Messages in this thread | | | From | Roberto Sassu <> | Subject | [PATCH v4 0/3] ima: Provide more info about buffer measurement | Date | Fri, 23 Jul 2021 10:53:01 +0200 |
| |
This patch set provides more information about buffer measurement. It requires the modification of the existing functions ima_measure_critical_data() and process_buffer_measurement() as, unlike for files, there is no integrity_iint_cache structure that can be used to store and retrieve at a later time the buffer measurement (there is no index, for files it is the inode number).
First, this patch set introduces the new function ima_get_current_hash_algo(), to obtain the algorithm used to calculate the buffer digest (patch 1).
Second, it changes the type of return value of ima_measure_critical_data() and process_buffer_measurement() from void to int, to signal to the callers whether or not the buffer has been measured, or just the digest has been calculated and written to the supplied location (patch 2).
Lastly, it adds two new parameters to the functions above ('digest' and 'digest_len'), so that those functions can write the buffer digest to the location supplied by the callers (patch 3).
This patch set replaces the patch 'ima: Add digest, algo, measured parameters to ima_measure_critical_data()' in:
https://lore.kernel.org/linux-integrity/20210625165614.2284243-1-roberto.sassu@huawei.com/
Changelog
v3: - explain better the motivation for the patches (suggested by Mimi)
v2: - remove assignments of ima_measure_critical_data() and process_buffer_measurement() return values (suggested by Lakshmi)
v1: - add digest_len parameter to ima_measure_critical_data() and process_buffer_measurement() (suggested by Lakshmi) - fix doc formatting issues
Huawei Digest Lists patch set: - introduce ima_get_current_hash_algo() (suggested by Mimi) - remove algo and measured parameters from ima_measure_critical_data() and process_buffer_measurement() (suggested by Mimi) - return an integer from ima_measure_critical_data() and process_buffer_measurement() (suggested by Mimi) - correctly check when process_buffer_measurement() should return earlier
Roberto Sassu (3): ima: Introduce ima_get_current_hash_algo() ima: Return int in the functions to measure a buffer ima: Add digest and digest_len params to the functions to measure a buffer
include/linux/ima.h | 23 +++++-- security/integrity/ima/ima.h | 10 +-- security/integrity/ima/ima_appraise.c | 2 +- security/integrity/ima/ima_asymmetric_keys.c | 2 +- security/integrity/ima/ima_init.c | 3 +- security/integrity/ima/ima_main.c | 67 ++++++++++++++------ security/integrity/ima/ima_queue_keys.c | 2 +- security/selinux/ima.c | 6 +- 8 files changed, 78 insertions(+), 37 deletions(-)
-- 2.25.1
| |