On Wed Mar 27, 2024 at 5:00 PM EET, Mimi Zohar wrote:
> The init_module syscall loads an ELF image into kernel space without
> measuring the buffer containing the ELF image. To close this kernel
> module integrity gap, define a new critical-data record which includes
> the hash of the ELF image.
>
> Instead of including the buffer data in the IMA measurement list,
> include the hash of the buffer data to avoid large IMA measurement
> list records. The buffer data hash would be the same value as the
> finit_module syscall file hash.
>
> To enable measuring the init_module buffer and other critical data from
> boot, define "ima_policy=critical_data" on the boot command line. Since
> builtin policies are not persistent, a custom IMA policy must include
> the rule as well: measure func=CRITICAL_DATA label=modules
>
> To verify the template data hash value, first convert the buffer data
> hash to binary:
> grep "init_module" \
> /sys/kernel/security/integrity/ima/ascii_runtime_measurements | \
> tail -1 | cut -d' ' -f 6 | xxd -r -p | sha256sum
>
> Reported-by: Ken Goldman <[email protected]>
> Signed-off-by: Mimi Zohar <[email protected]>
> ---
> security/integrity/ima/ima_main.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/security/integrity/ima/ima_main.c
> b/security/integrity/ima/ima_main.c
> index c84e8c55333d..4b4348d681a6 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -902,6 +902,13 @@ static int ima_post_load_data(char *buf, loff_t size,
> return 0;
> }
>
> + /*
> + * Measure the init_module syscall buffer containing the ELF image.
> + */
> + if (load_id == LOADING_MODULE)
> + ima_measure_critical_data("modules", "init_module",
> + buf, size, true, NULL, 0);
No reason not to ack but could be just as well (passing checkpatch):
if (load_id == LOADING_MODULE)
ima_measure_critical_data("modules", "init_module", buf, size,
true, NULL, 0);
< 100 characters
> +
> return 0;
> }
>
Reviewed-by: Jarkko Sakkinen <[email protected]>
BR, Jarkko
