2013-06-07 18:16:30 +08:00
|
|
|
/*
|
|
|
|
|
* Copyright (C) 2013 Politecnico di Torino, Italy
|
|
|
|
|
* TORSEC group -- http://security.polito.it
|
|
|
|
|
*
|
|
|
|
|
* Author: Roberto Sassu <roberto.sassu@polito.it>
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU General Public License as
|
|
|
|
|
* published by the Free Software Foundation, version 2 of the
|
|
|
|
|
* License.
|
|
|
|
|
*
|
|
|
|
|
* File: ima_template_lib.h
|
|
|
|
|
* Header for the library of supported template fields.
|
|
|
|
|
*/
|
|
|
|
|
#ifndef __LINUX_IMA_TEMPLATE_LIB_H
|
|
|
|
|
#define __LINUX_IMA_TEMPLATE_LIB_H
|
|
|
|
|
|
|
|
|
|
#include <linux/seq_file.h>
|
|
|
|
|
#include "ima.h"
|
|
|
|
|
|
ima: introduce ima_parse_buf()
ima_parse_buf() takes as input the buffer start and end pointers, and
stores the result in a static array of ima_field_data structures,
where the len field contains the length parsed from the buffer, and
the data field contains the address of the buffer just after the length.
Optionally, the function returns the current value of the buffer pointer
and the number of array elements written.
A bitmap has been added as parameter of ima_parse_buf() to handle
the cases where the length is not prepended to data. Each bit corresponds
to an element of the ima_field_data array. If a bit is set, the length
is not parsed from the buffer, but is read from the corresponding element
of the array (the length must be set before calling the function).
ima_parse_buf() can perform three checks upon request by callers,
depending on the enforce mask passed to it:
- ENFORCE_FIELDS: matching of number of fields (length-data combination)
- there must be enough data in the buffer to parse the number of fields
requested (output: current value of buffer pointer)
- ENFORCE_BUFEND: matching of buffer end
- the ima_field_data array must be large enough to contain lengths and
data pointers for the amount of data requested (output: number
of fields written)
- ENFORCE_FIELDS | ENFORCE_BUFEND: matching of both
Use cases
- measurement entry header: ENFORCE_FIELDS | ENFORCE_BUFEND
- four fields must be parsed: pcr, digest, template name, template data
- ENFORCE_BUFEND is enforced only for the last measurement entry
- template digest (Crypto Agile): ENFORCE_BUFEND
- since only the total template digest length is known, the function
parses length-data combinations until the buffer end is reached
- template data: ENFORCE_FIELDS | ENFORCE_BUFEND
- since the number of fields and the total template data length
are known, the function can perform both checks
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2017-05-16 20:53:41 +08:00
|
|
|
#define ENFORCE_FIELDS 0x00000001
|
|
|
|
|
#define ENFORCE_BUFEND 0x00000002
|
|
|
|
|
|
2013-06-07 18:16:30 +08:00
|
|
|
void ima_show_template_digest(struct seq_file *m, enum ima_show_type show,
|
|
|
|
|
struct ima_field_data *field_data);
|
2013-06-07 18:16:32 +08:00
|
|
|
void ima_show_template_digest_ng(struct seq_file *m, enum ima_show_type show,
|
|
|
|
|
struct ima_field_data *field_data);
|
2013-06-07 18:16:30 +08:00
|
|
|
void ima_show_template_string(struct seq_file *m, enum ima_show_type show,
|
|
|
|
|
struct ima_field_data *field_data);
|
2013-07-23 23:15:00 +08:00
|
|
|
void ima_show_template_sig(struct seq_file *m, enum ima_show_type show,
|
|
|
|
|
struct ima_field_data *field_data);
|
ima: introduce ima_parse_buf()
ima_parse_buf() takes as input the buffer start and end pointers, and
stores the result in a static array of ima_field_data structures,
where the len field contains the length parsed from the buffer, and
the data field contains the address of the buffer just after the length.
Optionally, the function returns the current value of the buffer pointer
and the number of array elements written.
A bitmap has been added as parameter of ima_parse_buf() to handle
the cases where the length is not prepended to data. Each bit corresponds
to an element of the ima_field_data array. If a bit is set, the length
is not parsed from the buffer, but is read from the corresponding element
of the array (the length must be set before calling the function).
ima_parse_buf() can perform three checks upon request by callers,
depending on the enforce mask passed to it:
- ENFORCE_FIELDS: matching of number of fields (length-data combination)
- there must be enough data in the buffer to parse the number of fields
requested (output: current value of buffer pointer)
- ENFORCE_BUFEND: matching of buffer end
- the ima_field_data array must be large enough to contain lengths and
data pointers for the amount of data requested (output: number
of fields written)
- ENFORCE_FIELDS | ENFORCE_BUFEND: matching of both
Use cases
- measurement entry header: ENFORCE_FIELDS | ENFORCE_BUFEND
- four fields must be parsed: pcr, digest, template name, template data
- ENFORCE_BUFEND is enforced only for the last measurement entry
- template digest (Crypto Agile): ENFORCE_BUFEND
- since only the total template digest length is known, the function
parses length-data combinations until the buffer end is reached
- template data: ENFORCE_FIELDS | ENFORCE_BUFEND
- since the number of fields and the total template data length
are known, the function can perform both checks
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2017-05-16 20:53:41 +08:00
|
|
|
int ima_parse_buf(void *bufstartp, void *bufendp, void **bufcurp,
|
|
|
|
|
int maxfields, struct ima_field_data *fields, int *curfields,
|
|
|
|
|
unsigned long *len_mask, int enforce_mask, char *bufname);
|
2015-04-11 23:09:50 +08:00
|
|
|
int ima_eventdigest_init(struct ima_event_data *event_data,
|
2013-06-07 18:16:30 +08:00
|
|
|
struct ima_field_data *field_data);
|
2015-04-11 23:09:50 +08:00
|
|
|
int ima_eventname_init(struct ima_event_data *event_data,
|
2013-06-07 18:16:30 +08:00
|
|
|
struct ima_field_data *field_data);
|
2015-04-11 23:09:50 +08:00
|
|
|
int ima_eventdigest_ng_init(struct ima_event_data *event_data,
|
|
|
|
|
struct ima_field_data *field_data);
|
|
|
|
|
int ima_eventname_ng_init(struct ima_event_data *event_data,
|
2013-06-07 18:16:32 +08:00
|
|
|
struct ima_field_data *field_data);
|
2015-04-11 23:09:50 +08:00
|
|
|
int ima_eventsig_init(struct ima_event_data *event_data,
|
2013-07-23 23:15:00 +08:00
|
|
|
struct ima_field_data *field_data);
|
2013-06-07 18:16:30 +08:00
|
|
|
#endif /* __LINUX_IMA_TEMPLATE_LIB_H */
|