About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Documentation / security / IMA-templates.txt




Custom Search

Based on kernel version 3.13. Page generated on 2014-01-20 22:04 EST.

1	                       IMA Template Management Mechanism
2	
3	
4	==== INTRODUCTION ====
5	
6	The original 'ima' template is fixed length, containing the filedata hash
7	and pathname. The filedata hash is limited to 20 bytes (md5/sha1).
8	The pathname is a null terminated string, limited to 255 characters.
9	To overcome these limitations and to add additional file metadata, it is
10	necessary to extend the current version of IMA by defining additional
11	templates. For example, information that could be possibly reported are
12	the inode UID/GID or the LSM labels either of the inode and of the process
13	that is accessing it.
14	
15	However, the main problem to introduce this feature is that, each time
16	a new template is defined, the functions that generate and display
17	the measurements list would include the code for handling a new format
18	and, thus, would significantly grow over the time.
19	
20	The proposed solution solves this problem by separating the template
21	management from the remaining IMA code. The core of this solution is the
22	definition of two new data structures: a template descriptor, to determine
23	which information should be included in the measurement list; a template
24	field, to generate and display data of a given type.
25	
26	Managing templates with these structures is very simple. To support
27	a new data type, developers define the field identifier and implement
28	two functions, init() and show(), respectively to generate and display
29	measurement entries. Defining a new template descriptor requires
30	specifying the template format, a string of field identifiers separated
31	by the '|' character. While in the current implementation it is possible
32	to define new template descriptors only by adding their definition in the
33	template specific code (ima_template.c), in a future version it will be
34	possible to register a new template on a running kernel by supplying to IMA
35	the desired format string. In this version, IMA initializes at boot time
36	all defined template descriptors by translating the format into an array
37	of template fields structures taken from the set of the supported ones.
38	
39	After the initialization step, IMA will call ima_alloc_init_template()
40	(new function defined within the patches for the new template management
41	mechanism) to generate a new measurement entry by using the template
42	descriptor chosen through the kernel configuration or through the newly
43	introduced 'ima_template=' kernel command line parameter. It is during this
44	phase that the advantages of the new architecture are clearly shown:
45	the latter function will not contain specific code to handle a given template
46	but, instead, it simply calls the init() method of the template fields
47	associated to the chosen template descriptor and store the result (pointer
48	to allocated data and data length) in the measurement entry structure.
49	
50	The same mechanism is employed to display measurements entries.
51	The functions ima[_ascii]_measurements_show() retrieve, for each entry,
52	the template descriptor used to produce that entry and call the show()
53	method for each item of the array of template fields structures.
54	
55	
56	
57	==== SUPPORTED TEMPLATE FIELDS AND DESCRIPTORS ====
58	
59	In the following, there is the list of supported template fields
60	('<identifier>': description), that can be used to define new template
61	descriptors by adding their identifier to the format string
62	(support for more data types will be added later):
63	
64	 - 'd': the digest of the event (i.e. the digest of a measured file),
65	        calculated with the SHA1 or MD5 hash algorithm;
66	 - 'n': the name of the event (i.e. the file name), with size up to 255 bytes;
67	 - 'd-ng': the digest of the event, calculated with an arbitrary hash
68	           algorithm (field format: [<hash algo>:]digest, where the digest
69	           prefix is shown only if the hash algorithm is not SHA1 or MD5);
70	 - 'n-ng': the name of the event, without size limitations.
71	
72	
73	Below, there is the list of defined template descriptors:
74	 - "ima": its format is 'd|n';
75	 - "ima-ng" (default): its format is 'd-ng|n-ng'.
76	
77	
78	
79	==== USE ====
80	
81	To specify the template descriptor to be used to generate measurement entries,
82	currently the following methods are supported:
83	
84	 - select a template descriptor among those supported in the kernel
85	   configuration ('ima-ng' is the default choice);
86	 - specify a template descriptor name from the kernel command line through
87	   the 'ima_template=' parameter.
Hide Line Numbers
About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Information is copyright its respective author. All material is available from the Linux Kernel Source distributed under a GPL License. This page is provided as a free service by mjmwired.net.