Skip to content

Commit 8ec4566

Browse files
Tushar Sugandhisnitm
Tushar Sugandhi
authored and
snitm
committed
dm: update target status functions to support IMA measurement
For device mapper targets to take advantage of IMA's measurement capabilities, the status functions for the individual targets need to be updated to handle the status_type_t case for value STATUSTYPE_IMA. Update status functions for the following target types, to log their respective attributes to be measured using IMA. 01. cache 02. crypt 03. integrity 04. linear 05. mirror 06. multipath 07. raid 08. snapshot 09. striped 10. verity For rest of the targets, handle the STATUSTYPE_IMA case by setting the measurement buffer to NULL. For IMA to measure the data on a given system, the IMA policy on the system needs to be updated to have the following line, and the system needs to be restarted for the measurements to take effect. /etc/ima/ima-policy measure func=CRITICAL_DATA label=device-mapper template=ima-buf The measurements will be reflected in the IMA logs, which are located at: /sys/kernel/security/integrity/ima/ascii_runtime_measurements /sys/kernel/security/integrity/ima/binary_runtime_measurements These IMA logs can later be consumed by various attestation clients running on the system, and send them to external services for attesting the system. The DM target data measured by IMA subsystem can alternatively be queried from userspace by setting DM_IMA_MEASUREMENT_FLAG with DM_TABLE_STATUS_CMD. Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
1 parent 7d1d1df commit 8ec4566

32 files changed

Lines changed: 328 additions & 2 deletions

‎drivers/md/dm-cache-target.c‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3122,6 +3122,30 @@ static void cache_status(struct dm_target *ti, status_type_t type,
31223122
DMEMIT(" %s", cache->ctr_args[i]);
31233123
if (cache->nr_ctr_args)
31243124
DMEMIT(" %s", cache->ctr_args[cache->nr_ctr_args - 1]);
3125+
break;
3126+
3127+
case STATUSTYPE_IMA:
3128+
DMEMIT_TARGET_NAME_VERSION(ti->type);
3129+
if (get_cache_mode(cache) == CM_FAIL)
3130+
DMEMIT(",metadata_mode=fail");
3131+
else if (get_cache_mode(cache) == CM_READ_ONLY)
3132+
DMEMIT(",metadata_mode=ro");
3133+
else
3134+
DMEMIT(",metadata_mode=rw");
3135+
3136+
format_dev_t(buf, cache->metadata_dev->bdev->bd_dev);
3137+
DMEMIT(",cache_metadata_device=%s", buf);
3138+
format_dev_t(buf, cache->cache_dev->bdev->bd_dev);
3139+
DMEMIT(",cache_device=%s", buf);
3140+
format_dev_t(buf, cache->origin_dev->bdev->bd_dev);
3141+
DMEMIT(",cache_origin_device=%s", buf);
3142+
DMEMIT(",writethrough=%c", writethrough_mode(cache) ? 'y' : 'n');
3143+
DMEMIT(",writeback=%c", writeback_mode(cache) ? 'y' : 'n');
3144+
DMEMIT(",passthrough=%c", passthrough_mode(cache) ? 'y' : 'n');
3145+
DMEMIT(",metadata2=%c", cache->features.metadata_version == 2 ? 'y' : 'n');
3146+
DMEMIT(",no_discard_passdown=%c", cache->features.discard_passdown ? 'n' : 'y');
3147+
DMEMIT(";");
3148+
break;
31253149
}
31263150

31273151
return;

‎drivers/md/dm-clone-target.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1499,6 +1499,11 @@ static void clone_status(struct dm_target *ti, status_type_t type,
14991499

15001500
for (i = 0; i < clone->nr_ctr_args; i++)
15011501
DMEMIT(" %s", clone->ctr_args[i]);
1502+
break;
1503+
1504+
case STATUSTYPE_IMA:
1505+
*result = '\0';
1506+
break;
15021507
}
15031508

15041509
return;

‎drivers/md/dm-crypt.c‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3485,7 +3485,34 @@ static void crypt_status(struct dm_target *ti, status_type_t type,
34853485
if (test_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags))
34863486
DMEMIT(" iv_large_sectors");
34873487
}
3488+
break;
3489+
3490+
case STATUSTYPE_IMA:
3491+
DMEMIT_TARGET_NAME_VERSION(ti->type);
3492+
DMEMIT(",allow_discards=%c", ti->num_discard_bios ? 'y' : 'n');
3493+
DMEMIT(",same_cpu_crypt=%c", test_bit(DM_CRYPT_SAME_CPU, &cc->flags) ? 'y' : 'n');
3494+
DMEMIT(",submit_from_crypt_cpus=%c", test_bit(DM_CRYPT_NO_OFFLOAD, &cc->flags) ?
3495+
'y' : 'n');
3496+
DMEMIT(",no_read_workqueue=%c", test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags) ?
3497+
'y' : 'n');
3498+
DMEMIT(",no_write_workqueue=%c", test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags) ?
3499+
'y' : 'n');
3500+
DMEMIT(",iv_large_sectors=%c", test_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags) ?
3501+
'y' : 'n');
34883502

3503+
if (cc->on_disk_tag_size)
3504+
DMEMIT(",integrity_tag_size=%u,cipher_auth=%s",
3505+
cc->on_disk_tag_size, cc->cipher_auth);
3506+
if (cc->sector_size != (1 << SECTOR_SHIFT))
3507+
DMEMIT(",sector_size=%d", cc->sector_size);
3508+
if (cc->cipher_string)
3509+
DMEMIT(",cipher_string=%s", cc->cipher_string);
3510+
3511+
DMEMIT(",key_size=%u", cc->key_size);
3512+
DMEMIT(",key_parts=%u", cc->key_parts);
3513+
DMEMIT(",key_extra_size=%u", cc->key_extra_size);
3514+
DMEMIT(",key_mac_size=%u", cc->key_mac_size);
3515+
DMEMIT(";");
34893516
break;
34903517
}
34913518
}

‎drivers/md/dm-delay.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,10 @@ static void delay_status(struct dm_target *ti, status_type_t type,
326326
DMEMIT_DELAY_CLASS(&dc->flush);
327327
}
328328
break;
329+
330+
case STATUSTYPE_IMA:
331+
*result = '\0';
332+
break;
329333
}
330334
}
331335

‎drivers/md/dm-dust.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -527,6 +527,10 @@ static void dust_status(struct dm_target *ti, status_type_t type,
527527
DMEMIT("%s %llu %u", dd->dev->name,
528528
(unsigned long long)dd->start, dd->blksz);
529529
break;
530+
531+
case STATUSTYPE_IMA:
532+
*result = '\0';
533+
break;
530534
}
531535
}
532536

‎drivers/md/dm-ebs-target.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,9 @@ static void ebs_status(struct dm_target *ti, status_type_t type,
401401
snprintf(result, maxlen, ec->u_bs_set ? "%s %llu %u %u" : "%s %llu %u",
402402
ec->dev->name, (unsigned long long) ec->start, ec->e_bs, ec->u_bs);
403403
break;
404+
case STATUSTYPE_IMA:
405+
*result = '\0';
406+
break;
404407
}
405408
}
406409

‎drivers/md/dm-era-target.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1644,6 +1644,10 @@ static void era_status(struct dm_target *ti, status_type_t type,
16441644
format_dev_t(buf, era->origin_dev->bdev->bd_dev);
16451645
DMEMIT("%s %u", buf, era->sectors_per_block);
16461646
break;
1647+
1648+
case STATUSTYPE_IMA:
1649+
*result = '\0';
1650+
break;
16471651
}
16481652

16491653
return;

‎drivers/md/dm-flakey.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,10 @@ static void flakey_status(struct dm_target *ti, status_type_t type,
440440
fc->corrupt_bio_value, fc->corrupt_bio_flags);
441441

442442
break;
443+
444+
case STATUSTYPE_IMA:
445+
result[0] = '\0';
446+
break;
443447
}
444448
}
445449

‎drivers/md/dm-integrity.c‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3306,6 +3306,31 @@ static void dm_integrity_status(struct dm_target *ti, status_type_t type,
33063306
EMIT_ALG(journal_mac_alg, "journal_mac");
33073307
break;
33083308
}
3309+
case STATUSTYPE_IMA:
3310+
DMEMIT_TARGET_NAME_VERSION(ti->type);
3311+
DMEMIT(",dev_name=%s,start=%llu,tag_size=%u,mode=%c",
3312+
ic->dev->name, ic->start, ic->tag_size, ic->mode);
3313+
3314+
if (ic->meta_dev)
3315+
DMEMIT(",meta_device=%s", ic->meta_dev->name);
3316+
if (ic->sectors_per_block != 1)
3317+
DMEMIT(",block_size=%u", ic->sectors_per_block << SECTOR_SHIFT);
3318+
3319+
DMEMIT(",recalculate=%c", (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) ?
3320+
'y' : 'n');
3321+
DMEMIT(",allow_discards=%c", ic->discard ? 'y' : 'n');
3322+
DMEMIT(",fix_padding=%c",
3323+
((ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING)) != 0) ? 'y' : 'n');
3324+
DMEMIT(",fix_hmac=%c",
3325+
((ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) != 0) ? 'y' : 'n');
3326+
DMEMIT(",legacy_recalculate=%c", ic->legacy_recalculate ? 'y' : 'n');
3327+
3328+
DMEMIT(",journal_sectors=%u", ic->initial_sectors - SB_SECTORS);
3329+
DMEMIT(",interleave_sectors=%u", 1U << ic->sb->log2_interleave_sectors);
3330+
DMEMIT(",buffer_sectors=%u", 1U << ic->log2_buffer_sectors);
3331+
DMEMIT(",mode=%c", ic->mode);
3332+
DMEMIT(";");
3333+
break;
33093334
}
33103335
}
33113336

‎drivers/md/dm-linear.c‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,15 +106,21 @@ static void linear_status(struct dm_target *ti, status_type_t type,
106106
unsigned status_flags, char *result, unsigned maxlen)
107107
{
108108
struct linear_c *lc = (struct linear_c *) ti->private;
109+
size_t sz = 0;
109110

110111
switch (type) {
111112
case STATUSTYPE_INFO:
112113
result[0] = '\0';
113114
break;
114115

115116
case STATUSTYPE_TABLE:
116-
snprintf(result, maxlen, "%s %llu", lc->dev->name,
117-
(unsigned long long)lc->start);
117+
DMEMIT("%s %llu", lc->dev->name, (unsigned long long)lc->start);
118+
break;
119+
120+
case STATUSTYPE_IMA:
121+
DMEMIT_TARGET_NAME_VERSION(ti->type);
122+
DMEMIT(",device_name=%s,start=%llu;", lc->dev->name,
123+
(unsigned long long)lc->start);
118124
break;
119125
}
120126
}

0 commit comments

Comments
 (0)