iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dm ima: measure data on table clear

Browse Source 
For a given block device, an inactive table slot contains the parameters
to configure the device with.  The inactive table can be cleared
multiple times, accidentally or maliciously, which may impact the
functionality of the device, and compromise the system.  Therefore it is
important to measure and log the event when a table is cleared.

Measure device parameters, and table hashes when the inactive table slot
is cleared.

Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
This commit is contained in:
Tushar Sugandhi 2021-07-12 17:49:01 -07:00 committed by Mike Snitzer
parent 84010e519f
commit 99169b9383
3 changed files with 97 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

92
drivers/md/dm-ima.c
View File

@ -563,3 +563,95 @@ exit:
kfree(dev_name);
kfree(dev_uuid);
}
/*
* Measure ima data on table clear.
*/
void dm_ima_measure_on_table_clear(struct mapped_device *md, bool new_map)
{
unsigned int l = 0, capacity_len = 0;
char *device_table_data = NULL, *dev_name = NULL, *dev_uuid = NULL, *capacity_str = NULL;
char inactive_str[] = "inactive_table_hash=";
unsigned int inactive_len = strlen(inactive_str);
bool noio = true;
int r;
device_table_data = dm_ima_alloc(DM_IMA_DEVICE_BUF_LEN, GFP_KERNEL, noio);
if (!device_table_data)
return;
r = dm_ima_alloc_and_copy_capacity_str(md, &capacity_str, noio);
if (r)
goto error1;
if (md->ima.inactive_table.device_metadata_len &&
md->ima.inactive_table.hash_len) {
memcpy(device_table_data + l, md->ima.inactive_table.device_metadata,
md->ima.inactive_table.device_metadata_len);
l += md->ima.inactive_table.device_metadata_len;
memcpy(device_table_data + l, inactive_str, inactive_len);
l += inactive_len;
memcpy(device_table_data + l, md->ima.inactive_table.hash,
md->ima.inactive_table.hash_len);
l += md->ima.inactive_table.hash_len;
memcpy(device_table_data + l, ";", 1);
l++;
}
if (!l) {
if (dm_ima_alloc_and_copy_name_uuid(md, &dev_name, &dev_uuid, noio))
goto error2;
scnprintf(device_table_data, DM_IMA_DEVICE_BUF_LEN,
"name=%s,uuid=%s;table_clear=no_data;", dev_name, dev_uuid);
l += strlen(device_table_data);
}
capacity_len = strlen(capacity_str);
memcpy(device_table_data + l, capacity_str, capacity_len);
l += capacity_len;
dm_ima_measure_data("table_clear", device_table_data, l, noio);
if (new_map) {
if (md->ima.inactive_table.hash &&
md->ima.inactive_table.hash != md->ima.active_table.hash)
kfree(md->ima.inactive_table.hash);
md->ima.inactive_table.hash = NULL;
md->ima.inactive_table.hash_len = 0;
if (md->ima.inactive_table.device_metadata &&
md->ima.inactive_table.device_metadata != md->ima.active_table.device_metadata)
kfree(md->ima.inactive_table.device_metadata);
md->ima.inactive_table.device_metadata = NULL;
md->ima.inactive_table.device_metadata_len = 0;
md->ima.inactive_table.num_targets = 0;
if (md->ima.active_table.hash) {
md->ima.inactive_table.hash = md->ima.active_table.hash;
md->ima.inactive_table.hash_len = md->ima.active_table.hash_len;
}
if (md->ima.active_table.device_metadata) {
md->ima.inactive_table.device_metadata =
md->ima.active_table.device_metadata;
md->ima.inactive_table.device_metadata_len =
md->ima.active_table.device_metadata_len;
md->ima.inactive_table.num_targets =
md->ima.active_table.num_targets;
}
}
kfree(dev_name);
kfree(dev_uuid);
error2:
kfree(capacity_str);
error1:
kfree(device_table_data);
}

2
drivers/md/dm-ima.h
View File

@ -51,6 +51,7 @@ void dm_ima_reset_data(struct mapped_device *md);
void dm_ima_measure_on_table_load(struct dm_table *table, unsigned int status_flags);
void dm_ima_measure_on_device_resume(struct mapped_device *md, bool swap);
void dm_ima_measure_on_device_remove(struct mapped_device *md, bool remove_all);
void dm_ima_measure_on_table_clear(struct mapped_device *md, bool new_map);
#else
@ -58,6 +59,7 @@ static inline void dm_ima_reset_data(struct mapped_device *md) {}
static inline void dm_ima_measure_on_table_load(struct dm_table *table, unsigned int status_flags) {}
static inline void dm_ima_measure_on_device_resume(struct mapped_device *md, bool swap) {}
static inline void dm_ima_measure_on_device_remove(struct mapped_device *md, bool remove_all) {}
static inline void dm_ima_measure_on_table_clear(struct mapped_device *md, bool new_map) {}
#endif /* CONFIG_IMA */

3
drivers/md/dm-ioctl.c
View File

@ -1505,6 +1505,7 @@ static int table_clear(struct file *filp, struct dm_ioctl *param, size_t param_s
struct hash_cell *hc;
struct mapped_device *md;
struct dm_table *old_map = NULL;
bool has_new_map = false;
down_write(&_hash_lock);
@ -1518,6 +1519,7 @@ static int table_clear(struct file *filp, struct dm_ioctl *param, size_t param_s
if (hc->new_map) {
old_map = hc->new_map;
hc->new_map = NULL;
has_new_map = true;
}
param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
@ -1529,6 +1531,7 @@ static int table_clear(struct file *filp, struct dm_ioctl *param, size_t param_s
dm_sync_table(md);
dm_table_destroy(old_map);
}
dm_ima_measure_on_table_clear(md, has_new_map);
dm_put(md);
return 0;