[PATCH v6 4/8] IMA: add policy rule to measure critical data

[Tushar Sugandhi]

A new IMA policy rule is needed for the IMA hook
ima_measure_critical_data() and the corresponding func CRITICAL_DATA for
measuring the input buffer. The policy rule should ensure the buffer
would get measured only when the policy rule allows the action. The
policy rule should also support the necessary constraints (flags etc.)
for integrity critical buffer data measurements.

Add a policy rule to define the constraints for restricting integrity
critical data measurements.

Signed-off-by: Tushar Sugandhi <tusha...@linux.microsoft.com>
---
 security/integrity/ima/ima_policy.c | 35 +++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/security/integrity/ima/ima_policy.c 
b/security/integrity/ima/ima_policy.c
index 2a0c0603626e..583be7674f3e 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -34,6 +34,7 @@
 #define IMA_PCR                0x0100
 #define IMA_FSNAME     0x0200
 #define IMA_KEYRINGS   0x0400
+#define IMA_DATA_SOURCES       0x0800
 
 #define UNKNOWN                0
 #define MEASURE                0x0001  /* same as IMA_MEASURE */
@@ -85,6 +86,7 @@ struct ima_rule_entry {
        } lsm[MAX_LSM_RULES];
        char *fsname;
        struct ima_rule_opt_list *keyrings; /* Measure keys added to these 
keyrings */
+       struct ima_rule_opt_list *data_sources; /* Measure data from these 
sources */
        struct ima_template_desc *template;
 };
 
@@ -479,6 +481,12 @@ static bool ima_match_rule_data(struct ima_rule_entry 
*rule,
                else
                        opt_list = rule->keyrings;
                break;
+       case CRITICAL_DATA:
+               if (!rule->data_sources)
+                       return true;
+               else
+                       opt_list = rule->data_sources;
+               break;
        default:
                break;
        }
@@ -518,13 +526,19 @@ static bool ima_match_rules(struct ima_rule_entry *rule, 
struct inode *inode,
 {
        int i;
 
-       if (func == KEY_CHECK) {
-               return (rule->flags & IMA_FUNC) && (rule->func == func) &&
-                       ima_match_rule_data(rule, func_data, cred);
-       }
        if ((rule->flags & IMA_FUNC) &&
            (rule->func != func && func != POST_SETATTR))
                return false;
+
+       switch (func) {
+       case KEY_CHECK:
+       case CRITICAL_DATA:
+               return ((rule->func == func) &&
+                       ima_match_rule_data(rule, func_data, cred));
+       default:
+               break;
+       }
+
        if ((rule->flags & IMA_MASK) &&
            (rule->mask != mask && func != POST_SETATTR))
                return false;
@@ -1119,6 +1133,19 @@ static bool ima_validate_rule(struct ima_rule_entry 
*entry)
                if (ima_rule_contains_lsm_cond(entry))
                        return false;
 
+               break;
+       case CRITICAL_DATA:
+               if (entry->action & ~(MEASURE | DONT_MEASURE))
+                       return false;
+
+               if (!(entry->flags & IMA_DATA_SOURCES) ||
+                   (entry->flags & ~(IMA_FUNC | IMA_UID | IMA_PCR |
+                   IMA_DATA_SOURCES)))
+                       return false;
+
+               if (ima_rule_contains_lsm_cond(entry))
+                       return false;
+
                break;
        default:
                return false;
-- 
2.17.1