Hi Randy,
On Tue, Nov 7, 2017 at 5:48 AM, Randy Dunlap wrote:
> From: Randy Dunlap
>
> Update list of available compiled-in fonts in lib/fonts/:
> add 6x10 and drop RomanLarge (which was reverted 12 years ago).
>
> Signed-off-by: Randy Dunlap
> Cc: Geert Uytterhoeven
Acked-by: Geert Uytterhoe
IMA is a security module with the objective of reporting or enforcing the
integrity of a system, by measuring files accessed with the execve(),
mmap() and open() system calls. For reporting, it takes advantage of the
TPM and extends a PCR with the digest of an evaluated event. For enforcing,
it ret
Rename ima_read_policy() to ima_read_file(), and add file_id as new
parameter. If file_id is equal to READING_POLICY, ima_read_file() behavior
remains unchanged. ima_read_file() will be used to read digest list
metadata.
Signed-off-by: Roberto Sassu
---
security/integrity/ima/ima_fs.c | 18 +
This patch removes ima_show_htable_violations() and
ima_show_measurements_count(). ima_show_htable_value(), called by those
functions, determines which hash table data should be copied to the buffer
depending on the dentry of the file passed as argument.
Signed-off-by: Roberto Sassu
---
security
This patch first introduces a new structure called ima_digest, which
contains a digest parsed from a digest list. It has been preferred to
ima_queue_entry, as the existing structure includes an additional member
(a list head), which is not necessary for digest lookup. It also introduces
the is_muta
This patch introduces a parser of RPM package headers. It extracts the
digests from the RPMTAG_FILEDIGESTS header section and converts them to
binary data before adding them to the hash table.
The advantage of this data type is that verifiers can determine who
produced that data, as headers are si
The new policy action 'digest_list' has been added to selectively search a
digest in the ima_digests_htable hash table only for specific rules.
The main use case would be to use digest lists to measure/appraise the TCB,
so that the PCR 10 value is predictable, and to extend a different PCR if
bina
EVM protects all extended attributes defined by LSMs, if LSMs are enabled
in the kernel configuration.
It is desirable to select a subset of extended attributes at run-time, so
that setting remaining extended attributes is allowed if they should not be
protected. At the moment, this option can be
Appraisal verification consists on comparing the calculated digest of an
accessed file with the value of the security.ima extended attribute. With
digest lists, appraisal verification succeeds if the calculated digest is
included in a list. Since the digital signature of each digest list is
verifie
Commit b65a9cfc2c38 ("Untangling ima mess, part 2: deal with counters")
moved the call of ima_file_check() from may_open() to do_filp_open() at a
point where the file descriptor is already opened.
This breaks the assumption made by IMA that file descriptors being closed
belong to files whose acces
This patch adds the documentation of digest lists.
Signed-off-by: Roberto Sassu
---
Documentation/security/IMA-digest-lists.txt | 161
1 file changed, 161 insertions(+)
create mode 100644 Documentation/security/IMA-digest-lists.txt
diff --git a/Documentation/securi
This patch introduces the file 'digest_lists' in the securityfs filesystem,
to load digest lists metadata. IMA will parse the metadata and load the
digest lists from the path provided.
It also introduces 'digests_count', to show the number of digests stored in
the ima_digests_htable hash table.
S
This patch introduces two new hooks DIGEST_LIST_METADATA_CHECK and
DIGEST_LIST_CHECK, which are called respectively when parsing digest list
metadata and digest lists.
It also checks that rules for these two hooks are always specified in the
current policy. Without them, digest lists could be uplo
Digest lists can be uploaded to IMA by supplying the path of their
metadata.
Digest list metadata are:
- DATA_ALGO: algorithm of the digests to be uploaded
- DATA_DIGEST: digest of the file containing the digest list
- DATA_SIGNATURE: signature of the file containing the digest list
- DATA_FILE_P
This patch introduces the parser for the compact digest list.
Its format is:
entry_id[2] count[4] data_len[4]
data[data_len]
entry_id[2] count[4] data_len[4]
data[data_len]
...
entry_id, count and data_len are in little endian.
This format is suitable to store a large number of digests, as there
This patch renames ima_open_policy() and ima_release_policy() respectively
to ima_open_data_upload() and ima_release_data_upload(). They will be used
to implement file operations for interfaces allowing to upload and read
provided data.
Also, the new flag IMA_POLICY_BUSY has been defined specifica
This patch renames ima_write_policy() to ima_write_data(). Also, it
determines the kernel_read_file_id from the dentry associated to the file,
and passes it to ima_read_file().
Signed-off-by: Roberto Sassu
---
security/integrity/ima/ima_fs.c | 55 ++---
1 file
Hi Ruslan,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on balbi-usb/next]
[also build test ERROR on v4.14-rc8 next-20171107]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system]
url:
https://github.com/0day-ci
On 06/11/2017 21:26, Eduardo Valentin wrote:
> Currently, the existing qspinlock implementation will fallback to
> test-and-set if the hypervisor has not set the PV_UNHALT flag.
>
> This patch gives the opportunity to guest kernels to select
> between test-and-set and the regular queueu fair lock
On Tue, Nov 07, 2017 at 01:23:56PM +0100, Paolo Bonzini wrote:
> On 06/11/2017 21:26, Eduardo Valentin wrote:
> > Currently, the existing qspinlock implementation will fallback to
> > test-and-set if the hypervisor has not set the PV_UNHALT flag.
> >
> > This patch gives the opportunity to guest k
On 07/11/2017 13:39, Eduardo Valentin wrote:
>> is this still needed after Waiman's patch to adaptively switch between
>> tas and pvqspinlock?
> Can you please point me to it ? Is it already in tip/master?
>
No, he just posted it:
https://marc.info/?l=linux-kernel&m=150972337909996&w=2
Paolo
--
Hi Ruslan,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on balbi-usb/next]
[also build test WARNING on v4.14-rc8 next-20171107]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system]
url:
https://github.com/0day
On 11/06/2017, 11:51 AM, Ricardo Ribalda Delgado wrote:
> The sample code does not initialize to zero a local variable and then it
> uses the uninitialized code.
>
> Fix in case someone copy/paste the sample code.
>
> Signed-off-by: Ricardo Ribalda Delgado
> ---
> Documentation/serial/serial-rs
Hi Roberto,
On Tue, 2017-11-07 at 11:36 +0100, Roberto Sassu wrote:
> IMA is a security module with the objective of reporting or enforcing the
> integrity of a system, by measuring files accessed with the execve(),
> mmap() and open() system calls. For reporting, it takes advantage of the
> TPM a
On Tue, Nov 7, 2017 at 2:36 AM, Roberto Sassu wrote:
> Finally, digest lists address also the third issue because Linux
> distribution vendors already provide the digests of files included in each
> RPM package. The digest list is stored in the RPM header, signed by the
> vendor.
RPM's hardly uni
Hi Jiri
On Tue, Nov 7, 2017 at 2:28 PM, Jiri Slaby wrote:
> On 11/06/2017, 11:51 AM, Ricardo Ribalda Delgado wrote:
>> The sample code does not initialize to zero a local variable and then it
>> uses the uninitialized code.
>>
>> Fix in case someone copy/paste the sample code.
>>
>> Signed-off-by
On 11/7/2017 2:37 PM, Mimi Zohar wrote:
Hi Roberto,
On Tue, 2017-11-07 at 11:36 +0100, Roberto Sassu wrote:
IMA is a security module with the objective of reporting or enforcing the
integrity of a system, by measuring files accessed with the execve(),
mmap() and open() system calls. For reporti
On Mon, 6 Nov 2017, Chris Metcalf wrote:
> On 11/6/2017 10:38 AM, Christopher Lameter wrote:
> > > What about that d*mn 1 Hz clock?
> > >
> > > It's still there, so this code still requires some further work before
> > > it can actually get a process into long-term task isolation (without
> > > th
On 11/7/2017 12:10 PM, Christopher Lameter wrote:
On Mon, 6 Nov 2017, Chris Metcalf wrote:
On 11/6/2017 10:38 AM, Christopher Lameter wrote:
What about that d*mn 1 Hz clock?
It's still there, so this code still requires some further work before
it can actually get a process into long-term tas
On 11/7/2017 3:49 PM, Matthew Garrett wrote:
On Tue, Nov 7, 2017 at 2:36 AM, Roberto Sassu wrote:
Finally, digest lists address also the third issue because Linux
distribution vendors already provide the digests of files included in each
RPM package. The digest list is stored in the RPM header,
On Tue, 7 Nov 2017, Chris Metcalf wrote:
> > Presumably we have another context there were we may be able to call into
> > the cleanup code with interrupts enabled.
>
> Right now for task isolation we run with interrupts enabled during the
> initial sys_prctl() call, and call quiet_vmstat_sync() t
On Tue, Nov 7, 2017 at 12:53 PM, Roberto Sassu wrote:
> On 11/7/2017 3:49 PM, Matthew Garrett wrote:
>> RPM's hardly universal, and distributions are in the process of moving
>> away from using it for distributing non-core applications (Flatpak and
>> Snap are becoming increasingly popular here).
From: Randy Dunlap
Update list of available compiled-in fonts in lib/fonts/:
add 6x10 and drop RomanLarge (which was reverted 12 years ago).
Also sort the list alphabetically.
Signed-off-by: Randy Dunlap
Cc: Geert Uytterhoeven
Acked-by: Geert Uytterhoeven # v1
---
Documentation/fb/fbcon.txt
> -Original Message-
> From: linux-integrity-ow...@vger.kernel.org [mailto:linux-integrity-
> ow...@vger.kernel.org] On Behalf Of Roberto Sassu
> Sent: Tuesday, November 07, 2017 5:37 AM
> To: linux-integr...@vger.kernel.org
> Cc: linux-security-mod...@vger.kernel.org; linux-fsde...@vger.ke
On Tue, Nov 07, 2017 at 08:32:16AM +0100, Florian Weimer wrote:
> * Ram Pai:
>
> > On Mon, Nov 06, 2017 at 10:28:41PM +0100, Florian Weimer wrote:
> >> * Ram Pai:
> >>
> >> > Testing:
> >> > ---
> >> > This patch series has passed all the protection key
> >> > tests available in the selftest
On 11/07/2017 02:39 PM, Ram Pai wrote:
>
> As per the current semantics of sys_pkey_free(); the way I understand it,
> the calling thread is saying disassociate me from this key.
No. It is saying: "this *process* no longer has any uses of this key,
it can be reused".
--
To unsubscribe from this
On Tue, Nov 07, 2017 at 02:47:10PM -0800, Dave Hansen wrote:
> On 11/07/2017 02:39 PM, Ram Pai wrote:
> >
> > As per the current semantics of sys_pkey_free(); the way I understand it,
> > the calling thread is saying disassociate me from this key.
>
> No. It is saying: "this *process* no longer
37 matches
Mail list logo
