linux_dsm_epyc7002/security/integrity/ima
Mimi Zohar d9ddf077bb ima: support for kexec image and initramfs
Add IMA policy support for measuring/appraising the kexec image and
initramfs. Two new IMA policy identifiers KEXEC_KERNEL_CHECK and
KEXEC_INITRAMFS_CHECK are defined.

Example policy rules:
measure func=KEXEC_KERNEL_CHECK
appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig
measure func=KEXEC_INITRAMFS_CHECK
appraise func=KEXEC_INITRAMFS_CHECK appraise_type=imasig

Moving the enumeration to the vfs layer simplified the patches, allowing
the IMA changes, for the most part, to be separated from the other
changes.  Unfortunately, passing either a kernel_read_file_id or a
ima_hooks enumeration within IMA is messy.

Option 1: duplicate kernel_read_file enumeration in ima_hooks

enum kernel_read_file_id {
	...
        READING_KEXEC_IMAGE,
        READING_KEXEC_INITRAMFS,
        READING_MAX_ID

enum ima_hooks {
	...
	KEXEC_KERNEL_CHECK
	KEXEC_INITRAMFS_CHECK

Option 2: define ima_hooks as extension of kernel_read_file
eg: enum ima_hooks {
        FILE_CHECK = READING_MAX_ID,
        MMAP_CHECK,

In order to pass both kernel_read_file_id and ima_hooks values, we
would need to specify a struct containing a union.

struct caller_id {
        union {
                enum ima_hooks func_id;
                enum kernel_read_file_id read_id;
        };
};

Option 3: incorportate the ima_hooks enumeration into kernel_read_file_id,
perhaps changing the enumeration name.

For now, duplicate the new READING_KEXEC_IMAGE/INITRAMFS in the ima_hooks.

Changelog v4:
- replaced switch statement with a kernel_read_file_id to an ima_hooks
id mapping array - Dmitry
- renamed ima_hook tokens KEXEC_CHECK and INITRAMFS_CHECK to
KEXEC_KERNEL_CHECK and KEXEC_INITRAMFS_CHECK respectively - Dave Young

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: Petko Manolov <petkan@mip-labs.com>
Acked-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
Cc: Dave Young <dyoung@redhat.com>
2016-02-21 09:06:16 -05:00
..
ima_api.c ima: define a new hook to measure and appraise a file already in memory 2016-02-20 22:35:08 -05:00
ima_appraise.c ima: remove firmware and module specific cached status info 2016-02-21 09:06:13 -05:00
ima_crypto.c ima: calculate the hash of a buffer using aynchronous hash(ahash) 2016-02-18 17:14:44 -05:00
ima_fs.c ima: ima_write_policy() limit locking 2016-01-03 13:22:38 -05:00
ima_init.c ima: separate 'security.ima' reading functionality from collect 2016-02-18 17:13:32 -05:00
ima_main.c ima: support for kexec image and initramfs 2016-02-21 09:06:16 -05:00
ima_mok.c security/integrity: make ima/ima_mok.c explicitly non-modular 2015-12-15 10:01:43 -05:00
ima_policy.c ima: support for kexec image and initramfs 2016-02-21 09:06:16 -05:00
ima_queue.c integrity: fix checkpatch errors 2014-03-07 12:15:45 -05:00
ima_template_lib.c ima: separate 'security.ima' reading functionality from collect 2016-02-18 17:13:32 -05:00
ima_template_lib.h ima: wrap event related data to the new ima_event_data structure 2015-05-21 13:59:28 -04:00
ima_template.c ima: separate 'security.ima' reading functionality from collect 2016-02-18 17:13:32 -05:00
ima.h ima: support for kexec image and initramfs 2016-02-21 09:06:16 -05:00
Kconfig IMA: allow reading back the current IMA policy 2015-12-15 10:01:43 -05:00
Makefile IMA: create machine owner and blacklist keyrings 2015-12-15 10:01:43 -05:00