函数逻辑报告

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:security\integrity\ima\ima_main.c Create Date:2022-07-27 21:59:33
Last Modify:2020-03-12 14:18:49 Copyright©Brick
首页 函数Tree
注解内核,赢得工具下载SCCTEnglish

函数名称：process_measurement

函数原型：static int process_measurement(struct file *file, const struct cred *cred, unsigned int secid, char *buf, loff_t size, int mask, enum ima_hooks func)

返回类型：int

参数：

类型参数名称
struct file *file
const struct cred *cred
unsigned intsecid
char *buf
loff_tsize
intmask
enum ima_hooksfunc
196  inode等于file_inode(file)
197  struct integrity_iint_cache * iint = NULL
198  struct ima_template_desc * template_desc = NULL
199  char * pathbuf = NULL
201  const char * pathname = NULL
202  rc等于0, must_appraise等于0
203  pcr等于CONFIG_IMA_MEASURE_PCR_IDX
204  struct evm_ima_xattr_data * xattr_value = NULL
205  struct modsig * modsig = NULL
206  xattr_len等于0
210  如果非current content of the policy 或非S_ISREG(i_mode)则返回:0
217  action等于LIM API function definitions
219  violation_check等于func恒等于FILE_CHECK或func恒等于MMAP_CHECK的值且current content of the policy 按位与 action cache flags
221  如果非action且非violation_check则返回:0
224  must_appraise等于action按位与IMA_APPRAISE
227  如果action按位与 subaction appraise cache flags 则func等于FILE_CHECK
230  inode_lock(inode)
232  如果action则
233  iint等于grity_inode_get - find or allocate an iint associated with an inode*@inode: pointer to the inode*@return: allocated iint* Caller must lock i_mutex
234  如果非iint则rc等于负ENOMEM
238  如果非rc且violation_check则ma_rdwr_violation_check* Only invalidate the PCR for measured files:* - Opening a file for write when already open for read,* results in a time of measure, time of use (ToMToU) error.* - Opening a file for read when already open for write,
242  inode_unlock(inode)
244  如果rc则转到:out
246  如果非action则转到:out
249  mutex_lock( & protects: version, flags, digest )
251  如果st_and_clear_bit - Clear a bit and return its old value*@nr: Bit to clear*@addr: Address to count from* This is an atomic fully-ordered operation (implied full memory barrier).则flags与等于IMA_APPRAISE按位或IMA_APPRAISED按位或IMA_APPRAISE_SUBMASK按位或IMA_APPRAISED_SUBMASK按位或 cache flags 的值的反
262  如果st_and_clear_bit - Clear a bit and return its old value*@nr: Bit to clear*@addr: Address to count from* This is an atomic fully-ordered operation (implied full memory barrier).或s_iflags按位与SB_I_IMA_UNVERIFIABLE_SIGNATURE且非s_iflags按位与SB_I_UNTRUSTED_MOUNTER的值且非action按位与IMA_FAIL_UNVERIFIABLE_SIGS的值则
266  flags与等于IMA_DONE_MASK的反
267  measured_pcrs等于0
274  flags或等于action
275  action与等于IMA_DO_MASK
276  action与等于flags按位与IMA_DONE_MASK按位异或IMA_MEASURED的值的值右移1位的值的反
279  如果action按位与 action cache flags 且measured_pcrs按位与0x1左移pcr位则action异或等于 action cache flags
283  如果action按位与IMA_HASH且非st_bit - Determine whether a bit is set*@nr: bit number to test*@addr: Address to start counting from则
285  xattr_len等于ima_read_xattr(file_dentry(file), & xattr_value)
286  如果xattr_value且xattr_len大于2且type恒等于EVM_IMA_XATTR_DIGSIG则设置内存位
289  flags或等于IMA_HASHED
290  action异或等于IMA_HASH
291  设置内存位
295  如果非action则
296  如果must_appraise则
297  rc等于Prevent mmap'ing a file execute that is already mmap'ed write
299  如果非rc则rc等于ima_get_cache_status(iint, func)
302  转到:out_locked
305  如果action按位与IMA_APPRAISE_SUBMASK或字符串比较不等于0则
308  xattr_len等于ima_read_xattr(file_dentry(file), & xattr_value)
315  如果flags按位与IMA_MODSIG_ALLOWED则
316  rc等于ima_read_modsig(func, buf, size, & modsig)
318  如果非rc且ima_template_has_modsig(template_desc)且flags按位与IMA_MEASURED则action或等于 action cache flags
324  hash_algo等于ima_get_hash_algo(xattr_value, xattr_len)
326  rc等于ma_collect_measurement - collect file measurement* Calculate the file hash, if it doesn't already exist,* storing the measurement and i_version in the iint.* Must be called with iint->mutex held.* Return 0 on success, error code otherwise
327  如果rc不等于0且rc不等于负EBADF且rc不等于负EINVAL则转到:out_locked
330  如果非pathbuf则pathname等于ima_d_path( & f_path, & pathbuf, filename)
333  如果action按位与 action cache flags 则ma_store_measurement - store file measurement* Create an "ima" template and then store the template by calling* ima_store_template
337  如果rc恒等于0且action按位与IMA_APPRAISE_SUBMASK则
338  rc等于ma_check_blacklist - determine if the binary is blacklisted.* Add the hash of the blacklisted binary to the measurement list, based* on policy.* Returns -EPERM if the hash is blacklisted.
339  如果rc不等于负EPERM则
340  inode_lock(inode)
341  rc等于ma_appraise_measurement - appraise file measurement* Call evm_verifyxattr() to verify the integrity of 'security.ima'.* Assuming success, compare the xattr hash with the collected measurement.* Return 0 on success, error code otherwise
344  inode_unlock(inode)
346  如果非rc则rc等于Prevent mmap'ing a file execute that is already mmap'ed write
350  如果action按位与IMA_AUDIT则ima_audit_measurement(iint, pathname)
353  如果f_flags按位与O_DIRECT且flags按位与IMA_PERMIT_DIRECTIO则rc等于0
355  out_locked :
356  如果mask按位与MAY_WRITE且st_bit - Determine whether a bit is set*@nr: bit number to test*@addr: Address to start counting from且非flags按位与IMA_NEW_FILE的值则rc等于负EACCES
359  mutex_unlock - release the mutex*@lock: the mutex to be released* Unlock a mutex that has been locked by this task previously.* This function must not be used in interrupt context. Unlocking* of a not locked mutex is not allowed.
360  释放内存
361  ima_free_modsig(modsig)
362  out :
363  如果pathbuf则__putname(pathbuf)
365  如果must_appraise则
366  如果rc且ima_appraise按位与Appraise integrity measurements 则返回:负EACCES
368  如果f_mode按位与le is open for writing 则设置内存位
371  返回:0
调用者
名称描述
ima_file_mmapma_file_mmap - based on policy, collect/store measurement.*@file: pointer to the file to be measured (May be NULL)*@prot: contains the protection that will be applied by the kernel.* Measure files being mmapped executable based on the ima_must_measure()
ima_bprm_checkma_bprm_check - based on policy, collect/store measurement.*@bprm: contains the linux_binprm structure* The OS protects against an executable file, already open for write,* from being executed in deny_write_access() and an executable file,
ima_file_checkma_path_check - based on policy, collect/store measurement.*@file: pointer to the file to be measured*@mask: contains MAY_READ, MAY_WRITE, MAY_EXEC or MAY_APPEND* Measure files based on the ima_must_measure() policy decision.* On success return 0
ima_post_read_filema_post_read_file - in memory collect/appraise/audit measurement*@file: pointer to the file to be measured/appraised/audit*@buf: pointer to in memory file contents*@size: size of in memory file contents*@read_id: caller identifier