The configured IMA measurement list template format can be replaced at
runtime on the boot command line, including a custom template format.
This patch adds support for restoring a measuremement list containing
multiple builtin/custom template formats.

Signed-off-by: Mimi Zohar <zo...@linux.vnet.ibm.com>
---
 security/integrity/ima/ima_template.c | 53 +++++++++++++++++++++++++++++++++--
 1 file changed, 50 insertions(+), 3 deletions(-)

diff --git a/security/integrity/ima/ima_template.c 
b/security/integrity/ima/ima_template.c
index 804bb95..7b15baa 100644
--- a/security/integrity/ima/ima_template.c
+++ b/security/integrity/ima/ima_template.c
@@ -155,9 +155,14 @@ static int template_desc_init_fields(const char 
*template_fmt,
 {
        const char *template_fmt_ptr;
        struct ima_template_field *found_fields[IMA_TEMPLATE_NUM_FIELDS_MAX];
-       int template_num_fields = template_fmt_size(template_fmt);
+       int template_num_fields;
        int i, len;
 
+       if (num_fields && *num_fields > 0) /* already initialized? */
+               return 0;
+
+       template_num_fields = template_fmt_size(template_fmt);
+
        if (template_num_fields > IMA_TEMPLATE_NUM_FIELDS_MAX) {
                pr_err("format string '%s' contains too many fields\n",
                       template_fmt);
@@ -237,6 +242,35 @@ int __init ima_init_template(void)
        return result;
 }
 
+static struct ima_template_desc *restore_template_fmt(char *template_name)
+{
+       struct ima_template_desc *template_desc = NULL;
+       int ret;
+
+       ret = template_desc_init_fields(template_name, NULL, NULL);
+       if (ret < 0) {
+               pr_err("attempting to initialize the template \"%s\" failed\n",
+                       template_name);
+               goto out;
+       }
+
+       template_desc = kzalloc(sizeof(*template_desc), GFP_KERNEL);
+       if (!template_desc)
+               goto out;
+
+       template_desc->name = "";
+       template_desc->fmt = kstrdup(template_name, GFP_KERNEL);
+       if (!template_desc->fmt)
+               goto out;
+
+       spin_lock(&template_list);
+       list_add_tail_rcu(&template_desc->list, &defined_templates);
+       spin_unlock(&template_list);
+       synchronize_rcu();
+out:
+       return template_desc;
+}
+
 static int ima_restore_template_data(struct ima_template_desc *template_desc,
                                     void *template_data,
                                     int template_data_size,
@@ -367,10 +401,23 @@ int ima_restore_measurement_list(loff_t size, void *buf)
                }
                data_v1 = bufp += (u_int8_t)hdr_v1->template_name_len;
 
-               /* get template format */
                template_desc = lookup_template_desc(template_name);
                if (!template_desc) {
-                       pr_err("template \"%s\" not found\n", template_name);
+                       template_desc = restore_template_fmt(template_name);
+                       if (!template_desc)
+                               break;
+               }
+
+               /*
+                * Only the running system's template format is initialized
+                * on boot.  As needed, initialize the other template formats.
+                */
+               ret = template_desc_init_fields(template_desc->fmt,
+                                               &(template_desc->fields),
+                                               &(template_desc->num_fields));
+               if (ret < 0) {
+                       pr_err("attempting to restore the template fmt \"%s\" \
+                               failed\n", template_desc->fmt);
                        ret = -EINVAL;
                        break;
                }
-- 
2.1.0


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

Reply via email to