ima: switch to new template management mechanism

This patch performs the switch to the new template mechanism by modifying
the functions ima_alloc_init_template(), ima_measurements_show() and
ima_ascii_measurements_show(). The old function ima_template_show() was
removed as it is no longer needed. Also, if the template descriptor used
to generate a measurement entry is not 'ima', the whole length of field
data stored for an entry is provided before the data itself through the
binary_runtime_measurement interface.

Changelog:
- unnecessary to use strncmp() (Mimi Zohar)
- create new variable 'field' in ima_alloc_init_template() (Roberto Sassu)
- use GFP_NOFS flag in ima_alloc_init_template() (Roberto Sassu)
- new variable 'num_fields' in ima_store_template() (Roberto Sassu,
  proposed by Mimi Zohar)
- rename ima_calc_buffer_hash/template_hash() to ima_calc_field_array_hash(),
  something more generic (Mimi, requested by Dmitry)
- sparse error fix - Fengguang Wu
- fix lindent warnings
- always include the field length in the template data length
- include the template field length variable size in the template data length
- include both the template field data and field length in the template digest
  calculation. Simplifies verifying the template digest. (Mimi)

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

1 files changed, 25 insertions, 29 deletions

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 414862e1904b..d47a7c86a21d 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -110,6 +110,7 @@ void ima_putc(struct seq_file *m, void *data, int datalen)
  *       char[20]=template digest
  *       32bit-le=template name size
  *       char[n]=template name
+ *       [eventdata length]
  *       eventdata[n]=template specific data
  */
 static int ima_measurements_show(struct seq_file *m, void *v)
@@ -119,6 +120,7 @@ static int ima_measurements_show(struct seq_file *m, void *v)
         struct ima_template_entry *e;
         int namelen;
         u32 pcr = CONFIG_IMA_MEASURE_PCR_IDX;
+        int i;
 
         /* get entry */
         e = qe->entry;
@@ -136,15 +138,22 @@ static int ima_measurements_show(struct seq_file *m, void *v)
         ima_putc(m, e->digest, TPM_DIGEST_SIZE);
 
         /* 3rd: template name size */
-        namelen = strlen(e->template_name);
+        namelen = strlen(e->template_desc->name);
         ima_putc(m, &namelen, sizeof namelen);
 
         /* 4th:  template name */
-        ima_putc(m, (void *)e->template_name, namelen);
+        ima_putc(m, e->template_desc->name, namelen);
+
+        /* 5th:  template length (except for 'ima' template) */
+        if (strcmp(e->template_desc->name, IMA_TEMPLATE_IMA_NAME) != 0)
+                ima_putc(m, &e->template_data_len,
+                         sizeof(e->template_data_len));
 
-        /* 5th:  template specific data */
-        ima_template_show(m, (struct ima_template_data *)&e->template,
-                          IMA_SHOW_BINARY);
+        /* 6th:  template specific data */
+        for (i = 0; i < e->template_desc->num_fields; i++) {
+                e->template_desc->fields[i]->field_show(m, IMA_SHOW_BINARY,
+                                                        &e->template_data[i]);
+        }
         return 0;
 }
 
@@ -175,33 +184,13 @@ void ima_print_digest(struct seq_file *m, u8 *digest, int size)
                 seq_printf(m, "%02x", *(digest + i));
 }
 
-void ima_template_show(struct seq_file *m, void *e, enum ima_show_type show)
-{
-        struct ima_template_data *entry = e;
-        int namelen;
-
-        switch (show) {
-        case IMA_SHOW_ASCII:
-                ima_print_digest(m, entry->digest, IMA_DIGEST_SIZE);
-                seq_printf(m, " %s\n", entry->file_name);
-                break;
-        case IMA_SHOW_BINARY:
-                ima_putc(m, entry->digest, IMA_DIGEST_SIZE);
-
-                namelen = strlen(entry->file_name);
-                ima_putc(m, &namelen, sizeof namelen);
-                ima_putc(m, entry->file_name, namelen);
-        default:
-                break;
-        }
-}
-
 /* print in ascii */
 static int ima_ascii_measurements_show(struct seq_file *m, void *v)
 {
         /* the list never shrinks, so we don't need a lock here */
         struct ima_queue_entry *qe = v;
         struct ima_template_entry *e;
+        int i;
 
         /* get entry */
         e = qe->entry;
@@ -215,11 +204,18 @@ static int ima_ascii_measurements_show(struct seq_file *m, void *v)
         ima_print_digest(m, e->digest, TPM_DIGEST_SIZE);
 
         /* 3th:  template name */
-        seq_printf(m, " %s ", e->template_name);
+        seq_printf(m, " %s", e->template_desc->name);
 
         /* 4th:  template specific data */
-        ima_template_show(m, (struct ima_template_data *)&e->template,
-                          IMA_SHOW_ASCII);
+        for (i = 0; i < e->template_desc->num_fields; i++) {
+                seq_puts(m, " ");
+                if (e->template_data[i].len == 0)
+                        continue;
+
+                e->template_desc->fields[i]->field_show(m, IMA_SHOW_ASCII,
+                                                        &e->template_data[i]);
+        }
+        seq_puts(m, "\n");
         return 0;
 }