hulk inclusion category: feature feature: digest-lists
---------------------------
This patch introduces a new hard-coded policy to measure executable code:
dont_measure fsmagic=0x9fa0 dont_measure fsmagic=0x62656572 dont_measure fsmagic=0x64626720 dont_measure fsmagic=0x1cd1 dont_measure fsmagic=0x42494e4d dont_measure fsmagic=0x73636673 dont_measure fsmagic=0xf97cff8c dont_measure fsmagic=0x43415d53 dont_measure fsmagic=0x27e0eb dont_measure fsmagic=0x63677270 dont_measure fsmagic=0x6e736673 measure func=MMAP_CHECK mask=MAY_EXEC measure func=BPRM_CHECK mask=MAY_EXEC measure func=MODULE_CHECK measure func=FIRMWARE_CHECK measure func=POLICY_CHECK measure func=DIGEST_LIST_CHECK
It can be selected by specifying ima_policy=exec_tcb in the kernel command line. Files in tmpfs are not excluded from measurement.
Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- .../admin-guide/kernel-parameters.txt | 5 ++++ security/integrity/ima/ima_policy.c | 23 ++++++++++++++++--- 2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 65efa24e3dd0..e0e8d054782d 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1601,6 +1601,11 @@ mode bit set by either the effective uid (euid=0) or uid=0.
+ The "exec_tcb" policy is similar to the "tcb" policy + except for file open, which is not considered. Files + in the tmpfs filesystem are not excluded from + measurement. + The "appraise_tcb" policy appraises the integrity of all files owned by root. (This is the equivalent of ima_appraise_tcb.) diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index a4014eef4fb4..3de081671725 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -56,7 +56,7 @@ enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE };
-enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB }; +enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB, EXEC_TCB };
struct ima_rule_entry { struct list_head list; @@ -225,6 +225,8 @@ static int __init policy_setup(char *str) continue; if ((strcmp(p, "tcb") == 0) && !ima_policy) ima_policy = DEFAULT_TCB; + else if ((strcmp(p, "exec_tcb") == 0) && !ima_policy) + ima_policy = EXEC_TCB; else if (strcmp(p, "appraise_tcb") == 0) ima_use_appraise_tcb = true; else if (strcmp(p, "secure_boot") == 0) @@ -495,8 +497,14 @@ void __init ima_init_policy(void) secure_boot_entries = ima_use_secure_boot ? ARRAY_SIZE(secure_boot_rules) : 0;
- for (i = 0; i < measure_entries; i++) + for (i = 0; i < measure_entries; i++) { + if (ima_policy == EXEC_TCB && + (dont_measure_rules[i].flags & IMA_FSMAGIC) && + dont_measure_rules[i].fsmagic == TMPFS_MAGIC) + continue; + list_add_tail(&dont_measure_rules[i].list, &ima_default_rules); + }
switch (ima_policy) { case ORIGINAL_TCB: @@ -505,9 +513,18 @@ void __init ima_init_policy(void) &ima_default_rules); break; case DEFAULT_TCB: - for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++) + /* fall through */ + case EXEC_TCB: + for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++) { + if (ima_policy == EXEC_TCB && + (default_measurement_rules[i].flags & IMA_FUNC) && + default_measurement_rules[i].func == FILE_CHECK) + continue; + list_add_tail(&default_measurement_rules[i].list, &ima_default_rules); + } + break; default: break; }