From: Roberto Sassu <roberto.sa...@huawei.com> The digest_cache LSM allows integrity providers to record how the digest list being used to populate the digest cache was verified.
Integrity providers can register a kernel_post_read_file LSM hook implementation, and call digest_cache_verif_set() providing the result of the digest list verification, together with the digest list file descriptor. IMA implements ima_digest_cache_store_allowed_usage(), storing allowed usage of the digest cache based on whether or not the digest list the digest cache is being populated from was measured/appraised. If the digest list was measured (IMA_MEASURED set in iint->flags), ima_digest_cache_store_allowed_usage() sets the IMA_DIGEST_CACHE_MEASURE_DATA in the allowed usage. If the digest list was appraised (IMA_APPRAISED_SUBMASK), ima_digest_cache_store_allowed_usage() sets the IMA_DIGEST_CACHE_APPRAISE_DATA in the allowed usage. Allowed usage based on integrity metadata will be ANDed with the allowed usage from the IMA policy. Then, the final decision will ultimately depend on whether or not the calculated digest of the accessed file was found in the digest cache. ANDing the usage prevents remote verifiers from receiving an incomplete IMA measurement list, where measurements are skipped, but there isn't the digest list the calculated file digest was searched into. It also prevents successful appraisal without appraising the digest list itself. Signed-off-by: Roberto Sassu <roberto.sa...@huawei.com> --- security/integrity/ima/Makefile | 1 + security/integrity/ima/ima_digest_cache.c | 45 +++++++++++++++++++++++ security/integrity/ima/ima_digest_cache.h | 21 +++++++++++ security/integrity/ima/ima_main.c | 3 ++ 4 files changed, 70 insertions(+) create mode 100644 security/integrity/ima/ima_digest_cache.c create mode 100644 security/integrity/ima/ima_digest_cache.h diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile index b376d38b4ee6..edd74a7374de 100644 --- a/security/integrity/ima/Makefile +++ b/security/integrity/ima/Makefile @@ -14,6 +14,7 @@ ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o ima-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o ima-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o ima-$(CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS) += ima_queue_keys.o +ima-$(CONFIG_SECURITY_DIGEST_CACHE) += ima_digest_cache.o ifeq ($(CONFIG_EFI),y) ima-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT) += ima_efi.o diff --git a/security/integrity/ima/ima_digest_cache.c b/security/integrity/ima/ima_digest_cache.c new file mode 100644 index 000000000000..0b0fd26cc0d7 --- /dev/null +++ b/security/integrity/ima/ima_digest_cache.c @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (C) 2024 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu <roberto.sa...@huawei.com> + * + * Integrate with the digest_cache LSM. + */ + +#include <linux/digest_cache.h> + +#include "ima_digest_cache.h" + +/** + * ima_digest_cache_store_allowed_usage - Store allowed usage in digest cache + * @file: Digest list file descriptor + * @iint: Inode integrity metadata + * + * Set digest cache allowed usage in the digest cache associated to the + * digest list file descriptor. Allowed usage is based on whether or not the + * digest list was measured/appraised. + */ +void ima_digest_cache_store_allowed_usage(struct file *file, + struct ima_iint_cache *iint) +{ + u64 allowed_usage = 0; + int rc; + + if (iint->flags & IMA_MEASURED) + allowed_usage |= IMA_DIGEST_CACHE_MEASURE_DATA; + if (iint->flags & IMA_APPRAISED_SUBMASK) + allowed_usage |= IMA_DIGEST_CACHE_APPRAISE_DATA; + + /* + * Set digest cache allowed usage from integrity metadata flags for + * later use. + */ + rc = digest_cache_verif_set(file, "ima", &allowed_usage, + sizeof(allowed_usage)); + + /* Ignore if fd doesn't have digest cache set (prefetching). */ + if (rc && rc != -ENOENT) + pr_debug("Cannot set verification mask for %s, ret: %d, ignoring\n", + file_dentry(file)->d_name.name, rc); +} diff --git a/security/integrity/ima/ima_digest_cache.h b/security/integrity/ima/ima_digest_cache.h new file mode 100644 index 000000000000..f2534a01bb18 --- /dev/null +++ b/security/integrity/ima/ima_digest_cache.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2024 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu <roberto.sa...@huawei.com> + * + * Header file of ima_digest_cache.c. + */ + +#include "ima.h" + +#ifdef CONFIG_SECURITY_DIGEST_CACHE +void ima_digest_cache_store_allowed_usage(struct file *file, + struct ima_iint_cache *iint); +#else +static inline void +ima_digest_cache_store_allowed_usage(struct file *file, + struct ima_iint_cache *iint) +{ } + +#endif /* CONFIG_SECURITY_DIGEST_CACHE */ diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index e3ca80098c4c..7c968cdb5678 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -28,6 +28,7 @@ #include <linux/iversion.h> #include "ima.h" +#include "ima_digest_cache.h" #ifdef CONFIG_IMA_APPRAISE int ima_appraise = IMA_APPRAISE_ENFORCE; @@ -399,6 +400,8 @@ static int process_measurement(struct file *file, const struct cred *cred, if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) && !(iint->flags & IMA_NEW_FILE)) rc = -EACCES; + if (!rc && func == DIGEST_LIST_CHECK) + ima_digest_cache_store_allowed_usage(file, iint); mutex_unlock(&iint->mutex); kfree(xattr_value); ima_free_modsig(modsig); -- 2.34.1