1. 13 Sep, 2012 1 commit
    • Peter Moody's avatar
      ima: audit log hashes · e7c568e0
      Peter Moody authored
      This adds an 'audit' policy action which audit logs file measurements.
      Changelog v6:
       - use new action flag handling (Dmitry Kasatkin).
       - removed whitespace (Mimi)
      Changelog v5:
       - use audit_log_untrustedstring.
      Changelog v4:
       - cleanup digest -> hash conversion.
       - use filename rather than d_path in ima_audit_measurement.
      Changelog v3:
       - Use newly exported audit_log_task_info for logging pid/ppid/uid/etc.
       - Update the ima_policy ABI documentation.
      Changelog v2:
       - Use 'audit' action rather than 'measure_and_audit' to permit
       auditing in the absence of measuring..
      Changelog v1:
       - Initial posting.
      Signed-off-by: default avatarPeter Moody <pmoody@google.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
  2. 07 Sep, 2012 1 commit
    • Mimi Zohar's avatar
      ima: add appraise action keywords and default rules · 07f6a794
      Mimi Zohar authored
      Unlike the IMA measurement policy, the appraise policy can not be dependent
      on runtime process information, such as the task uid, as the 'security.ima'
      xattr is written on file close and must be updated each time the file changes,
      regardless of the current task uid.
      This patch extends the policy language with 'fowner', defines an appraise
      policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
      a new boot command line option, to enable the appraise policy.
      Changelog v3:
      - separate the measure from the appraise rules in order to support measuring
        without appraising and appraising without measuring.
      - change appraisal default for filesystems without xattr support to fail
      - update default appraise policy for cgroups
      Changelog v1:
      - don't appraise RAMFS (Dmitry Kasatkin)
      - merged rest of "ima: ima_must_appraise_or_measure API change" commit
        (Dmtiry Kasatkin)
        ima_must_appraise_or_measure() called ima_match_policy twice, which
        searched the policy for a matching rule.  Once for a matching measurement
        rule and subsequently for an appraisal rule. Searching the policy twice
        is unnecessary overhead, which could be noticeable with a large policy.
        The new version of ima_must_appraise_or_measure() does everything in a
        single iteration using a new version of ima_match_policy().  It returns
        With the use of action mask only one efficient matching function
        is enough.  Removed other specific versions of matching functions.
      - change 'owner' to 'fowner' to conform to the new LSM conditions posted by
        Roberto Sassu.
      - fix calls to ima_log_string()
      Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
      Signed-off-by: default avatarDmitry Kasatkin <dmitry.kasatkin@intel.com>
  3. 07 Feb, 2010 1 commit
  4. 05 Feb, 2009 1 commit