|
@@ -0,0 +1,87 @@
|
|
|
+ IMA Template Management Mechanism
|
|
|
+
|
|
|
+
|
|
|
+==== INTRODUCTION ====
|
|
|
+
|
|
|
+The original 'ima' template is fixed length, containing the filedata hash
|
|
|
+and pathname. The filedata hash is limited to 20 bytes (md5/sha1).
|
|
|
+The pathname is a null terminated string, limited to 255 characters.
|
|
|
+To overcome these limitations and to add additional file metadata, it is
|
|
|
+necessary to extend the current version of IMA by defining additional
|
|
|
+templates. For example, information that could be possibly reported are
|
|
|
+the inode UID/GID or the LSM labels either of the inode and of the process
|
|
|
+that is accessing it.
|
|
|
+
|
|
|
+However, the main problem to introduce this feature is that, each time
|
|
|
+a new template is defined, the functions that generate and display
|
|
|
+the measurements list would include the code for handling a new format
|
|
|
+and, thus, would significantly grow over the time.
|
|
|
+
|
|
|
+The proposed solution solves this problem by separating the template
|
|
|
+management from the remaining IMA code. The core of this solution is the
|
|
|
+definition of two new data structures: a template descriptor, to determine
|
|
|
+which information should be included in the measurement list; a template
|
|
|
+field, to generate and display data of a given type.
|
|
|
+
|
|
|
+Managing templates with these structures is very simple. To support
|
|
|
+a new data type, developers define the field identifier and implement
|
|
|
+two functions, init() and show(), respectively to generate and display
|
|
|
+measurement entries. Defining a new template descriptor requires
|
|
|
+specifying the template format, a string of field identifiers separated
|
|
|
+by the '|' character. While in the current implementation it is possible
|
|
|
+to define new template descriptors only by adding their definition in the
|
|
|
+template specific code (ima_template.c), in a future version it will be
|
|
|
+possible to register a new template on a running kernel by supplying to IMA
|
|
|
+the desired format string. In this version, IMA initializes at boot time
|
|
|
+all defined template descriptors by translating the format into an array
|
|
|
+of template fields structures taken from the set of the supported ones.
|
|
|
+
|
|
|
+After the initialization step, IMA will call ima_alloc_init_template()
|
|
|
+(new function defined within the patches for the new template management
|
|
|
+mechanism) to generate a new measurement entry by using the template
|
|
|
+descriptor chosen through the kernel configuration or through the newly
|
|
|
+introduced 'ima_template=' kernel command line parameter. It is during this
|
|
|
+phase that the advantages of the new architecture are clearly shown:
|
|
|
+the latter function will not contain specific code to handle a given template
|
|
|
+but, instead, it simply calls the init() method of the template fields
|
|
|
+associated to the chosen template descriptor and store the result (pointer
|
|
|
+to allocated data and data length) in the measurement entry structure.
|
|
|
+
|
|
|
+The same mechanism is employed to display measurements entries.
|
|
|
+The functions ima[_ascii]_measurements_show() retrieve, for each entry,
|
|
|
+the template descriptor used to produce that entry and call the show()
|
|
|
+method for each item of the array of template fields structures.
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+==== SUPPORTED TEMPLATE FIELDS AND DESCRIPTORS ====
|
|
|
+
|
|
|
+In the following, there is the list of supported template fields
|
|
|
+('<identifier>': description), that can be used to define new template
|
|
|
+descriptors by adding their identifier to the format string
|
|
|
+(support for more data types will be added later):
|
|
|
+
|
|
|
+ - 'd': the digest of the event (i.e. the digest of a measured file),
|
|
|
+ calculated with the SHA1 or MD5 hash algorithm;
|
|
|
+ - 'n': the name of the event (i.e. the file name), with size up to 255 bytes;
|
|
|
+ - 'd-ng': the digest of the event, calculated with an arbitrary hash
|
|
|
+ algorithm (field format: [<hash algo>:]digest, where the digest
|
|
|
+ prefix is shown only if the hash algorithm is not SHA1 or MD5);
|
|
|
+ - 'n-ng': the name of the event, without size limitations.
|
|
|
+
|
|
|
+
|
|
|
+Below, there is the list of defined template descriptors:
|
|
|
+ - "ima": its format is 'd|n';
|
|
|
+ - "ima-ng" (default): its format is 'd-ng|n-ng'.
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+==== USE ====
|
|
|
+
|
|
|
+To specify the template descriptor to be used to generate measurement entries,
|
|
|
+currently the following methods are supported:
|
|
|
+
|
|
|
+ - select a template descriptor among those supported in the kernel
|
|
|
+ configuration ('ima-ng' is the default choice);
|
|
|
+ - specify a template descriptor name from the kernel command line through
|
|
|
+ the 'ima_template=' parameter.
|