Files
linux/include/linux
Tyler Hicks 4834177e63 ima: Support additional conditionals in the KEXEC_CMDLINE hook function
Take the properties of the kexec kernel's inode and the current task
ownership into consideration when matching a KEXEC_CMDLINE operation to
the rules in the IMA policy. This allows for some uniformity when
writing IMA policy rules for KEXEC_KERNEL_CHECK, KEXEC_INITRAMFS_CHECK,
and KEXEC_CMDLINE operations.

Prior to this patch, it was not possible to write a set of rules like
this:

 dont_measure func=KEXEC_KERNEL_CHECK obj_type=foo_t
 dont_measure func=KEXEC_INITRAMFS_CHECK obj_type=foo_t
 dont_measure func=KEXEC_CMDLINE obj_type=foo_t
 measure func=KEXEC_KERNEL_CHECK
 measure func=KEXEC_INITRAMFS_CHECK
 measure func=KEXEC_CMDLINE

The inode information associated with the kernel being loaded by a
kexec_kernel_load(2) syscall can now be included in the decision to
measure or not

Additonally, the uid, euid, and subj_* conditionals can also now be
used in KEXEC_CMDLINE rules. There was no technical reason as to why
those conditionals weren't being considered previously other than
ima_match_rules() didn't have a valid inode to use so it immediately
bailed out for KEXEC_CMDLINE operations rather than going through the
full list of conditional comparisons.

Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: kexec@lists.infradead.org
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2020-07-20 13:28:16 -04:00
..
2020-05-17 21:10:28 -07:00
2020-05-09 16:15:13 -06:00
2020-05-24 20:48:11 +02:00
2020-05-19 09:40:29 -06:00
2020-04-10 15:36:21 -07:00
2020-05-13 08:44:35 -07:00
2020-05-04 11:19:58 -07:00
2020-06-18 09:24:35 -06:00
2020-06-09 09:39:13 -07:00
2020-05-28 07:59:45 -07:00
2020-04-30 12:54:01 -07:00
2020-05-18 10:30:21 +01:00
2020-06-02 15:15:46 +01:00
2020-05-08 18:18:11 +01:00
2020-05-08 00:12:42 +02:00
2020-05-28 10:31:09 +02:00
2020-04-07 10:43:38 -07:00
2020-06-10 19:14:18 -07:00
2020-05-09 13:57:12 +02:00
2020-04-02 09:35:27 -07:00
2020-05-15 13:51:28 -07:00
2020-05-09 13:57:12 +02:00
2020-05-17 14:10:07 -06:00
2020-05-14 16:44:24 +02:00
2020-05-14 16:44:25 +02:00
2020-04-28 11:05:44 +02:00
2020-05-28 11:11:45 -07:00
2020-05-04 09:16:37 -07:00
2020-05-29 14:52:53 +02:00
2020-04-01 12:06:26 -04:00
2020-04-17 06:05:30 -04:00