[PATCH v3 2/5] IMA: Define an IMA hook to measure LSM data
From: Lakshmi Ramasubramanian <hidden>
Date: 2020-07-17 22:28:32
Also in:
linux-integrity, lkml, selinux
Subsystem:
extended verification module (evm), integrity measurement architecture (ima), security subsystem, the rest · Maintainers:
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
IMA subsystem needs to define an IMA hook that the security modules can call to measure critical data of the security modules. Define a new IMA hook, namely ima_lsm_state(), that the security modules can call to measure data. Signed-off-by: Lakshmi Ramasubramanian <redacted> --- include/linux/ima.h | 4 ++++ security/integrity/ima/ima_main.c | 17 +++++++++++++++++ 2 files changed, 21 insertions(+)
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 9164e1534ec9..7e2686f4953a 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h@@ -26,6 +26,7 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size, extern void ima_post_path_mknod(struct dentry *dentry); extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); extern void ima_kexec_cmdline(const void *buf, int size); +extern void ima_lsm_state(const char *lsm_event_name, const void *buf, int size); #ifdef CONFIG_IMA_KEXEC extern void ima_add_kexec_buffer(struct kimage *image);
@@ -104,6 +105,9 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) } static inline void ima_kexec_cmdline(const void *buf, int size) {} + +static inline void ima_lsm_state(const char *lsm_event_name, + const void *buf, int size) {} #endif /* CONFIG_IMA */ #ifndef CONFIG_IMA_KEXEC
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 8351b2fd48e0..04d9a1d35300 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c@@ -835,6 +835,23 @@ void ima_kexec_cmdline(const void *buf, int size) KEXEC_CMDLINE, 0, NULL); } +/** + * ima_lsm_state - measure LSM specific state + * @lsm_event_name: LSM event + * @buf: pointer to buffer containing LSM specific state + * @size: Number of bytes in buf + * + * Buffers can only be measured, not appraised. + */ +void ima_lsm_state(const char *lsm_event_name, const void *buf, int size) +{ + if (!lsm_event_name || !buf || !size) + return; + + process_buffer_measurement(buf, size, lsm_event_name, + LSM_STATE, 0, NULL); +} + static int __init init_ima(void) { int error;
--
2.27.0