Skip to content

Commit

Permalink
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/…
Browse files Browse the repository at this point in the history
…jmorris/linux-security

Pull security subsystem updates from James Morris:
 "Highlights:

   - Integrity: add local fs integrity verification to detect offline
     attacks
   - Integrity: add digital signature verification
   - Simple stacking of Yama with other LSMs (per LSS discussions)
   - IBM vTPM support on ppc64
   - Add new driver for Infineon I2C TIS TPM
   - Smack: add rule revocation for subject labels"

Fixed conflicts with the user namespace support in kernel/auditsc.c and
security/integrity/ima/ima_policy.c.

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (39 commits)
  Documentation: Update git repository URL for Smack userland tools
  ima: change flags container data type
  Smack: setprocattr memory leak fix
  Smack: implement revoking all rules for a subject label
  Smack: remove task_wait() hook.
  ima: audit log hashes
  ima: generic IMA action flag handling
  ima: rename ima_must_appraise_or_measure
  audit: export audit_log_task_info
  tpm: fix tpm_acpi sparse warning on different address spaces
  samples/seccomp: fix 31 bit build on s390
  ima: digital signature verification support
  ima: add support for different security.ima data types
  ima: add ima_inode_setxattr/removexattr function and calls
  ima: add inode_post_setattr call
  ima: replace iint spinblock with rwlock/read_lock
  ima: allocating iint improvements
  ima: add appraise action keywords and default rules
  ima: integrity appraisal extension
  vfs: move ima_file_free before releasing the file
  ...
  • Loading branch information
Linus Torvalds committed Oct 3, 2012
2 parents 65b99c7 + bf53083 commit 8826532
Show file tree
Hide file tree
Showing 52 changed files with 3,546 additions and 463 deletions.
25 changes: 21 additions & 4 deletions Documentation/ABI/testing/ima_policy
Original file line number Diff line number Diff line change
Expand Up @@ -12,48 +12,65 @@ Description:
then closing the file. The new policy takes effect after
the file ima/policy is closed.

IMA appraisal, if configured, uses these file measurements
for local measurement appraisal.

rule format: action [condition ...]

action: measure | dont_measure
action: measure | dont_measure | appraise | dont_appraise | audit
condition:= base | lsm
base: [[func=] [mask=] [fsmagic=] [uid=]]
base: [[func=] [mask=] [fsmagic=] [uid=] [fowner]]
lsm: [[subj_user=] [subj_role=] [subj_type=]
[obj_user=] [obj_role=] [obj_type=]]

base: func:= [BPRM_CHECK][FILE_MMAP][FILE_CHECK]
mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
fsmagic:= hex value
uid:= decimal value
fowner:=decimal value
lsm: are LSM specific

default policy:
# PROC_SUPER_MAGIC
dont_measure fsmagic=0x9fa0
dont_appraise fsmagic=0x9fa0
# SYSFS_MAGIC
dont_measure fsmagic=0x62656572
dont_appraise fsmagic=0x62656572
# DEBUGFS_MAGIC
dont_measure fsmagic=0x64626720
dont_appraise fsmagic=0x64626720
# TMPFS_MAGIC
dont_measure fsmagic=0x01021994
dont_appraise fsmagic=0x01021994
# RAMFS_MAGIC
dont_measure fsmagic=0x858458f6
dont_appraise fsmagic=0x858458f6
# SECURITYFS_MAGIC
dont_measure fsmagic=0x73636673
dont_appraise fsmagic=0x73636673

measure func=BPRM_CHECK
measure func=FILE_MMAP mask=MAY_EXEC
measure func=FILE_CHECK mask=MAY_READ uid=0
appraise fowner=0

The default policy measures all executables in bprm_check,
all files mmapped executable in file_mmap, and all files
open for read by root in do_filp_open.
open for read by root in do_filp_open. The default appraisal
policy appraises all files owned by root.

Examples of LSM specific definitions:

SELinux:
# SELINUX_MAGIC
dont_measure fsmagic=0xF97CFF8C
dont_measure fsmagic=0xf97cff8c
dont_appraise fsmagic=0xf97cff8c

dont_measure obj_type=var_log_t
dont_appraise obj_type=var_log_t
dont_measure obj_type=auditd_log_t
dont_appraise obj_type=auditd_log_t
measure subj_user=system_u func=FILE_CHECK mask=MAY_READ
measure subj_role=system_r func=FILE_CHECK mask=MAY_READ

Expand Down
70 changes: 70 additions & 0 deletions Documentation/ABI/testing/sysfs-driver-ppi
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
What: /sys/devices/pnp0/<bus-num>/ppi/
Date: August 2012
Kernel Version: 3.6
Contact: xiaoyan.zhang@intel.com
Description:
This folder includes the attributes related with PPI (Physical
Presence Interface). Only if TPM is supported by BIOS, this
folder makes sence. The folder path can be got by command
'find /sys/ -name 'pcrs''. For the detail information of PPI,
please refer to the PPI specification from
http://www.trustedcomputinggroup.org/

What: /sys/devices/pnp0/<bus-num>/ppi/version
Date: August 2012
Contact: xiaoyan.zhang@intel.com
Description:
This attribute shows the version of the PPI supported by the
platform.
This file is readonly.

What: /sys/devices/pnp0/<bus-num>/ppi/request
Date: August 2012
Contact: xiaoyan.zhang@intel.com
Description:
This attribute shows the request for an operation to be
executed in the pre-OS environment. It is the only input from
the OS to the pre-OS environment. The request should be an
integer value range from 1 to 160, and 0 means no request.
This file can be read and written.

What: /sys/devices/pnp0/00:<bus-num>/ppi/response
Date: August 2012
Contact: xiaoyan.zhang@intel.com
Description:
This attribute shows the response to the most recent operation
request it acted upon. The format is "<request> <response num>
: <response description>".
This file is readonly.

What: /sys/devices/pnp0/<bus-num>/ppi/transition_action
Date: August 2012
Contact: xiaoyan.zhang@intel.com
Description:
This attribute shows the platform-specific action that should
take place in order to transition to the BIOS for execution of
a requested operation. The format is "<action num>: <action
description>".
This file is readonly.

What: /sys/devices/pnp0/<bus-num>/ppi/tcg_operations
Date: August 2012
Contact: xiaoyan.zhang@intel.com
Description:
This attribute shows whether it is allowed to request an
operation to be executed in the pre-OS environment by the BIOS
for the requests defined by TCG, i.e. requests from 1 to 22.
The format is "<request> <status num>: <status description>".
This attribute is only supported by PPI version 1.2+.
This file is readonly.

What: /sys/devices/pnp0/<bus-num>/ppi/vs_operations
Date: August 2012
Contact: xiaoyan.zhang@intel.com
Description:
This attribute shows whether it is allowed to request an
operation to be executed in the pre-OS environment by the BIOS
for the verdor specific requests, i.e. requests from 128 to
255. The format is same with tcg_operations. This attribute
is also only supported by PPI version 1.2+.
This file is readonly.
8 changes: 8 additions & 0 deletions Documentation/kernel-parameters.txt
Original file line number Diff line number Diff line change
Expand Up @@ -1051,6 +1051,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
ihash_entries= [KNL]
Set number of hash buckets for inode cache.

ima_appraise= [IMA] appraise integrity measurements
Format: { "off" | "enforce" | "fix" }
default: "enforce"

ima_appraise_tcb [IMA]
The builtin appraise policy appraises all files
owned by uid=0.

ima_audit= [IMA]
Format: { "0" | "1" }
0 -- integrity auditing messages. (Default)
Expand Down
10 changes: 6 additions & 4 deletions Documentation/security/Smack.txt
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,11 @@ Smack kernels use the CIPSO IP option. Some network
configurations are intolerant of IP options and can impede
access to systems that use them as Smack does.

The current git repositories for Smack user space are:
The current git repository for Smack user space is:

git@gitorious.org:meego-platform-security/smackutil.git
git@gitorious.org:meego-platform-security/libsmack.git
git://github.com/smack-team/smack.git

These should make and install on most modern distributions.
This should make and install on most modern distributions.
There are three commands included in smackutil:

smackload - properly formats data for writing to /smack/load
Expand Down Expand Up @@ -194,6 +193,9 @@ onlycap
these capabilities are effective at for processes with any
label. The value is set by writing the desired label to the
file or cleared by writing "-" to the file.
revoke-subject
Writing a Smack label here sets the access to '-' for all access
rules with that subject label.

You can add access rules in /etc/smack/accesses. They take the form:

Expand Down
62 changes: 62 additions & 0 deletions arch/powerpc/kernel/prom_init.c
Original file line number Diff line number Diff line change
Expand Up @@ -1623,6 +1623,63 @@ static void __init prom_instantiate_rtas(void)
}

#ifdef CONFIG_PPC64
/*
* Allocate room for and instantiate Stored Measurement Log (SML)
*/
static void __init prom_instantiate_sml(void)
{
phandle ibmvtpm_node;
ihandle ibmvtpm_inst;
u32 entry = 0, size = 0;
u64 base;

prom_debug("prom_instantiate_sml: start...\n");

ibmvtpm_node = call_prom("finddevice", 1, 1, ADDR("/ibm,vtpm"));
prom_debug("ibmvtpm_node: %x\n", ibmvtpm_node);
if (!PHANDLE_VALID(ibmvtpm_node))
return;

ibmvtpm_inst = call_prom("open", 1, 1, ADDR("/ibm,vtpm"));
if (!IHANDLE_VALID(ibmvtpm_inst)) {
prom_printf("opening vtpm package failed (%x)\n", ibmvtpm_inst);
return;
}

if (call_prom_ret("call-method", 2, 2, &size,
ADDR("sml-get-handover-size"),
ibmvtpm_inst) != 0 || size == 0) {
prom_printf("SML get handover size failed\n");
return;
}

base = alloc_down(size, PAGE_SIZE, 0);
if (base == 0)
prom_panic("Could not allocate memory for sml\n");

prom_printf("instantiating sml at 0x%x...", base);

if (call_prom_ret("call-method", 4, 2, &entry,
ADDR("sml-handover"),
ibmvtpm_inst, size, base) != 0 || entry == 0) {
prom_printf("SML handover failed\n");
return;
}
prom_printf(" done\n");

reserve_mem(base, size);

prom_setprop(ibmvtpm_node, "/ibm,vtpm", "linux,sml-base",
&base, sizeof(base));
prom_setprop(ibmvtpm_node, "/ibm,vtpm", "linux,sml-size",
&size, sizeof(size));

prom_debug("sml base = 0x%x\n", base);
prom_debug("sml size = 0x%x\n", (long)size);

prom_debug("prom_instantiate_sml: end...\n");
}

/*
* Allocate room for and initialize TCE tables
*/
Expand Down Expand Up @@ -2916,6 +2973,11 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
prom_instantiate_opal();
#endif

#ifdef CONFIG_PPC64
/* instantiate sml */
prom_instantiate_sml();
#endif

/*
* On non-powermacs, put all CPUs in spin-loops.
*
Expand Down
13 changes: 13 additions & 0 deletions drivers/char/hw_random/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -289,3 +289,16 @@ config HW_RANDOM_EXYNOS
module will be called exynos-rng.

If unsure, say Y.

config HW_RANDOM_TPM
tristate "TPM HW Random Number Generator support"
depends on HW_RANDOM && TCG_TPM
default HW_RANDOM
---help---
This driver provides kernel-side support for the Random Number
Generator in the Trusted Platform Module

To compile this driver as a module, choose M here: the
module will be called tpm-rng.

If unsure, say Y.
1 change: 1 addition & 0 deletions drivers/char/hw_random/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,4 @@ obj-$(CONFIG_HW_RANDOM_PICOXCELL) += picoxcell-rng.o
obj-$(CONFIG_HW_RANDOM_PPC4XX) += ppc4xx-rng.o
obj-$(CONFIG_HW_RANDOM_PSERIES) += pseries-rng.o
obj-$(CONFIG_HW_RANDOM_EXYNOS) += exynos-rng.o
obj-$(CONFIG_HW_RANDOM_TPM) += tpm-rng.o
50 changes: 50 additions & 0 deletions drivers/char/hw_random/tpm-rng.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
/*
* Copyright (C) 2012 Kent Yoder IBM Corporation
*
* HWRNG interfaces to pull RNG data from a TPM
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/

#include <linux/module.h>
#include <linux/hw_random.h>
#include <linux/tpm.h>

#define MODULE_NAME "tpm-rng"

static int tpm_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
{
return tpm_get_random(TPM_ANY_NUM, data, max);
}

static struct hwrng tpm_rng = {
.name = MODULE_NAME,
.read = tpm_rng_read,
};

static int __init rng_init(void)
{
return hwrng_register(&tpm_rng);
}
module_init(rng_init);

static void __exit rng_exit(void)
{
hwrng_unregister(&tpm_rng);
}
module_exit(rng_exit);

MODULE_LICENSE("GPL v2");
MODULE_AUTHOR("Kent Yoder <key@linux.vnet.ibm.com>");
MODULE_DESCRIPTION("RNG driver for TPM devices");
19 changes: 19 additions & 0 deletions drivers/char/tpm/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,17 @@ config TCG_TIS
from within Linux. To compile this driver as a module, choose
M here; the module will be called tpm_tis.

config TCG_TIS_I2C_INFINEON
tristate "TPM Interface Specification 1.2 Interface (I2C - Infineon)"
depends on I2C
---help---
If you have a TPM security chip that is compliant with the
TCG TIS 1.2 TPM specification and Infineon's I2C Protocol Stack
Specification 0.20 say Yes and it will be accessible from within
Linux.
To compile this driver as a module, choose M here; the module
will be called tpm_tis_i2c_infineon.

config TCG_NSC
tristate "National Semiconductor TPM Interface"
depends on X86
Expand Down Expand Up @@ -62,4 +73,12 @@ config TCG_INFINEON
Further information on this driver and the supported hardware
can be found at http://www.trust.rub.de/projects/linux-device-driver-infineon-tpm/

config TCG_IBMVTPM
tristate "IBM VTPM Interface"
depends on PPC64
---help---
If you have IBM virtual TPM (VTPM) support say Yes and it
will be accessible from within Linux. To compile this driver
as a module, choose M here; the module will be called tpm_ibmvtpm.

endif # TCG_TPM
8 changes: 8 additions & 0 deletions drivers/char/tpm/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,16 @@
obj-$(CONFIG_TCG_TPM) += tpm.o
ifdef CONFIG_ACPI
obj-$(CONFIG_TCG_TPM) += tpm_bios.o
tpm_bios-objs += tpm_eventlog.o tpm_acpi.o tpm_ppi.o
else
ifdef CONFIG_TCG_IBMVTPM
obj-$(CONFIG_TCG_TPM) += tpm_bios.o
tpm_bios-objs += tpm_eventlog.o tpm_of.o
endif
endif
obj-$(CONFIG_TCG_TIS) += tpm_tis.o
obj-$(CONFIG_TCG_TIS_I2C_INFINEON) += tpm_i2c_infineon.o
obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
obj-$(CONFIG_TCG_IBMVTPM) += tpm_ibmvtpm.o
Loading

0 comments on commit 8826532

Please sign in to comment.