lkml.org 
[lkml]   [2020]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5/5] LSM: Define workqueue for measuring security module state
    Date
    The data maintained by the security modules could be tampered with by
    malware. The LSM needs to periodically query the state of
    the security modules and measure the data when the state is changed.

    Define a workqueue for handling this periodic query and measurement.

    Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
    ---
    security/security.c | 26 ++++++++++++++++++++++++++
    1 file changed, 26 insertions(+)

    diff --git a/security/security.c b/security/security.c
    index e7175db5a093..3dad6766cb9d 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -89,6 +89,11 @@ static __initdata struct lsm_info *exclusive;
    static struct lsm_info *security_state_lsms;
    static int security_state_lsms_count;

    +static long security_state_timeout = 300000; /* 5 Minutes */
    +static void security_state_handler(struct work_struct *work);
    +static DECLARE_DELAYED_WORK(security_state_delayed_work,
    + security_state_handler);
    +
    static __initdata bool debug;
    #define init_debug(...) \
    do { \
    @@ -294,6 +299,26 @@ static void __init initialize_security_state_lsms(void)
    security_state_lsms_count = count;
    }

    +static void initialize_security_state_monitor(void)
    +{
    + if (security_state_lsms_count == 0)
    + return;
    +
    + schedule_delayed_work(&security_state_delayed_work,
    + msecs_to_jiffies(security_state_timeout));
    +}
    +
    +static void security_state_handler(struct work_struct *work)
    +{
    + int inx;
    +
    + for (inx = 0; inx < security_state_lsms_count; inx++)
    + measure_security_state(&(security_state_lsms[inx]));
    +
    + schedule_delayed_work(&security_state_delayed_work,
    + msecs_to_jiffies(security_state_timeout));
    +}
    +
    /* Populate ordered LSMs list from comma-separated LSM name list. */
    static void __init ordered_lsm_parse(const char *order, const char *origin)
    {
    @@ -417,6 +442,7 @@ static void __init ordered_lsm_init(void)
    }

    initialize_security_state_lsms();
    + initialize_security_state_monitor();

    kfree(ordered_lsms);
    }
    --
    2.27.0
    \
     
     \ /
      Last update: 2020-06-13 04:42    [W:5.847 / U:1.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site