ima: enforcing appraise type

The IMA-appraisal extension added local integrity validation and
enforcement of the measurement against a "good" value stored as an
extended attribute 'security.ima'.  The initial methods for validating
'security.ima' were hash and digital signature based.

Missing is the ability to specify the validation method required. This
patch set addresses this omission, by defining a new policy option
'appraise_type='.  

As a result of this change, appraisal rules now can be written on a
per hook basis, resulting in different appraisal status results.  The 
'ima_appraise_tcb' policy appraises all files owned by root.  A new
hook specific rule could specify that all kernel modules, for example,
require a digital signature.  This patch set caches the appraisal result
on a per hook basis.

Mimi

Dmitry Kasatkin (5):
  ima: remove security.ima hexdump
  integrity: reduce storage size for ima_status and evm_status
  ima: move path resolving to separate function
  ima: forbid write access to files with digital signatures
  ima: added policy support for 'security.ima' type

Mimi Zohar (5):
  ima: support new kernel module syscall (place holder)
  ima: rename FILE_MMAP to MMAP_CHECK
  ima: increase iint flag size
  ima: per hook cache integrity appraisal status
  ima: differentiate appraise status only for hook specific rules

 Documentation/ABI/testing/ima_policy  |    7 ++-
 include/linux/ima.h                   |    6 ++
 security/integrity/iint.c             |   10 ++-
 security/integrity/ima/ima.h          |    8 ++-
 security/integrity/ima/ima_api.c      |   21 +++++-
 security/integrity/ima/ima_appraise.c |   64 ++++++++++++++----
 security/integrity/ima/ima_main.c     |  121 +++++++++++++++++++++-----------
 security/integrity/ima/ima_policy.c   |   53 +++++++++++++-
 security/integrity/integrity.h        |   50 ++++++++++----
 security/security.c                   |   12 +++
 10 files changed, 268 insertions(+), 84 deletions(-)

-- 
1.7.7.6

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html