integrity: IMA as an integrity service provider
Subsystems (4)
RFC PATCH 2/4 integrity: IMA as an integrity service provider
This is a re-release of Integrity Measurement Architecture(IMA) as a standalone method of providing support for the Linunx Integrity Module(LIM) API integrity_measure() call. When integrity_measure() is called, IMA submits the measurement (hash) of the file to the TPM chip, for inclusion in one of the chip's Platform Configuration Registers (PCR). IMA also keeps a list of all file names and hashes that have been submitted to the TPM, which can be viewed through securityfs. By separately requesting a TPM_Quote from the chip, an application can get a chip-signed value of the PCR, which, along with the list of measurements from IMA, can be used to attest, or prove to a third party, the validity of the hash list. (Refer to
http://trousers.sourceforge.net package for TPM userspace utilities.)
IMA can be included or excluded in the kernel configuration. If included in the kernel and the IMA_BOOTPARAM is selected, IMA can also be enabled/disabled on the kernel command line with 'ima='.
The mtime is currently not being updated promptly for mmapped files. There are currently two proposals to resolve this problem. When it is fixed, there will be a performance improvement.
---
security/Kconfig +11 -0
@@ -47,6 +47,17 @@ config INTEGRITY If you are unsure how to answer this question, answer N. +config INTEGRITY_AUDIT + bool "Integrity audit boot parameter" + depends on INTEGRITY + default y + help + This option adds a kernel parameter 'integrity_audit', which + allows integrity auditing to be disabled at boot. If this + option is selected, integrity auditing can be disabled with + 'integrity_audit=0' on the kernel command line. +source security/ima/Kconfig + config SECURITY bool "Enable different security models" depends on SYSFS
include/linux/magic.h +2 -0
@@ -6,6 +6,7 @@#define AFS_SUPER_MAGIC 0x5346414F#define AUTOFS_SUPER_MAGIC 0x0187#define CODA_SUPER_MAGIC 0x73757245 +#define DEBUGFS_MAGIC 0x64626720#define EFS_SUPER_MAGIC 0x414A53#define EXT2_SUPER_MAGIC 0xEF53#define EXT3_SUPER_MAGIC 0xEF53
@@ -39,6 +40,7 @@#define UNIONFS_SUPER_MAGIC 0xf15f083d#define SMB_SUPER_MAGIC 0x517B +#define SYSFS_MAGIC 0x62656572#define USBDEVICE_SUPER_MAGIC 0x9fa2#define CONTAINER_SUPER_MAGIC 0x27e0eb
security/ima/Kconfig new file +62 -0
62 lines not on this page · raw message
security/ima/Makefile new file +6 -0
@@ -0,0 +1,6 @@ + +obj-$(CONFIG_IMA_MEASURE) += ima.o + +ifeq ($(CONFIG_IMA_MEASURE), y) +ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o +endif
security/ima/ima.h new file +108 -0
108 lines not on this page · raw message
security/ima/ima_crypto.c new file +115 -0
115 lines not on this page · raw message
security/ima/ima_fs.c new file +275 -0
275 lines not on this page · raw message
security/ima/ima_init.c new file +103 -0
103 lines not on this page · raw message
security/ima/ima_main.c new file +511 -0
511 lines not on this page · raw message
security/ima/ima_queue.c new file +124 -0
124 lines not on this page · raw message
Documentation/kernel-parameters.txt +12 -0
@@ -42,6 +42,7 @@ parameter is applicable: FB The frame buffer device is enabled. HW Appropriate hardware is enabled. IA-64 IA-64 architecture is enabled. + IMA Integrity measurement architecture is enabled. IOSCHED More than one I/O scheduler is enabled. IP_PNP IP DHCP, BOOTP, or RARP is enabled. ISAPNP ISA PnP code is enabled.
@@ -767,6 +768,17 @@ and is between 256 and 4096 characters. ihash_entries= [KNL] Set number of hash buckets for inode cache. + ima= [IMA] Disable or enable IMA at boot time. + Format: { "0" | "1" } + See security/ima/Kconfig help text. + 0 -- disable. + 1 -- enable. + Default value is set via kernel config option. + + ima_hash= [IMA] runtime ability to define hash crypto alg. + Format: { "MD5" | "SHA1" } + Default is "SHA1". + in2000= [HW,SCSI] See header of drivers/scsi/in2000.c.
fs/debugfs/inode.c +1 -2
@@ -26,8 +26,7 @@#include <linux/debugfs.h> #include <linux/fsnotify.h> #include <linux/string.h> - -#define DEBUGFS_MAGIC 0x64626720 +#include <linux/magic.h> /* declared over in file.c */ extern struct file_operations debugfs_file_operations;
fs/sysfs/mount.c +1 -3
@@ -6,14 +6,12 @@#include <linux/fs.h> #include <linux/mount.h> +#include <linux/magic.h> #include <linux/pagemap.h> #include <linux/init.h> #include "sysfs.h" -/* Random magic number */ -#define SYSFS_MAGIC 0x62656572 -struct vfsmount *sysfs_mount;struct super_block * sysfs_sb =NULL ;struct kmem_cache *sysfs_dir_cachep;
security/Makefile +1 -0
@@ -14,6 +14,7 @@ endif obj-$(CONFIG_SECURITY) += security.o dummy.o inode.o obj-$(CONFIG_INTEGRITY) += integrity.o integrity_dummy.o \ integrity_audit.o +obj-$(CONFIG_IMA_MEASURE) += ima/ # Must precede capability.o in order to stack properly. obj-$(CONFIG_SECURITY_SELINUX) += selinux/built-in.o obj-$(CONFIG_SECURITY_CAPABILITIES) += commoncap.o capability.o
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.