IMA: Add KEY_CHECK func to measure keys

Measure keys loaded onto any keyring.

This patch defines a new IMA policy func namely KEY_CHECK to
measure keys. Updated ima_match_rules() to check for KEY_CHECK
and ima_parse_rule() to handle KEY_CHECK.

Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
index 29aaedf..066d327 100644 (file)
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -29,7 +29,7 @@ Description:
                base:   func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK]
                                [FIRMWARE_CHECK]
                                [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
-                               [KEXEC_CMDLINE]
+                               [KEXEC_CMDLINE] [KEY_CHECK]
                        mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
                               [[^]MAY_EXEC]
                        fsmagic:= hex value
@@ -113,3 +113,7 @@ Description:
                Example of appraise rule allowing modsig appended signatures:
 
                        appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig
+
+               Example of measure rule using KEY_CHECK to measure all keys:
+
+                       measure func=KEY_CHECK

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index df4ca48..fe6c698 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -193,6 +193,7 @@ static inline unsigned long ima_hash_key(u8 *digest)
        hook(KEXEC_INITRAMFS_CHECK)     \
        hook(POLICY_CHECK)              \
        hook(KEXEC_CMDLINE)             \
+       hook(KEY_CHECK)                 \
        hook(MAX_CHECK)
 #define __ima_hook_enumify(ENUM)       ENUM,
 

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index f19a895..1525a28 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -373,7 +373,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 {
        int i;
 
-       if (func == KEXEC_CMDLINE) {
+       if ((func == KEXEC_CMDLINE) || (func == KEY_CHECK)) {
                if ((rule->flags & IMA_FUNC) && (rule->func == func))
                        return true;
                return false;
@@ -997,6 +997,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
                                entry->func = POLICY_CHECK;
                        else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0)
                                entry->func = KEXEC_CMDLINE;
+                       else if (strcmp(args[0].from, "KEY_CHECK") == 0)
+                               entry->func = KEY_CHECK;
                        else
                                result = -EINVAL;
                        if (!result)