From: Krzysztof Struczynski krzysztof.struczynski@huawei.com
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA
--------------------------------
IMA subsystem is configured at boot time using kernel command-line parameters, e.g.: ima_policy=tcb|appraise_tcb|secure_boot. The same configuration options should be available for the new ima namespace. Add new functions to parse configuration string and store parsed data in the new policy data structures. Don't implement it yet, just add the dummy interface.
Signed-off-by: Krzysztof Struczynski krzysztof.struczynski@huawei.com Reviewed-by: Zhang Tianxing zhangtianxing3@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- security/integrity/ima/ima.h | 10 ++++++++ security/integrity/ima/ima_appraise.c | 10 ++++++++ security/integrity/ima/ima_policy.c | 37 +++++++++++++++++++++++++++ 3 files changed, 57 insertions(+)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 6a59c8b9bc4c..e62bd2dfa595 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -311,6 +311,16 @@ void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos); void ima_policy_stop(struct seq_file *m, void *v); int ima_policy_show(struct seq_file *m, void *v);
+int ima_policy_setup(char *str, + struct ima_policy_setup_data *policy_setup_data, + bool *fail_unverifiable_sigs); +int ima_default_measure_policy_setup(const char *str, + struct ima_policy_setup_data *setup_data); +int ima_default_appraise_policy_setup(const char *str, + struct ima_policy_setup_data *setup_data); +int ima_default_appraise_setup(const char *str, + struct ima_policy_setup_data *setup_data); + /* Appraise integrity measurements */ #define IMA_APPRAISE_ENFORCE 0x01 #define IMA_APPRAISE_FIX 0x02 diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 3fb378017f9d..ad7715822e06 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -18,6 +18,16 @@ #include "ima_digest_list.h"
static bool ima_appraise_req_evm __ro_after_init; + +int ima_default_appraise_setup(const char *str, + struct ima_policy_setup_data *setup_data) +{ + /* Currently unused. It will be implemented after namespacing ima + * policy, when global variables are removed. + */ + return 1; +} + static int __init default_appraise_setup(char *str) { #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index bdfe5ec0a79a..fe5d0f311f1c 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -246,6 +246,15 @@ struct ima_policy_data init_policy_data = { .ima_temp_rules = LIST_HEAD_INIT(init_policy_data.ima_temp_rules), };
+int ima_default_measure_policy_setup(const char *str, + struct ima_policy_setup_data *setup_data) +{ + /* Currently unused. It will be implemented after namespacing ima + * policy, when global variables are removed. + */ + return 1; +} + static int __init default_measure_policy_setup(char *str) { if (ima_policy) @@ -261,6 +270,25 @@ static bool ima_use_appraise_exec_tcb __initdata; static bool ima_use_appraise_exec_immutable __initdata; static bool ima_use_secure_boot __initdata; static bool ima_fail_unverifiable_sigs __ro_after_init; + +/** + * ima_policy_setup - parse policy configuration string "ima_policy=" + * @str: string to be parsed + * @setup_data: pointer to a structure where parsed data is stored + * @fail_unverifiable_sigs: boolean flag treated separately to preserve + * __ro_after_init + */ +int ima_policy_setup(char *str, + struct ima_policy_setup_data *setup_data, + bool *fail_unverifiable_sigs) +{ + + /* Currently unused. It will be implemented after namespacing ima + * policy, when global variables are removed. + */ + return 1; +} + static int __init policy_setup(char *str) { char *p; @@ -290,6 +318,15 @@ static int __init policy_setup(char *str) } __setup("ima_policy=", policy_setup);
+int ima_default_appraise_policy_setup(const char *str, + struct ima_policy_setup_data *setup_data) +{ + /* Currently unused. It will be implemented after namespacing ima + * policy, when global variables are removed. + */ + return 1; +} + static int __init default_appraise_policy_setup(char *str) { ima_use_appraise_tcb = true;