IMA: Define a new template field buf
authorPrakhar Srivastava <prsriva02@gmail.com>
Mon, 24 Jun 2019 06:23:30 +0000 (23:23 -0700)
committerMimi Zohar <zohar@linux.ibm.com>
Sun, 30 Jun 2019 21:53:45 +0000 (17:53 -0400)
commit86b4da8c0e7fcb6c217c604efcd9438ad55dd055
treed0fd6261853d1c15238f42be11c80f6f730f43f4
parentb0935123a18360d19f1dcc779ea33841cdc304cc
IMA: Define a new template field buf

A buffer(kexec boot command line arguments) measured into IMA
measuremnt list cannot be appraised, without already being
aware of the buffer contents. Since hashes are non-reversible,
raw buffer is needed for validation or regenerating hash for
appraisal/attestation.

Add support to store/read the buffer contents in HEX.
The kexec cmdline hash is stored in the "d-ng" field of the
template data.  It can be verified using
sudo cat /sys/kernel/security/integrity/ima/ascii_runtime_measurements |
  grep  kexec-cmdline | cut -d' ' -f 6 | xxd -r -p | sha256sum

- Add two new fields to ima_event_data to hold the buf and
buf_len
- Add a new template field 'buf' to be used to store/read
the buffer data.
- Updated process_buffer_meaurement to add the buffer to
ima_event_data. process_buffer_measurement added in
"Define a new IMA hook to measure the boot command line
 arguments"
- Add a new template policy name ima-buf to represent
'd-ng|n-ng|buf'

Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: James Morris <jamorris@linux.microsoft.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Documentation/security/IMA-templates.rst
security/integrity/ima/ima.h
security/integrity/ima/ima_main.c
security/integrity/ima/ima_template.c
security/integrity/ima/ima_template_lib.c
security/integrity/ima/ima_template_lib.h