diff mbox series

[v5,1/2] IMA: Define workqueue for early boot "key" measurements

Message ID 20191218164434.2877-2-nramas@linux.microsoft.com (mailing list archive)
State New, archived
Headers show
Series IMA: Deferred measurement of keys | expand

Commit Message

Lakshmi Ramasubramanian Dec. 18, 2019, 4:44 p.m. UTC
Measuring keys requires a custom IMA policy to be loaded.
Keys created or updated before a custom IMA policy is loaded should
be queued and the keys should be processed after a custom policy
is loaded.

This patch defines workqueue for queuing keys when a custom IMA policy
has not yet been loaded.

A flag namely ima_process_keys is used to check if the key should be
queued or should be processed immediately.

Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
---
 security/integrity/ima/ima.h                 |  15 +++
 security/integrity/ima/ima_asymmetric_keys.c | 115 +++++++++++++++++++
 2 files changed, 130 insertions(+)

Comments

Mimi Zohar Dec. 19, 2019, 1:11 p.m. UTC | #1
On Wed, 2019-12-18 at 08:44 -0800, Lakshmi Ramasubramanian wrote:
> +/*
> + * ima_process_queued_keys() - process keys queued for measurement
> + *
> + * This function sets ima_process_keys to true and processes queued keys.
> + * From here on keys will be processed right away (not queued).
> + */
> +void ima_process_queued_keys(void)
> +{
> +	struct ima_key_entry *entry, *tmp;
> +	bool process = false;
> +
> +	if (ima_process_keys)
> +		return;
> +
> +	/*
> +	 * Since ima_process_keys is set to true, any new key will be
> +	 * processed immediately and not be queued to ima_keys list.
> +	 * First one setting the ima_process_keys flag to true will
> +	 * process the queued keys.
> +	 */
> +	mutex_lock(&ima_keys_mutex);
> +	if (!ima_process_keys) {
> +		ima_process_keys = true;
> +		process = true;
> +	}
> +	mutex_unlock(&ima_keys_mutex);
> +
> +	if (!process)
> +		return;
> +
> +	list_for_each_entry_safe(entry, tmp, &ima_keys, list) {
> +		process_buffer_measurement(entry->payload, entry->payload_len,
> +					   entry->keyring_name, KEY_CHECK, 0,
> +					   entry->keyring_name);
> +		list_del(&entry->list);
> +		ima_free_key_entry(entry);
> +	}
> +}
> +

Getting rid of the temporary list is definitely a big improvement.  As
James suggested, using test_and_set_bit() and test_bit() would improve
this code even more.  I think, James correct me if I'm wrong, you
would be able to get rid of both the mutex and "process".

Mimi


>  /**
>   * ima_post_key_create_or_update - measure asymmetric keys
>   * @keyring: keyring to which the key is linked to
Lakshmi Ramasubramanian Dec. 19, 2019, 4:55 p.m. UTC | #2
On 12/19/19 5:11 AM, Mimi Zohar wrote:

> 
> Getting rid of the temporary list is definitely a big improvement.  As
> James suggested, using test_and_set_bit() and test_bit() would improve
> this code even more.  I think, James correct me if I'm wrong, you
> would be able to get rid of both the mutex and "process".
> 
> Mimi

I am not sure if the mutex can be removed.

In ima_queue_key() we need to test the flag and add the key to the list 
as an atomic operation:

  if (!test_bit())
     insert_key_to_list

Suppose the if condition is true, but before we could insert the key to 
the list, ima_process_queued_keys() runs and processes queued keys we'll 
add the key to the list and never process it.

Is there an API in the kernel to test and add an entry to a list 
atomically?

thanks,
  -lakshmi
Mimi Zohar Dec. 20, 2019, 12:53 p.m. UTC | #3
On Thu, 2019-12-19 at 08:55 -0800, Lakshmi Ramasubramanian wrote:
> I am not sure if the mutex can be removed.
> 
> In ima_queue_key() we need to test the flag and add the key to the list 
> as an atomic operation:
> 
>   if (!test_bit())
>      insert_key_to_list
> 
> Suppose the if condition is true, but before we could insert the key to 
> the list, ima_process_queued_keys() runs and processes queued keys we'll 
> add the key to the list and never process it.
> 
> Is there an API in the kernel to test and add an entry to a list 
> atomically?

Ok, using test_and_set_bit() and test_bit() only helps, if we can get
rid of the mutex.  I'll queue these patches.

thanks,

Mimi
diff mbox series

Patch

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index f06238e41a7c..97f8a4078483 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -205,6 +205,21 @@  extern const char *const func_tokens[];
 
 struct modsig;
 
+#ifdef CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+/*
+ * To track keys that need to be measured.
+ */
+struct ima_key_entry {
+	struct list_head list;
+	void *payload;
+	size_t payload_len;
+	char *keyring_name;
+};
+void ima_process_queued_keys(void);
+#else
+static inline void ima_process_queued_keys(void) {}
+#endif /* CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE */
+
 /* LIM API function definitions */
 int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
 		   int mask, enum ima_hooks func, int *pcr,
diff --git a/security/integrity/ima/ima_asymmetric_keys.c b/security/integrity/ima/ima_asymmetric_keys.c
index fea2e7dd3b09..d520a67180d8 100644
--- a/security/integrity/ima/ima_asymmetric_keys.c
+++ b/security/integrity/ima/ima_asymmetric_keys.c
@@ -14,6 +14,121 @@ 
 #include <keys/asymmetric-type.h>
 #include "ima.h"
 
+/*
+ * Flag to indicate whether a key can be processed
+ * right away or should be queued for processing later.
+ */
+static bool ima_process_keys;
+
+/*
+ * To synchronize access to the list of keys that need to be measured
+ */
+static DEFINE_MUTEX(ima_keys_mutex);
+static LIST_HEAD(ima_keys);
+
+static void ima_free_key_entry(struct ima_key_entry *entry)
+{
+	if (entry) {
+		kfree(entry->payload);
+		kfree(entry->keyring_name);
+		kfree(entry);
+	}
+}
+
+static struct ima_key_entry *ima_alloc_key_entry(
+	struct key *keyring,
+	const void *payload, size_t payload_len)
+{
+	int rc = 0;
+	struct ima_key_entry *entry;
+
+	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+	if (entry) {
+		entry->payload = kmemdup(payload, payload_len, GFP_KERNEL);
+		entry->keyring_name = kstrdup(keyring->description,
+					      GFP_KERNEL);
+		entry->payload_len = payload_len;
+	}
+
+	if ((entry == NULL) || (entry->payload == NULL) ||
+	    (entry->keyring_name == NULL)) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	INIT_LIST_HEAD(&entry->list);
+
+out:
+	if (rc) {
+		ima_free_key_entry(entry);
+		entry = NULL;
+	}
+
+	return entry;
+}
+
+bool ima_queue_key(struct key *keyring, const void *payload,
+		   size_t payload_len)
+{
+	bool queued = false;
+	struct ima_key_entry *entry;
+
+	entry = ima_alloc_key_entry(keyring, payload, payload_len);
+	if (!entry)
+		return false;
+
+	mutex_lock(&ima_keys_mutex);
+	if (!ima_process_keys) {
+		list_add_tail(&entry->list, &ima_keys);
+		queued = true;
+	}
+	mutex_unlock(&ima_keys_mutex);
+
+	if (!queued)
+		ima_free_key_entry(entry);
+
+	return queued;
+}
+
+/*
+ * ima_process_queued_keys() - process keys queued for measurement
+ *
+ * This function sets ima_process_keys to true and processes queued keys.
+ * From here on keys will be processed right away (not queued).
+ */
+void ima_process_queued_keys(void)
+{
+	struct ima_key_entry *entry, *tmp;
+	bool process = false;
+
+	if (ima_process_keys)
+		return;
+
+	/*
+	 * Since ima_process_keys is set to true, any new key will be
+	 * processed immediately and not be queued to ima_keys list.
+	 * First one setting the ima_process_keys flag to true will
+	 * process the queued keys.
+	 */
+	mutex_lock(&ima_keys_mutex);
+	if (!ima_process_keys) {
+		ima_process_keys = true;
+		process = true;
+	}
+	mutex_unlock(&ima_keys_mutex);
+
+	if (!process)
+		return;
+
+	list_for_each_entry_safe(entry, tmp, &ima_keys, list) {
+		process_buffer_measurement(entry->payload, entry->payload_len,
+					   entry->keyring_name, KEY_CHECK, 0,
+					   entry->keyring_name);
+		list_del(&entry->list);
+		ima_free_key_entry(entry);
+	}
+}
+
 /**
  * ima_post_key_create_or_update - measure asymmetric keys
  * @keyring: keyring to which the key is linked to