summaryrefslogtreecommitdiff
path: root/include/linux/ima.h
diff options
context:
space:
mode:
authorTushar Sugandhi <tusharsu@linux.microsoft.com>2021-01-07 20:07:03 -0800
committerMimi Zohar <zohar@linux.ibm.com>2021-01-14 23:41:26 -0500
commitd6e645012d97164609260ac567b304681734c5e2 (patch)
treea3407860354577f3af1260aad6f37820c6e8bfea /include/linux/ima.h
parent291af651b350817f7f1cbe308faaf7fa7af2a92c (diff)
IMA: define a hook to measure kernel integrity critical data
IMA provides capabilities to measure file and buffer data. However, various data structures, policies, and states stored in kernel memory also impact the integrity of the system. Several kernel subsystems contain such integrity critical data. These kernel subsystems help protect the integrity of the system. Currently, IMA does not provide a generic function for measuring kernel integrity critical data. Define ima_measure_critical_data, a new IMA hook, to measure kernel integrity critical data. Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'include/linux/ima.h')
-rw-r--r--include/linux/ima.h7
1 files changed, 7 insertions, 0 deletions
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 7db9cca1af34..59bd90ac3c35 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -31,6 +31,9 @@ extern void ima_post_path_mknod(struct dentry *dentry);
extern int ima_file_hash(struct file *file, char *buf, size_t buf_size);
extern int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size);
extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size);
+extern void ima_measure_critical_data(const char *event_name,
+ const void *buf, size_t buf_len,
+ bool hash);
#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
extern void ima_appraise_parse_cmdline(void);
@@ -128,6 +131,10 @@ static inline int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size
}
static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {}
+
+static inline void ima_measure_critical_data(const char *event_name,
+ const void *buf, size_t buf_len,
+ bool hash) {}
#endif /* CONFIG_IMA */
#ifndef CONFIG_IMA_KEXEC