lkml.org 
[lkml]   [2021]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v7 08/14] ima: Implement hierarchical processing of file accesses
    Date
    From: Stefan Berger <stefanb@linux.ibm.com>

    Implement hierarchical processing of file accesses in IMA namespaces by
    walking the list of IMA namespaces towards the init_ima_ns. This way
    file accesses can be audited in an IMA namespace and also be evaluated
    against the IMA policies of parent IMA namespaces.

    Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
    ---
    include/linux/ima.h | 9 +++++++++
    security/integrity/ima/ima_main.c | 30 ++++++++++++++++++++++++++----
    2 files changed, 35 insertions(+), 4 deletions(-)

    diff --git a/include/linux/ima.h b/include/linux/ima.h
    index 61461ee5b208..f9e592bb9560 100644
    --- a/include/linux/ima.h
    +++ b/include/linux/ima.h
    @@ -66,6 +66,15 @@ static inline const char * const *arch_get_ima_policy(void)
    }
    #endif

    +static inline struct user_namespace *ima_user_ns(struct ima_namespace *ns)
    +{
    + struct user_namespace *user_ns;
    +
    + user_ns = current_user_ns();
    + WARN_ON(user_ns->ima_ns != ns);
    + return user_ns;
    +}
    +
    #else
    static inline enum hash_algo ima_get_current_hash_algo(void)
    {
    diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
    index 98be891c2621..4c85a8df3c86 100644
    --- a/security/integrity/ima/ima_main.c
    +++ b/security/integrity/ima/ima_main.c
    @@ -200,10 +200,10 @@ void ima_file_free(struct file *file)
    ima_check_last_writer(iint, inode, file);
    }

    -static int process_measurement(struct ima_namespace *ns,
    - struct file *file, const struct cred *cred,
    - u32 secid, char *buf, loff_t size, int mask,
    - enum ima_hooks func)
    +static int __process_measurement(struct ima_namespace *ns,
    + struct file *file, const struct cred *cred,
    + u32 secid, char *buf, loff_t size, int mask,
    + enum ima_hooks func)
    {
    struct inode *inode = file_inode(file);
    struct integrity_iint_cache *iint = NULL;
    @@ -405,6 +405,28 @@ static int process_measurement(struct ima_namespace *ns,
    return 0;
    }

    +static int process_measurement(struct ima_namespace *ns,
    + struct file *file, const struct cred *cred,
    + u32 secid, char *buf, loff_t size, int mask,
    + enum ima_hooks func)
    +{
    + struct user_namespace *user_ns = ima_user_ns(ns);
    + int ret = 0;
    +
    + while (user_ns) {
    + ns = user_ns->ima_ns;
    +
    + ret = __process_measurement(ns, file, cred, secid, buf, size,
    + mask, func);
    + if (ret)
    + break;
    +
    + user_ns = user_ns->parent;
    + };
    +
    + return ret;
    +}
    +
    /**
    * ima_file_mmap - based on policy, collect/store measurement.
    * @file: pointer to the file to be measured (May be NULL)
    --
    2.31.1
    \
     
     \ /
      Last update: 2021-12-16 06:45    [W:3.341 / U:1.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site