Introduction¶

The originalima template is fixed length, containing the filedata hashand pathname. The filedata hash is limited to 20 bytes (md5/sha1).The pathname is a null terminated string, limited to 255 characters.To overcome these limitations and to add additional file metadata, it isnecessary to extend the current version of IMA by defining additionaltemplates. For example, information that could be possibly reported arethe inode UID/GID or the LSM labels either of the inode and of the processthat is accessing it.

However, the main problem to introduce this feature is that, each timea new template is defined, the functions that generate and displaythe measurements list would include the code for handling a new formatand, thus, would significantly grow over the time.

The proposed solution solves this problem by separating the templatemanagement from the remaining IMA code. The core of this solution is thedefinition of two new data structures: a template descriptor, to determinewhich information should be included in the measurement list; a templatefield, to generate and display data of a given type.

Managing templates with these structures is very simple. To supporta new data type, developers define the field identifier and implementtwo functions, init() and show(), respectively to generate and displaymeasurement entries. Defining a new template descriptor requiresspecifying the template format (a string of field identifiers separatedby the| character) through theima_template_fmt kernel command lineparameter. At boot time, IMA initializes the chosen template descriptorby translating the format into an array of template fields structures takenfrom the set of the supported ones.

After the initialization step, IMA will callima_alloc_init_template()(new function defined within the patches for the new template managementmechanism) to generate a new measurement entry by using the templatedescriptor chosen through the kernel configuration or through the newlyintroducedima_template andima_template_fmt kernel command line parameters.It is during this phase that the advantages of the new architecture areclearly shown: the latter function will not contain specific code to handlea given template but, instead, it simply calls theinit() method of the templatefields associated to the chosen template descriptor and store the result(pointer to allocated data and data length) in the measurement entry structure.

The same mechanism is employed to display measurements entries.The functionsima[_ascii]_measurements_show() retrieve, for each entry,the template descriptor used to produce that entry and call the show()method for each item of the array of template fields structures.

Supported Template Fields and Descriptors¶

In the following, there is the list of supported template fields('<identifier>':description), that can be used to define new templatedescriptors by adding their identifier to the format string(support for more data types will be added later):

• ‘d’: the digest of the event (i.e. the digest of a measured file),calculated with the SHA1 or MD5 hash algorithm;
• ‘n’: the name of the event (i.e. the file name), with size up to 255 bytes;
• ‘d-ng’: the digest of the event, calculated with an arbitrary hashalgorithm (field format: [<hash algo>:]digest, where the digestprefix is shown only if the hash algorithm is not SHA1 or MD5);
• ‘d-modsig’: the digest of the event without the appended modsig;
• ‘n-ng’: the name of the event, without size limitations;
• ‘sig’: the file signature;
• ‘modsig’ the appended file signature;
• ‘buf’: the buffer data that was used to generate the hash without size limitations;

Below, there is the list of defined template descriptors:

• “ima”: its format isd|n;
• “ima-ng” (default): its format isd-ng|n-ng;
• “ima-sig”: its format isd-ng|n-ng|sig;
• “ima-buf”: its format isd-ng|n-ng|buf;
• “ima-modsig”: its format isd-ng|n-ng|sig|d-modsig|modsig;

Use¶

To specify the template descriptor to be used to generate measurement entries,currently the following methods are supported:

• select a template descriptor among those supported in the kernelconfiguration (ima-ng is the default choice);
• specify a template descriptor name from the kernel command line throughtheima_template= parameter;
• register a new template descriptor with custom format through the kernelcommand line parameterima_template_fmt=.