• Tushar Sugandhi's avatar
    dm: update target status functions to support IMA measurement · 8ec45662
    Tushar Sugandhi authored
    For device mapper targets to take advantage of IMA's measurement
    capabilities, the status functions for the individual targets need to be
    updated to handle the status_type_t case for value STATUSTYPE_IMA.
    
    Update status functions for the following target types, to log their
    respective attributes to be measured using IMA.
     01. cache
     02. crypt
     03. integrity
     04. linear
     05. mirror
     06. multipath
     07. raid
     08. snapshot
     09. striped
     10. verity
    
    For rest of the targets, handle the STATUSTYPE_IMA case by setting the
    measurement buffer to NULL.
    
    For IMA to measure the data on a given system, the IMA policy on the
    system needs to be updated to have the following line, and the system
    needs to be restarted for the measurements to take effect.
    
    /etc/ima/ima-policy
     measure func=CRITICAL_DATA label=device-mapper template=ima-buf
    
    The measurements will be reflected in the IMA logs, which are located at:
    
    /sys/kernel/security/integrity/ima/ascii_runtime_measurements
    /sys/kernel/security/integrity/ima/binary_runtime_measurements
    
    These IMA logs can later be consumed by various attestation clients
    running on the system, and send them to external services for attesting
    the system.
    
    The DM target data measured by IMA subsystem can alternatively
    be queried from userspace by setting DM_IMA_MEASUREMENT_FLAG with
    DM_TABLE_STATUS_CMD.
    Signed-off-by: default avatarTushar Sugandhi <tusharsu@linux.microsoft.com>
    Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
    8ec45662
dm-stripe.c 13.1 KB