| Message ID | 1477017898-10375-3-git-send-email-bauerman@linux.vnet.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri, Oct 21, 2016 at 5:44 AM, Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> wrote: > From: Mimi Zohar <zohar@linux.vnet.ibm.com> > > The TPM PCRs are only reset on a hard reboot. In order to validate a > TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement list > of the running kernel must be saved and restored on boot. This patch > restores the measurement list. > > Changelog v5: > - replace CONFIG_KEXEC_FILE with architecture CONFIG_HAVE_IMA_KEXEC (Thiago) > - replace kexec_get_handover_buffer() with ima_get_kexec_buffer() (Thiago) > - replace kexec_free_handover_buffer() with ima_free_kexec_buffer() (Thiago) > - remove unnecessary includes from ima_kexec.c (Thiago) > - fix off-by-one error when checking hdr_v1->template_name_len (Colin King) > > Changelog v2: > - redefined ima_kexec_hdr to use types with well defined sizes (M. Ellerman) > - defined missing ima_load_kexec_buffer() stub function > > Changelog v1: > - call ima_load_kexec_buffer() (Thiago) > > Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> > --- > security/integrity/ima/Makefile | 1 + > security/integrity/ima/ima.h | 21 +++++ > security/integrity/ima/ima_init.c | 2 + > security/integrity/ima/ima_kexec.c | 44 +++++++++ > security/integrity/ima/ima_queue.c | 10 ++ > security/integrity/ima/ima_template.c | 170 ++++++++++++++++++++++++++++++++++ > 6 files changed, 248 insertions(+) > > diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile > index 9aeaedad1e2b..29f198bde02b 100644 > --- a/security/integrity/ima/Makefile > +++ b/security/integrity/ima/Makefile > @@ -8,4 +8,5 @@ obj-$(CONFIG_IMA) += ima.o > ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \ > ima_policy.o ima_template.o ima_template_lib.o > ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o > +ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o > obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o > diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h > index db25f54a04fe..51dc8d57d64d 100644 > --- a/security/integrity/ima/ima.h > +++ b/security/integrity/ima/ima.h > @@ -28,6 +28,10 @@ > > #include "../integrity.h" > > +#ifdef CONFIG_HAVE_IMA_KEXEC > +#include <asm/ima.h> > +#endif > + > enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, > IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; > enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; > @@ -102,6 +106,21 @@ struct ima_queue_entry { > }; > extern struct list_head ima_measurements; /* list of all measurements */ > > +/* Some details preceding the binary serialized measurement list */ > +struct ima_kexec_hdr { > + u16 version; > + u16 _reserved0; > + u32 _reserved1; > + u64 buffer_size; > + u64 count; > +}; > + > +#ifdef CONFIG_HAVE_IMA_KEXEC > +void ima_load_kexec_buffer(void); > +#else > +static inline void ima_load_kexec_buffer(void) {} > +#endif /* CONFIG_HAVE_IMA_KEXEC */ > + > /* Internal IMA function definitions */ > int ima_init(void); > int ima_fs_init(void); > @@ -122,6 +141,8 @@ int ima_init_crypto(void); > void ima_putc(struct seq_file *m, void *data, int datalen); > void ima_print_digest(struct seq_file *m, u8 *digest, u32 size); > struct ima_template_desc *ima_template_desc_current(void); > +int ima_restore_measurement_entry(struct ima_template_entry *entry); > +int ima_restore_measurement_list(loff_t bufsize, void *buf); > int ima_init_template(void); > > /* > diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c > index 32912bd54ead..3ba0ca49cba6 100644 > --- a/security/integrity/ima/ima_init.c > +++ b/security/integrity/ima/ima_init.c > @@ -128,6 +128,8 @@ int __init ima_init(void) > if (rc != 0) > return rc; > > + ima_load_kexec_buffer(); > + > rc = ima_add_boot_aggregate(); /* boot aggregate must be first entry */ > if (rc != 0) > return rc; > diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c > new file mode 100644 > index 000000000000..36afd0fe9747 > --- /dev/null > +++ b/security/integrity/ima/ima_kexec.c > @@ -0,0 +1,44 @@ > +/* > + * Copyright (C) 2016 IBM Corporation > + * > + * Authors: > + * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> > + * Mimi Zohar <zohar@linux.vnet.ibm.com> > + * > + * This program is free software; you can redistribute it and/or modify > + * it under the terms of the GNU General Public License as published by > + * the Free Software Foundation; either version 2 of the License, or > + * (at your option) any later version. > + */ > +#include "ima.h" > + > +/* > + * Restore the measurement list from the previous kernel. > + */ > +void ima_load_kexec_buffer(void) > +{ > + void *kexec_buffer = NULL; > + size_t kexec_buffer_size = 0; > + int rc; > + > + rc = ima_get_kexec_buffer(&kexec_buffer, &kexec_buffer_size); > + switch (rc) { > + case 0: > + rc = ima_restore_measurement_list(kexec_buffer_size, > + kexec_buffer); > + if (rc != 0) > + pr_err("Failed to restore the measurement list: %d\n", > + rc); > + > + ima_free_kexec_buffer(); > + break; > + case -ENOTSUPP: > + pr_debug("Restoring the measurement list not supported\n"); > + break; > + case -ENOENT: > + pr_debug("No measurement list to restore\n"); > + break; > + default: > + pr_debug("Error restoring the measurement list: %d\n", rc); > + } > +} > diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c > index 32f6ac0f96df..4b1bb7787839 100644 > --- a/security/integrity/ima/ima_queue.c > +++ b/security/integrity/ima/ima_queue.c > @@ -149,3 +149,13 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation, > op, audit_cause, result, audit_info); > return result; > } > + > +int ima_restore_measurement_entry(struct ima_template_entry *entry) > +{ > + int result = 0; > + > + mutex_lock(&ima_extend_list_mutex); > + result = ima_add_digest_entry(entry); > + mutex_unlock(&ima_extend_list_mutex); > + return result; > +} > diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c > index febd12ed9b55..37f972cb05fe 100644 > --- a/security/integrity/ima/ima_template.c > +++ b/security/integrity/ima/ima_template.c > @@ -37,6 +37,7 @@ static struct ima_template_field supported_fields[] = { > {.field_id = "sig", .field_init = ima_eventsig_init, > .field_show = ima_show_template_sig}, > }; > +#define MAX_TEMPLATE_NAME_LEN 15 > > static struct ima_template_desc *ima_template; > static struct ima_template_desc *lookup_template_desc(const char *name); > @@ -205,3 +206,172 @@ int __init ima_init_template(void) > > return result; > } > + > +static int ima_restore_template_data(struct ima_template_desc *template_desc, > + void *template_data, > + int template_data_size, > + struct ima_template_entry **entry) > +{ > + struct binary_field_data { > + u32 len; > + u8 data[0]; > + } __packed; > + > + struct binary_field_data *field_data; > + int offset = 0; > + int ret = 0; > + int i; > + > + *entry = kzalloc(sizeof(**entry) + > + template_desc->num_fields * sizeof(struct ima_field_data), > + GFP_NOFS); > + if (!*entry) > + return -ENOMEM; > + > + (*entry)->template_desc = template_desc; > + for (i = 0; i < template_desc->num_fields; i++) { > + field_data = template_data + offset; > + > + /* Each field of the template data is prefixed with a length. */ > + if (offset > (template_data_size - sizeof(field_data->len))) { > + pr_err("Restoring the template field failed\n"); > + ret = -EINVAL; > + break; > + } > + offset += sizeof(field_data->len); > + > + if (offset > (template_data_size - field_data->len)) { > + pr_err("Restoring the template field data failed\n"); > + ret = -EINVAL; > + break; > + } > + offset += field_data->len; > + > + (*entry)->template_data[i].len = field_data->len; > + (*entry)->template_data_len += sizeof(field_data->len); > + > + (*entry)->template_data[i].data = > + kzalloc(field_data->len + 1, GFP_KERNEL); > + if (!(*entry)->template_data[i].data) { > + ret = -ENOMEM; > + break; > + } > + memcpy((*entry)->template_data[i].data, field_data->data, > + field_data->len); > + (*entry)->template_data_len += field_data->len; > + } > + > + if (ret < 0) { > + ima_free_template_entry(*entry); > + *entry = NULL; > + } > + > + return ret; > +} > + > +/* Restore the serialized binary measurement list without extending PCRs. */ > +int ima_restore_measurement_list(loff_t size, void *buf) > +{ > + struct binary_hdr_v1 { > + u32 pcr; > + u8 digest[TPM_DIGEST_SIZE]; > + u32 template_name_len; > + char template_name[0]; > + } __packed; > + char template_name[MAX_TEMPLATE_NAME_LEN]; > + > + struct binary_data_v1 { > + u32 template_data_size; > + char template_data[0]; > + } __packed; > + > + struct ima_kexec_hdr *khdr = buf; > + struct binary_hdr_v1 *hdr_v1; > + struct binary_data_v1 *data_v1; > + > + void *bufp = buf + sizeof(*khdr); > + void *bufendp = buf + khdr->buffer_size; > + struct ima_template_entry *entry; > + struct ima_template_desc *template_desc; > + unsigned long count = 0; > + int ret = 0; > + > + if (!buf || size < sizeof(*khdr)) > + return 0; > + > + if (khdr->version != 1) { > + pr_err("attempting to restore a incompatible measurement list"); > + return 0; > + } > + > + /* > + * ima kexec buffer prefix: version, buffer size, count > + * v1 format: pcr, digest, template-name-len, template-name, > + * template-data-size, template-data > + */ > + while ((bufp < bufendp) && (count++ < khdr->count)) { > + if (count > ULONG_MAX - 1) { > + pr_err("attempting to restore too many measurements"); > + ret = -EINVAL; > + } > + > + hdr_v1 = bufp; > + if ((hdr_v1->template_name_len >= MAX_TEMPLATE_NAME_LEN) || > + ((bufp + hdr_v1->template_name_len) > bufendp)) { based on following code template_name_len does not include header (sizeof(*hdr_v1))? If so the check is wrong??? > + pr_err("attempting to restore a template name \ > + that is too long\n"); > + ret = -EINVAL; > + break; > + } > + bufp += sizeof(*hdr_v1); > + > + /* template name is not null terminated */ > + memcpy(template_name, bufp, hdr_v1->template_name_len); > + template_name[hdr_v1->template_name_len] = 0; > + > + if (strcmp(template_name, "ima") == 0) { > + pr_err("attempting to restore an unsupported \ > + template \"%s\" failed\n", template_name); > + ret = -EINVAL; > + break; > + } > + data_v1 = bufp += (u_int8_t)hdr_v1->template_name_len; > + > + /* get template format */ > + template_desc = lookup_template_desc(template_name); > + if (!template_desc) { > + pr_err("template \"%s\" not found\n", template_name); > + ret = -EINVAL; > + break; > + } > + > + if (bufp > (bufendp - sizeof(data_v1->template_data_size))) { > + pr_err("restoring the template data size failed\n"); > + ret = -EINVAL; > + break; > + } > + bufp += (u_int8_t) sizeof(data_v1->template_data_size); > + > + if (bufp > (bufendp - data_v1->template_data_size)) { > + pr_err("restoring the template data failed\n"); > + ret = -EINVAL; > + break; > + } > + It looks like a similar problem... sizeof(struct binary_data_v1) is missing in the check... > + ret = ima_restore_template_data(template_desc, > + data_v1->template_data, > + data_v1->template_data_size, > + &entry); > + if (ret < 0) > + break; > + > + memcpy(entry->digest, hdr_v1->digest, TPM_DIGEST_SIZE); > + entry->pcr = hdr_v1->pcr; > + ret = ima_restore_measurement_entry(entry); > + if (ret < 0) > + break; > + > + bufp += data_v1->template_data_size; > + } > + return ret; > +} > -- > 2.7.4 > In overall it is a bit hard to read this function somehow.. Dmitry > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, SlashDot.org! http://sdm.link/slashdot > _______________________________________________ > Linux-ima-devel mailing list > Linux-ima-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/linux-ima-devel
On Tue, 2016-11-08 at 21:46 +0200, Dmitry Kasatkin wrote: > On Fri, Oct 21, 2016 at 5:44 AM, Thiago Jung Bauermann > <bauerman@linux.vnet.ibm.com> wrote: > > From: Mimi Zohar <zohar@linux.vnet.ibm.com> > > > > The TPM PCRs are only reset on a hard reboot. In order to validate a > > TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement list > > of the running kernel must be saved and restored on boot. This patch > > restores the measurement list. > > > > Changelog v5: > > - replace CONFIG_KEXEC_FILE with architecture CONFIG_HAVE_IMA_KEXEC (Thiago) > > - replace kexec_get_handover_buffer() with ima_get_kexec_buffer() (Thiago) > > - replace kexec_free_handover_buffer() with ima_free_kexec_buffer() (Thiago) > > - remove unnecessary includes from ima_kexec.c (Thiago) > > - fix off-by-one error when checking hdr_v1->template_name_len (Colin King) > > > > Changelog v2: > > - redefined ima_kexec_hdr to use types with well defined sizes (M. Ellerman) > > - defined missing ima_load_kexec_buffer() stub function > > > > Changelog v1: > > - call ima_load_kexec_buffer() (Thiago) > > > > Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> > > --- > > security/integrity/ima/Makefile | 1 + > > security/integrity/ima/ima.h | 21 +++++ > > security/integrity/ima/ima_init.c | 2 + > > security/integrity/ima/ima_kexec.c | 44 +++++++++ > > security/integrity/ima/ima_queue.c | 10 ++ > > security/integrity/ima/ima_template.c | 170 ++++++++++++++++++++++++++++++++++ > > 6 files changed, 248 insertions(+) > > > > diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile > > index 9aeaedad1e2b..29f198bde02b 100644 > > --- a/security/integrity/ima/Makefile > > +++ b/security/integrity/ima/Makefile > > @@ -8,4 +8,5 @@ obj-$(CONFIG_IMA) += ima.o > > ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \ > > ima_policy.o ima_template.o ima_template_lib.o > > ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o > > +ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o > > obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o > > diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h > > index db25f54a04fe..51dc8d57d64d 100644 > > --- a/security/integrity/ima/ima.h > > +++ b/security/integrity/ima/ima.h > > @@ -28,6 +28,10 @@ > > > > #include "../integrity.h" > > > > +#ifdef CONFIG_HAVE_IMA_KEXEC > > +#include <asm/ima.h> > > +#endif > > + > > enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, > > IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; > > enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; > > @@ -102,6 +106,21 @@ struct ima_queue_entry { > > }; > > extern struct list_head ima_measurements; /* list of all measurements */ > > > > +/* Some details preceding the binary serialized measurement list */ > > +struct ima_kexec_hdr { > > + u16 version; > > + u16 _reserved0; > > + u32 _reserved1; > > + u64 buffer_size; > > + u64 count; > > +}; > > + > > +#ifdef CONFIG_HAVE_IMA_KEXEC > > +void ima_load_kexec_buffer(void); > > +#else > > +static inline void ima_load_kexec_buffer(void) {} > > +#endif /* CONFIG_HAVE_IMA_KEXEC */ > > + > > /* Internal IMA function definitions */ > > int ima_init(void); > > int ima_fs_init(void); > > @@ -122,6 +141,8 @@ int ima_init_crypto(void); > > void ima_putc(struct seq_file *m, void *data, int datalen); > > void ima_print_digest(struct seq_file *m, u8 *digest, u32 size); > > struct ima_template_desc *ima_template_desc_current(void); > > +int ima_restore_measurement_entry(struct ima_template_entry *entry); > > +int ima_restore_measurement_list(loff_t bufsize, void *buf); > > int ima_init_template(void); > > > > /* > > diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c > > index 32912bd54ead..3ba0ca49cba6 100644 > > --- a/security/integrity/ima/ima_init.c > > +++ b/security/integrity/ima/ima_init.c > > @@ -128,6 +128,8 @@ int __init ima_init(void) > > if (rc != 0) > > return rc; > > > > + ima_load_kexec_buffer(); > > + > > rc = ima_add_boot_aggregate(); /* boot aggregate must be first entry */ > > if (rc != 0) > > return rc; > > diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c > > new file mode 100644 > > index 000000000000..36afd0fe9747 > > --- /dev/null > > +++ b/security/integrity/ima/ima_kexec.c > > @@ -0,0 +1,44 @@ > > +/* > > + * Copyright (C) 2016 IBM Corporation > > + * > > + * Authors: > > + * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> > > + * Mimi Zohar <zohar@linux.vnet.ibm.com> > > + * > > + * This program is free software; you can redistribute it and/or modify > > + * it under the terms of the GNU General Public License as published by > > + * the Free Software Foundation; either version 2 of the License, or > > + * (at your option) any later version. > > + */ > > +#include "ima.h" > > + > > +/* > > + * Restore the measurement list from the previous kernel. > > + */ > > +void ima_load_kexec_buffer(void) > > +{ > > + void *kexec_buffer = NULL; > > + size_t kexec_buffer_size = 0; > > + int rc; > > + > > + rc = ima_get_kexec_buffer(&kexec_buffer, &kexec_buffer_size); > > + switch (rc) { > > + case 0: > > + rc = ima_restore_measurement_list(kexec_buffer_size, > > + kexec_buffer); > > + if (rc != 0) > > + pr_err("Failed to restore the measurement list: %d\n", > > + rc); > > + > > + ima_free_kexec_buffer(); > > + break; > > + case -ENOTSUPP: > > + pr_debug("Restoring the measurement list not supported\n"); > > + break; > > + case -ENOENT: > > + pr_debug("No measurement list to restore\n"); > > + break; > > + default: > > + pr_debug("Error restoring the measurement list: %d\n", rc); > > + } > > +} > > diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c > > index 32f6ac0f96df..4b1bb7787839 100644 > > --- a/security/integrity/ima/ima_queue.c > > +++ b/security/integrity/ima/ima_queue.c > > @@ -149,3 +149,13 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation, > > op, audit_cause, result, audit_info); > > return result; > > } > > + > > +int ima_restore_measurement_entry(struct ima_template_entry *entry) > > +{ > > + int result = 0; > > + > > + mutex_lock(&ima_extend_list_mutex); > > + result = ima_add_digest_entry(entry); > > + mutex_unlock(&ima_extend_list_mutex); > > + return result; > > +} > > diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c > > index febd12ed9b55..37f972cb05fe 100644 > > --- a/security/integrity/ima/ima_template.c > > +++ b/security/integrity/ima/ima_template.c > > @@ -37,6 +37,7 @@ static struct ima_template_field supported_fields[] = { > > {.field_id = "sig", .field_init = ima_eventsig_init, > > .field_show = ima_show_template_sig}, > > }; > > +#define MAX_TEMPLATE_NAME_LEN 15 > > > > static struct ima_template_desc *ima_template; > > static struct ima_template_desc *lookup_template_desc(const char *name); > > @@ -205,3 +206,172 @@ int __init ima_init_template(void) > > > > return result; > > } > > + > > +static int ima_restore_template_data(struct ima_template_desc *template_desc, > > + void *template_data, > > + int template_data_size, > > + struct ima_template_entry **entry) > > +{ > > + struct binary_field_data { > > + u32 len; > > + u8 data[0]; > > + } __packed; > > + > > + struct binary_field_data *field_data; > > + int offset = 0; > > + int ret = 0; > > + int i; > > + > > + *entry = kzalloc(sizeof(**entry) + > > + template_desc->num_fields * sizeof(struct ima_field_data), > > + GFP_NOFS); > > + if (!*entry) > > + return -ENOMEM; > > + > > + (*entry)->template_desc = template_desc; > > + for (i = 0; i < template_desc->num_fields; i++) { > > + field_data = template_data + offset; > > + > > + /* Each field of the template data is prefixed with a length. */ > > + if (offset > (template_data_size - sizeof(field_data->len))) { > > + pr_err("Restoring the template field failed\n"); > > + ret = -EINVAL; > > + break; > > + } > > + offset += sizeof(field_data->len); > > + > > + if (offset > (template_data_size - field_data->len)) { > > + pr_err("Restoring the template field data failed\n"); > > + ret = -EINVAL; > > + break; > > + } > > + offset += field_data->len; > > + > > + (*entry)->template_data[i].len = field_data->len; > > + (*entry)->template_data_len += sizeof(field_data->len); > > + > > + (*entry)->template_data[i].data = > > + kzalloc(field_data->len + 1, GFP_KERNEL); > > + if (!(*entry)->template_data[i].data) { > > + ret = -ENOMEM; > > + break; > > + } > > + memcpy((*entry)->template_data[i].data, field_data->data, > > + field_data->len); > > + (*entry)->template_data_len += field_data->len; > > + } > > + > > + if (ret < 0) { > > + ima_free_template_entry(*entry); > > + *entry = NULL; > > + } > > + > > + return ret; > > +} > > + > > +/* Restore the serialized binary measurement list without extending PCRs. */ > > +int ima_restore_measurement_list(loff_t size, void *buf) > > +{ > > + struct binary_hdr_v1 { > > + u32 pcr; > > + u8 digest[TPM_DIGEST_SIZE]; > > + u32 template_name_len; > > + char template_name[0]; > > + } __packed; > > + char template_name[MAX_TEMPLATE_NAME_LEN]; > > + > > + struct binary_data_v1 { > > + u32 template_data_size; > > + char template_data[0]; > > + } __packed; > > + > > + struct ima_kexec_hdr *khdr = buf; > > + struct binary_hdr_v1 *hdr_v1; > > + struct binary_data_v1 *data_v1; > > + > > + void *bufp = buf + sizeof(*khdr); > > + void *bufendp = buf + khdr->buffer_size; > > + struct ima_template_entry *entry; > > + struct ima_template_desc *template_desc; > > + unsigned long count = 0; > > + int ret = 0; > > + > > + if (!buf || size < sizeof(*khdr)) > > + return 0; > > + > > + if (khdr->version != 1) { > > + pr_err("attempting to restore a incompatible measurement list"); > > + return 0; > > + } > > + > > + /* > > + * ima kexec buffer prefix: version, buffer size, count > > + * v1 format: pcr, digest, template-name-len, template-name, > > + * template-data-size, template-data > > + */ > > + while ((bufp < bufendp) && (count++ < khdr->count)) { > > + if (count > ULONG_MAX - 1) { > > + pr_err("attempting to restore too many measurements"); > > + ret = -EINVAL; > > + } > > + > > + hdr_v1 = bufp; > > + if ((hdr_v1->template_name_len >= MAX_TEMPLATE_NAME_LEN) || > > + ((bufp + hdr_v1->template_name_len) > bufendp)) { > > based on following code template_name_len does not include header > (sizeof(*hdr_v1))? > If so the check is wrong??? Yes, good catch. In addition, before assigning hdr_v1 there should be a size check as well. > > > + pr_err("attempting to restore a template name \ > > + that is too long\n"); > > + ret = -EINVAL; > > + break; > > + } > > + bufp += sizeof(*hdr_v1); > > + > > + /* template name is not null terminated */ > > + memcpy(template_name, bufp, hdr_v1->template_name_len); > > + template_name[hdr_v1->template_name_len] = 0; > > + > > + if (strcmp(template_name, "ima") == 0) { > > + pr_err("attempting to restore an unsupported \ > > + template \"%s\" failed\n", template_name); > > + ret = -EINVAL; > > + break; > > + } > > + data_v1 = bufp += (u_int8_t)hdr_v1->template_name_len; > > + > > + /* get template format */ > > + template_desc = lookup_template_desc(template_name); > > + if (!template_desc) { > > + pr_err("template \"%s\" not found\n", template_name); > > + ret = -EINVAL; > > + break; > > + } > > + > > + if (bufp > (bufendp - sizeof(data_v1->template_data_size))) { > > + pr_err("restoring the template data size failed\n"); > > + ret = -EINVAL; > > + break; > > + } > > + bufp += (u_int8_t) sizeof(data_v1->template_data_size); > > + > > + if (bufp > (bufendp - data_v1->template_data_size)) { > > + pr_err("restoring the template data failed\n"); > > + ret = -EINVAL; > > + break; > > + } > > + > > It looks like a similar problem... sizeof(struct binary_data_v1) is > missing in the check... Following the template name, is the template data length and the template data. > > + ret = ima_restore_template_data(template_desc, > > + data_v1->template_data, > > + data_v1->template_data_size, > > + &entry); > > + if (ret < 0) > > + break; > > + > > + memcpy(entry->digest, hdr_v1->digest, TPM_DIGEST_SIZE); > > + entry->pcr = hdr_v1->pcr; > > + ret = ima_restore_measurement_entry(entry); > > + if (ret < 0) > > + break; > > + > > + bufp += data_v1->template_data_size; > > + } > > + return ret; > > +} > > -- > > 2.7.4 > > > > In overall it is a bit hard to read this function somehow.. Ok, I'll see if there is any way of simplifying/cleaning up walking the measurement list some more. Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Tue, 2016-11-08 at 15:47 -0500, Mimi Zohar wrote: > On Tue, 2016-11-08 at 21:46 +0200, Dmitry Kasatkin wrote: > > On Fri, Oct 21, 2016 at 5:44 AM, Thiago Jung Bauermann > > > +/* Restore the serialized binary measurement list without extending PCRs. */ > > > +int ima_restore_measurement_list(loff_t size, void *buf) > > > +{ > > > + struct binary_hdr_v1 { > > > + u32 pcr; > > > + u8 digest[TPM_DIGEST_SIZE]; > > > + u32 template_name_len; > > > + char template_name[0]; > > > + } __packed; > > > + char template_name[MAX_TEMPLATE_NAME_LEN]; > > > + > > > + struct binary_data_v1 { > > > + u32 template_data_size; > > > + char template_data[0]; > > > + } __packed; > > > + > > > + struct ima_kexec_hdr *khdr = buf; > > > + struct binary_hdr_v1 *hdr_v1; > > > + struct binary_data_v1 *data_v1; > > > + > > > + void *bufp = buf + sizeof(*khdr); > > > + void *bufendp = buf + khdr->buffer_size; > > > + struct ima_template_entry *entry; > > > + struct ima_template_desc *template_desc; > > > + unsigned long count = 0; > > > + int ret = 0; > > > + > > > + if (!buf || size < sizeof(*khdr)) > > > + return 0; > > > + > > > + if (khdr->version != 1) { > > > + pr_err("attempting to restore a incompatible measurement list"); > > > + return 0; > > > + } > > > + > > > + /* > > > + * ima kexec buffer prefix: version, buffer size, count > > > + * v1 format: pcr, digest, template-name-len, template-name, > > > + * template-data-size, template-data > > > + */ > > > + while ((bufp < bufendp) && (count++ < khdr->count)) { > > > + if (count > ULONG_MAX - 1) { > > > + pr_err("attempting to restore too many measurements"); > > > + ret = -EINVAL; > > > + } > > > + > > > + hdr_v1 = bufp; > > > + if ((hdr_v1->template_name_len >= MAX_TEMPLATE_NAME_LEN) || > > > + ((bufp + hdr_v1->template_name_len) > bufendp)) { > > > > based on following code template_name_len does not include header > > (sizeof(*hdr_v1))? > > If so the check is wrong??? > > Yes, good catch. In addition, before assigning hdr_v1 there should be a > size check as well. > > > > > > + pr_err("attempting to restore a template name \ > > > + that is too long\n"); > > > + ret = -EINVAL; > > > + break; > > > + } > > > + bufp += sizeof(*hdr_v1); This line should have been before the test above. > > > + > > > + /* template name is not null terminated */ > > > + memcpy(template_name, bufp, hdr_v1->template_name_len); > > > + template_name[hdr_v1->template_name_len] = 0; > > > + > > > + if (strcmp(template_name, "ima") == 0) { > > > + pr_err("attempting to restore an unsupported \ > > > + template \"%s\" failed\n", template_name); > > > + ret = -EINVAL; > > > + break; > > > + } > > > + data_v1 = bufp += (u_int8_t)hdr_v1->template_name_len; > > > + > > > + /* get template format */ > > > + template_desc = lookup_template_desc(template_name); > > > + if (!template_desc) { > > > + pr_err("template \"%s\" not found\n", template_name); > > > + ret = -EINVAL; > > > + break; > > > + } > > > + > > > + if (bufp > (bufendp - sizeof(data_v1->template_data_size))) { > > > + pr_err("restoring the template data size failed\n"); > > > + ret = -EINVAL; > > > + break; > > > + } > > > + bufp += (u_int8_t) sizeof(data_v1->template_data_size); > > > + > > > + if (bufp > (bufendp - data_v1->template_data_size)) { > > > + pr_err("restoring the template data failed\n"); > > > + ret = -EINVAL; > > > + break; > > > + } > > > + > > > > It looks like a similar problem... sizeof(struct binary_data_v1) is > > missing in the check... > > Following the template name, is the template data length and the > template data. > > > > + ret = ima_restore_template_data(template_desc, > > > + data_v1->template_data, > > > + data_v1->template_data_size, > > > + &entry); > > > + if (ret < 0) > > > + break; > > > + > > > + memcpy(entry->digest, hdr_v1->digest, TPM_DIGEST_SIZE); > > > + entry->pcr = hdr_v1->pcr; > > > + ret = ima_restore_measurement_entry(entry); > > > + if (ret < 0) > > > + break; > > > + > > > + bufp += data_v1->template_data_size; > > > + } > > > + return ret; > > > +} > > > -- > > > 2.7.4 > > > > > > > In overall it is a bit hard to read this function somehow.. > > Ok, I'll see if there is any way of simplifying/cleaning up walking the > measurement list some more. I moved some code around so that the bufp pointer update is immediately after the buffer overflow tests and moved one check outside the while loop. I tried defining a buffer overflow macro, but that didn't seem to help. The updated patches are available in the next-kexec-restore branch of: git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile index 9aeaedad1e2b..29f198bde02b 100644 --- a/security/integrity/ima/Makefile +++ b/security/integrity/ima/Makefile @@ -8,4 +8,5 @@ obj-$(CONFIG_IMA) += ima.o ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \ ima_policy.o ima_template.o ima_template_lib.o ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o +ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index db25f54a04fe..51dc8d57d64d 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -28,6 +28,10 @@ #include "../integrity.h" +#ifdef CONFIG_HAVE_IMA_KEXEC +#include <asm/ima.h> +#endif + enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; @@ -102,6 +106,21 @@ struct ima_queue_entry { }; extern struct list_head ima_measurements; /* list of all measurements */ +/* Some details preceding the binary serialized measurement list */ +struct ima_kexec_hdr { + u16 version; + u16 _reserved0; + u32 _reserved1; + u64 buffer_size; + u64 count; +}; + +#ifdef CONFIG_HAVE_IMA_KEXEC +void ima_load_kexec_buffer(void); +#else +static inline void ima_load_kexec_buffer(void) {} +#endif /* CONFIG_HAVE_IMA_KEXEC */ + /* Internal IMA function definitions */ int ima_init(void); int ima_fs_init(void); @@ -122,6 +141,8 @@ int ima_init_crypto(void); void ima_putc(struct seq_file *m, void *data, int datalen); void ima_print_digest(struct seq_file *m, u8 *digest, u32 size); struct ima_template_desc *ima_template_desc_current(void); +int ima_restore_measurement_entry(struct ima_template_entry *entry); +int ima_restore_measurement_list(loff_t bufsize, void *buf); int ima_init_template(void); /* diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c index 32912bd54ead..3ba0ca49cba6 100644 --- a/security/integrity/ima/ima_init.c +++ b/security/integrity/ima/ima_init.c @@ -128,6 +128,8 @@ int __init ima_init(void) if (rc != 0) return rc; + ima_load_kexec_buffer(); + rc = ima_add_boot_aggregate(); /* boot aggregate must be first entry */ if (rc != 0) return rc; diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c new file mode 100644 index 000000000000..36afd0fe9747 --- /dev/null +++ b/security/integrity/ima/ima_kexec.c @@ -0,0 +1,44 @@ +/* + * Copyright (C) 2016 IBM Corporation + * + * Authors: + * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> + * Mimi Zohar <zohar@linux.vnet.ibm.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + */ +#include "ima.h" + +/* + * Restore the measurement list from the previous kernel. + */ +void ima_load_kexec_buffer(void) +{ + void *kexec_buffer = NULL; + size_t kexec_buffer_size = 0; + int rc; + + rc = ima_get_kexec_buffer(&kexec_buffer, &kexec_buffer_size); + switch (rc) { + case 0: + rc = ima_restore_measurement_list(kexec_buffer_size, + kexec_buffer); + if (rc != 0) + pr_err("Failed to restore the measurement list: %d\n", + rc); + + ima_free_kexec_buffer(); + break; + case -ENOTSUPP: + pr_debug("Restoring the measurement list not supported\n"); + break; + case -ENOENT: + pr_debug("No measurement list to restore\n"); + break; + default: + pr_debug("Error restoring the measurement list: %d\n", rc); + } +} diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c index 32f6ac0f96df..4b1bb7787839 100644 --- a/security/integrity/ima/ima_queue.c +++ b/security/integrity/ima/ima_queue.c @@ -149,3 +149,13 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation, op, audit_cause, result, audit_info); return result; } + +int ima_restore_measurement_entry(struct ima_template_entry *entry) +{ + int result = 0; + + mutex_lock(&ima_extend_list_mutex); + result = ima_add_digest_entry(entry); + mutex_unlock(&ima_extend_list_mutex); + return result; +} diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c index febd12ed9b55..37f972cb05fe 100644 --- a/security/integrity/ima/ima_template.c +++ b/security/integrity/ima/ima_template.c @@ -37,6 +37,7 @@ static struct ima_template_field supported_fields[] = { {.field_id = "sig", .field_init = ima_eventsig_init, .field_show = ima_show_template_sig}, }; +#define MAX_TEMPLATE_NAME_LEN 15 static struct ima_template_desc *ima_template; static struct ima_template_desc *lookup_template_desc(const char *name); @@ -205,3 +206,172 @@ int __init ima_init_template(void) return result; } + +static int ima_restore_template_data(struct ima_template_desc *template_desc, + void *template_data, + int template_data_size, + struct ima_template_entry **entry) +{ + struct binary_field_data { + u32 len; + u8 data[0]; + } __packed; + + struct binary_field_data *field_data; + int offset = 0; + int ret = 0; + int i; + + *entry = kzalloc(sizeof(**entry) + + template_desc->num_fields * sizeof(struct ima_field_data), + GFP_NOFS); + if (!*entry) + return -ENOMEM; + + (*entry)->template_desc = template_desc; + for (i = 0; i < template_desc->num_fields; i++) { + field_data = template_data + offset; + + /* Each field of the template data is prefixed with a length. */ + if (offset > (template_data_size - sizeof(field_data->len))) { + pr_err("Restoring the template field failed\n"); + ret = -EINVAL; + break; + } + offset += sizeof(field_data->len); + + if (offset > (template_data_size - field_data->len)) { + pr_err("Restoring the template field data failed\n"); + ret = -EINVAL; + break; + } + offset += field_data->len; + + (*entry)->template_data[i].len = field_data->len; + (*entry)->template_data_len += sizeof(field_data->len); + + (*entry)->template_data[i].data = + kzalloc(field_data->len + 1, GFP_KERNEL); + if (!(*entry)->template_data[i].data) { + ret = -ENOMEM; + break; + } + memcpy((*entry)->template_data[i].data, field_data->data, + field_data->len); + (*entry)->template_data_len += field_data->len; + } + + if (ret < 0) { + ima_free_template_entry(*entry); + *entry = NULL; + } + + return ret; +} + +/* Restore the serialized binary measurement list without extending PCRs. */ +int ima_restore_measurement_list(loff_t size, void *buf) +{ + struct binary_hdr_v1 { + u32 pcr; + u8 digest[TPM_DIGEST_SIZE]; + u32 template_name_len; + char template_name[0]; + } __packed; + char template_name[MAX_TEMPLATE_NAME_LEN]; + + struct binary_data_v1 { + u32 template_data_size; + char template_data[0]; + } __packed; + + struct ima_kexec_hdr *khdr = buf; + struct binary_hdr_v1 *hdr_v1; + struct binary_data_v1 *data_v1; + + void *bufp = buf + sizeof(*khdr); + void *bufendp = buf + khdr->buffer_size; + struct ima_template_entry *entry; + struct ima_template_desc *template_desc; + unsigned long count = 0; + int ret = 0; + + if (!buf || size < sizeof(*khdr)) + return 0; + + if (khdr->version != 1) { + pr_err("attempting to restore a incompatible measurement list"); + return 0; + } + + /* + * ima kexec buffer prefix: version, buffer size, count + * v1 format: pcr, digest, template-name-len, template-name, + * template-data-size, template-data + */ + while ((bufp < bufendp) && (count++ < khdr->count)) { + if (count > ULONG_MAX - 1) { + pr_err("attempting to restore too many measurements"); + ret = -EINVAL; + } + + hdr_v1 = bufp; + if ((hdr_v1->template_name_len >= MAX_TEMPLATE_NAME_LEN) || + ((bufp + hdr_v1->template_name_len) > bufendp)) { + pr_err("attempting to restore a template name \ + that is too long\n"); + ret = -EINVAL; + break; + } + bufp += sizeof(*hdr_v1); + + /* template name is not null terminated */ + memcpy(template_name, bufp, hdr_v1->template_name_len); + template_name[hdr_v1->template_name_len] = 0; + + if (strcmp(template_name, "ima") == 0) { + pr_err("attempting to restore an unsupported \ + template \"%s\" failed\n", template_name); + ret = -EINVAL; + break; + } + data_v1 = bufp += (u_int8_t)hdr_v1->template_name_len; + + /* get template format */ + template_desc = lookup_template_desc(template_name); + if (!template_desc) { + pr_err("template \"%s\" not found\n", template_name); + ret = -EINVAL; + break; + } + + if (bufp > (bufendp - sizeof(data_v1->template_data_size))) { + pr_err("restoring the template data size failed\n"); + ret = -EINVAL; + break; + } + bufp += (u_int8_t) sizeof(data_v1->template_data_size); + + if (bufp > (bufendp - data_v1->template_data_size)) { + pr_err("restoring the template data failed\n"); + ret = -EINVAL; + break; + } + + ret = ima_restore_template_data(template_desc, + data_v1->template_data, + data_v1->template_data_size, + &entry); + if (ret < 0) + break; + + memcpy(entry->digest, hdr_v1->digest, TPM_DIGEST_SIZE); + entry->pcr = hdr_v1->pcr; + ret = ima_restore_measurement_entry(entry); + if (ret < 0) + break; + + bufp += data_v1->template_data_size; + } + return ret; +}