linux-stable.git/security/integrity/ima/ima_queue.c, branch linux-4.15.y

ima: fix get_binary_runtime_size()

2017-06-21T18:37:12+00:00

Remove '+ 1' from 'size += strlen(entry->template_desc->name) + 1;',
as the template name is sent to userspace without the '\0' character.

Signed-off-by: Roberto Sassu 
Signed-off-by: Mimi Zohar

ima: maintain memory size needed for serializing the measurement list

2016-12-20T17:48:44+00:00

In preparation for serializing the binary_runtime_measurements, this
patch maintains the amount of memory required.

Link: http://lkml.kernel.org/r/1480554346-29071-5-git-send-email-zohar@linux.vnet.ibm.com
Signed-off-by: Mimi Zohar 
Acked-by: Dmitry Kasatkin 
Cc: Thiago Jung Bauermann 
Cc: "Eric W. Biederman" 
Cc: Andreas Steffen 
Cc: Josh Sklar 
Cc: Dave Young 
Cc: Vivek Goyal 
Cc: Baoquan He 
Cc: Michael Ellerman 
Cc: Benjamin Herrenschmidt 
Cc: Paul Mackerras 
Cc: Stewart Smith 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ima: permit duplicate measurement list entries

2016-12-20T17:48:43+00:00

Measurements carried across kexec need to be added to the IMA
measurement list, but should not prevent measurements of the newly
booted kernel from being added to the measurement list.  This patch adds
support for allowing duplicate measurements.

The "boot_aggregate" measurement entry is the delimiter between soft
boots.

Link: http://lkml.kernel.org/r/1480554346-29071-4-git-send-email-zohar@linux.vnet.ibm.com
Signed-off-by: Mimi Zohar 
Acked-by: Dmitry Kasatkin 
Cc: Thiago Jung Bauermann 
Cc: "Eric W. Biederman" 
Cc: Andreas Steffen 
Cc: Josh Sklar 
Cc: Dave Young 
Cc: Vivek Goyal 
Cc: Baoquan He 
Cc: Michael Ellerman 
Cc: Benjamin Herrenschmidt 
Cc: Paul Mackerras 
Cc: Stewart Smith 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ima: on soft reboot, restore the measurement list

2016-12-20T17:48:43+00:00

The TPM PCRs are only reset on a hard reboot.  In order to validate a
TPM's quote after a soft reboot (eg.  kexec -e), the IMA measurement
list of the running kernel must be saved and restored on boot.  This
patch restores the measurement list.

Link: http://lkml.kernel.org/r/1480554346-29071-3-git-send-email-zohar@linux.vnet.ibm.com
Signed-off-by: Mimi Zohar 
Acked-by: Dmitry Kasatkin 
Cc: Thiago Jung Bauermann 
Cc: "Eric W. Biederman" 
Cc: Andreas Steffen 
Cc: Josh Sklar 
Cc: Dave Young 
Cc: Vivek Goyal 
Cc: Baoquan He 
Cc: Michael Ellerman 
Cc: Benjamin Herrenschmidt 
Cc: Paul Mackerras 
Cc: Stewart Smith 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ima: extend the measurement entry specific pcr

2016-06-30T05:14:22+00:00

Extend the PCR supplied as a parameter, instead of assuming that the
measurement entry uses the default configured PCR.

Signed-off-by: Eric Richter 
Signed-off-by: Mimi Zohar

ima: redefine duplicate template entries

2016-06-30T05:14:21+00:00

Template entry duplicates are prevented from being added to the
measurement list by checking a hash table that contains the template
entry digests. However, the PCR value is not included in this comparison,
so duplicate template entry digests with differing PCRs may be dropped.

This patch redefines duplicate template entries as template entries with
the same digest and same PCR values.

Reported-by: Mimi Zohar 
Signed-off-by: Eric Richter 
Signed-off-by: Mimi Zohar

integrity: fix checkpatch errors

2014-03-07T17:15:45+00:00

Between checkpatch changes (eg. sizeof) and inconsistencies between
Lindent and checkpatch, unfixed checkpatch errors make it difficult
to see new errors. This patch fixes them. Some lines with over 80 chars
remained unchanged to improve code readability.

The "extern" keyword is removed from internal evm.h to make it consistent
with internal ima.h.

Signed-off-by: Dmitry Kasatkin 
Signed-off-by: Mimi Zohar

security: integrity: Use a more current logging style

2014-03-07T17:15:21+00:00

Convert printks to pr_.
Add pr_fmt.
Remove embedded prefixes.

Signed-off-by: Joe Perches 
Signed-off-by: Mimi Zohar

ima: pass the filename argument up to ima_add_template_entry()

2013-10-25T21:17:03+00:00

Pass the filename argument to ima_add_template_entry() in order to
eliminate a dependency on template specific data (third argument of
integrity_audit_msg).

This change is required because, with the new template management
mechanism, the generation of a new measurement entry will be performed
by new specific functions (introduced in next patches) and the current IMA
code will not be aware anymore of how data is stored in the entry payload.

Signed-off-by: Roberto Sassu 
Signed-off-by: Mimi Zohar

ima: differentiate between template hash and file data hash sizes

2013-10-25T21:17:00+00:00

The TPM v1.2 limits the template hash size to 20 bytes.  This
patch differentiates between the template hash size, as defined
in the ima_template_entry, and the file data hash size, as
defined in the ima_template_data.  Subsequent patches add support
for different file data hash algorithms.

Change log:
- hash digest definition in ima_store_template() should be TPM_DIGEST_SIZE

Signed-off-by: Mimi Zohar