IMA: Call workqueue functions to measure queued keys

Measuring keys requires a custom IMA policy to be loaded.  Keys should
be queued for measurement if a custom IMA policy is not yet loaded.
Keys queued for measurement, if any, should be processed when a custom
policy is loaded.

This patch updates the IMA hook function ima_post_key_create_or_update()
to queue the key if a custom IMA policy has not yet been loaded.  And,
ima_update_policy() function, which is called when a custom IMA policy
is loaded, is updated to process queued keys.

Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/security/integrity/ima/ima_asymmetric_keys.c b/security/integrity/ima/ima_asymmetric_keys.c
index fea2e7d..7678f0e 100644 (file)
--- a/security/integrity/ima/ima_asymmetric_keys.c
+++ b/security/integrity/ima/ima_asymmetric_keys.c
@@ -30,6 +30,8 @@ void ima_post_key_create_or_update(struct key *keyring, struct key *key,
                                   const void *payload, size_t payload_len,
                                   unsigned long flags, bool create)
 {
+       bool queued = false;
+
        /* Only asymmetric keys are handled by this hook. */
        if (key->type != &key_type_asymmetric)
                return;
@@ -37,6 +39,12 @@ void ima_post_key_create_or_update(struct key *keyring, struct key *key,
        if (!payload || (payload_len == 0))
                return;
 
+       if (ima_should_queue_key())
+               queued = ima_queue_key(keyring, payload, payload_len);
+
+       if (queued)
+               return;
+
        /*
         * keyring->description points to the name of the keyring
         * (such as ".builtin_trusted_keys", ".ima", etc.) to

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index b560a3f..f45ae38 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -809,6 +809,9 @@ void ima_update_policy(void)
                kfree(arch_policy_entry);
        }
        ima_update_policy_flag();
+
+       /* Custom IMA policy has been loaded */
+       ima_process_queued_keys();
 }
 
 /* Keep the enumeration in sync with the policy_tokens! */