1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0+
2*4882a593Smuzhiyun /*
3*4882a593Smuzhiyun * Copyright (C) 2019 Microsoft Corporation
4*4882a593Smuzhiyun *
5*4882a593Smuzhiyun * Author: Lakshmi Ramasubramanian (nramas@linux.microsoft.com)
6*4882a593Smuzhiyun *
7*4882a593Smuzhiyun * File: ima_asymmetric_keys.c
8*4882a593Smuzhiyun * Defines an IMA hook to measure asymmetric keys on key
9*4882a593Smuzhiyun * create or update.
10*4882a593Smuzhiyun */
11*4882a593Smuzhiyun
12*4882a593Smuzhiyun #include <keys/asymmetric-type.h>
13*4882a593Smuzhiyun #include "ima.h"
14*4882a593Smuzhiyun
15*4882a593Smuzhiyun /**
16*4882a593Smuzhiyun * ima_post_key_create_or_update - measure asymmetric keys
17*4882a593Smuzhiyun * @keyring: keyring to which the key is linked to
18*4882a593Smuzhiyun * @key: created or updated key
19*4882a593Smuzhiyun * @payload: The data used to instantiate or update the key.
20*4882a593Smuzhiyun * @payload_len: The length of @payload.
21*4882a593Smuzhiyun * @flags: key flags
22*4882a593Smuzhiyun * @create: flag indicating whether the key was created or updated
23*4882a593Smuzhiyun *
24*4882a593Smuzhiyun * Keys can only be measured, not appraised.
25*4882a593Smuzhiyun * The payload data used to instantiate or update the key is measured.
26*4882a593Smuzhiyun */
ima_post_key_create_or_update(struct key * keyring,struct key * key,const void * payload,size_t payload_len,unsigned long flags,bool create)27*4882a593Smuzhiyun void ima_post_key_create_or_update(struct key *keyring, struct key *key,
28*4882a593Smuzhiyun const void *payload, size_t payload_len,
29*4882a593Smuzhiyun unsigned long flags, bool create)
30*4882a593Smuzhiyun {
31*4882a593Smuzhiyun bool queued = false;
32*4882a593Smuzhiyun
33*4882a593Smuzhiyun /* Only asymmetric keys are handled by this hook. */
34*4882a593Smuzhiyun if (key->type != &key_type_asymmetric)
35*4882a593Smuzhiyun return;
36*4882a593Smuzhiyun
37*4882a593Smuzhiyun if (!payload || (payload_len == 0))
38*4882a593Smuzhiyun return;
39*4882a593Smuzhiyun
40*4882a593Smuzhiyun if (ima_should_queue_key())
41*4882a593Smuzhiyun queued = ima_queue_key(keyring, payload, payload_len);
42*4882a593Smuzhiyun
43*4882a593Smuzhiyun if (queued)
44*4882a593Smuzhiyun return;
45*4882a593Smuzhiyun
46*4882a593Smuzhiyun /*
47*4882a593Smuzhiyun * keyring->description points to the name of the keyring
48*4882a593Smuzhiyun * (such as ".builtin_trusted_keys", ".ima", etc.) to
49*4882a593Smuzhiyun * which the given key is linked to.
50*4882a593Smuzhiyun *
51*4882a593Smuzhiyun * The name of the keyring is passed in the "eventname"
52*4882a593Smuzhiyun * parameter to process_buffer_measurement() and is set
53*4882a593Smuzhiyun * in the "eventname" field in ima_event_data for
54*4882a593Smuzhiyun * the key measurement IMA event.
55*4882a593Smuzhiyun *
56*4882a593Smuzhiyun * The name of the keyring is also passed in the "keyring"
57*4882a593Smuzhiyun * parameter to process_buffer_measurement() to check
58*4882a593Smuzhiyun * if the IMA policy is configured to measure a key linked
59*4882a593Smuzhiyun * to the given keyring.
60*4882a593Smuzhiyun */
61*4882a593Smuzhiyun process_buffer_measurement(NULL, payload, payload_len,
62*4882a593Smuzhiyun keyring->description, KEY_CHECK, 0,
63*4882a593Smuzhiyun keyring->description);
64*4882a593Smuzhiyun }
65