Add kernel cmdline parameter for CCNP measurement

[ruomengh]

1. ima_template=ima-cgpath is required for CCNP measurement

[dongx1x]

LGTM.

[wenhuizhang]

Hi, @ruomengh ,

5.15 does not have some an option, I am evaluating how large the patch would be for this option.
Seems like not big patch, however need to validate with the 5.15 code.

Ref: https://patchwork.kernel.org/project/linux-integrity/patch/[email protected]/

~/linux-image-bsk/security/integrity/ima# vim ima_template.c

static struct ima_template_desc builtin_templates[] = {
        {.name = IMA_TEMPLATE_IMA_NAME, .fmt = IMA_TEMPLATE_IMA_FMT},
        {.name = "ima-ng", .fmt = "d-ng|n-ng"},
        {.name = "ima-sig", .fmt = "d-ng|n-ng|sig"},
        {.name = "ima-buf", .fmt = "d-ng|n-ng|buf"},
        {.name = "ima-modsig", .fmt = "d-ng|n-ng|sig|d-modsig|modsig"},
        {.name = "evm-sig",
         .fmt = "d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode"},
        {.name = "", .fmt = ""},        /* placeholder for a custom format */
};

[wenhuizhang]

Nor does 6.8-next

static struct [ima_template_desc](https://elixir.bootlin.com/linux/latest/C/ident/ima_template_desc) [builtin_templates](https://elixir.bootlin.com/linux/latest/C/ident/builtin_templates)[] = {
	{.name = [IMA_TEMPLATE_IMA_NAME](https://elixir.bootlin.com/linux/latest/C/ident/IMA_TEMPLATE_IMA_NAME), .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = [IMA_TEMPLATE_IMA_FMT](https://elixir.bootlin.com/linux/latest/C/ident/IMA_TEMPLATE_IMA_FMT)},
	{.name = "ima-ng", .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = "d-ng|n-ng"},
	{.name = "ima-sig", .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = "d-ng|n-ng|sig"},
	{.name = "ima-ngv2", .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = "d-ngv2|n-ng"},
	{.name = "ima-sigv2", .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = "d-ngv2|n-ng|sig"},
	{.name = "ima-buf", .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = "d-ng|n-ng|buf"},
	{.name = "ima-modsig", .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = "d-ng|n-ng|sig|d-modsig|modsig"},
	{.name = "evm-sig",
	 .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = "d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode"},
	{.name = "", .[fmt](https://elixir.bootlin.com/linux/latest/C/ident/fmt) = ""},	/* placeholder for a custom format */
};

[ruomengh]

Hi, @ruomengh ,

5.15 does not have some an option, I am evaluating how large the patch would be for this option. Seems like not big patch, however need to validate with the 5.15 code.

Ref: https://patchwork.kernel.org/project/linux-integrity/patch/[email protected]/

~/linux-image-bsk/security/integrity/ima# vim ima_template.c

static struct ima_template_desc builtin_templates[] = {
        {.name = IMA_TEMPLATE_IMA_NAME, .fmt = IMA_TEMPLATE_IMA_FMT},
        {.name = "ima-ng", .fmt = "d-ng|n-ng"},
        {.name = "ima-sig", .fmt = "d-ng|n-ng|sig"},
        {.name = "ima-buf", .fmt = "d-ng|n-ng|buf"},
        {.name = "ima-modsig", .fmt = "d-ng|n-ng|sig|d-modsig|modsig"},
        {.name = "evm-sig",
         .fmt = "d-ng|n-ng|evmsig|xattrnames|xattrlengths|xattrvalues|iuid|igid|imode"},
        {.name = "", .fmt = ""},        /* placeholder for a custom format */
};

This parameter is based on a separated kernel patch for container measurement. The patch will be put in the project later.