redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

ima: refactor ima_init_policy() 

This patch removes the code duplication in ima_init_policy() by defining
a new function named add_rules(). The new function adds the rules to the
initial IMA policy, the custom policy or both based on the policy mask
(IMA_DEFAULT_POLICY, IMA_CUSTOM_POLICY).

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
hifive-unleashed-5.1
Nayna Jain 2018-10-09 23:00:35 +05:30 committed by Mimi Zohar
parent b5ca117365
commit c52657d93b
1 changed files with 56 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
security/integrity/ima/ima_policy.c
View File

@ -58,6 +58,8 @@ enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB }; enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
enum policy_rule_list { IMA_DEFAULT_POLICY = 1, IMA_CUSTOM_POLICY };
struct ima_rule_entry { struct ima_rule_entry {
struct list_head list; struct list_head list;
int action; int action;
@ -473,6 +475,32 @@ static int ima_appraise_flag(enum ima_hooks func)
return 0; return 0;
} }
static void add_rules(struct ima_rule_entry *entries, int count,
enum policy_rule_list policy_rule)
{
int i = 0;
for (i = 0; i < count; i++) {
struct ima_rule_entry *entry;
if (policy_rule & IMA_DEFAULT_POLICY)
list_add_tail(&entries[i].list, &ima_default_rules);
if (policy_rule & IMA_CUSTOM_POLICY) {
entry = kmemdup(&entries[i], sizeof(*entry),
GFP_KERNEL);
if (!entry)
continue;
list_add_tail(&entry->list, &ima_policy_rules);
}
if (entries[i].action == APPRAISE)
temp_ima_appraise |= ima_appraise_flag(entries[i].func);
if (entries[i].func == POLICY_CHECK)
temp_ima_appraise |= IMA_APPRAISE_POLICY;
}
}
/** /**
* ima_init_policy - initialize the default measure rules. * ima_init_policy - initialize the default measure rules.
* *
@ -481,28 +509,23 @@ static int ima_appraise_flag(enum ima_hooks func)
*/ */
void __init ima_init_policy(void) void __init ima_init_policy(void)
{ {
int i, measure_entries, appraise_entries, secure_boot_entries; int build_appraise_entries;
/* if !ima_policy set entries = 0 so we load NO default rules */ /* if !ima_policy, we load NO default rules */
measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0; if (ima_policy)
appraise_entries = ima_use_appraise_tcb ? add_rules(dont_measure_rules, ARRAY_SIZE(dont_measure_rules),
ARRAY_SIZE(default_appraise_rules) : 0; IMA_DEFAULT_POLICY);
secure_boot_entries = ima_use_secure_boot ?
ARRAY_SIZE(secure_boot_rules) : 0;
for (i = 0; i < measure_entries; i++)
list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
switch (ima_policy) { switch (ima_policy) {
case ORIGINAL_TCB: case ORIGINAL_TCB:
for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++) add_rules(original_measurement_rules,
list_add_tail(&original_measurement_rules[i].list, ARRAY_SIZE(original_measurement_rules),
&ima_default_rules); IMA_DEFAULT_POLICY);
break; break;
case DEFAULT_TCB: case DEFAULT_TCB:
for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++) add_rules(default_measurement_rules,
list_add_tail(&default_measurement_rules[i].list, ARRAY_SIZE(default_measurement_rules),
&ima_default_rules); IMA_DEFAULT_POLICY);
default: default:
break; break;
} }
@ -511,38 +534,30 @@ void __init ima_init_policy(void)
* Insert the builtin "secure_boot" policy rules requiring file * Insert the builtin "secure_boot" policy rules requiring file
* signatures, prior to any other appraise rules. * signatures, prior to any other appraise rules.
*/ */
for (i = 0; i < secure_boot_entries; i++) { if (ima_use_secure_boot)
list_add_tail(&secure_boot_rules[i].list, &ima_default_rules); add_rules(secure_boot_rules, ARRAY_SIZE(secure_boot_rules),
temp_ima_appraise |= IMA_DEFAULT_POLICY);
ima_appraise_flag(secure_boot_rules[i].func);
}
/* /*
* Insert the build time appraise rules requiring file signatures * Insert the build time appraise rules requiring file signatures
* for both the initial and custom policies, prior to other appraise * for both the initial and custom policies, prior to other appraise
* rules. * rules. As the secure boot rules includes all of the build time
* rules, include either one or the other set of rules, but not both.
*/ */
for (i = 0; i < ARRAY_SIZE(build_appraise_rules); i++) { build_appraise_entries = ARRAY_SIZE(build_appraise_rules);
struct ima_rule_entry *entry; if (build_appraise_entries) {
if (ima_use_secure_boot)
if (!secure_boot_entries) add_rules(build_appraise_rules, build_appraise_entries,
list_add_tail(&build_appraise_rules[i].list, IMA_CUSTOM_POLICY);
&ima_default_rules); else
add_rules(build_appraise_rules, build_appraise_entries,
entry = kmemdup(&build_appraise_rules[i], sizeof(*entry), IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY);
GFP_KERNEL);
if (entry)
list_add_tail(&entry->list, &ima_policy_rules);
build_ima_appraise |=
ima_appraise_flag(build_appraise_rules[i].func);
} }
for (i = 0; i < appraise_entries; i++) { if (ima_use_appraise_tcb)
list_add_tail(&default_appraise_rules[i].list, add_rules(default_appraise_rules,
&ima_default_rules); ARRAY_SIZE(default_appraise_rules),
if (default_appraise_rules[i].func == POLICY_CHECK) IMA_DEFAULT_POLICY);
temp_ima_appraise |= IMA_APPRAISE_POLICY;
}
ima_rules = &ima_default_rules; ima_rules = &ima_default_rules;
ima_update_policy_flag(); ima_update_policy_flag();