diff options
Diffstat (limited to 'Documentation/security/IMA-templates.txt')
| -rw-r--r-- | Documentation/security/IMA-templates.txt | 87 |
1 files changed, 0 insertions, 87 deletions
diff --git a/Documentation/security/IMA-templates.txt b/Documentation/security/IMA-templates.txt deleted file mode 100644 index a777e5f..0000000 --- a/Documentation/security/IMA-templates.txt +++ /dev/null @@ -1,87 +0,0 @@ - IMA Template Management Mechanism - - -==== INTRODUCTION ==== - -The original 'ima' template is fixed length, containing the filedata hash -and pathname. The filedata hash is limited to 20 bytes (md5/sha1). -The pathname is a null terminated string, limited to 255 characters. -To overcome these limitations and to add additional file metadata, it is -necessary to extend the current version of IMA by defining additional -templates. For example, information that could be possibly reported are -the inode UID/GID or the LSM labels either of the inode and of the process -that is accessing it. - -However, the main problem to introduce this feature is that, each time -a new template is defined, the functions that generate and display -the measurements list would include the code for handling a new format -and, thus, would significantly grow over the time. - -The proposed solution solves this problem by separating the template -management from the remaining IMA code. The core of this solution is the -definition of two new data structures: a template descriptor, to determine -which information should be included in the measurement list; a template -field, to generate and display data of a given type. - -Managing templates with these structures is very simple. To support -a new data type, developers define the field identifier and implement -two functions, init() and show(), respectively to generate and display -measurement entries. Defining a new template descriptor requires -specifying the template format, a string of field identifiers separated -by the '|' character. While in the current implementation it is possible -to define new template descriptors only by adding their definition in the -template specific code (ima_template.c), in a future version it will be -possible to register a new template on a running kernel by supplying to IMA -the desired format string. In this version, IMA initializes at boot time -all defined template descriptors by translating the format into an array -of template fields structures taken from the set of the supported ones. - -After the initialization step, IMA will call ima_alloc_init_template() -(new function defined within the patches for the new template management -mechanism) to generate a new measurement entry by using the template -descriptor chosen through the kernel configuration or through the newly -introduced 'ima_template=' kernel command line parameter. It is during this -phase that the advantages of the new architecture are clearly shown: -the latter function will not contain specific code to handle a given template -but, instead, it simply calls the init() method of the template fields -associated to the chosen template descriptor and store the result (pointer -to allocated data and data length) in the measurement entry structure. - -The same mechanism is employed to display measurements entries. -The functions ima[_ascii]_measurements_show() retrieve, for each entry, -the template descriptor used to produce that entry and call the show() -method for each item of the array of template fields structures. - - - -==== SUPPORTED TEMPLATE FIELDS AND DESCRIPTORS ==== - -In the following, there is the list of supported template fields -('<identifier>': description), that can be used to define new template -descriptors by adding their identifier to the format string -(support for more data types will be added later): - - - 'd': the digest of the event (i.e. the digest of a measured file), - calculated with the SHA1 or MD5 hash algorithm; - - 'n': the name of the event (i.e. the file name), with size up to 255 bytes; - - 'd-ng': the digest of the event, calculated with an arbitrary hash - algorithm (field format: [<hash algo>:]digest, where the digest - prefix is shown only if the hash algorithm is not SHA1 or MD5); - - 'n-ng': the name of the event, without size limitations. - - -Below, there is the list of defined template descriptors: - - "ima": its format is 'd|n'; - - "ima-ng" (default): its format is 'd-ng|n-ng'. - - - -==== USE ==== - -To specify the template descriptor to be used to generate measurement entries, -currently the following methods are supported: - - - select a template descriptor among those supported in the kernel - configuration ('ima-ng' is the default choice); - - specify a template descriptor name from the kernel command line through - the 'ima_template=' parameter. |