Commit | Line | Data |
---|---|---|
adf53a77 RS |
1 | IMA Template Management Mechanism |
2 | ||
3 | ||
4 | ==== INTRODUCTION ==== | |
5 | ||
6 | The original 'ima' template is fixed length, containing the filedata hash | |
7 | and pathname. The filedata hash is limited to 20 bytes (md5/sha1). | |
8 | The pathname is a null terminated string, limited to 255 characters. | |
9 | To overcome these limitations and to add additional file metadata, it is | |
10 | necessary to extend the current version of IMA by defining additional | |
11 | templates. For example, information that could be possibly reported are | |
12 | the inode UID/GID or the LSM labels either of the inode and of the process | |
13 | that is accessing it. | |
14 | ||
15 | However, the main problem to introduce this feature is that, each time | |
16 | a new template is defined, the functions that generate and display | |
17 | the measurements list would include the code for handling a new format | |
18 | and, thus, would significantly grow over the time. | |
19 | ||
20 | The proposed solution solves this problem by separating the template | |
21 | management from the remaining IMA code. The core of this solution is the | |
22 | definition of two new data structures: a template descriptor, to determine | |
23 | which information should be included in the measurement list; a template | |
24 | field, to generate and display data of a given type. | |
25 | ||
26 | Managing templates with these structures is very simple. To support | |
27 | a new data type, developers define the field identifier and implement | |
28 | two functions, init() and show(), respectively to generate and display | |
29 | measurement entries. Defining a new template descriptor requires | |
30 | specifying the template format, a string of field identifiers separated | |
31 | by the '|' character. While in the current implementation it is possible | |
32 | to define new template descriptors only by adding their definition in the | |
33 | template specific code (ima_template.c), in a future version it will be | |
34 | possible to register a new template on a running kernel by supplying to IMA | |
35 | the desired format string. In this version, IMA initializes at boot time | |
36 | all defined template descriptors by translating the format into an array | |
37 | of template fields structures taken from the set of the supported ones. | |
38 | ||
39 | After the initialization step, IMA will call ima_alloc_init_template() | |
40 | (new function defined within the patches for the new template management | |
41 | mechanism) to generate a new measurement entry by using the template | |
42 | descriptor chosen through the kernel configuration or through the newly | |
43 | introduced 'ima_template=' kernel command line parameter. It is during this | |
44 | phase that the advantages of the new architecture are clearly shown: | |
45 | the latter function will not contain specific code to handle a given template | |
46 | but, instead, it simply calls the init() method of the template fields | |
47 | associated to the chosen template descriptor and store the result (pointer | |
48 | to allocated data and data length) in the measurement entry structure. | |
49 | ||
50 | The same mechanism is employed to display measurements entries. | |
51 | The functions ima[_ascii]_measurements_show() retrieve, for each entry, | |
52 | the template descriptor used to produce that entry and call the show() | |
53 | method for each item of the array of template fields structures. | |
54 | ||
55 | ||
56 | ||
57 | ==== SUPPORTED TEMPLATE FIELDS AND DESCRIPTORS ==== | |
58 | ||
59 | In the following, there is the list of supported template fields | |
60 | ('<identifier>': description), that can be used to define new template | |
61 | descriptors by adding their identifier to the format string | |
62 | (support for more data types will be added later): | |
63 | ||
64 | - 'd': the digest of the event (i.e. the digest of a measured file), | |
65 | calculated with the SHA1 or MD5 hash algorithm; | |
66 | - 'n': the name of the event (i.e. the file name), with size up to 255 bytes; | |
67 | - 'd-ng': the digest of the event, calculated with an arbitrary hash | |
68 | algorithm (field format: [<hash algo>:]digest, where the digest | |
69 | prefix is shown only if the hash algorithm is not SHA1 or MD5); | |
ef8894b0 MZ |
70 | - 'n-ng': the name of the event, without size limitations; |
71 | - 'sig': the file signature. | |
adf53a77 RS |
72 | |
73 | ||
74 | Below, there is the list of defined template descriptors: | |
75 | - "ima": its format is 'd|n'; | |
ef8894b0 MZ |
76 | - "ima-ng" (default): its format is 'd-ng|n-ng'; |
77 | - "ima-sig": its format is 'd-ng|n-ng|sig'. | |
adf53a77 RS |
78 | |
79 | ||
80 | ||
81 | ==== USE ==== | |
82 | ||
83 | To specify the template descriptor to be used to generate measurement entries, | |
84 | currently the following methods are supported: | |
85 | ||
86 | - select a template descriptor among those supported in the kernel | |
87 | configuration ('ima-ng' is the default choice); | |
88 | - specify a template descriptor name from the kernel command line through | |
89 | the 'ima_template=' parameter. |