Messages in this thread | | | Date | Mon, 14 Feb 2022 15:38:28 -0500 | Subject | Re: [PATCH v5 4/8] ima: define a new template field 'd-type' and a new template 'ima-ngv2' | From | Stefan Berger <> |
| |
On 2/11/22 16:43, Mimi Zohar wrote: > In preparation to differentiate between regular IMA file hashes and > fs-verity's file digests, define a new template field named 'd-type'. > Define a new template named 'ima-ngv2', which includes the new 'd-type' > field. > > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> > --- > security/integrity/ima/ima_template.c | 3 +++ > security/integrity/ima/ima_template_lib.c | 13 +++++++++++++ > security/integrity/ima/ima_template_lib.h | 2 ++ > 3 files changed, 18 insertions(+) > > diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c > index db1ad6d7a57f..b321342e5bee 100644 > --- a/security/integrity/ima/ima_template.c > +++ b/security/integrity/ima/ima_template.c > @@ -19,6 +19,7 @@ enum header_fields { HDR_PCR, HDR_DIGEST, HDR_TEMPLATE_NAME, > static struct ima_template_desc builtin_templates[] = { > {.name = IMA_TEMPLATE_IMA_NAME, .fmt = IMA_TEMPLATE_IMA_FMT}, > {.name = "ima-ng", .fmt = "d-ng|n-ng"}, > + {.name = "ima-ngv2", .fmt = "d-ng|n-ng|d-type"}, > {.name = "ima-sig", .fmt = "d-ng|n-ng|sig"}, > {.name = "ima-buf", .fmt = "d-ng|n-ng|buf"}, > {.name = "ima-modsig", .fmt = "d-ng|n-ng|sig|d-modsig|modsig"}, > @@ -40,6 +41,8 @@ static const struct ima_template_field supported_fields[] = { > .field_show = ima_show_template_digest_ng}, > {.field_id = "n-ng", .field_init = ima_eventname_ng_init, > .field_show = ima_show_template_string}, > + {.field_id = "d-type", .field_init = ima_eventdigest_type_init, > + .field_show = ima_show_template_string}, > {.field_id = "sig", .field_init = ima_eventsig_init, > .field_show = ima_show_template_sig}, > {.field_id = "buf", .field_init = ima_eventbuf_init, > diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c > index 7155d17a3b75..a213579e825e 100644 > --- a/security/integrity/ima/ima_template_lib.c > +++ b/security/integrity/ima/ima_template_lib.c > @@ -383,6 +383,19 @@ int ima_eventdigest_ng_init(struct ima_event_data *event_data, > hash_algo, field_data); > } > > +/* > + * This function writes the digest type of an event. > + */ > +int ima_eventdigest_type_init(struct ima_event_data *event_data, > + struct ima_field_data *field_data) > +{ > + static const char * const digest_type[] = {"ima"};
This array makes sense with 6/8.
Acked-by: Stefan Berger <stefanb@linux.ibm.com>
> + > + return ima_write_template_field_data(digest_type[0], > + strlen(digest_type[0]), > + DATA_FMT_STRING, field_data); > +} > + > /* > * This function writes the digest of the file which is expected to match the > * digest contained in the file's appended signature. > diff --git a/security/integrity/ima/ima_template_lib.h b/security/integrity/ima/ima_template_lib.h > index c71f1de95753..539a5e354925 100644 > --- a/security/integrity/ima/ima_template_lib.h > +++ b/security/integrity/ima/ima_template_lib.h > @@ -38,6 +38,8 @@ int ima_eventname_init(struct ima_event_data *event_data, > struct ima_field_data *field_data); > int ima_eventdigest_ng_init(struct ima_event_data *event_data, > struct ima_field_data *field_data); > +int ima_eventdigest_type_init(struct ima_event_data *event_data, > + struct ima_field_data *field_data); > int ima_eventdigest_modsig_init(struct ima_event_data *event_data, > struct ima_field_data *field_data); > int ima_eventname_ng_init(struct ima_event_data *event_data,
| |