linux-kernel - [PATCH-v2 3/6] ima: added ima_get_template_desc() for templates dynamic registration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1384864428-3895-4-git-send-email-roberto.sassu@polito.it>
Date:	Tue, 19 Nov 2013 13:33:42 +0100
From:	Roberto Sassu <roberto.sassu@...ito.it>
To:	linux-security-module@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org,
	linux-ima-devel@...ts.sourceforge.net, zohar@...ibm.com,
	d.kasatkin@...sung.com, james.l.morris@...cle.com,
	Roberto Sassu <roberto.sassu@...ito.it>
Subject: [PATCH-v2 3/6] ima: added ima_get_template_desc() for templates dynamic registration

This patch introduces the ima_get_template_desc() function which returns
a template descriptor depending on the template name and format passed
as arguments (at least one argument should be not NULL). If the first
argument is not NULL, the new function searches an existing template
descriptor by name among those defined and returns it to the caller.
Instead, if the second argument is not NULL and the first is NULL,
it does a template lookup by format and, if not found, creates a new one
before returning the pointer to the caller. Newly created templates
are cached to avoid duplicates.

Signed-off-by: Roberto Sassu <roberto.sassu@...ito.it>
---
 security/integrity/ima/ima.h          |  2 ++
 security/integrity/ima/ima_template.c | 45 +++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 8b4a4f3..632d92e 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -109,6 +109,8 @@ int ima_init_crypto(void);
 void ima_putc(struct seq_file *m, void *data, int datalen);
 void ima_print_digest(struct seq_file *m, u8 *digest, int size);
 struct ima_template_desc *ima_template_desc_current(void);
+struct ima_template_desc *ima_get_template_desc(char *template_name,
+						char *template_fmt);
 int ima_init_template(void);
 
 int ima_init_template(void);
diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
index c849723..9bec7d4 100644
--- a/security/integrity/ima/ima_template.c
+++ b/security/integrity/ima/ima_template.c
@@ -41,6 +41,8 @@ static struct ima_template_desc *ima_template;
 static struct ima_template_desc *lookup_template_desc_by_name(const char *name);
 static struct ima_template_field *lookup_template_field(const char *field_id);
 
+static DEFINE_MUTEX(ima_templates_mutex);
+
 static int __init ima_template_setup(char *str)
 {
 	struct ima_template_desc *template_desc;
@@ -248,6 +250,49 @@ struct ima_template_desc *ima_template_desc_current(void)
 	return ima_template;
 }
 
+struct ima_template_desc *ima_get_template_desc(char *template_name,
+						char *template_fmt)
+{
+	struct ima_template_desc *desc;
+	int result;
+
+	if (template_name == NULL && template_fmt == NULL)
+		return NULL;
+
+	if (template_name)
+		desc = lookup_template_desc_by_name(template_name);
+	else {
+		mutex_lock(&ima_templates_mutex);
+		desc = lookup_template_desc_by_fmt(template_fmt);
+		if (desc == NULL) {
+			desc = kzalloc(sizeof(*desc), GFP_KERNEL);
+			if (desc == NULL)
+				goto out_unlock;
+		}
+		desc->name = "";
+		desc->fmt = kstrdup(template_fmt, GFP_KERNEL);
+		if (desc->fmt == NULL)
+			goto out_free;
+
+		result = template_desc_init_fields(desc->fmt, &(desc->fields),
+						   &(desc->num_fields));
+		if (result < 0)
+			goto out_free_fmt;
+
+		list_add_tail(&desc->list, &defined_templates[0].list);
+		mutex_unlock(&ima_templates_mutex);
+	}
+
+	return desc;
+out_free_fmt:
+	kfree(desc->fmt);
+out_free:
+	kfree(desc);
+out_unlock:
+	mutex_unlock(&ima_templates_mutex);
+	return NULL;
+}
+
 int ima_init_template(void)
 {
 	int result;
-- 
1.8.1.4


Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (2061 bytes)