#include <linux/types.h>
#include <linux/crypto.h>
#include <linux/security.h>
#include <linux/hash.h>
#include <linux/tpm.h>
#include <linux/audit.h>
#include "../integrity.h"

Data Structures
struct	ima_template_data

struct	ima_template_entry

struct	ima_queue_entry

struct	ima_h_table

Macros
#define	IMA_DIGEST_SIZE SHA1_DIGEST_SIZE

#define	IMA_EVENT_NAME_LEN_MAX 255

#define	IMA_HASH_BITS 9

#define	IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)

#define	IMA_APPRAISE_ENFORCE 0x01

#define	IMA_APPRAISE_FIX 0x02

Enumerations
enum	ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_ASCII }

enum	tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }

enum	ima_hooks { FILE_CHECK = 1, FILE_MMAP, BPRM_CHECK, POST_SETATTR }

Functions
int	ima_init (void)

void	ima_cleanup (void)

int	ima_fs_init (void)

void	ima_fs_cleanup (void)

int	ima_inode_alloc (struct inode *inode)

int	ima_add_template_entry (struct ima_template_entry entry, int violation, const char op, struct inode *inode)

int	ima_calc_hash (struct file file, char digest)

int	ima_calc_template_hash (int template_len, void template, char digest)

int	ima_calc_boot_aggregate (char *digest)

void	ima_add_violation (struct inode inode, const unsigned char filename, const char op, const char cause)

int	ima_get_action (struct inode *inode, int mask, int function)

int	ima_must_measure (struct inode *inode, int mask, int function)

int	ima_collect_measurement (struct integrity_iint_cache iint, struct file file)

void	ima_store_measurement (struct integrity_iint_cache iint, struct file file, const unsigned char *filename)

void	ima_audit_measurement (struct integrity_iint_cache iint, const unsigned char filename)

int	ima_store_template (struct ima_template_entry entry, int violation, struct inode inode)

void	ima_template_show (struct seq_file m, void e, enum ima_show_type show)

struct integrity_iint_cache *	integrity_iint_insert (struct inode *inode)

struct integrity_iint_cache *	integrity_iint_find (struct inode *inode)

int	ima_match_policy (struct inode *inode, enum ima_hooks func, int mask, int flags)

void	ima_init_policy (void)

void	ima_update_policy (void)

ssize_t	ima_parse_add_rule (char *)

void	ima_delete_rules (void)

Variables
int	ima_initialized

int	ima_used_chip

char *	ima_hash

int	ima_appraise

struct list_head	ima_measurements

spinlock_t	ima_queue_lock

struct ima_h_table	ima_htable

Macro Definition Documentation

#define IMA_APPRAISE_ENFORCE 0x01

Definition at line 140 of file ima.h.

#define IMA_APPRAISE_FIX 0x02

Definition at line 141 of file ima.h.

#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE

Definition at line 33 of file ima.h.

#define IMA_EVENT_NAME_LEN_MAX 255

Definition at line 34 of file ima.h.

#define IMA_HASH_BITS 9

Definition at line 36 of file ima.h.

#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)

Definition at line 37 of file ima.h.

Enumeration Type Documentation

enum ima_hooks

Enumerator:

FILE_CHECK
FILE_MMAP
BPRM_CHECK
POST_SETATTR

Definition at line 130 of file ima.h.

enum ima_show_type

Enumerator:

IMA_SHOW_BINARY
IMA_SHOW_ASCII

Definition at line 29 of file ima.h.

enum tpm_pcrs

Enumerator:

TPM_PCR0
TPM_PCR8

Definition at line 30 of file ima.h.

Function Documentation

int ima_add_template_entry	(	struct ima_template_entry *	entry,
		int	violation,
		const char *	op,
		struct inode *	inode
	)

Definition at line 107 of file ima_queue.c.

void ima_add_violation	(	struct inode *	inode,
		const unsigned char *	filename,
		const char *	op,
		const char *	cause
	)

Definition at line 74 of file ima_api.c.

void ima_audit_measurement	(	struct integrity_iint_cache *	iint,
		const unsigned char *	filename
	)

Definition at line 211 of file ima_api.c.

int ima_calc_boot_aggregate ( char * digest )

Definition at line 127 of file ima_crypto.c.

int ima_calc_hash	(	struct file *	file,
		char *	digest
	)

Definition at line 45 of file ima_crypto.c.

int ima_calc_template_hash	(	int	template_len,
		void *	template,
		char *	digest
	)

Definition at line 97 of file ima_crypto.c.

void ima_cleanup ( void )

int ima_collect_measurement	(	struct integrity_iint_cache *	iint,
		struct file *	file
	)

Definition at line 140 of file ima_api.c.

void ima_delete_rules ( void )

Definition at line 586 of file ima_policy.c.

void ima_fs_cleanup ( void )

int ima_fs_init ( void )

Definition at line 328 of file ima_fs.c.

int ima_get_action	(	struct inode *	inode,
		int	mask,
		int	function
	)

ima_get_action - appraise & measure decision based on policy. : pointer to inode to measure : contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE) : calling function (FILE_CHECK, BPRM_CHECK, FILE_MMAP)

The policy is defined in terms of keypairs: subj=, obj=, type=, func=, mask=, fsmagic= subj,obj, and type: are LSM specific. func: FILE_CHECK | BPRM_CHECK | FILE_MMAP mask: contains the permission mask fsmagic: hex value

Returns IMA_MEASURE, IMA_APPRAISE mask.

Definition at line 115 of file ima_api.c.

int ima_init ( void )

Definition at line 75 of file ima_init.c.

void ima_init_policy ( void )

ima_init_policy - initialize the default measure rules.

ima_rules points to either the ima_default_rules or the the new ima_policy_rules.

Definition at line 230 of file ima_policy.c.

int ima_inode_alloc ( struct inode * inode )

int ima_match_policy	(	struct inode *	inode,
		enum ima_hooks	func,
		int	mask,
		int	flags
	)

ima_match_policy - decision based on LSM and other conditions : pointer to an inode for which the policy decision is being made : IMA hook identifier : requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)

Measure decision based on func/mask/fsmagic and LSM(subj/obj/type) conditions.

(There is no need for locking when walking the policy list, as elements in the list are never deleted, nor does the list change.)

Definition at line 197 of file ima_policy.c.

int ima_must_measure	(	struct inode *	inode,
		int	mask,
		int	function
	)

Definition at line 125 of file ima_api.c.

ssize_t ima_parse_add_rule ( char * rule )

ima_parse_add_rule - add a rule to ima_policy_rules - ima measurement policy rule

Uses a mutex to protect the policy list from multiple concurrent writers. Returns the length of the rule parsed, an error code on failure

Definition at line 536 of file ima_policy.c.

void ima_store_measurement	(	struct integrity_iint_cache *	iint,
		struct file *	file,
		const unsigned char *	filename
	)

Definition at line 179 of file ima_api.c.

int ima_store_template	(	struct ima_template_entry *	entry,
		int	violation,
		struct inode *	inode
	)

Definition at line 41 of file ima_api.c.

void ima_template_show	(	struct seq_file *	m,
		void *	e,
		enum ima_show_type	show
	)

Definition at line 179 of file ima_fs.c.

void ima_update_policy ( void )

ima_update_policy - update default_rules with new measure rules

Called on file .release to update the default rules with a complete new policy. Once updated, the policy is locked, no additional rules can be added to the policy.

Definition at line 261 of file ima_policy.c.

struct integrity_iint_cache* integrity_iint_find ( struct inode * inode )

read

Definition at line 57 of file iint.c.

struct integrity_iint_cache* integrity_iint_insert ( struct inode * inode )

read

Variable Documentation

int ima_appraise

Definition at line 35 of file ima_main.c.

char* ima_hash

Definition at line 38 of file ima_main.c.

struct ima_h_table ima_htable

Definition at line 31 of file ima_queue.c.

int ima_initialized

Definition at line 30 of file ima_main.c.

struct list_head ima_measurements

spinlock_t ima_queue_lock

int ima_used_chip

Definition at line 25 of file ima_init.c.

Data Structures

Macros

Enumerations

Functions

Variables

Macro Definition Documentation

Enumeration Type Documentation

Function Documentation

Variable Documentation