[PATCH v7 08/14] ima: Implement hierarchical processing of file accesses
STALE1736d
From: Stefan Berger <hidden>
Date: 2021-12-16 05:44:01
Also in:
linux-integrity, lkml
Subsystem:
extended verification module (evm), integrity measurement architecture (ima), security subsystem, the rest · Maintainers:
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Revision v7 of 3 in this series.
Revisions (3)
- v7 current
- v8 [diff vs current]
- v9 [diff vs current]
From: Stefan Berger <stefanb@linux.ibm.com> Implement hierarchical processing of file accesses in IMA namespaces by walking the list of IMA namespaces towards the init_ima_ns. This way file accesses can be audited in an IMA namespace and also be evaluated against the IMA policies of parent IMA namespaces. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> --- include/linux/ima.h | 9 +++++++++ security/integrity/ima/ima_main.c | 30 ++++++++++++++++++++++++++---- 2 files changed, 35 insertions(+), 4 deletions(-)
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 61461ee5b208..f9e592bb9560 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h@@ -66,6 +66,15 @@ static inline const char * const *arch_get_ima_policy(void) } #endif +static inline struct user_namespace *ima_user_ns(struct ima_namespace *ns) +{ + struct user_namespace *user_ns; + + user_ns = current_user_ns(); + WARN_ON(user_ns->ima_ns != ns); + return user_ns; +} + #else static inline enum hash_algo ima_get_current_hash_algo(void) {
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 98be891c2621..4c85a8df3c86 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c@@ -200,10 +200,10 @@ void ima_file_free(struct file *file) ima_check_last_writer(iint, inode, file); } -static int process_measurement(struct ima_namespace *ns, - struct file *file, const struct cred *cred, - u32 secid, char *buf, loff_t size, int mask, - enum ima_hooks func) +static int __process_measurement(struct ima_namespace *ns, + struct file *file, const struct cred *cred, + u32 secid, char *buf, loff_t size, int mask, + enum ima_hooks func) { struct inode *inode = file_inode(file); struct integrity_iint_cache *iint = NULL;
@@ -405,6 +405,28 @@ static int process_measurement(struct ima_namespace *ns, return 0; } +static int process_measurement(struct ima_namespace *ns, + struct file *file, const struct cred *cred, + u32 secid, char *buf, loff_t size, int mask, + enum ima_hooks func) +{ + struct user_namespace *user_ns = ima_user_ns(ns); + int ret = 0; + + while (user_ns) { + ns = user_ns->ima_ns; + + ret = __process_measurement(ns, file, cred, secid, buf, size, + mask, func); + if (ret) + break; + + user_ns = user_ns->parent; + }; + + return ret; +} + /** * ima_file_mmap - based on policy, collect/store measurement. * @file: pointer to the file to be measured (May be NULL)
--
2.31.1