integrity: IMA integrity_measure() support

PATCH In review Mimi Zohar 2 participants 3 messages Mar 23, 2007 – Mar 26, 2007 Security (LSM)

Share & tools

Mimi Zohar

author

2007-03-23 16:11 UTC #0 lore raw

PATCH 4/7 integrity: IMA integrity_measure() support

This is a re-release of Integrity Measurement Architecture(IMA) as a method of providing support for the integrity service framework API integrity_measure() call. When integrity_measure() is called, IMA submits the measurement (hash) of the file to the TPM chip, for inclusion in one of the chip's Platform Configuration Registers (PCR). IMA also keeps a list of all file names and hashes that have been submitted to the TPM, which can be viewed through securityfs. By separately requesting a TPM_Quote from the chip, an application can get a chip-signed value of the PCR, which, along with the list of measurements from IMA, can be used to attest, or prove to a third party, the validity of the hash list. (The tpm-3.2.1 package includes example TPM applications for creating keys, and performing the TPM_Quote operation.)

IMA can be included or excluded in the kernel configuration. If included in the kernel, IMA can also be enabled or disabled on the kernel command line with evm_enable_ima=0.

Signed-off-by Mimi Zohar <[email protected]>

Signed-off-by Kylene Hall <[email protected]>

---

security/evm/Kconfig +1 -0

Index: linux-2.6.21-rc4-mm1/security/evm/Kconfig
===================================================================
@@ -15,3 +15,4 @@ config INTEGRITY_EVM
 
 	  If you are unsure how to answer this question, answer N.
 
+source security/evm/ima/Kconfig

security/evm/Makefile +3 -0

Index: linux-2.6.21-rc4-mm1/security/evm/Makefile
===================================================================
@@ -3,3 +3,6 @@ obj-$(CONFIG_INTEGRITY_EVM) += evm.o
 
 evm-y := evm_main.o evm_config.o evm_crypto.o evm_secfs.o
 
+ifeq ($(CONFIG_IMA_MEASURE), y)
+evm-y += ima/ima_fs.o ima/ima_queue.o ima/ima_init.o ima/ima_main.o
+endif

security/evm/evm_integrity.h new file +49 -0

49 lines not on this page · raw message

security/evm/evm_secfs.c +18 -2

Index: linux-2.6.21-rc4-mm1/security/evm/evm_secfs.c
===================================================================
@@ -20,7 +20,7 @@
 extern int evm_initialized;
 
 static struct dentry *evm_secdir, *evm_config;
-static struct dentry *evm_dir, *evm_cache, *evm_crypto, *evm_xattr;
+static struct dentry *evm_dir, *evm_cache, *evm_crypto, *evm_xattr, *evm_ima;
 
 static int evm_open_debug(struct inode *inode, struct file *file)
 {

@@ -62,6 +62,10 @@ static ssize_t evm_read_debug(struct fil
 		len = sprintf(page, "evm_debug: crypto: %s\n",
 			      ((evm_debug & EVM_CRYPTO) == EVM_CRYPTO)
 			      ? "ON" : "OFF");
+	else if (strcmp(file->private_data, "ima") == 0)
+		len = sprintf(page, "evm_debug: ima: %s\n",
+			      ((evm_debug & EVM_IMA) == EVM_IMA)
+			      ? "ON" : "OFF");
 	else
 		len = sprintf(page, "unknown evm_debug option\n");

@@ -87,6 +91,9 @@ static ssize_t evm_write_debug(struct fi
 	else if (strcmp(file->private_data, "crypto") == 0)
 		evm_debug = (flag == '0') ? evm_debug & ~EVM_CRYPTO :
 		    evm_debug | EVM_CRYPTO;
+	else if (strcmp(file->private_data, "ima") == 0)
+		evm_debug = (flag == '0') ? evm_debug & ~EVM_IMA :
+		    evm_debug | EVM_IMA;
 	return buflen;
 }

@@ -169,12 +176,20 @@ int __init evm_init_secfs(void)
 	if (!evm_crypto || IS_ERR(evm_crypto))
 		goto out_del_cache;
 
+	evm_ima = debugfs_create_file("ima", S_IRUSR | S_IRGRP, evm_dir,
+				      "ima", &evm_debug_ops);
+	if (!evm_ima || IS_ERR(evm_ima))
+		goto out_del_crypto;
+
 	evm_xattr = debugfs_create_file("xattr", S_IRUSR | S_IRGRP, evm_dir,
 					"xattr", &evm_debug_ops);
 	if (!evm_xattr || IS_ERR(evm_xattr))
-		goto out_del_crypto;
+		goto out_del_ima;
+
 	return 0;
 
+out_del_ima:
+	debugfs_remove(evm_ima);
 out_del_crypto:
 	debugfs_remove(evm_crypto);
 out_del_cache:

@@ -192,6 +207,7 @@ void __exit evm_cleanup_secfs(void)
 {
 	debugfs_remove(evm_xattr);
 	debugfs_remove(evm_crypto);
+	debugfs_remove(evm_ima);
 	debugfs_remove(evm_cache);
 	debugfs_remove(evm_dir);
 	if (evm_config)

security/evm/ima/Kconfig new file +32 -0

Index: linux-2.6.21-rc4-mm1/security/evm/ima/Kconfig
===================================================================
@@ -0,0 +1,32 @@
+#
+# IBM Integrity Measurement Architecture
+#
+
+#menu "TPM-based Integrity Measurement Architecture"
+
+config IMA_MEASURE
+	bool "TCG run-time Integrity Measurement Architecture"
+	depends on (CRYPTO_SHA1=y) && INTEGRITY_EVM
+	depends on ACPI
+	select TCG_TPM
+	help
+	  IMA maintains a list of hash values of executables and
+	  other sensitive system files loaded into the run-time
+	  of this system. If your system has a TPM chip, then IMA
+	  also maintains an aggregate integrity value over this
+	  list inside the TPM hardware.  These measurements and
+	  the aggregate (signed inside the TPM) can be retrieved
+	  and presented to remote parties to establish system
+	  properties. If unsure, say N.
+
+config IMA_MEASURE_PCR_IDX
+	int "PCR for Aggregate (8<= Index <= 14)"
+	depends on IMA_MEASURE
+	range 8 14
+	default 10
+	help
+	  IMA_MEASURE_PCR_IDX determines the TPM PCR register index
+	  that IMA uses to maintain the integrity aggregate of the
+	  measurement list.  If unsure, use the default 10.
+#endmenu
+

security/evm/ima/ima.h new file +104 -0

104 lines not on this page · raw message

security/evm/ima/ima_evm.h new file +18 -0

Index: linux-2.6.21-rc4-mm1/security/evm/ima/ima_evm.h
===================================================================
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) 2005,2007 IBM Corporation
+ *
+ * Reiner Sailer <[email protected]>
+ *
+ * IBM Integrity Measurement Architecture for evm/slim.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ * File: ima_evm.h
+ *		exported ima functions
+ */
+int ima_init(void);
+void ima_cleanup(void);
+void ima_measure(const unsigned char *name, int hash_len, char *hash);

security/evm/ima/ima_fs.c new file +284 -0

284 lines not on this page · raw message

security/evm/ima/ima_init.c new file +117 -0

117 lines not on this page · raw message

security/evm/ima/ima_main.c new file +87 -0

87 lines not on this page · raw message

security/evm/ima/ima_queue.c new file +128 -0

128 lines not on this page · raw message

Andrew Morton

2007-03-25 08:19 UTC #1 lore raw

Quoted 1 line · On Fri, 23 Mar 2007 12:09:50 -0400 Mimi Zohar <[email protected]> wrote:

+void create_htable(void);

I notice a bit of a tendency in these patches to create ill-chosen global identifiers. Please review the whole patchset for that.

Andrew Morton

2007-03-26 18:18 UTC #2 lore raw

In reply to Mimi Zohar

Quoted 14 lines · On Fri, 23 Mar 2007 12:09:50 -0400 Mimi Zohar <[email protected]> wrote:

This is a re-release of Integrity Measurement Architecture(IMA) as a method of providing support for the integrity service framework API integrity_measure() call. When integrity_measure() is called, IMA submits the measurement (hash) of the file to the TPM chip, for inclusion in one of the chip's Platform Configuration Registers (PCR). IMA also keeps a list of all file names and hashes that have been submitted to the TPM, which can be viewed through securityfs. By separately requesting a TPM_Quote from the chip, an application can get a chip-signed value of the PCR, which, along with the list of measurements from IMA, can be used to attest, or prove to a third party, the validity of the hash list. (The tpm-3.2.1 package includes example TPM applications for creating keys, and performing the TPM_Quote operation.)

Quoted 3 lines

IMA can be included or excluded in the kernel configuration. If included in the kernel, IMA can also be enabled or disabled on the kernel command line with evm_enable_ima=0.

It breaks the ia64 build:

ima_fs_cleanup: discarded in section `.exit.text' from security/built-in.o

it's calling an __exit function from a non-_-exit function.

I'll remove the __exit tag from ima_fs_cleanup(), but that's the wrong fix
- really the caller should be fixed but it's all tangled up in a quite unnecessary inlined function.

I must say that this code doesn't leave an impression of having sufficient overall quality. It needs some caring for.