aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-06-21integrity: Small code improvementsThiago Jung Bauermann6-9/+11
These changes are too small to warrant their own patches: The keyid and sig_size members of struct signature_v2_hdr are in BE format, so use a type that makes this assumption explicit. Also, use beXX_to_cpu instead of __beXX_to_cpu to read them. Change integrity_kernel_read to take a void * buffer instead of char * buffer, so that callers don't have to use a cast if they provide a buffer that isn't a char *. Add missing #endif comment in ima.h pointing out which macro it refers to. Add missing fall through comment in ima_appraise.c. Constify mask_tokens and func_tokens arrays. Signed-off-by: Thiago Jung Bauermann <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: fix get_binary_runtime_size()Roberto Sassu1-1/+1
Remove '+ 1' from 'size += strlen(entry->template_desc->name) + 1;', as the template name is sent to userspace without the '\0' character. Signed-off-by: Roberto Sassu <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: use ima_parse_buf() to parse template dataRoberto Sassu1-31/+13
The binary_field_data structure definition has been removed from ima_restore_template_data(). The lengths and data pointers are directly stored into the template_data array of the ima_template_entry structure. For template data, both the number of fields and buffer end checks can be done, as these information are known (respectively from the template descriptor, and from the measurement header field). Signed-off-by: Roberto Sassu <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: use ima_parse_buf() to parse measurements headersRoberto Sassu1-52/+28
The binary_hdr_v1 and binary_data_v1 structures defined in ima_restore_measurement_list() have been replaced with an array of four ima_field_data structures where pcr, digest, template name and template data lengths and pointers are stored. The length of pcr and digest in the ima_field_data array and the bits in the bitmap are set before ima_parse_buf() is called. The ENFORCE_FIELDS bit is set for all entries except the last one (there is still data to parse), and ENFORCE_BUFEND is set only for the last entry. Signed-off-by: Roberto Sassu <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: introduce ima_parse_buf()Roberto Sassu2-0/+67
ima_parse_buf() takes as input the buffer start and end pointers, and stores the result in a static array of ima_field_data structures, where the len field contains the length parsed from the buffer, and the data field contains the address of the buffer just after the length. Optionally, the function returns the current value of the buffer pointer and the number of array elements written. A bitmap has been added as parameter of ima_parse_buf() to handle the cases where the length is not prepended to data. Each bit corresponds to an element of the ima_field_data array. If a bit is set, the length is not parsed from the buffer, but is read from the corresponding element of the array (the length must be set before calling the function). ima_parse_buf() can perform three checks upon request by callers, depending on the enforce mask passed to it: - ENFORCE_FIELDS: matching of number of fields (length-data combination) - there must be enough data in the buffer to parse the number of fields requested (output: current value of buffer pointer) - ENFORCE_BUFEND: matching of buffer end - the ima_field_data array must be large enough to contain lengths and data pointers for the amount of data requested (output: number of fields written) - ENFORCE_FIELDS | ENFORCE_BUFEND: matching of both Use cases - measurement entry header: ENFORCE_FIELDS | ENFORCE_BUFEND - four fields must be parsed: pcr, digest, template name, template data - ENFORCE_BUFEND is enforced only for the last measurement entry - template digest (Crypto Agile): ENFORCE_BUFEND - since only the total template digest length is known, the function parses length-data combinations until the buffer end is reached - template data: ENFORCE_FIELDS | ENFORCE_BUFEND - since the number of fields and the total template data length are known, the function can perform both checks Signed-off-by: Roberto Sassu <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: Add cgroups2 to the defaults listLaura Abbott1-0/+3
cgroups2 is beginning to show up in wider usage. Add it to the default nomeasure/noappraise list like other filesystems. Signed-off-by: Laura Abbott <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: use memdup_user_nulGeliang Tang1-9/+4
Use memdup_user_nul() helper instead of open-coding to simplify the code. Signed-off-by: Geliang Tang <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: fix up #endif commentsTycho Andersen1-2/+2
While reading the code, I noticed that these #endif comments don't match how they're actually nested. This patch fixes that. Signed-off-by: Tycho Andersen <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21IMA: Correct Kconfig dependencies for hash selectionBen Hutchings1-4/+4
IMA uses the hash algorithm too early to be able to use a module. Require the selected hash algorithm to be built-in. Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: define is_ima_appraise_enabled()Mimi Zohar2-0/+16
Only return enabled if in enforcing mode, not fix or log modes. Signed-off-by: Mimi Zohar <[email protected]> Changes: - Define is_ima_appraise_enabled() as a bool (Thiago Bauermann)
2017-06-21ima: define Kconfig IMA_APPRAISE_BOOTPARAM optionMimi Zohar2-0/+10
Permit enabling the different "ima_appraise=" modes (eg. log, fix) from the boot command line. Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21ima: define a set of appraisal rules requiring file signaturesMimi Zohar2-2/+30
The builtin "ima_appraise_tcb" policy should require file signatures for at least a few of the hooks (eg. kernel modules, firmware, and the kexec kernel image), but changing it would break the existing userspace/kernel ABI. This patch defines a new builtin policy named "secure_boot", which can be specified on the "ima_policy=" boot command line, independently or in conjunction with the "ima_appraise_tcb" policy, by specifing ima_policy="appraise_tcb | secure_boot". The new appraisal rules requiring file signatures will be added prior to the "ima_appraise_tcb" rules. Signed-off-by: Mimi Zohar <[email protected]> Changelog: - Reference secure boot in the new builtin policy name. (Thiago Bauermann)
2017-06-21ima: extend the "ima_policy" boot command line to support multiple policiesMimi Zohar2-11/+21
Add support for providing multiple builtin policies on the "ima_policy=" boot command line. Use "|" as the delimitor separating the policy names. Signed-off-by: Mimi Zohar <[email protected]>
2017-06-21Merge branch 'smack-for-4.13' of git://github.com/cschaufler/smack-next into ↵James Morris4-18/+31
next
2017-06-19tpm/tpm_atmel: remove unnecessary NULL checkGustavo A. R. Silva1-7/+5
Remove unnecessary NULL check. Pointer _chip_ cannot be NULL in this instance. Signed-off-by: Gustavo A. R. Silva <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jarkko Sakkinen <[email protected]> (compilation) Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-19tpm/st33zp24: Switch to devm_acpi_dev_add_driver_gpios()Andy Shevchenko2-4/+2
Switch to use managed variant of acpi_dev_add_driver_gpios() to simplify error path and fix potentially wrong assignment if ->probe() fails. Signed-off-by: Andy Shevchenko <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jarkko Sakkinen <[email protected]> (compilation) Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm: vtpm_proxy: Prevent userspace from sending driver commandStefan Berger1-0/+33
To prevent userspace from sending the TPM driver command to set the locality, we need to check every command that is sent from user space. To distinguish user space commands from internally sent commands we introduce an additional state flag STATE_DRIVER_COMMAND that is set while the driver sends this command. Similar to the TPM 2 space commands we return an error code when this command is detected. Signed-off-by: Stefan Berger <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm: vtpm_proxy: Implement request_locality function.Stefan Berger3-0/+41
Implement the request_locality function. To set the locality on the backend we define vendor-specific TPM 1.2 and TPM 2 ordinals and send a command to the backend to set the locality for the next commands. To avoid recursing into requesting the locality, we set the TPM_TRANSMIT_RAW flag when calling tpm_transmit_cmd. To avoid recursing into TPM 2 space related commands, we set the space parameter to NULL. Signed-off-by: Stefan Berger <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm: Introduce flag TPM_TRANSMIT_RAWStefan Berger2-1/+3
Introduce the flag TPM_TRANSMIT_RAW that allows us to transmit a command without recursing into the requesting of locality. Signed-off-by: Stefan Berger <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm: vtpm_proxy: Suppress error logging when in closed stateStefan Berger2-3/+4
Suppress the error logging when the core TPM driver sends commands to the VTPM proxy driver and -EPIPE is returned in case the VTPM proxy driver is 'closed' (closed anonymous file descriptor). This error code is only returned by the send function and by tpm_transmit when the VTPM proxy driver is being used. Signed-off-by: Stefan Berger <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm, tpmrm: Mark tpmrm_write as staticPeter Huewe1-1/+1
sparse complains that tpmrm_write can be made static, and since it is right we make it static. Signed-off-by: Peter Huewe <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm: remove struct tpm_pcrextend_inJarkko Sakkinen1-6/+0
Removed struct tpm_pcrextend_in as it is not used for anything anymore. Signed-off-by: Jarkko Sakkinen <[email protected]> Reviewed-by: Peter Huewe <[email protected]>
2017-06-13tpm, tpm_infineon: remove useless snprintf() callsJarkko Sakkinen1-4/+4
The memory copy from rodata to stack is useless. Signed-off-by: Jarkko Sakkinen <[email protected]> Reviewed-by: Peter Huewe <[email protected]>
2017-06-13tpm: fix byte order related arithmetic inconsistency in tpm_getcap()Jarkko Sakkinen2-27/+16
You should not do arithmetic with __be32 or __le32 types because sometimes it results incorrect results. Calculations must be done only with integers that are in in the CPU byte order. This commit migrates tpm_getcap() to struct tpm_buf in order to sort out these issues. Signed-off-by: Jarkko Sakkinen <[email protected]> Reviewed-by: Jason Gunthorpe <[email protected]>
2017-06-13tpm: Apply a sane minimum adapterlimit value for retransmission.Bryan Freed1-20/+56
When the I2C Infineon part is attached to an I2C adapter that imposes a size limitation, large requests will fail with -EOPNOTSUPP. Retry them with a sane minimum size without re-issuing the 0x05 command as this appears to occasionally put the TPM in a bad state. Signed-off-by: Bryan Freed <[email protected]> [rework the patch to adapt to the feedback received] Signed-off-by: Enric Balletbo i Serra <[email protected]> Acked-by: Andrew Lunn <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Reviewed-by: Andrew Lunn <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm_tis: Consolidate the platform and acpi probe flowJason Gunthorpe1-113/+54
Now that the platform device was merged for OF support we can use the platform device to match ACPI devices as well and run everything through tpm_tis_init. pnp_acpi_device is replaced with ACPI_COMPANION, and ACPI_HANDLE is pushed further down. platform_get_resource is used instead of acpi_dev_get_resources. The itpm global module parameter is no longer changed during itpm detection, instead the phy specific bit is set directly. Signed-off-by: Jason Gunthorpe <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jerry Snitselaar <[email protected]> (with TPM 2.0) Tested-by: Jarkko Sakkinen <[email protected]> (with TPM 1.2) Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm_tis: Use platform_get_irqJason Gunthorpe1-4/+2
Replace the open coded IORESOURCE_IRQ with platform_get_irq, which supports more cases. Fixes: 00194826e6be ("tpm_tis: Clean up the force=1 module parameter") Signed-off-by: Jason Gunthorpe <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jerry Snitselaar <[email protected]> (with TPM 2.0) Tested-by: Jarkko Sakkinen <[email protected]> (with TPM 1.2) Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm_tis: Fix IRQ autoprobing when using platform_deviceJason Gunthorpe1-1/+1
The test was backwards, triggering IRQ autoprobing if the firmware did not specify an IRQ, instead of triggering it only when the module force parameter was specified. Since autoprobing is not enabled on !x86 and the platform device is currently only used on !x86, or with force, this has gone unnoticed. Fixes: 00194826e6be ("tpm_tis: Clean up the force=1 module parameter") Signed-off-by: Jason Gunthorpe <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jerry Snitselaar <[email protected]> (with TPM 2.0) Tested-by: Jarkko Sakkinen <[email protected]> (with TPM 1.2) Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm: move TPM 1.2 code of tpm_pcr_extend() to tpm1_pcr_extend()Roberto Sassu1-17/+24
In preparation of the modifications to tpm_pcr_extend(), which will allow callers to supply a digest for each PCR bank of a TPM 2.0, the TPM 1.2 specific code has been moved to tpm1_pcr_extend(). tpm1_pcr_extend() uses tpm_buf_init() to prepare the command buffer, which offers protection against buffer overflow. It is called by tpm_pcr_extend() and tpm_pm_suspend(). Signed-off-by: Roberto Sassu <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm: move endianness conversion of ordinals to tpm_input_headerRoberto Sassu2-14/+14
Move CPU native value to big-endian conversion of ordinals to the tpm_input_header declarations. With the previous and this patch it will now be possible to modify TPM 1.2 functions to use tpm_buf_init(), which expects CPU native value for the tag and ordinal arguments. Signed-off-by: Roberto Sassu <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-13tpm: move endianness conversion of TPM_TAG_RQU_COMMAND to tpm_input_headerRoberto Sassu3-9/+9
In the long term, TPM 1.2 functions in the driver interface will be modified to use tpm_buf_init(). However, tag and ordinals cannot be passed directly to tpm_buf_init(), because this function performs CPU native to big-endian conversion of these arguments. Since TPM_TAG_RQU_COMMAND and TPM_ORD_ are already converted, passing them to the function will undo the previous conversion. This patch moves the conversion of TPM_TAG_RQU_COMMAND from the tpm.h header file in the driver directory to the tpm_input_header declarations in the driver interface and tpm-sysfs.c. Signed-off-by: Roberto Sassu <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Tested-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>
2017-06-10apparmor: export that basic profile namespaces are supportedJohn Johansen1-0/+7
Allow userspace to detect that basic profile policy namespaces are available. Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: add stacked domain labels interfaceJohn Johansen2-0/+8
Update the user interface to support the stacked change_profile transition. Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: add domain label stacking info to apparmorfsJohn Johansen3-0/+39
Now that the domain label transition is complete advertise it to userspace. Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: move change_profile mediation to using labelsJohn Johansen1-68/+123
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: move change_hat mediation to using labelsJohn Johansen1-102/+201
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: move exec domain mediation to using labelsJohn Johansen2-259/+678
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: support v7 transition format compatible with label_parseJohn Johansen2-7/+15
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: mediate files when they are receivedJohn Johansen2-0/+7
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: rework file permission to cache file access in file->ctxJohn Johansen1-6/+76
This is a temporary step, towards using the file->ctx for delegation, and also helps speed up file queries, until the permission lookup cache is introduced. Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: move path_link mediation to using labelsJohn Johansen3-47/+59
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: refactor path name lookup and permission checks around labelsJohn Johansen3-45/+85
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: update aa_audit_file() to use labelsJohn Johansen3-9/+18
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: move aa_file_perm() to use labelsJohn Johansen3-37/+64
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: allow ptrace checks to be finer grained than just capabilityJohn Johansen3-0/+68
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: move ptrace checks to using labelsJohn Johansen5-80/+58
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: add cross check permission helper macrosJohn Johansen1-1/+41
The cross check permission helper macros will help simplify code that does cross task permission checks like ptrace. Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: move resource checks to using labelsJohn Johansen3-42/+80
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: move capability checks to using labelsJohn Johansen5-29/+58
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: update query interface to support label queriesJohn Johansen1-7/+39
Signed-off-by: John Johansen <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.