynamically
      allocates the needed hash storage.
      
      Changelog:
      - fix krealloc bug
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      a35c3fb6
    • Dmitry Kasatkin's avatar
      ima: pass full xattr with the signature · b1aaab22
      Dmitry Kasatkin authored
      For possibility to use xattr type for new signature formats,
      pass full xattr to the signature verification function.
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      b1aaab22
    • Dmitry Kasatkin's avatar
      ima: read and use signature hash algorithm · d3634d0f
      Dmitry Kasatkin authored
      All files on the filesystem, currently, are hashed using the same hash
      algorithm.  In preparation for files from different packages being
      signed using different hash algorithms, this patch adds support for
      reading the signature hash algorithm from the 'security.ima' extended
      attribute and calculates the appropriate file data hash based on it.
      
      Changelog:
      - fix scripts Lindent and checkpatch msgs - Mimi
      - fix md5 support for older version, which occupied 20 bytes in the
        xattr, not the expected 16 bytes.  Fix the comparison to compare
        only the first 16 bytes.
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      d3634d0f
    • Dmitry Kasatkin's avatar
      ima: provide support for arbitrary hash algorithms · c7c8bb23
      Dmitry Kasatkin authored
      In preparation of supporting more hash algorithms with larger hash sizes
      needed for signature verification, this patch replaces the 20 byte sized
      digest, with a more flexible structure.  The new structure includes the
      hash algorithm, digest size, and digest.
      
      Changelog:
      - recalculate filedata hash for the measurement list, if the signature
        hash digest size is greater than 20 bytes.
      - use generic HASH_ALGO_
      - make ima_calc_file_hash static
      - scripts lindent and checkpatch fixes
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      c7c8bb23
    • Dmitry Kasatkin's avatar
      keys: change asymmetric keys to use common hash definitions · 3fe78ca2
      Dmitry Kasatkin authored
      This patch makes use of the newly defined common hash algorithm info,
      replacing, for example, PKEY_HASH with HASH_ALGO.
      
      Changelog:
      - Lindent fixes - Mimi
      
      CC: David Howells <dhowells@redhat.com>
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      3fe78ca2
    • Dmitry Kasatkin's avatar
      crypto: provide single place for hash algo information · ee08997f
      Dmitry Kasatkin authored
      This patch provides a single place for information about hash algorithms,
      such as hash sizes and kernel driver names, which will be used by IMA
      and the public key code.
      
      Changelog:
      - Fix sparse and checkpatch warnings
      - Move hash algo enums to uapi for userspace signing functions.
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      ee08997f
    • Mimi Zohar's avatar
      Revert "ima: policy for RAMFS" · 08de59eb
      Mimi Zohar authored
      This reverts commit 4c2c3927.
      
      Everything in the initramfs should be measured and appraised,
      but until the initramfs has extended attribute support, at
      least measured.
      Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
      Cc: Stable Kernel <stable@kernel.org>
      08de59eb
    • Dmitry Kasatkin's avatar
      ima: fix script messages · 089bc8e9
      Dmitry Kasatkin authored
      Fix checkpatch, lindent, etc, warnings/errors
      Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
      089bc8e9
  2. 22 Oct, 2013 16 commits
  3. 26 Sep, 2013 2 commits
    • Paul Moore's avatar
      selinux: correct locking in selinux_netlbl_socket_connect) · 42d64e1a
      Paul Moore authored
      The SELinux/NetLabel glue code has a locking bug that affects systems
      with NetLabel enabled, see the kernel error message below.  This patch
      corrects this problem by converting the bottom half socket lock to a
      more conventional, and correct for this call-path, lock_sock() call.
      
       ===============================
       [ INFO: suspicious RCU usage. ]
       3.11.0-rc3+ #19 Not tainted
       -------------------------------
       net/ipv4/cipso_ipv4.c:1928 suspicious rcu_dereference_protected() usage!
      
       other info that might help us debug this:
      
       rcu_scheduler_active = 1, debug_locks = 0
       2 locks held by ping/731:
        #0:  (slock-AF_INET/1){+.-...}, at: [...] selinux_netlbl_socket_connect
        #1:  (rcu_read_lock){.+.+..}, at: [<...>] netlbl_conn_setattr
      
       stack backtrace:
       CPU: 1 PID: 731 Comm: ping Not tainted 3.11.0-rc3+ #19
       Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
        0000000000000001 ffff88006f659d28 ffffffff81726b6a ffff88003732c500
        ffff88006f659d58 ffffffff810e4457 ffff88006b845a00 0000000000000000
        000000000000000c ffff880075aa2f50 ffff88006f659d90 ffffffff8169bec7
       Call Trace:
        [<ffffffff81726b6a>] dump_stack+0x54/0x74
        [<ffffffff810e4457>] lockdep_rcu_suspicious+0xe7/0x120
        [<ffffffff8169bec7>] cipso_v4_sock_setattr+0x187/0x1a0
        [<ffffffff8170f317>] netlbl_conn_setattr+0x187/0x190
        [<ffffffff8170f195>] ? netlbl_conn_setattr+0x5/0x190
        [<ffffffff8131ac9e>] selinux_netlbl_socket_connect+0xae/0xc0
        [<ffffffff81303025>] selinux_socket_connect+0x135/0x170
        [<ffffffff8119d127>] ? might_fault+0x57/0xb0
        [<ffffffff812fb146>] security_socket_connect+0x16/0x20
        [<ffffffff815d3ad3>] SYSC_connect+0x73/0x130
        [<ffffffff81739a85>] ? sysret_check+0x22/0x5d
        [<ffffffff810e5e2d>] ? trace_hardirqs_on_caller+0xfd/0x1c0
        [<ffffffff81373d4e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
        [<ffffffff815d52be>] SyS_connect+0xe/0x10
        [<ffffffff81739a59>] system_call_fastpath+0x16/0x1b
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
      42d64e1a
    • Duan Jiong's avatar
      7d1db4b2
  4. 25 Sep, 2013 3 commits