diff options
| -rw-r--r-- | Documentation/admin-guide/LSM/ipe.rst | 6 | ||||
| -rw-r--r-- | Documentation/security/ipe.rst | 2 | ||||
| -rw-r--r-- | security/ipe/audit.c | 52 | ||||
| -rw-r--r-- | security/ipe/policy.c | 2 | ||||
| -rw-r--r-- | security/ipe/policy_parser.c | 10 |
5 files changed, 36 insertions, 36 deletions
diff --git a/Documentation/admin-guide/LSM/ipe.rst b/Documentation/admin-guide/LSM/ipe.rst index a756d8158531..9e82a2082b94 100644 --- a/Documentation/admin-guide/LSM/ipe.rst +++ b/Documentation/admin-guide/LSM/ipe.rst @@ -502,11 +502,11 @@ The following table lists the error codes that may appear in the errno field whi Event Examples:: type=1404 audit(1653425689.008:55): enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 - type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=) + type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 type=1327 audit(1653425689.008:55): proctitle="-bash" type=1404 audit(1653425689.008:55): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=ipe res=1 - type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=) + type=1300 audit(1653425689.008:55): arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=55c1065e5c60 a2=2 a3=0 items=0 ppid=405 pid=441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 type=1327 audit(1653425689.008:55): proctitle="-bash" This record will always be emitted in conjunction with a ``AUDITSYSCALL`` record for the ``write`` syscall. @@ -791,7 +791,7 @@ Allow execution of a specific fs-verity file Additional Information ---------------------- -- `Github Repository <https://github.com/microsoft/ipe>`_ +- `IPE website <https://ipe-lsm.org/>`_ - :doc:`Developer and design docs for IPE </security/ipe>` FAQ diff --git a/Documentation/security/ipe.rst b/Documentation/security/ipe.rst index 5eb3e6265fbd..4490aed5918a 100644 --- a/Documentation/security/ipe.rst +++ b/Documentation/security/ipe.rst @@ -442,5 +442,5 @@ IPE has KUnit Tests for the policy parser. Recommended kunitconfig:: CONFIG_SECURITY_IPE_KUNIT_TEST=y In addition, IPE has a python based integration -`test suite <https://github.com/microsoft/ipe/tree/test-suite>`_ that +`test suite <https://github.com/Integrity-Policy-Enforcement/ci>`_ that can test both user interfaces and enforcement functionalities. diff --git a/security/ipe/audit.c b/security/ipe/audit.c index 93fb59fbddd6..b6f8fb54085a 100644 --- a/security/ipe/audit.c +++ b/security/ipe/audit.c @@ -34,34 +34,34 @@ "new_policy_digest=" IPE_AUDIT_HASH_ALG ":" static const char *const audit_op_names[__IPE_OP_MAX + 1] = { - "EXECUTE", - "FIRMWARE", - "KMODULE", - "KEXEC_IMAGE", - "KEXEC_INITRAMFS", - "POLICY", - "X509_CERT", - "UNKNOWN", + [IPE_OP_EXEC] = "EXECUTE", + [IPE_OP_FIRMWARE] = "FIRMWARE", + [IPE_OP_KERNEL_MODULE] = "KMODULE", + [IPE_OP_KEXEC_IMAGE] = "KEXEC_IMAGE", + [IPE_OP_KEXEC_INITRAMFS] = "KEXEC_INITRAMFS", + [IPE_OP_POLICY] = "POLICY", + [IPE_OP_X509] = "X509_CERT", + [IPE_OP_INVALID] = "UNKNOWN", }; static const char *const audit_hook_names[__IPE_HOOK_MAX] = { - "BPRM_CHECK", - "BPRM_CREDS_FOR_EXEC", - "MMAP", - "MPROTECT", - "KERNEL_READ", - "KERNEL_LOAD", + [IPE_HOOK_BPRM_CHECK] = "BPRM_CHECK", + [IPE_HOOK_BPRM_CREDS_FOR_EXEC] = "BPRM_CREDS_FOR_EXEC", + [IPE_HOOK_MMAP] = "MMAP", + [IPE_HOOK_MPROTECT] = "MPROTECT", + [IPE_HOOK_KERNEL_READ] = "KERNEL_READ", + [IPE_HOOK_KERNEL_LOAD] = "KERNEL_LOAD", }; static const char *const audit_prop_names[__IPE_PROP_MAX] = { - "boot_verified=FALSE", - "boot_verified=TRUE", - "dmverity_roothash=", - "dmverity_signature=FALSE", - "dmverity_signature=TRUE", - "fsverity_digest=", - "fsverity_signature=FALSE", - "fsverity_signature=TRUE", + [IPE_PROP_BOOT_VERIFIED_FALSE] = "boot_verified=FALSE", + [IPE_PROP_BOOT_VERIFIED_TRUE] = "boot_verified=TRUE", + [IPE_PROP_DMV_ROOTHASH] = "dmverity_roothash=", + [IPE_PROP_DMV_SIG_FALSE] = "dmverity_signature=FALSE", + [IPE_PROP_DMV_SIG_TRUE] = "dmverity_signature=TRUE", + [IPE_PROP_FSV_DIGEST] = "fsverity_digest=", + [IPE_PROP_FSV_SIG_FALSE] = "fsverity_signature=FALSE", + [IPE_PROP_FSV_SIG_TRUE] = "fsverity_signature=TRUE", }; /** @@ -262,18 +262,10 @@ void ipe_audit_policy_load(const struct ipe_policy *const p) */ void ipe_audit_enforce(bool new_enforce, bool old_enforce) { - struct audit_buffer *ab; - - ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS); - if (!ab) - return; - audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS, "enforcing=%d old_enforcing=%d auid=%u ses=%u" " enabled=1 old-enabled=1 lsm=ipe res=1", new_enforce, old_enforce, from_kuid(&init_user_ns, audit_get_loginuid(current)), audit_get_sessionid(current)); - - audit_log_end(ab); } diff --git a/security/ipe/policy.c b/security/ipe/policy.c index 827867be4fac..e542329726bc 100644 --- a/security/ipe/policy.c +++ b/security/ipe/policy.c @@ -52,7 +52,7 @@ void ipe_free_policy(struct ipe_policy *p) ipe_del_policyfs_node(p); ipe_free_parsed_policy(p->parsed); /* - * p->text is allocated only when p->pkcs7 is not NULL + * p->text is allocated only when p->pkcs7 is NULL * otherwise it points to the plaintext data inside the pkcs7 */ if (!p->pkcs7) diff --git a/security/ipe/policy_parser.c b/security/ipe/policy_parser.c index 6fa5bebf8471..309a61594e1d 100644 --- a/security/ipe/policy_parser.c +++ b/security/ipe/policy_parser.c @@ -128,6 +128,8 @@ static const match_table_t header_tokens = { {__IPE_HEADER_MAX, NULL} }; +static_assert(ARRAY_SIZE(header_tokens) == __IPE_HEADER_MAX + 1); + /** * parse_header() - Parse policy header information. * @line: Supplies header line to be parsed. @@ -201,7 +203,7 @@ out: * * %false - The token is not "DEFAULT" * * %true - The token is "DEFAULT" */ -static bool token_default(char *token) +static bool token_default(const char *token) { return !strcmp(token, "DEFAULT"); } @@ -240,6 +242,8 @@ static const match_table_t operation_tokens = { {IPE_OP_INVALID, NULL} }; +static_assert(ARRAY_SIZE(operation_tokens) == __IPE_OP_MAX + 1); + /** * parse_operation() - Parse the operation type given a token string. * @t: Supplies the token string to be parsed. @@ -259,6 +263,8 @@ static const match_table_t action_tokens = { {IPE_ACTION_INVALID, NULL} }; +static_assert(ARRAY_SIZE(action_tokens) == __IPE_ACTION_MAX + 1); + /** * parse_action() - Parse the action type given a token string. * @t: Supplies the token string to be parsed. @@ -284,6 +290,8 @@ static const match_table_t property_tokens = { {IPE_PROP_INVALID, NULL} }; +static_assert(ARRAY_SIZE(property_tokens) == __IPE_PROP_MAX + 1); + /** * parse_property() - Parse a rule property given a token string. * @t: Supplies the token string to be parsed. |