integrity: IMA integrity_measure() support
RFC PATCH 4/6 integrity: IMA integrity_measure() support
This is a re-release of Integrity Measurement Architecture(IMA) as a method of providing support for the integrity service framework API integrity_measure() call. When integrity_measure() is called, IMA submits the measurement (hash) of the file to the TPM chip, for inclusion in one of the chip's Platform Configuration Registers (PCR). IMA also keeps a list of all file names and hashes that have been submitted to the TPM, which can be viewed through securityfs. By separately requesting a TPM_Quote from the chip, an application can get a chip-signed value of the PCR, which, along with the list of measurements from IMA, can be used to attest, or prove to a third party, the validity of the hash list. (The tpm-3.2.1 package includes example TPM applications for creating keys, and performing the TPM_Quote operation.)
IMA can be included or excluded in the kernel configuration. If included in the kernel, IMA can also be enabled or disabled on the kernel command line with evm_enable_ima=0.
security/evm/Kconfig +1 -0
@@ -15,3 +15,4 @@ config INTEGRITY_EVM If you are unsure how to answer this question, answer N. +source security/evm/ima/Kconfig
security/evm/Makefile +3 -0
@@ -3,3 +3,6 @@ obj-$(CONFIG_INTEGRITY_EVM) += evm.o evm-y := evm_main.o evm_config.o evm_crypto.o evm_secfs.o +ifeq ($(CONFIG_IMA_MEASURE), y) +evm-y += ima/ima_fs.o ima/ima_queue.o ima/ima_init.o ima/ima_main.o +endif
security/evm/evm_integrity.h new file +49 -0
49 lines not on this page · raw message
security/evm/evm_secfs.c +18 -2
@@ -20,7 +20,7 @@extern int evm_initialized;static struct dentry *evm_secdir, *evm_config; -static struct dentry *evm_dir, *evm_cache, *evm_crypto, *evm_xattr; +static struct dentry *evm_dir, *evm_cache, *evm_crypto, *evm_xattr, *evm_ima;static int evm_open_debug (struct inode *inode,struct file *file) {
@@ -62,6 +62,10 @@ static ssize_t evm_read_debug(struct fil len =sprintf (page,"evm_debug: crypto: %s\n" , ((evm_debug &EVM_CRYPTO ) ==EVM_CRYPTO ) ?"ON" :"OFF" ); + else if (strcmp(file->private_data, "ima") == 0) + len =sprintf (page,"evm_debug: ima: %s\n" , + ((evm_debug &EVM_IMA ) ==EVM_IMA ) + ?"ON" :"OFF" ); else len =sprintf (page,"unknown evm_debug option\n" );
@@ -87,6 +91,9 @@ static ssize_t evm_write_debug(struct fielse if (strcmp (file->private_data,"crypto" ) ==0 ) evm_debug = (flag =='0' ) ? evm_debug & ~EVM_CRYPTO : evm_debug |EVM_CRYPTO ; +else if (strcmp (file->private_data,"ima" ) ==0 ) + evm_debug = (flag =='0' ) ? evm_debug & ~EVM_IMA : + evm_debug |EVM_IMA ;return buflen; }
@@ -169,12 +176,20 @@ int __init evm_init_secfs(void)if (!evm_crypto ||IS_ERR (evm_crypto)) goto out_del_cache; + evm_ima =debugfs_create_file ("ima" ,S_IRUSR |S_IRGRP , evm_dir, +"ima" , &evm_debug_ops); +if (!evm_ima ||IS_ERR (evm_ima)) + goto out_del_crypto; + evm_xattr =debugfs_create_file ("xattr" ,S_IRUSR |S_IRGRP , evm_dir,"xattr" , &evm_debug_ops);if (!evm_xattr ||IS_ERR (evm_xattr)) - goto out_del_crypto; + goto out_del_ima; +return 0 ; +out_del_ima: +debugfs_remove (evm_ima); out_del_crypto:debugfs_remove (evm_crypto); out_del_cache:
@@ -192,6 +207,7 @@ void __exit evm_cleanup_secfs(void) {debugfs_remove (evm_xattr);debugfs_remove (evm_crypto); +debugfs_remove (evm_ima);debugfs_remove (evm_cache);debugfs_remove (evm_dir);if (evm_config)
security/evm/ima/Kconfig new file +31 -0
@@ -0,0 +1,31 @@ +# +# IBM Integrity Measurement Architecture +# + +#menu "TPM-based Integrity Measurement Architecture" + +config IMA_MEASURE + bool "TCG run-time Integrity Measurement Architecture" + depends on SECURITY && (CRYPTO_SHA1=y) && INTEGRITY_EVM + depends on ACPI + help + IMA maintains a list of hash values of executables and + other sensitive system files loaded into the run-time + of this system. If your system has a TPM chip, then IMA + also maintains an aggregate integrity value over this + list inside the TPM hardware. These measurements and + the aggregate (signed inside the TPM) can be retrieved + and presented to remote parties to establish system + properties. If unsure, say N. + +config IMA_MEASURE_PCR_IDX + int "PCR for Aggregate (8<= Index <= 14)" + depends on IMA_MEASURE + range 8 14 + default 10 + help + IMA_MEASURE_PCR_IDX determines the TPM PCR register index + that IMA uses to maintain the integrity aggregate of the + measurement list. If unsure, use the default 10. +#endmenu +
security/evm/ima/ima.h new file +104 -0
104 lines not on this page · raw message
security/evm/ima/ima_evm.h new file +18 -0
@@ -0,0 +1,18 @@ +/* +* Copyright (C) 2005,2007 IBM Corporation +* +* Reiner Sailer <[email protected]> +* +* IBM Integrity Measurement Architecture for evm/slim. +* +* This program is free software; you can redistribute it and/or +* modify it under the terms of the GNU General Public License as +* published by the Free Software Foundation, version 2 of the +* License. +* +* File: ima_evm.h +* exported ima functions +*/ +int ima_init (void ); +void ima_cleanup (void ); +void ima_measure (const unsigned char *name,int hash_len,char *hash);
security/evm/ima/ima_fs.c new file +284 -0
284 lines not on this page · raw message
security/evm/ima/ima_init.c new file +117 -0
117 lines not on this page · raw message
security/evm/ima/ima_main.c new file +87 -0
87 lines not on this page · raw message
security/evm/ima/ima_queue.c new file +128 -0
128 lines not on this page · raw message