1 files changed, 85 insertions, 21 deletions

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index b3dd616560f7..0356e1d437ca 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -26,7 +26,8 @@
 
 #include "../integrity.h"
 
-enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_ASCII };
+enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
+                     IMA_SHOW_ASCII };
 enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
 
 /* digest size for IMA, fits SHA1 or MD5 */
@@ -36,23 +37,48 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
 #define IMA_HASH_BITS 9
 #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
 
+#define IMA_TEMPLATE_FIELD_ID_MAX_LEN   16
+#define IMA_TEMPLATE_NUM_FIELDS_MAX     15
+
+#define IMA_TEMPLATE_IMA_NAME "ima"
+#define IMA_TEMPLATE_IMA_FMT "d|n"
+
 /* set during initialization */
 extern int ima_initialized;
 extern int ima_used_chip;
-extern char *ima_hash;
+extern int ima_hash_algo;
 extern int ima_appraise;
 
-/* IMA inode template definition */
-struct ima_template_data {
-        u8 digest[IMA_DIGEST_SIZE];     /* sha1/md5 measurement hash */
-        char file_name[IMA_EVENT_NAME_LEN_MAX + 1];     /* name + \0 */
+/* IMA template field data definition */
+struct ima_field_data {
+        u8 *data;
+        u32 len;
+};
+
+/* IMA template field definition */
+struct ima_template_field {
+        const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
+        int (*field_init) (struct integrity_iint_cache *iint, struct file *file,
+                           const unsigned char *filename,
+                           struct evm_ima_xattr_data *xattr_value,
+                           int xattr_len, struct ima_field_data *field_data);
+        void (*field_show) (struct seq_file *m, enum ima_show_type show,
+                            struct ima_field_data *field_data);
+};
+
+/* IMA template descriptor definition */
+struct ima_template_desc {
+        char *name;
+        char *fmt;
+        int num_fields;
+        struct ima_template_field **fields;
 };
 
 struct ima_template_entry {
-        u8 digest[IMA_DIGEST_SIZE];     /* sha1 or md5 measurement hash */
-        const char *template_name;
-        int template_len;
-        struct ima_template_data template;
+        u8 digest[TPM_DIGEST_SIZE];     /* sha1 or md5 measurement hash */
+        struct ima_template_desc *template_desc; /* template descriptor */
+        u32 template_data_len;
+        struct ima_field_data template_data[0]; /* template related data */
 };
 
 struct ima_queue_entry {
@@ -69,13 +95,22 @@ int ima_fs_init(void);
 void ima_fs_cleanup(void);
 int ima_inode_alloc(struct inode *inode);
 int ima_add_template_entry(struct ima_template_entry *entry, int violation,
-                           const char *op, struct inode *inode);
-int ima_calc_file_hash(struct file *file, char *digest);
-int ima_calc_buffer_hash(const void *data, int len, char *digest);
-int ima_calc_boot_aggregate(char *digest);
-void ima_add_violation(struct inode *inode, const unsigned char *filename,
+                           const char *op, struct inode *inode,
+                           const unsigned char *filename);
+int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
+int ima_calc_field_array_hash(struct ima_field_data *field_data,
+                              struct ima_template_desc *desc, int num_fields,
+                              struct ima_digest_data *hash);
+int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
+void ima_add_violation(struct file *file, const unsigned char *filename,
                        const char *op, const char *cause);
 int ima_init_crypto(void);
+void ima_putc(struct seq_file *m, void *data, int datalen);
+void ima_print_digest(struct seq_file *m, u8 *digest, int size);
+struct ima_template_desc *ima_template_desc_current(void);
+int ima_init_template(void);
+
+int ima_init_template(void);
 
 /*
  * used to protect h_table and sha_table
@@ -98,14 +133,22 @@ static inline unsigned long ima_hash_key(u8 *digest)
 int ima_get_action(struct inode *inode, int mask, int function);
 int ima_must_measure(struct inode *inode, int mask, int function);
 int ima_collect_measurement(struct integrity_iint_cache *iint,
-                            struct file *file);
+                            struct file *file,
+                            struct evm_ima_xattr_data **xattr_value,
+                            int *xattr_len);
 void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
-                           const unsigned char *filename);
+                           const unsigned char *filename,
+                           struct evm_ima_xattr_data *xattr_value,
+                           int xattr_len);
 void ima_audit_measurement(struct integrity_iint_cache *iint,
                            const unsigned char *filename);
+int ima_alloc_init_template(struct integrity_iint_cache *iint,
+                            struct file *file, const unsigned char *filename,
+                            struct evm_ima_xattr_data *xattr_value,
+                            int xattr_len, struct ima_template_entry **entry);
 int ima_store_template(struct ima_template_entry *entry, int violation,
-                       struct inode *inode);
-void ima_template_show(struct seq_file *m, void *e, enum ima_show_type show);
+                       struct inode *inode, const unsigned char *filename);
+void ima_free_template_entry(struct ima_template_entry *entry);
 const char *ima_d_path(struct path *path, char **pathbuf);
 
 /* rbtree tree calls to lookup, insert, delete
@@ -131,17 +174,25 @@ void ima_delete_rules(void);
 
 #ifdef CONFIG_IMA_APPRAISE
 int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
-                             struct file *file, const unsigned char *filename);
+                             struct file *file, const unsigned char *filename,
+                             struct evm_ima_xattr_data *xattr_value,
+                             int xattr_len);
 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
 void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
 enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
                                            int func);
+void ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                       struct ima_digest_data *hash);
+int ima_read_xattr(struct dentry *dentry,
+                   struct evm_ima_xattr_data **xattr_value);
 
 #else
 static inline int ima_appraise_measurement(int func,
                                            struct integrity_iint_cache *iint,
                                            struct file *file,
-                                           const unsigned char *filename)
+                                           const unsigned char *filename,
+                                           struct evm_ima_xattr_data *xattr_value,
+                                           int xattr_len)
 {
         return INTEGRITY_UNKNOWN;
 }
@@ -162,6 +213,19 @@ static inline enum integrity_status ima_get_cache_status(struct integrity_iint_c
 {
         return INTEGRITY_UNKNOWN;
 }
+
+static inline void ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
+                                     int xattr_len,
+                                     struct ima_digest_data *hash)
+{
+}
+
+static inline int ima_read_xattr(struct dentry *dentry,
+                                 struct evm_ima_xattr_data **xattr_value)
+{
+        return 0;
+}
+
 #endif
 
 /* LSM based policy rules require audit */