From patchwork Tue Nov 7 10:37:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 10046433 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E695F60360 for ; Tue, 7 Nov 2017 10:54:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BF6ED287C3 for ; Tue, 7 Nov 2017 10:54:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B473D29DB3; Tue, 7 Nov 2017 10:54:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 59CAB287C3 for ; Tue, 7 Nov 2017 10:54:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754782AbdKGKxp (ORCPT ); Tue, 7 Nov 2017 05:53:45 -0500 Received: from lhrrgout.huawei.com ([194.213.3.17]:39778 "EHLO lhrrgout.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751749AbdKGKml (ORCPT ); Tue, 7 Nov 2017 05:42:41 -0500 Received: from 172.18.7.190 (EHLO lhreml701-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DSD64394; Tue, 07 Nov 2017 10:42:39 +0000 (GMT) Received: from localhost.localdomain (10.204.65.254) by smtpsuk.huawei.com (10.201.108.42) with Microsoft SMTP Server (TLS) id 14.3.361.1; Tue, 7 Nov 2017 10:42:32 +0000 From: Roberto Sassu To: CC: , , , , , Roberto Sassu Subject: [PATCH v2 07/15] ima: add parser of compact digest list Date: Tue, 7 Nov 2017 11:37:02 +0100 Message-ID: <20171107103710.10883-8-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20171107103710.10883-1-roberto.sassu@huawei.com> References: <20171107103710.10883-1-roberto.sassu@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.204.65.254] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090201.5A018E1F.0471, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: ae72bd7ff58400102ef4f46631aec8c8 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This patch introduces the parser for the compact digest list. Its format is: entry_id[2] count[4] data_len[4] data[data_len] entry_id[2] count[4] data_len[4] data[data_len] ... entry_id, count and data_len are in little endian. This format is suitable to store a large number of digests, as there is no metadata provided for each. Digests (which have all the same size) are concatenated together and placed after the header. COMPACT_DIGEST (0) and COMPACT_DIGEST_MUTABLE (1) entry IDs are supported. If the entry ID is COMPACT_DIGEST and appraisal is in enforcing mode, file updates are denied. If the entry ID is COMPACT_DIGEST_MUTABLE, file updates are permitted. Changelog v1: - Renamed COMPACT_LIST_ID_DIGEST to COMPACT_DIGEST - Added support for immutable/mutable files Signed-off-by: Roberto Sassu --- security/integrity/ima/ima_digest_list.c | 66 ++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/security/integrity/ima/ima_digest_list.c b/security/integrity/ima/ima_digest_list.c index 28172424e5a2..6ad00ba32c94 100644 --- a/security/integrity/ima/ima_digest_list.c +++ b/security/integrity/ima/ima_digest_list.c @@ -23,6 +23,69 @@ enum digest_metadata_fields {DATA_ALGO, DATA_DIGEST, DATA_SIGNATURE, DATA_FILE_PATH, DATA_REF_ID, DATA_TYPE, DATA__LAST}; +enum digest_data_types {DATA_TYPE_COMPACT_LIST}; + +enum compact_list_entry_ids {COMPACT_DIGEST, COMPACT_DIGEST_MUTABLE}; + +struct compact_list_hdr { + u16 entry_id; + u32 count; + u32 datalen; +} __packed; + +static int ima_parse_compact_list(loff_t size, void *buf) +{ + void *bufp = buf, *bufendp = buf + size; + int digest_len = hash_digest_size[ima_hash_algo]; + struct compact_list_hdr *hdr; + u8 is_mutable = 0; + int ret, i; + + while (bufp < bufendp) { + if (bufp + sizeof(*hdr) > bufendp) { + pr_err("compact list, missing header\n"); + return -EINVAL; + } + + hdr = bufp; + + if (ima_canonical_fmt) { + hdr->entry_id = le16_to_cpu(hdr->entry_id); + hdr->count = le32_to_cpu(hdr->count); + hdr->datalen = le32_to_cpu(hdr->datalen); + } + + switch (hdr->entry_id) { + case COMPACT_DIGEST_MUTABLE: + is_mutable = 1; + case COMPACT_DIGEST: + break; + default: + pr_err("compact list, invalid data type\n"); + return -EINVAL; + } + + bufp += sizeof(*hdr); + + for (i = 0; i < hdr->count && + bufp + digest_len <= bufendp; i++) { + ret = ima_add_digest_data_entry(bufp, is_mutable); + if (ret < 0 && ret != -EEXIST) + return ret; + + bufp += digest_len; + } + + if (i != hdr->count || + bufp != (void *)hdr + sizeof(*hdr) + hdr->datalen) { + pr_err("compact list, invalid data\n"); + return -EINVAL; + } + } + + return 0; +} + static int ima_parse_digest_list_data(struct ima_field_data *data) { void *digest_list; @@ -47,6 +110,9 @@ static int ima_parse_digest_list_data(struct ima_field_data *data) } switch (data_type) { + case DATA_TYPE_COMPACT_LIST: + ret = ima_parse_compact_list(digest_list_size, digest_list); + break; default: pr_err("Parser for data type %d not implemented\n", data_type); ret = -EINVAL;