Eric Lee / smarc-ti-linux-kernel

5
Download as
Browse Code ยป

Commit c019e307ad82a8ee652b8ccbacf69ae94263b07b

Authored by Roberto Sassu
Committed by Mimi Zohar
1 parent 73a6b44a00
Exists in master and in 13 other branches dlt-processor-sdk-linux-03.00.00.04, processor-sdk-linux-02.00.01, smarc-ti-linux-3.15.y, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04, ti-linux-3.15.y, ti-lsk-linux-4.1.y

ima: restore the original behavior for sending data with ima template 

With the new template mechanism introduced in IMA since kernel 3.13,
the format of data sent through the binary_runtime_measurements interface
is slightly changed. Now, for a generic measurement, the format of
template data (after the template name) is:

template_len | field1_len | field1 | ... | fieldN_len | fieldN

In addition, fields containing a string now include the '\0' termination
character.

Instead, the format for the 'ima' template should be:

SHA1 digest | event name length | event name

It must be noted that while in the IMA 3.13 code 'event name length' is
'IMA_EVENT_NAME_LEN_MAX + 1' (256 bytes), so that the template digest
is calculated correctly, and 'event name' contains '\0', in the pre 3.13
code 'event name length' is exactly the string length and 'event name'
does not contain the termination character.

The patch restores the behavior of the IMA code pre 3.13 for the 'ima'
template so that legacy userspace tools obtain a consistent behavior
when receiving data from the binary_runtime_measurements interface
regardless of which kernel version is used.

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Cc: <stable@vger.kernel.org> # 3.3.13: 3ce1217 ima: define template fields library
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

Showing 3 changed files with 10 additions and 4 deletions Side-by-side Diff

security/integrity/ima/ima.h
Diff comments   View file @ c019e30
... ... @@ -27,7 +27,7 @@
27 27 #include "../integrity.h"
28 28  
29 29 enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
30   - IMA_SHOW_ASCII };
  30 + IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
31 31 enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
32 32  
33 33 /* digest size for IMA, fits SHA1 or MD5 */
security/integrity/ima/ima_fs.c
Diff comments   View file @ c019e30
... ... @@ -160,6 +160,8 @@
160 160  
161 161 if (is_ima_template && strcmp(field->field_id, "d") == 0)
162 162 show = IMA_SHOW_BINARY_NO_FIELD_LEN;
  163 + if (is_ima_template && strcmp(field->field_id, "n") == 0)
  164 + show = IMA_SHOW_BINARY_OLD_STRING_FMT;
163 165 field->field_show(m, show, &e->template_data[i]);
164 166 }
165 167 return 0;
security/integrity/ima/ima_template_lib.c
Diff comments   View file @ c019e30
... ... @@ -109,13 +109,16 @@
109 109 enum data_formats datafmt,
110 110 struct ima_field_data *field_data)
111 111 {
  112 + u32 len = (show == IMA_SHOW_BINARY_OLD_STRING_FMT) ?
  113 + strlen(field_data->data) : field_data->len;
  114 +
112 115 if (show != IMA_SHOW_BINARY_NO_FIELD_LEN)
113   - ima_putc(m, &field_data->len, sizeof(u32));
  116 + ima_putc(m, &len, sizeof(len));
114 117  
115   - if (!field_data->len)
  118 + if (!len)
116 119 return;
117 120  
118   - ima_putc(m, field_data->data, field_data->len);
  121 + ima_putc(m, field_data->data, len);
119 122 }
120 123  
121 124 static void ima_show_template_field_data(struct seq_file *m,
... ... @@ -129,6 +132,7 @@
129 132 break;
130 133 case IMA_SHOW_BINARY:
131 134 case IMA_SHOW_BINARY_NO_FIELD_LEN:
  135 + case IMA_SHOW_BINARY_OLD_STRING_FMT:
132 136 ima_show_template_data_binary(m, show, datafmt, field_data);
133 137 break;
134 138 default: