From: Roberto Sassu <[email protected]>
Introduce the ability of staging the entire (or a portion of the) IMA
measurement list for deletion. Staging means moving the current
content of
the measurement list to a separate location, and allowing users to
read and
delete it. This causes the measurement list to be atomically truncated
before new measurements can be added. Staging can be done only once
at a
time. In the event of kexec(), staging is reverted and staged
entries will
be carried over to the new kernel.
User space is responsible to concatenate the staged IMA measurements
list
portions following the temporal order in which the operations were
done,
together with the current measurement list. Then, it can send the
collected
data to the remote verifiers.
Also introduce the ability of trimming N measurements entries from
the IMA
measurements list, provided that user space has already read them.
Trimming
combines staging and deletion in one operation.
The benefit of these solutions is the ability to free precious kernel
memory, in exchange of delegating user space to reconstruct the full
measurement list from the chunks. No trust needs to be given to user
space,
since the integrity of the measurement list is protected by the TPM.
By default, staging/trimming the measurements list does not alter
the hash
table. When staging/trimming are done, IMA is still able to detect
collisions on the staged and later deleted measurement entries, by
keeping
the entry digests (only template data are freed).
However, since during the measurements list serialization only the SHA1
digest is passed, and since there are no template data to
recalculate the
other digests from, the hash table is currently not populated with
digests
from staged/deleted entries after kexec().
Introduce the new kernel option ima_flush_htable to decide whether
or not
the digests of staged measurement entries are flushed from the hash
table.
Then, introduce ascii_runtime_measurements_staged_<algo> and
binary_runtime_measurement_staged_<algo> interfaces to
stage/trim/delete
the measurements. Use 'echo A > <IMA interface>' and
'echo D > <IMA interface>' to respectively stage and delete the entire
measurements list. Use 'echo N > <IMA interface>', with N between 1 and
LONG_MAX, to stage the selected portion of the measurements list, and
'echo -N > <IMA interface>' to trim N measurements entries.
The ima_measure_users counter (protected by the ima_measure_lock
mutex) has
been introduced to protect access to the measurements list and the
staged
part. The open method of all the measurement interfaces has been
extended
to allow only one writer at a time or, in alternative, multiple
readers.
The write permission is used to stage/trim/delete the measurements, the
read permission to read them. Write requires also the CAP_SYS_ADMIN
capability.
Finally, introduce and maintain dedicate counters for the number of
measurement entries and binary size, for the current measurements list
(BINARY_SIZE), for the current measurements list plus staged entries
(BINARY_SIZE_STAGED) useful for kexec() segment allocation, and for the
entire measurement list without staging/trimming (BINARY_SIZE_FULL)
useful
for the kexec-related critical data records.
