iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/security/integrity/ima
History
Mimi Zohar 54f03916fb ima: permit fsverity's file digests in the IMA measurement list 
Permit fsverity's file digest (a hash of struct fsverity_descriptor) to
be included in the IMA measurement list, based on the new measurement
policy rule 'digest_type=verity' option.

To differentiate between a regular IMA file hash from an fsverity's
file digest, use the new d-ngv2 format field included in the ima-ngv2
template.

The following policy rule requires fsverity file digests and specifies
the new 'ima-ngv2' template, which contains the new 'd-ngv2' field.  The
policy rule may be constrained, for example based on a fsuuid or LSM
label.

measure func=FILE_CHECK digest_type=verity template=ima-ngv2

Acked-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2022-05-05 11:49:13 -04:00
..
ima_api.c
ima: permit fsverity's file digests in the IMA measurement list
2022-05-05 11:49:13 -04:00
ima_appraise.c
lsm: security_task_getsecid_subj() -> security_current_getsecid_subj()
2021-11-22 17:52:47 -05:00
ima_asymmetric_keys.c
ima: Add digest and digest_len params to the functions to measure a buffer
2021-07-23 09:27:02 -04:00
ima_crypto.c
ima/evm: Fix type mismatch
2021-06-08 16:29:10 -04:00
ima_efi.c
ima: generalize x86/EFI arch glue for other EFI architectures
2020-11-06 07:40:42 +01:00
ima_fs.c
ima: Return error code obtained from securityfs functions
2022-02-15 11:17:01 -05:00
ima_init.c
ima: define ima_max_digest_data struct without a flexible array variable
2022-02-15 11:52:06 -05:00
ima_kexec.c
ima: silence measurement list hexdump during kexec
2022-01-05 06:22:00 -05:00
ima_main.c
ima: permit fsverity's file digests in the IMA measurement list
2022-05-05 11:49:13 -04:00
ima_modsig.c
ima: Move comprehensive rule validation checks out of the token parser
2020-07-20 13:28:15 -04:00
ima_mok.c
IMA: remove -Wmissing-prototypes warning
2021-07-23 08:05:06 -04:00
ima_policy.c
ima: permit fsverity's file digests in the IMA measurement list
2022-05-05 11:49:13 -04:00
ima_queue_keys.c
ima: Add digest and digest_len params to the functions to measure a buffer
2021-07-23 09:27:02 -04:00
ima_queue.c
IMA: support for duplicate measurement records
2021-06-11 12:54:13 -04:00
ima_template_lib.c
ima: permit fsverity's file digests in the IMA measurement list
2022-05-05 11:49:13 -04:00
ima_template_lib.h
ima: define a new template field named 'd-ngv2' and templates
2022-05-05 11:49:13 -04:00
ima_template.c
ima: define a new template field named 'd-ngv2' and templates
2022-05-05 11:49:13 -04:00
ima.h
IMA: introduce a new policy option func=SETXATTR_CHECK
2021-08-16 17:35:35 -04:00
Kconfig
ima: remove the IMA_TEMPLATE Kconfig option
2022-04-07 08:48:20 -04:00
Makefile
ima: generalize x86/EFI arch glue for other EFI architectures
2020-11-06 07:40:42 +01:00