Skip to content

cloud-kernel
cloud-kernel

openanolis / cloud-kernel
1 年多 前同步成功

通知 160
Star 36
Fork 7
cloud-kernel
cloud-kernel
切换分支/标签
  1. 22 6月, 2017 10 次提交
    • R
      ima: use ima_parse_buf() to parse measurements headers · 47fdee60
      由 Roberto Sassu 提交于 
      The binary_hdr_v1 and binary_data_v1 structures defined in
ima_restore_measurement_list() have been replaced with an array of four
ima_field_data structures where pcr, digest, template name and
template data lengths and pointers are stored.

The length of pcr and digest in the ima_field_data array and the bits
in the bitmap are set before ima_parse_buf() is called. The ENFORCE_FIELDS
bit is set for all entries except the last one (there is still data to
parse), and ENFORCE_BUFEND is set only for the last entry.
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      47fdee60
    • R
      ima: introduce ima_parse_buf() · b17fd9ec
      由 Roberto Sassu 提交于 
      ima_parse_buf() takes as input the buffer start and end pointers, and
stores the result in a static array of ima_field_data structures,
where the len field contains the length parsed from the buffer, and
the data field contains the address of the buffer just after the length.
Optionally, the function returns the current value of the buffer pointer
and the number of array elements written.

A bitmap has been added as parameter of ima_parse_buf() to handle
the cases where the length is not prepended to data. Each bit corresponds
to an element of the ima_field_data array. If a bit is set, the length
is not parsed from the buffer, but is read from the corresponding element
of the array (the length must be set before calling the function).

ima_parse_buf() can perform three checks upon request by callers,
depending on the enforce mask passed to it:

- ENFORCE_FIELDS: matching of number of fields (length-data combination)
  - there must be enough data in the buffer to parse the number of fields
    requested (output: current value of buffer pointer)
- ENFORCE_BUFEND: matching of buffer end
  - the ima_field_data array must be large enough to contain lengths and
    data pointers for the amount of data requested (output: number
    of fields written)
- ENFORCE_FIELDS | ENFORCE_BUFEND: matching of both

Use cases

- measurement entry header: ENFORCE_FIELDS | ENFORCE_BUFEND
  - four fields must be parsed: pcr, digest, template name, template data
  - ENFORCE_BUFEND is enforced only for the last measurement entry
- template digest (Crypto Agile): ENFORCE_BUFEND
  - since only the total template digest length is known, the function
    parses length-data combinations until the buffer end is reached
- template data: ENFORCE_FIELDS | ENFORCE_BUFEND
  - since the number of fields and the total template data length
    are known, the function can perform both checks
Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      b17fd9ec
    • L
      ima: Add cgroups2 to the defaults list · 82e3bb4d
      由 Laura Abbott 提交于 
      cgroups2 is beginning to show up in wider usage. Add it to the default
nomeasure/noappraise list like other filesystems.
Signed-off-by: NLaura Abbott <labbott@redhat.com>
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      82e3bb4d
    • G
      ima: use memdup_user_nul · b4e28030
      由 Geliang Tang 提交于 
      Use memdup_user_nul() helper instead of open-coding to simplify the
code.
Signed-off-by: NGeliang Tang <geliangtang@gmail.com>
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      b4e28030
    • T
      ima: fix up #endif comments · 5d659f28
      由 Tycho Andersen 提交于 
      While reading the code, I noticed that these #endif comments don't match
how they're actually nested. This patch fixes that.
Signed-off-by: NTycho Andersen <tycho@docker.com>
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      5d659f28
    • B
      IMA: Correct Kconfig dependencies for hash selection · 38d19268
      由 Ben Hutchings 提交于 
      IMA uses the hash algorithm too early to be able to use a module.
Require the selected hash algorithm to be built-in.
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      38d19268
    • M
      ima: define is_ima_appraise_enabled() · 6f6723e2
      由 Mimi Zohar 提交于 
      Only return enabled if in enforcing mode, not fix or log modes.
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>

Changes:
- Define is_ima_appraise_enabled() as a bool (Thiago Bauermann)
      6f6723e2
    • M
      ima: define Kconfig IMA_APPRAISE_BOOTPARAM option · e1f5e01f
      由 Mimi Zohar 提交于 
      Permit enabling the different "ima_appraise=" modes (eg. log, fix)
from the boot command line.
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      e1f5e01f
    • M
      ima: define a set of appraisal rules requiring file signatures · 503ceaef
      由 Mimi Zohar 提交于 
      The builtin "ima_appraise_tcb" policy should require file signatures for
at least a few of the hooks (eg. kernel modules, firmware, and the kexec
kernel image), but changing it would break the existing userspace/kernel
ABI.

This patch defines a new builtin policy named "secure_boot", which
can be specified on the "ima_policy=" boot command line, independently
or in conjunction with the "ima_appraise_tcb" policy, by specifing
ima_policy="appraise_tcb | secure_boot".  The new appraisal rules
requiring file signatures will be added prior to the "ima_appraise_tcb"
rules.
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>

Changelog:
- Reference secure boot in the new builtin policy name. (Thiago Bauermann)
      503ceaef
    • M
      ima: extend the "ima_policy" boot command line to support multiple policies · 33ce9549
      由 Mimi Zohar 提交于 
      Add support for providing multiple builtin policies on the "ima_policy="
boot command line.  Use "|" as the delimitor separating the policy names.
Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      33ce9549
  3. 21 6月, 2017 1 次提交
  5. 19 6月, 2017 2 次提交
  7. 14 6月, 2017 15 次提交
  9. 11 6月, 2017 12 次提交