[lkml]   [2020]   [Jan]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH v7 0/3] IMA: Deferred measurement of keys
The IMA subsystem supports measuring asymmetric keys when the key is
created or updated[1]. But keys created or updated before a custom
IMA policy is loaded are currently not measured. This includes keys
added, for instance, to either the .ima or .builtin_trusted_keys keyrings,
which happens early in the boot process.

Measuring the early boot keys, by design, requires loading
a custom IMA policy. This change adds support for queuing keys
created or updated before a custom IMA policy is loaded.
The queued keys are processed when a custom policy is loaded.
Keys created or updated after a custom policy is loaded are measured
immediately (not queued). In the case when a custom policy is not loaded
within 5 minutes of IMA initialization, the queued keys are freed.


Testing performed:

* Ran kernel self-test following the instructions given in
* Ran the lkp-tests using the job script provided by
kernel test robot <>
* Booted the kernel with this change.
* Added .builtin_trusted_keys in "keyrings=" option in
the IMA policy and verified the keys added to this
keyring are measured.
* Specified only func=KEY_CHECK and not "keyrings=" option,
and verified the keys added to builtin_trusted_keys keyring
are processed.
* Added keys at runtime and verified they are measured
if the IMA policy permitted.
=> For example, added keys to .ima keyring and verified.



=> Updated cover letter per Mimi's suggestions.
=> Updated "Reported-by" tag to be specific about
the issues fixed in the patch.


=> Replaced mutex with a spinlock to sychronize access to
queued keys. This fixes the problem reported by
"kernel test robot <>"
=> Changed ima_queue_key() to a static function. This fixes
the issue reported by "kbuild test robot <>"
=> Added the patch to free the queued keys if a custom IMA policy
was not loaded to this patch set.


=> Removed temp keys list in ima_process_queued_keys()


=> Check and set ima_process_keys flag with mutex held.


=> Defined ima_process_keys flag to be static.
=> Set ima_process_keys with ima_keys_mutex held.
=> Added a comment in ima_process_queued_keys() function
to state the use of temporary list for keys.


=> Rebased the changes to v5.5-rc1
=> Updated function names, variable names, and code comments
to be less verbose.


=> Code cleanup


=> Based changes on v5.4-rc8
=> The following patchsets should be applied in that order
=> Added functions to queue and dequeue keys, and process
the queued keys when custom IMA policies are applied.

Lakshmi Ramasubramanian (3):
IMA: Define workqueue for early boot key measurements
IMA: Call workqueue functions to measure queued keys
IMA: Defined timer to free queued keys

security/integrity/ima/ima.h | 17 ++
security/integrity/ima/ima_asymmetric_keys.c | 159 +++++++++++++++++++
security/integrity/ima/ima_init.c | 8 +-
security/integrity/ima/ima_policy.c | 3 +
4 files changed, 186 insertions(+), 1 deletion(-)


 \ /
  Last update: 2020-01-03 20:55    [W:0.033 / U:1.976 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site