Messages in this thread Patch in this message | | | From | Roberto Sassu <> | Subject | [PATCH-v2 6/6] ima: use custom template obtained from a matched policy rule | Date | Tue, 19 Nov 2013 13:33:45 +0100 |
| |
This patch modifies existing IMA functions to retrieve the template descriptor from a matched policy rule and provide it to ima_alloc_init_template().
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> --- security/integrity/ima/ima.h | 5 +++-- security/integrity/ima/ima_api.c | 7 ++++--- security/integrity/ima/ima_main.c | 4 +++- security/integrity/ima/ima_policy.c | 5 ++++- 4 files changed, 14 insertions(+), 7 deletions(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index fc2fbf3..9df015c 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -133,7 +133,8 @@ static inline unsigned long ima_hash_key(u8 *digest) } /* LIM API function definitions */ -int ima_get_action(struct inode *inode, int mask, int function); +int ima_get_action(struct inode *inode, int mask, int function, + struct ima_template_desc **desc); int ima_must_measure(struct inode *inode, int mask, int function); int ima_collect_measurement(struct integrity_iint_cache *iint, struct file *file, @@ -165,7 +166,7 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode); enum ima_hooks { FILE_CHECK = 1, MMAP_CHECK, BPRM_CHECK, MODULE_CHECK, POST_SETATTR }; int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, - int flags); + int flags, struct ima_template_desc **desc); void ima_init_policy(void); void ima_update_policy(void); ssize_t ima_parse_add_rule(char *); diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index 444ec53..ebfd6cf 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -161,19 +161,20 @@ err_out: * Returns IMA_MEASURE, IMA_APPRAISE mask. * */ -int ima_get_action(struct inode *inode, int mask, int function) +int ima_get_action(struct inode *inode, int mask, int function, + struct ima_template_desc **desc) { int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE; if (!ima_appraise) flags &= ~IMA_APPRAISE; - return ima_match_policy(inode, function, mask, flags); + return ima_match_policy(inode, function, mask, flags, desc); } int ima_must_measure(struct inode *inode, int mask, int function) { - return ima_match_policy(inode, function, mask, IMA_MEASURE); + return ima_match_policy(inode, function, mask, IMA_MEASURE, NULL); } /* diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index e08ce72..44a1af1 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -167,6 +167,7 @@ static int process_measurement(struct file *file, const char *filename, struct inode *inode = file_inode(file); struct integrity_iint_cache *iint; struct ima_template_desc *template_desc = ima_template_desc_current(); + struct ima_template_desc *tmp_desc; char *pathbuf = NULL; const char *pathname = NULL; int rc = -ENOMEM, action, must_appraise, _func; @@ -180,7 +181,7 @@ static int process_measurement(struct file *file, const char *filename, * bitmask based on the appraise/audit/measurement policy. * Included is the appraise submask. */ - action = ima_get_action(inode, mask, function); + action = ima_get_action(inode, mask, function, &tmp_desc); if (!action) return 0; @@ -210,6 +211,7 @@ static int process_measurement(struct file *file, const char *filename, goto out_digsig; } + template_desc = (tmp_desc != NULL) ? tmp_desc : template_desc; if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) { if (action & IMA_APPRAISE_SUBMASK) xattr_ptr = &xattr_value; diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index f4b3fd0..edc38ac 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -260,7 +260,7 @@ static int get_subaction(struct ima_rule_entry *rule, int func) * change.) */ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, - int flags) + int flags, struct ima_template_desc **desc) { struct ima_rule_entry *entry; int action = 0, actmask = flags | (flags << 1); @@ -273,6 +273,9 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, if (!ima_match_rules(entry, inode, func, mask)) continue; + if (desc) + *desc = entry->desc; + action |= entry->flags & IMA_ACTION_FLAGS; action |= entry->action & IMA_DO_MASK; -- 1.8.1.4 [unhandled content-type:application/x-pkcs7-signature] | |