ima: Remove ima_h_table structure

The ima_h_table structure is a collection of IMA measurement list
metadata - number of records in the IMA measurement list, number of
integrity violations, and a hash table containing the IMA template data
hash, needed to prevent measurement list record duplication.

Removing records from the measurement list needs to be reflected in the
hash table. As a pre-req to removing records from the measurement list,
separate those counters from the hash table, remove the ima_h_table
structure, and just replace the hash table pointer.

Finally, rename ima_show_htable_value(), ima_show_htable_violations()
and ima_htable_violations_ops respectively to ima_show_counter(),
ima_show_num_violations() and ima_num_violations_ops.

Link: https://github.com/linux-integrity/linux/issues/1
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 69e9bf0b82c655fd139dffc6e7d33192cdcec7a8..b3ad7eac6a1e64ca87a955def5f110177d821893 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -324,12 +324,11 @@ int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
  */
 extern spinlock_t ima_queue_lock;
 
-struct ima_h_table {
-       atomic_long_t len;      /* number of stored measurements in the list */
-       atomic_long_t violations;
-       struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
-};
-extern struct ima_h_table ima_htable;
+/* Total number of measurement list records since hard boot. */
+extern atomic_long_t ima_num_records;
+/* Total number of violations since hard boot. */
+extern atomic_long_t ima_num_violations;
+extern struct hlist_head ima_htable[IMA_MEASURE_HTABLE_SIZE];
 
 static inline unsigned int ima_hash_key(u8 *digest)
 {

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 0916f24f005f2bf82bb8b57830499e07e461c8ec..122d127e108dcca8ddae6575c908144859783fb6 100644 (file)
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -146,7 +146,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
        int result;
 
        /* can overflow, only indicator */
-       atomic_long_inc(&ima_htable.violations);
+       atomic_long_inc(&ima_num_violations);
 
        result = ima_alloc_init_template(&event_data, &entry, NULL);
        if (result < 0) {

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index ca4931a95098d66b8ebba7076eab2ec690bfdc75..523d3e81f631314dcb78b7d4d5d6b1c06fb2fee2 100644 (file)
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -38,8 +38,8 @@ __setup("ima_canonical_fmt", default_canonical_fmt_setup);
 
 static int valid_policy = 1;
 
-static ssize_t ima_show_htable_value(char __user *buf, size_t count,
-                                    loff_t *ppos, atomic_long_t *val)
+static ssize_t ima_show_counter(char __user *buf, size_t count, loff_t *ppos,
+                               atomic_long_t *val)
 {
        char tmpbuf[32];        /* greater than largest 'long' string value */
        ssize_t len;
@@ -48,15 +48,14 @@ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
        return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
 }
 
-static ssize_t ima_show_htable_violations(struct file *filp,
-                                         char __user *buf,
-                                         size_t count, loff_t *ppos)
+static ssize_t ima_show_num_violations(struct file *filp, char __user *buf,
+                                      size_t count, loff_t *ppos)
 {
-       return ima_show_htable_value(buf, count, ppos, &ima_htable.violations);
+       return ima_show_counter(buf, count, ppos, &ima_num_violations);
 }
 
-static const struct file_operations ima_htable_violations_ops = {
-       .read = ima_show_htable_violations,
+static const struct file_operations ima_num_violations_ops = {
+       .read = ima_show_num_violations,
        .llseek = generic_file_llseek,
 };
 
@@ -64,8 +63,7 @@ static ssize_t ima_show_measurements_count(struct file *filp,
                                           char __user *buf,
                                           size_t count, loff_t *ppos)
 {
-       return ima_show_htable_value(buf, count, ppos, &ima_htable.len);
-
+       return ima_show_counter(buf, count, ppos, &ima_num_records);
 }
 
 static const struct file_operations ima_measurements_count_ops = {
@@ -545,7 +543,7 @@ int __init ima_fs_init(void)
        }
 
        dentry = securityfs_create_file("violations", S_IRUSR | S_IRGRP,
-                                  ima_dir, NULL, &ima_htable_violations_ops);
+                                  ima_dir, NULL, &ima_num_violations_ops);
        if (IS_ERR(dentry)) {
                ret = PTR_ERR(dentry);
                goto out;

diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
index 36a34c54de58ba63cbcfacfdd3c0b39dd0b4d492..77ad370dbc37573b7ecc7c00e98649ae6c0662c2 100644 (file)
--- a/security/integrity/ima/ima_kexec.c
+++ b/security/integrity/ima/ima_kexec.c
@@ -43,7 +43,7 @@ void ima_measure_kexec_event(const char *event_name)
        int n;
 
        buf_size = ima_get_binary_runtime_size();
-       len = atomic_long_read(&ima_htable.len);
+       len = atomic_long_read(&ima_num_records);
 
        n = scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
                      "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"

diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index 3195224508546813e4ba4bdd59b2d95a714a6820..6bdaefc790c347b501d9b03a7dc470451a4ff57f 100644 (file)
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -32,11 +32,12 @@ static unsigned long binary_runtime_size;
 static unsigned long binary_runtime_size = ULONG_MAX;
 #endif
 
+atomic_long_t ima_num_records = ATOMIC_LONG_INIT(0);
+atomic_long_t ima_num_violations = ATOMIC_LONG_INIT(0);
+
 /* key: inode (before secure-hashing a file) */
-struct ima_h_table ima_htable = {
-       .len = ATOMIC_LONG_INIT(0),
-       .violations = ATOMIC_LONG_INIT(0),
-       .queue[0 ... IMA_MEASURE_HTABLE_SIZE - 1] = HLIST_HEAD_INIT
+struct hlist_head ima_htable[IMA_MEASURE_HTABLE_SIZE] = {
+       [0 ... IMA_MEASURE_HTABLE_SIZE - 1] = HLIST_HEAD_INIT
 };
 
 /* mutex protects atomicity of extending measurement list
@@ -61,7 +62,7 @@ static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value,
 
        key = ima_hash_key(digest_value);
        rcu_read_lock();
-       hlist_for_each_entry_rcu(qe, &ima_htable.queue[key], hnext) {
+       hlist_for_each_entry_rcu(qe, &ima_htable[key], hnext) {
                rc = memcmp(qe->entry->digests[ima_hash_algo_idx].digest,
                            digest_value, hash_digest_size[ima_hash_algo]);
                if ((rc == 0) && (qe->entry->pcr == pcr)) {
@@ -113,10 +114,10 @@ static int ima_add_digest_entry(struct ima_template_entry *entry,
        INIT_LIST_HEAD(&qe->later);
        list_add_tail_rcu(&qe->later, &ima_measurements);
 
-       atomic_long_inc(&ima_htable.len);
+       atomic_long_inc(&ima_num_records);
        if (update_htable) {
                key = ima_hash_key(entry->digests[ima_hash_algo_idx].digest);
-               hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
+               hlist_add_head_rcu(&qe->hnext, &ima_htable[key]);
        }
 
        if (binary_runtime_size != ULONG_MAX) {