integrity: IMA as an integrity service provider
Subsystems (3)
RFC PATCH 2/3 integrity: IMA as an integrity service provider
This is a re-release of Integrity Measurement Architecture(IMA) as a standalone method of providing support for the Linunx Integrity Module(LIM) API integrity_measure() call. When integrity_measure() is called, IMA submits the measurement (hash) of the file to the TPM chip, for inclusion in one of the chip's Platform Configuration Registers (PCR). IMA also keeps a list of all file names and hashes that have been submitted to the TPM, which can be viewed through securityfs. By separately requesting a TPM_Quote from the chip, an application can get a chip-signed value of the PCR, which, along with the list of measurements from IMA, can be used to attest, or prove to a third party, the validity of the hash list. (Refer to
http://trousers.sourceforge.net package for TPM userspace utilities.)
IMA can be included or excluded in the kernel configuration. If included in the kernel and the IMA_BOOTPARAM is selected, IMA can also be enabled/disabled on the kernel command line with 'ima='.
The mtime is currently not being updated promptly for mmapped files. There are currently two proposals to resolve this problem. When it is fixed, performance will be substantially be improved.
---
security/Kconfig +1 -0
@@ -46,6 +46,7 @@ config INTEGRITY configured into your kernel. If you are unsure how to answer this question, answer N. +source security/ima/Kconfig config SECURITY bool "Enable different security models"
security/Makefile +1 -0
@@ -13,6 +13,7 @@ endif # Object file lists obj-$(CONFIG_SECURITY) += security.o dummy.o inode.o obj-$(CONFIG_INTEGRITY) += integrity.o integrity_dummy.o +obj-$(CONFIG_IMA_MEASURE) += ima/ # Must precede capability.o in order to stack properly. obj-$(CONFIG_SECURITY_SELINUX) += selinux/built-in.o obj-$(CONFIG_SECURITY_CAPABILITIES) += commoncap.o capability.o
fs/sysfs/mount.c +1 -3
@@ -6,15 +6,13 @@#include <linux/fs.h> #include <linux/mount.h> +#include <linux/magic.h> #include <linux/pagemap.h> #include <linux/init.h> #include <asm/semaphore.h> #include "sysfs.h" -/* Random magic number */ -#define SYSFS_MAGIC 0x62656572 -struct vfsmount *sysfs_mount;struct super_block * sysfs_sb =NULL ;struct kmem_cache *sysfs_dir_cachep;
include/linux/magic.h +1 -0
@@ -21,6 +21,7 @@#define MINIX2_SUPER_MAGIC 0x2468/* minix V2 fs */ #define MINIX2_SUPER_MAGIC2 0x2478/* minix V2 fs, 30 char names */ #define MINIX3_SUPER_MAGIC 0x4d5a/* minix V3 fs */ +#define SYSFS_MAGIC 0x62656572#define MSDOS_SUPER_MAGIC 0x4d44/* MD */ #define NCP_SUPER_MAGIC 0x564c/* Guess, what 0x564c is :-) */
security/ima/Kconfig new file +62 -0
62 lines not on this page · raw message
security/ima/Makefile new file +6 -0
@@ -0,0 +1,6 @@ + +obj-$(CONFIG_IMA_MEASURE) += ima.o + +ifeq ($(CONFIG_IMA_MEASURE), y) +ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o +endif
security/ima/ima.h new file +107 -0
107 lines not on this page · raw message
security/ima/ima_crypto.c new file +115 -0
115 lines not on this page · raw message
security/ima/ima_fs.c new file +275 -0
275 lines not on this page · raw message
security/ima/ima_init.c new file +116 -0
116 lines not on this page · raw message
security/ima/ima_main.c new file +364 -0
364 lines not on this page · raw message
security/ima/ima_queue.c new file +116 -0
116 lines not on this page · raw message
Documentation/kernel-parameters.txt +12 -0
@@ -42,6 +42,7 @@ parameter is applicable: FB The frame buffer device is enabled. HW Appropriate hardware is enabled. IA-64 IA-64 architecture is enabled. + IMA Integrity measurement architecture is enabled. IOSCHED More than one I/O scheduler is enabled. IP_PNP IP DHCP, BOOTP, or RARP is enabled. ISAPNP ISA PnP code is enabled.
@@ -760,6 +761,17 @@ and is between 256 and 4096 characters. ihash_entries= [KNL] Set number of hash buckets for inode cache. + ima= [IMA] Disable or enable IMA at boot time. + Format: { "0" | "1" } + See security/ima/Kconfig help text. + 0 -- disable. + 1 -- enable. + Default value is set via kernel config option. + + ima_hash= [IMA] runtime ability to define hash crypto alg. + Format: { "MD5" | "SHA1" } + Default is "SHA1". + in2000= [HW,SCSI] See header of drivers/scsi/in2000.c.
James Morris
maintainersecurity/ima/ima_main.c line 145
Quoted 11 lines · Mimi Zohar
security/ima/ima_main.c new file +11
-0+/* what could we exclude +* - non-executable/non-library files ? +* - /proc /dev ? +* Only measure files opened for read-only or execute +*/ +static int skip_measurement (struct inode *inode,int mask) +{ +if ((inode->i_sb->s_magic ==PROC_SUPER_MAGIC ) || + (inode->i_sb->s_magic ==SYSFS_MAGIC )) { +return 1 ;/*can't measure */ + }
I'm pretty sure you should skip measurement for many more pseudo filesystems than this.
- James
Signature · 2 lines
James Morris <[email protected]>
Quoted 17 lines · James Morris
security/ima/ima_main.c line 145
Quoted 11 lines · Mimi Zohar
security/ima/ima_main.c new file +11
-0+/* what could we exclude +* - non-executable/non-library files ? +* - /proc /dev ? +* Only measure files opened for read-only or execute +*/ +static int skip_measurement (struct inode *inode,int mask) +{ +if ((inode->i_sb->s_magic ==PROC_SUPER_MAGIC ) || + (inode->i_sb->s_magic ==SYSFS_MAGIC )) { +return 1 ;/*can't measure */ + }I'm pretty sure you should skip measurement for many more pseudo filesystems than this.
The LSM module controls what is measured and should only be calling integrity_measure() for appropriate files. IBAC, for example, only calls integrity_measure() for executables from bprm_check_security() and file_mmap() and for other regular files from inode_permission(), based on the existence of the 'security.measure' xattr, which is labeled by a userspace application. The integrity provider, here, is just doing a quick sanity check, but I'll definitely make it more complete and fix the comment to make this clearer.
Thanks!
Mimi