Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpf-lsm: Extend interoperability with IMA #9

Closed
wants to merge 7 commits into from
Closed

bpf-lsm: Extend interoperability with IMA #9

wants to merge 7 commits into from

Commits on Feb 15, 2022

  1. adding ci files

    @thefallentree
    thefallentree committed Feb 15, 2022
    Configuration menu
    Copy the full SHA
    258490c View commit details
    Browse the repository at this point in the history

  2. ima: Fix documentation-related warnings in ima_main.c 

    Fix some warnings in ima_main.c, displayed with W=n make argument.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
    @robertosassu @thefallentree
    robertosassu authored and thefallentree committed Feb 15, 2022
    Configuration menu
    Copy the full SHA
    f6db5ac View commit details
    Browse the repository at this point in the history

  3. ima: Always return a file measurement in ima_file_hash() 

    __ima_inode_hash() checks if a digest has been already calculated by
looking for the integrity_iint_cache structure associated to the passed
inode.

Users of ima_file_hash() (e.g. eBPF) might be interested in obtaining the
information without having to setup an IMA policy so that the digest is
always available at the time they call this function.

Call ima_collect_measurement() in __ima_inode_hash(), if the file
descriptor is available (passed by ima_file_hash()), and store the file
measurement in a temporary integrity_iint_cache structure.

This change does not cause memory usage increase, due to using the
temporary integrity_iint_cache structure, and due to freeing the
ima_digest_data structure inside integrity_iint_cache before exiting from
__ima_inode_hash().

For compatibility reasons, the behavior of ima_inode_hash() remains
unchanged.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    @robertosassu @thefallentree
    robertosassu authored and thefallentree committed Feb 15, 2022
    Configuration menu
    Copy the full SHA
    a6079ea View commit details
    Browse the repository at this point in the history

  4. bpf-lsm: Introduce new helper bpf_ima_file_hash() 

    ima_file_hash() has been modified to calculate the measurement of a file on
demand, if it has not been already performed by IMA. For compatibility
reasons, ima_inode_hash() remains unchanged.

Keep the same approach in eBPF and introduce the new helper
bpf_ima_file_hash() to take advantage of the modified behavior of
ima_file_hash().

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    @robertosassu @thefallentree
    robertosassu authored and thefallentree committed Feb 15, 2022
    Configuration menu
    Copy the full SHA
    c829587 View commit details
    Browse the repository at this point in the history

  5. selftests/bpf: Add test for bpf_ima_file_hash() 

    Modify the existing IMA test to call bpf_ima_file_hash() and update the
expected result accordingly.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    @robertosassu @thefallentree
    robertosassu authored and thefallentree committed Feb 15, 2022
    Configuration menu
    Copy the full SHA
    8b293df View commit details
    Browse the repository at this point in the history

  6. bpf-lsm: Make bpf_lsm_kernel_read_file() as sleepable 

    Make bpf_lsm_kernel_read_file() as sleepable, so that bpf_ima_inode_hash()
or bpf_ima_file_hash() can be called inside the implementation of this
hook.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    @robertosassu @thefallentree
    robertosassu authored and thefallentree committed Feb 15, 2022
    Configuration menu
    Copy the full SHA
    f729a20 View commit details
    Browse the repository at this point in the history

  7. selftests/bpf: Add test for bpf_lsm_kernel_read_file() 

    Test the ability of bpf_lsm_kernel_read_file() to call the sleepable
functions bpf_ima_inode_hash() or bpf_ima_file_hash() to obtain a
measurement of a loaded IMA policy.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    @robertosassu @thefallentree
    robertosassu authored and thefallentree committed Feb 15, 2022
    Configuration menu
    Copy the full SHA
    7ad99ed View commit details
    Browse the repository at this point in the history