ima: new templates management mechanism
The original 'ima' template is fixed length, containing the filedata hash
and pathname. The filedata hash is limited to 20 bytes (md5/sha1). The
pathname is a null terminated string, limited to 255 characters. To
overcome these limitations and to add additional file metadata, it is
necessary to extend the current version of IMA by defining additional
templates.
The main reason to introduce this feature is that, each time a new
template is defined, the functions that generate and display the
measurement list would include the code for handling a new format and,
thus, would significantly grow over time.
This patch set solves this problem by separating the template management
from the remaining IMA code. The core of this solution is the definition
of two new data structures: a template descriptor, to determine which
information should be included in the measurement list, and a template
field, to generate and display data of a given type.
To define a new template field, developers define the field identifier
and implement two functions, init() and show(), respectively to generate
and display measurement entries. Initially, this patch set defines the
following template fields (support for additional data types will be
added later):
- 'd': the digest of the event (i.e. the digest of a measured file),
calculated with the SHA1 or MD5 hash algorithm;
- 'n': the name of the event (i.e. the file name), with size up to
255 bytes;
- 'd-ng': the digest of the event, calculated with an arbitrary hash
algorithm (field format: [<hash algo>:]digest, where the digest
prefix is shown only if the hash algorithm is not SHA1 or MD5);
- 'n-ng': the name of the event, without size limitations.
Defining a new template descriptor requires specifying the template format,
a string of field identifiers separated by the '|' character. This patch
set defines the following template descriptors:
- "ima": its format is 'd|n';
- "ima-ng" (default): its format is 'd-ng|n-ng'
Further details about the new template architecture can be found in
Documentation/security/IMA-templates.txt.
Changelog:
- don't defer calling ima_init_template() - Mimi
- don't define ima_lookup_template_desc() until used - Mimi
- squashed with documentation patch - Mimi
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2013-06-07 18:16:29 +08:00
|
|
|
IMA Template Management Mechanism
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
==== INTRODUCTION ====
|
|
|
|
|
|
|
|
|
|
The original 'ima' template is fixed length, containing the filedata hash
|
|
|
|
|
and pathname. The filedata hash is limited to 20 bytes (md5/sha1).
|
|
|
|
|
The pathname is a null terminated string, limited to 255 characters.
|
|
|
|
|
To overcome these limitations and to add additional file metadata, it is
|
|
|
|
|
necessary to extend the current version of IMA by defining additional
|
|
|
|
|
templates. For example, information that could be possibly reported are
|
|
|
|
|
the inode UID/GID or the LSM labels either of the inode and of the process
|
|
|
|
|
that is accessing it.
|
|
|
|
|
|
|
|
|
|
However, the main problem to introduce this feature is that, each time
|
|
|
|
|
a new template is defined, the functions that generate and display
|
|
|
|
|
the measurements list would include the code for handling a new format
|
|
|
|
|
and, thus, would significantly grow over the time.
|
|
|
|
|
|
|
|
|
|
The proposed solution solves this problem by separating the template
|
|
|
|
|
management from the remaining IMA code. The core of this solution is the
|
|
|
|
|
definition of two new data structures: a template descriptor, to determine
|
|
|
|
|
which information should be included in the measurement list; a template
|
|
|
|
|
field, to generate and display data of a given type.
|
|
|
|
|
|
|
|
|
|
Managing templates with these structures is very simple. To support
|
|
|
|
|
a new data type, developers define the field identifier and implement
|
|
|
|
|
two functions, init() and show(), respectively to generate and display
|
|
|
|
|
measurement entries. Defining a new template descriptor requires
|
2014-10-13 20:08:42 +08:00
|
|
|
specifying the template format (a string of field identifiers separated
|
|
|
|
|
by the '|' character) through the 'ima_template_fmt' kernel command line
|
|
|
|
|
parameter. At boot time, IMA initializes the chosen template descriptor
|
|
|
|
|
by translating the format into an array of template fields structures taken
|
|
|
|
|
from the set of the supported ones.
|
ima: new templates management mechanism
The original 'ima' template is fixed length, containing the filedata hash
and pathname. The filedata hash is limited to 20 bytes (md5/sha1). The
pathname is a null terminated string, limited to 255 characters. To
overcome these limitations and to add additional file metadata, it is
necessary to extend the current version of IMA by defining additional
templates.
The main reason to introduce this feature is that, each time a new
template is defined, the functions that generate and display the
measurement list would include the code for handling a new format and,
thus, would significantly grow over time.
This patch set solves this problem by separating the template management
from the remaining IMA code. The core of this solution is the definition
of two new data structures: a template descriptor, to determine which
information should be included in the measurement list, and a template
field, to generate and display data of a given type.
To define a new template field, developers define the field identifier
and implement two functions, init() and show(), respectively to generate
and display measurement entries. Initially, this patch set defines the
following template fields (support for additional data types will be
added later):
- 'd': the digest of the event (i.e. the digest of a measured file),
calculated with the SHA1 or MD5 hash algorithm;
- 'n': the name of the event (i.e. the file name), with size up to
255 bytes;
- 'd-ng': the digest of the event, calculated with an arbitrary hash
algorithm (field format: [<hash algo>:]digest, where the digest
prefix is shown only if the hash algorithm is not SHA1 or MD5);
- 'n-ng': the name of the event, without size limitations.
Defining a new template descriptor requires specifying the template format,
a string of field identifiers separated by the '|' character. This patch
set defines the following template descriptors:
- "ima": its format is 'd|n';
- "ima-ng" (default): its format is 'd-ng|n-ng'
Further details about the new template architecture can be found in
Documentation/security/IMA-templates.txt.
Changelog:
- don't defer calling ima_init_template() - Mimi
- don't define ima_lookup_template_desc() until used - Mimi
- squashed with documentation patch - Mimi
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2013-06-07 18:16:29 +08:00
|
|
|
|
|
|
|
|
After the initialization step, IMA will call ima_alloc_init_template()
|
|
|
|
|
(new function defined within the patches for the new template management
|
|
|
|
|
mechanism) to generate a new measurement entry by using the template
|
|
|
|
|
descriptor chosen through the kernel configuration or through the newly
|
2014-10-13 20:08:42 +08:00
|
|
|
introduced 'ima_template' and 'ima_template_fmt' kernel command line parameters.
|
|
|
|
|
It is during this phase that the advantages of the new architecture are
|
|
|
|
|
clearly shown: the latter function will not contain specific code to handle
|
|
|
|
|
a given template but, instead, it simply calls the init() method of the template
|
|
|
|
|
fields associated to the chosen template descriptor and store the result
|
|
|
|
|
(pointer to allocated data and data length) in the measurement entry structure.
|
ima: new templates management mechanism
The original 'ima' template is fixed length, containing the filedata hash
and pathname. The filedata hash is limited to 20 bytes (md5/sha1). The
pathname is a null terminated string, limited to 255 characters. To
overcome these limitations and to add additional file metadata, it is
necessary to extend the current version of IMA by defining additional
templates.
The main reason to introduce this feature is that, each time a new
template is defined, the functions that generate and display the
measurement list would include the code for handling a new format and,
thus, would significantly grow over time.
This patch set solves this problem by separating the template management
from the remaining IMA code. The core of this solution is the definition
of two new data structures: a template descriptor, to determine which
information should be included in the measurement list, and a template
field, to generate and display data of a given type.
To define a new template field, developers define the field identifier
and implement two functions, init() and show(), respectively to generate
and display measurement entries. Initially, this patch set defines the
following template fields (support for additional data types will be
added later):
- 'd': the digest of the event (i.e. the digest of a measured file),
calculated with the SHA1 or MD5 hash algorithm;
- 'n': the name of the event (i.e. the file name), with size up to
255 bytes;
- 'd-ng': the digest of the event, calculated with an arbitrary hash
algorithm (field format: [<hash algo>:]digest, where the digest
prefix is shown only if the hash algorithm is not SHA1 or MD5);
- 'n-ng': the name of the event, without size limitations.
Defining a new template descriptor requires specifying the template format,
a string of field identifiers separated by the '|' character. This patch
set defines the following template descriptors:
- "ima": its format is 'd|n';
- "ima-ng" (default): its format is 'd-ng|n-ng'
Further details about the new template architecture can be found in
Documentation/security/IMA-templates.txt.
Changelog:
- don't defer calling ima_init_template() - Mimi
- don't define ima_lookup_template_desc() until used - Mimi
- squashed with documentation patch - Mimi
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2013-06-07 18:16:29 +08:00
|
|
|
|
|
|
|
|
The same mechanism is employed to display measurements entries.
|
|
|
|
|
The functions ima[_ascii]_measurements_show() retrieve, for each entry,
|
|
|
|
|
the template descriptor used to produce that entry and call the show()
|
|
|
|
|
method for each item of the array of template fields structures.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
==== SUPPORTED TEMPLATE FIELDS AND DESCRIPTORS ====
|
|
|
|
|
|
|
|
|
|
In the following, there is the list of supported template fields
|
|
|
|
|
('<identifier>': description), that can be used to define new template
|
|
|
|
|
descriptors by adding their identifier to the format string
|
|
|
|
|
(support for more data types will be added later):
|
|
|
|
|
|
|
|
|
|
- 'd': the digest of the event (i.e. the digest of a measured file),
|
|
|
|
|
calculated with the SHA1 or MD5 hash algorithm;
|
|
|
|
|
- 'n': the name of the event (i.e. the file name), with size up to 255 bytes;
|
|
|
|
|
- 'd-ng': the digest of the event, calculated with an arbitrary hash
|
|
|
|
|
algorithm (field format: [<hash algo>:]digest, where the digest
|
|
|
|
|
prefix is shown only if the hash algorithm is not SHA1 or MD5);
|
2013-11-17 13:31:47 +08:00
|
|
|
- 'n-ng': the name of the event, without size limitations;
|
|
|
|
|
- 'sig': the file signature.
|
ima: new templates management mechanism
The original 'ima' template is fixed length, containing the filedata hash
and pathname. The filedata hash is limited to 20 bytes (md5/sha1). The
pathname is a null terminated string, limited to 255 characters. To
overcome these limitations and to add additional file metadata, it is
necessary to extend the current version of IMA by defining additional
templates.
The main reason to introduce this feature is that, each time a new
template is defined, the functions that generate and display the
measurement list would include the code for handling a new format and,
thus, would significantly grow over time.
This patch set solves this problem by separating the template management
from the remaining IMA code. The core of this solution is the definition
of two new data structures: a template descriptor, to determine which
information should be included in the measurement list, and a template
field, to generate and display data of a given type.
To define a new template field, developers define the field identifier
and implement two functions, init() and show(), respectively to generate
and display measurement entries. Initially, this patch set defines the
following template fields (support for additional data types will be
added later):
- 'd': the digest of the event (i.e. the digest of a measured file),
calculated with the SHA1 or MD5 hash algorithm;
- 'n': the name of the event (i.e. the file name), with size up to
255 bytes;
- 'd-ng': the digest of the event, calculated with an arbitrary hash
algorithm (field format: [<hash algo>:]digest, where the digest
prefix is shown only if the hash algorithm is not SHA1 or MD5);
- 'n-ng': the name of the event, without size limitations.
Defining a new template descriptor requires specifying the template format,
a string of field identifiers separated by the '|' character. This patch
set defines the following template descriptors:
- "ima": its format is 'd|n';
- "ima-ng" (default): its format is 'd-ng|n-ng'
Further details about the new template architecture can be found in
Documentation/security/IMA-templates.txt.
Changelog:
- don't defer calling ima_init_template() - Mimi
- don't define ima_lookup_template_desc() until used - Mimi
- squashed with documentation patch - Mimi
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2013-06-07 18:16:29 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
Below, there is the list of defined template descriptors:
|
|
|
|
|
- "ima": its format is 'd|n';
|
2013-11-17 13:31:47 +08:00
|
|
|
- "ima-ng" (default): its format is 'd-ng|n-ng';
|
|
|
|
|
- "ima-sig": its format is 'd-ng|n-ng|sig'.
|
ima: new templates management mechanism
The original 'ima' template is fixed length, containing the filedata hash
and pathname. The filedata hash is limited to 20 bytes (md5/sha1). The
pathname is a null terminated string, limited to 255 characters. To
overcome these limitations and to add additional file metadata, it is
necessary to extend the current version of IMA by defining additional
templates.
The main reason to introduce this feature is that, each time a new
template is defined, the functions that generate and display the
measurement list would include the code for handling a new format and,
thus, would significantly grow over time.
This patch set solves this problem by separating the template management
from the remaining IMA code. The core of this solution is the definition
of two new data structures: a template descriptor, to determine which
information should be included in the measurement list, and a template
field, to generate and display data of a given type.
To define a new template field, developers define the field identifier
and implement two functions, init() and show(), respectively to generate
and display measurement entries. Initially, this patch set defines the
following template fields (support for additional data types will be
added later):
- 'd': the digest of the event (i.e. the digest of a measured file),
calculated with the SHA1 or MD5 hash algorithm;
- 'n': the name of the event (i.e. the file name), with size up to
255 bytes;
- 'd-ng': the digest of the event, calculated with an arbitrary hash
algorithm (field format: [<hash algo>:]digest, where the digest
prefix is shown only if the hash algorithm is not SHA1 or MD5);
- 'n-ng': the name of the event, without size limitations.
Defining a new template descriptor requires specifying the template format,
a string of field identifiers separated by the '|' character. This patch
set defines the following template descriptors:
- "ima": its format is 'd|n';
- "ima-ng" (default): its format is 'd-ng|n-ng'
Further details about the new template architecture can be found in
Documentation/security/IMA-templates.txt.
Changelog:
- don't defer calling ima_init_template() - Mimi
- don't define ima_lookup_template_desc() until used - Mimi
- squashed with documentation patch - Mimi
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2013-06-07 18:16:29 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
==== USE ====
|
|
|
|
|
|
|
|
|
|
To specify the template descriptor to be used to generate measurement entries,
|
|
|
|
|
currently the following methods are supported:
|
|
|
|
|
|
|
|
|
|
- select a template descriptor among those supported in the kernel
|
|
|
|
|
configuration ('ima-ng' is the default choice);
|
|
|
|
|
- specify a template descriptor name from the kernel command line through
|
2014-10-13 20:08:42 +08:00
|
|
|
the 'ima_template=' parameter;
|
|
|
|
|
- register a new template descriptor with custom format through the kernel
|
|
|
|
|
command line parameter 'ima_template_fmt='.
|
