lkml.org 
[lkml]   [2024]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[RFC][PATCH 6/8] ima: Use digest cache for measurement
    Date
    From: Roberto Sassu <roberto.sassu@huawei.com>

    Introduce a new measurement style using digest caches, which can be
    performed exclusively on non-standard PCRs, to avoid ambiguity.

    While a measurement on the standard PCR means that a file was accessed and
    had the measured content, a measurement with the digest cache means only
    that the calculated file digest was not found in any of the measured digest
    lists (any digest list used for the search must be measured, otherwise IMA
    wouldn't use it).

    The new measurement style does not tell: whether or not the file was
    actually accessed (since its measurement is skipped even if it was); in
    which sequence files were accessed. So, one has to guess that the system
    might have possibly accessed any of the files whose digest is in the
    measured digest lists, in any order.

    However, it has the following benefits: the IMA measurement list can be
    much shorter, system performance can be much better due to less PCR extend
    operations (see the performance evaluation in the digest_cache LSM
    documentation); the PCR can be predictable as long as the set of measured
    digest lists does not change (which obviously happens during software
    updates).

    The PCR can be predictable because the digest_cache LSM has a prefetching
    mechanism that reads digest lists in a deterministic order, until it
    finds the digest list containing the digest calculated by IMA from an
    accessed file. If IMA measures digest lists, the PCR is extended in a
    deterministic order too.

    Predictable PCR means that a TPM key can be made dependent on specific PCR
    values (or a OR of them, depending on the key policy). Accessing a file
    with an unknown digest immediately makes that TPM key unusable, requiring a
    reboot to use it again.

    This mechanism can be used for the so called implicit remote attestation,
    where the ability of a system to respond to challenges based on the private
    part of the TPM key means that the system has the expected PCR values
    (which would mean that the integrity of the system is ok). This is opposed
    to the explicit remote attestation, where a system has to send all its
    measurements, to prove to a remote party about its integrity.

    If the IMA policy allows the usage of the digest cache for the current file
    access (except for DIGEST_LIST_CHECK hook, not supported), call
    digest_cache_get() in process_measurement() to get a digest cache for that
    file, and call digest_cache_lookup() to search the calculated file digest.

    Doing the lookup is necessary to retrieve the digest cache containing the
    digest, since digest_cache_get() might only return a directory digest
    cache, useful only to iterate over the digest caches of the directory
    entries.

    If digest_cache_lookup() returns a positive value (digest cache reference
    in the digest_cache_found_t form), call digest_cache_from_found_t() to get
    an usable digest cache pointer, and digest_cache_verif_get() to get
    the verification result of the corresponding digest list, and AND it with
    the policy mask.

    Then, pass the AND result to ima_store_measurement() and, if the result has
    the IMA_DIGEST_CACHE_MEASURE_CONTENT flag set, behave as if the file was
    successfully added to the IMA measurement list (i.e. set the IMA_MEASURED
    flag and the PCR flag from the value specified in the matching policy
    rule), but actually don't do it.

    Finally, release the digest cache reference acquired with
    digest_cache_get(), by calling digest_cache_put().

    Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    ---
    security/integrity/ima/ima.h | 3 ++-
    security/integrity/ima/ima_api.c | 15 ++++++++++++++-
    security/integrity/ima/ima_main.c | 32 ++++++++++++++++++++++++++++---
    3 files changed, 45 insertions(+), 5 deletions(-)

    diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
    index 2dbcaf0a9402..cf04f5a22234 100644
    --- a/security/integrity/ima/ima.h
    +++ b/security/integrity/ima/ima.h
    @@ -382,7 +382,8 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
    const unsigned char *filename,
    struct evm_ima_xattr_data *xattr_value,
    int xattr_len, const struct modsig *modsig, int pcr,
    - struct ima_template_desc *template_desc);
    + struct ima_template_desc *template_desc,
    + u64 digest_cache_mask);
    int process_buffer_measurement(struct mnt_idmap *idmap,
    struct inode *inode, const void *buf, int size,
    const char *eventname, enum ima_hooks func,
    diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
    index 87e286ace43c..b216f86c983d 100644
    --- a/security/integrity/ima/ima_api.c
    +++ b/security/integrity/ima/ima_api.c
    @@ -345,7 +345,8 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
    const unsigned char *filename,
    struct evm_ima_xattr_data *xattr_value,
    int xattr_len, const struct modsig *modsig, int pcr,
    - struct ima_template_desc *template_desc)
    + struct ima_template_desc *template_desc,
    + u64 digest_cache_mask)
    {
    static const char op[] = "add_template_measure";
    static const char audit_cause[] = "ENOMEM";
    @@ -369,6 +370,18 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
    if (iint->measured_pcrs & (0x1 << pcr) && !modsig)
    return;

    + /*
    + * If digest cache usage was authorized with the IMA policy, the digest
    + * list the digest cache was populated from was measured, and the file
    + * digest was found in the digest cache, mark the file as successfully
    + * measured.
    + */
    + if (digest_cache_mask & IMA_DIGEST_CACHE_MEASURE_CONTENT) {
    + iint->flags |= IMA_MEASURED;
    + iint->measured_pcrs |= (0x1 << pcr);
    + return;
    + }
    +
    result = ima_alloc_init_template(&event_data, &entry, template_desc);
    if (result < 0) {
    integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
    diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
    index 3fc48214850a..48a09747ae7a 100644
    --- a/security/integrity/ima/ima_main.c
    +++ b/security/integrity/ima/ima_main.c
    @@ -222,7 +222,9 @@ static int process_measurement(struct file *file, const struct cred *cred,
    bool violation_check;
    enum hash_algo hash_algo;
    unsigned int allowed_algos = 0;
    - u64 verif_mask = 0;
    + u64 verif_mask = 0, *verif_mask_ptr, policy_mask = 0, allow_mask = 0;
    + struct digest_cache *digest_cache = NULL, *found_cache;
    + digest_cache_found_t found;

    if (!ima_policy_flag || !S_ISREG(inode->i_mode))
    return 0;
    @@ -233,7 +235,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
    */
    action = ima_get_action(file_mnt_idmap(file), inode, cred, secid,
    mask, func, &pcr, &template_desc, NULL,
    - &allowed_algos, NULL);
    + &allowed_algos, &policy_mask);
    violation_check = ((func == FILE_CHECK || func == MMAP_CHECK ||
    func == MMAP_CHECK_REQPROT) &&
    (ima_policy_flag & IMA_MEASURE));
    @@ -364,10 +366,34 @@ static int process_measurement(struct file *file, const struct cred *cred,
    if (!pathbuf) /* ima_rdwr_violation possibly pre-fetched */
    pathname = ima_d_path(&file->f_path, &pathbuf, filename);

    + /*
    + * For now we don't support nested verification with digest caches.
    + * Since we allow IMA policy rules without func=, we have to enforce
    + * this restriction here.
    + */
    + if (rc == 0 && policy_mask && func != DIGEST_LIST_CHECK)
    + digest_cache = digest_cache_get(file_dentry(file));
    +
    + if (digest_cache) {
    + found = digest_cache_lookup(file_dentry(file), digest_cache,
    + iint->ima_hash->digest,
    + iint->ima_hash->algo);
    + /* AND what is allowed by the policy, and what IMA verified. */
    + if (found) {
    + found_cache = digest_cache_from_found_t(found);
    + verif_mask_ptr = digest_cache_verif_get(found_cache,
    + "ima");
    + if (verif_mask_ptr)
    + allow_mask = policy_mask & *verif_mask_ptr;
    + }
    +
    + digest_cache_put(digest_cache);
    + }
    +
    if (action & IMA_MEASURE)
    ima_store_measurement(iint, file, pathname,
    xattr_value, xattr_len, modsig, pcr,
    - template_desc);
    + template_desc, allow_mask);
    if (rc == 0 && (action & IMA_APPRAISE_SUBMASK)) {
    rc = ima_check_blacklist(iint, modsig, pcr);
    if (rc != -EPERM) {
    --
    2.34.1

    \
     
     \ /
      Last update: 2024-05-27 15:02    [W:6.796 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site