Integrity Service API and dummy provider
RFC PATCH 2/6 Integrity Service API and dummy provider
This patch provides a framework and dummy provider for an integrity service. The three integrity functions provided are:
integrity_verify_metadata
integrity_verity_data
integrity_measure
(Details on the calls and their exact arguments are in linux/integrity.h, included in the patch.)
Normally these functions would be called by an LSM module during d_instantiate. The first function is used to retrieve a requested dentry's label (xattr, such as security.selinux, or security.slim.level), along with the result of integrity verification of the label.
Based on the result of this call, the LSM module may also choose to use integrity_verify_data to request a verification of the file's data, and integrity_measure, to commit the file's measurement to some form of logging/attestation service, such as a TPM.
The latter two functions are separate calls, so that the LSM module can optimize performance by using them only as needed. For example, if the integrity_verify_metadata call shows that the label is not trustworthy, it is probably not necessary to hash and measure the file, as the current LSM check will likely be denied anyway.
--- include/linux/integrity.h | 85 +++++++++++++++++++++++++++++++++++ security/Makefile | 1 security/integrity.c | 45 ++++++++++++++++++ security/integrity_dummy.c | 78 ++++++++++++++++++++++++++++++++ security/integrity_dummy.h | 12 ++++ 5 files changed, 221 insertions(+)
security/integrity.c new file +45 -0
@@ -0,0 +1,45 @@ +/* +* integrity.c +* +* register integrity subsystem +* +* Copyright (C) 2005,2006 IBM Corporation +* Author: Mimi Zohar <[email protected]> +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of the GNU General Public License as published by +* the Free Software Foundation, version 2 of the License. +*/ + +#include <linux/config.h> +#include <linux/module.h> +#include <linux/init.h> +#include <linux/kernel.h> +#include <linux/sched.h> +#include <linux/integrity.h> + +#include "integrity_dummy.h" + +struct integrity_operations *integrity_ops = &dummy_integrity_ops; + +int register_integrity (struct integrity_operations *ops) +{ +if (integrity_ops != &dummy_integrity_ops) +return -EAGAIN ; + + integrity_ops = ops; +return 0 ; +} + +int unregister_integrity (struct integrity_operations *ops) +{ +if (ops != integrity_ops) +return -EINVAL ; + + integrity_ops = &dummy_integrity_ops; +return 0 ; +} + +EXPORT_SYMBOL_GPL (register_integrity); +EXPORT_SYMBOL_GPL (unregister_integrity); +EXPORT_SYMBOL_GPL (integrity_ops);
security/integrity_dummy.c new file +78 -0
78 lines not on this page · raw message
include/linux/integrity.h new file +85 -0
85 lines not on this page · raw message
security/Makefile +1 -0
@@ -12,6 +12,7 @@ endif # Object file lists obj-$(CONFIG_SECURITY) += security.o dummy.o inode.o +obj-$(CONFIG_SECURITY) += integrity.o integrity_dummy.o # Must precede capability.o in order to stack properly. obj-$(CONFIG_SECURITY_SELINUX) += selinux/built-in.o obj-$(CONFIG_SECURITY_CAPABILITIES) += commoncap.o capability.o
security/integrity_dummy.h new file +12 -0
@@ -0,0 +1,12 @@ +/* +* integrity_dummy.h +* +* Copyright (C) 2005,2006 IBM Corporation +* Author: Mimi Zohar <[email protected]> +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of the GNU General Public License as published by +* the Free Software Foundation, version 2 of the License. +*/ + +extern struct integrity_operations dummy_integrity_ops;
James Morris
maintainerQuoted 10 lines · Kylene Jo Hall
+ * @verify_data:
+ * Verify the integrity of a dentry.
+ * @dentry contains the dentry structure to be verified.
+ * Possible return codes are:INTEGRITY_PASS,INTEGRITY_FAIL,
+ *INTEGRITY_NOLABEL
+ *
+ * @verify_metadata:
+ * Verify the integrity of a dentry's metadata; return the value
+ * of the requestedxattr_nameand the verification result of the
+ * dentry's metadata.
Quoted 8 lines
+ * @dentry contains the dentry structure of the metadata to be verified.
+ * @xattr_name, if not null, contains the name of the xattr
+ * being requested.
+ * @xattr_value, if not null, is a pointer for the xattr value.
+ * @xattr_val_len will be set to the length of the xattr value.
+ * @xattr_status is the result of the getxattr request for the xattr.
+ * Possible return codes are:INTEGRITY_PASS,INTEGRITY_FAIL,
+ *INTEGRITY_NOLABEL,-EOPNOTSUPP,-ENOMEM,
What I would suggest with these API calls is that they always only return errno values, and that you pass back the INTEGRITY_ values via a pointer.
This ensures that errno values are cleanly propagated throughout the kernel and that 'system' errors are separated from higher level integrity service status values.
Signature · 2 lines
James Morris <[email protected]>
Quoted 13 lines · James Morris
Quoted 11 lines · Kylene Jo Hall
+ * @verify_data:
+ * Verify the integrity of a dentry. + * @dentry contains the dentry structure to be verified. + * Possible return codes are: INTEGRITY_PASS, INTEGRITY_FAIL,+ *
INTEGRITY_NOLABEL
+ *
+ * @verify_metadata:
+ * Verify the integrity of a dentry's metadata; return the value
+ * of the requestedxattr_nameand the verification result of the
+ * dentry's metadata.
+ * @dentry contains the dentry structure of the metadata to be
verified.
Quoted 5 lines
Quoted 5 lines
+ * @xattr_name, if not null, contains the name of the xattr
+ * being requested.+ * @xattr_value, if not null, is a pointer for the xattr value. + * @xattr_val_len will be set to the length of the xattr value. + * @xattr_status is the result of the getxattr request for the
xattr.
Quoted 11 lines
Quoted 2 lines
+ * Possible return codes are:
INTEGRITY_PASS,INTEGRITY_FAIL,
+ *INTEGRITY_NOLABEL,-EOPNOTSUPP,-ENOMEM,What I would suggest with these API calls is that they always only return
errno values, and that you pass back the
INTEGRITY_values via a pointer.This ensures that errno values are cleanly propagated throughout the kernel and that 'system' errors are separated from higher level integrity
service status values.
Yes, that definitely would be cleaner. We'll include this change in the next
set of patches.
Thank you.
Mimi Zohar