aboutsummaryrefslogtreecommitdiffstats
path: root/security/integrity/ima
diff options
context:
space:
mode:
Diffstat (limited to 'security/integrity/ima')
-rw-r--r--security/integrity/ima/Kconfig24
-rw-r--r--security/integrity/ima/Makefile4
-rw-r--r--security/integrity/ima/ima.h79
-rw-r--r--security/integrity/ima/ima_api.c101
-rw-r--r--security/integrity/ima/ima_appraise.c263
-rw-r--r--security/integrity/ima/ima_audit.c18
-rw-r--r--security/integrity/ima/ima_crypto.c8
-rw-r--r--security/integrity/ima/ima_fs.c13
-rw-r--r--security/integrity/ima/ima_init.c5
-rw-r--r--security/integrity/ima/ima_main.c179
-rw-r--r--security/integrity/ima/ima_policy.c221
11 files changed, 181 insertions, 734 deletions
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index d232c73647a..b6ecfd4d8d7 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -3,15 +3,13 @@
3config IMA 3config IMA
4 bool "Integrity Measurement Architecture(IMA)" 4 bool "Integrity Measurement Architecture(IMA)"
5 depends on SECURITY 5 depends on SECURITY
6 select INTEGRITY
7 select SECURITYFS 6 select SECURITYFS
8 select CRYPTO 7 select CRYPTO
9 select CRYPTO_HMAC 8 select CRYPTO_HMAC
10 select CRYPTO_MD5 9 select CRYPTO_MD5
11 select CRYPTO_SHA1 10 select CRYPTO_SHA1
12 select TCG_TPM if HAS_IOMEM && !UML 11 select TCG_TPM if !S390
13 select TCG_TIS if TCG_TPM && X86 12 select TCG_TIS if TCG_TPM
14 select TCG_IBMVTPM if TCG_TPM && PPC64
15 help 13 help
16 The Trusted Computing Group(TCG) runtime Integrity 14 The Trusted Computing Group(TCG) runtime Integrity
17 Measurement Architecture(IMA) maintains a list of hash 15 Measurement Architecture(IMA) maintains a list of hash
@@ -39,9 +37,8 @@ config IMA_MEASURE_PCR_IDX
39 measurement list. If unsure, use the default 10. 37 measurement list. If unsure, use the default 10.
40 38
41config IMA_AUDIT 39config IMA_AUDIT
42 bool "Enables auditing support" 40 bool
43 depends on IMA 41 depends on IMA
44 depends on AUDIT
45 default y 42 default y
46 help 43 help
47 This option adds a kernel parameter 'ima_audit', which 44 This option adds a kernel parameter 'ima_audit', which
@@ -56,18 +53,3 @@ config IMA_LSM_RULES
56 default y 53 default y
57 help 54 help
58 Disabling this option will disregard LSM based policy rules. 55 Disabling this option will disregard LSM based policy rules.
59
60config IMA_APPRAISE
61 bool "Appraise integrity measurements"
62 depends on IMA
63 default n
64 help
65 This option enables local measurement integrity appraisal.
66 It requires the system to be labeled with a security extended
67 attribute containing the file hash measurement. To protect
68 the security extended attributes from offline attack, enable
69 and configure EVM.
70
71 For more information on integrity appraisal refer to:
72 <http://linux-ima.sourceforge.net>
73 If unsure, say N.
diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile
index 3f2ca6bdc38..787c4cb916c 100644
--- a/security/integrity/ima/Makefile
+++ b/security/integrity/ima/Makefile
@@ -6,6 +6,4 @@
6obj-$(CONFIG_IMA) += ima.o 6obj-$(CONFIG_IMA) += ima.o
7 7
8ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \ 8ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
9 ima_policy.o 9 ima_policy.o ima_iint.o ima_audit.o
10ima-$(CONFIG_IMA_AUDIT) += ima_audit.o
11ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 079a85dc37b..08408bd7146 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -24,23 +24,21 @@
24#include <linux/tpm.h> 24#include <linux/tpm.h>
25#include <linux/audit.h> 25#include <linux/audit.h>
26 26
27#include "../integrity.h"
28
29enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_ASCII }; 27enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_ASCII };
30enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; 28enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
31 29
32/* digest size for IMA, fits SHA1 or MD5 */ 30/* digest size for IMA, fits SHA1 or MD5 */
33#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE 31#define IMA_DIGEST_SIZE 20
34#define IMA_EVENT_NAME_LEN_MAX 255 32#define IMA_EVENT_NAME_LEN_MAX 255
35 33
36#define IMA_HASH_BITS 9 34#define IMA_HASH_BITS 9
37#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS) 35#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
38 36
39/* set during initialization */ 37/* set during initialization */
38extern int iint_initialized;
40extern int ima_initialized; 39extern int ima_initialized;
41extern int ima_used_chip; 40extern int ima_used_chip;
42extern char *ima_hash; 41extern char *ima_hash;
43extern int ima_appraise;
44 42
45/* IMA inode template definition */ 43/* IMA inode template definition */
46struct ima_template_data { 44struct ima_template_data {
@@ -62,19 +60,10 @@ struct ima_queue_entry {
62}; 60};
63extern struct list_head ima_measurements; /* list of all measurements */ 61extern struct list_head ima_measurements; /* list of all measurements */
64 62
65#ifdef CONFIG_IMA_AUDIT
66/* declarations */ 63/* declarations */
67void integrity_audit_msg(int audit_msgno, struct inode *inode, 64void integrity_audit_msg(int audit_msgno, struct inode *inode,
68 const unsigned char *fname, const char *op, 65 const unsigned char *fname, const char *op,
69 const char *cause, int result, int info); 66 const char *cause, int result, int info);
70#else
71static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
72 const unsigned char *fname,
73 const char *op, const char *cause,
74 int result, int info)
75{
76}
77#endif
78 67
79/* Internal IMA function definitions */ 68/* Internal IMA function definitions */
80int ima_init(void); 69int ima_init(void);
@@ -107,66 +96,44 @@ static inline unsigned long ima_hash_key(u8 *digest)
107 return hash_long(*digest, IMA_HASH_BITS); 96 return hash_long(*digest, IMA_HASH_BITS);
108} 97}
109 98
99/* iint cache flags */
100#define IMA_MEASURED 0x01
101
102/* integrity data associated with an inode */
103struct ima_iint_cache {
104 struct rb_node rb_node; /* rooted in ima_iint_tree */
105 struct inode *inode; /* back pointer to inode in question */
106 u64 version; /* track inode changes */
107 unsigned char flags;
108 u8 digest[IMA_DIGEST_SIZE];
109 struct mutex mutex; /* protects: version, flags, digest */
110};
111
110/* LIM API function definitions */ 112/* LIM API function definitions */
111int ima_get_action(struct inode *inode, int mask, int function);
112int ima_must_measure(struct inode *inode, int mask, int function); 113int ima_must_measure(struct inode *inode, int mask, int function);
113int ima_collect_measurement(struct integrity_iint_cache *iint, 114int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file);
114 struct file *file); 115void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
115void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
116 const unsigned char *filename);
117void ima_audit_measurement(struct integrity_iint_cache *iint,
118 const unsigned char *filename); 116 const unsigned char *filename);
119int ima_store_template(struct ima_template_entry *entry, int violation, 117int ima_store_template(struct ima_template_entry *entry, int violation,
120 struct inode *inode); 118 struct inode *inode);
121void ima_template_show(struct seq_file *m, void *e, enum ima_show_type show); 119void ima_template_show(struct seq_file *m, void *e,
120 enum ima_show_type show);
122 121
123/* rbtree tree calls to lookup, insert, delete 122/* rbtree tree calls to lookup, insert, delete
124 * integrity data associated with an inode. 123 * integrity data associated with an inode.
125 */ 124 */
126struct integrity_iint_cache *integrity_iint_insert(struct inode *inode); 125struct ima_iint_cache *ima_iint_insert(struct inode *inode);
127struct integrity_iint_cache *integrity_iint_find(struct inode *inode); 126struct ima_iint_cache *ima_iint_find(struct inode *inode);
128 127
129/* IMA policy related functions */ 128/* IMA policy related functions */
130enum ima_hooks { FILE_CHECK = 1, FILE_MMAP, BPRM_CHECK, MODULE_CHECK, POST_SETATTR }; 129enum ima_hooks { FILE_CHECK = 1, FILE_MMAP, BPRM_CHECK };
131 130
132int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, 131int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask);
133 int flags);
134void ima_init_policy(void); 132void ima_init_policy(void);
135void ima_update_policy(void); 133void ima_update_policy(void);
136ssize_t ima_parse_add_rule(char *); 134ssize_t ima_parse_add_rule(char *);
137void ima_delete_rules(void); 135void ima_delete_rules(void);
138 136
139/* Appraise integrity measurements */
140#define IMA_APPRAISE_ENFORCE 0x01
141#define IMA_APPRAISE_FIX 0x02
142#define IMA_APPRAISE_MODULES 0x04
143
144#ifdef CONFIG_IMA_APPRAISE
145int ima_appraise_measurement(struct integrity_iint_cache *iint,
146 struct file *file, const unsigned char *filename);
147int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
148void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
149
150#else
151static inline int ima_appraise_measurement(struct integrity_iint_cache *iint,
152 struct file *file,
153 const unsigned char *filename)
154{
155 return INTEGRITY_UNKNOWN;
156}
157
158static inline int ima_must_appraise(struct inode *inode, int mask,
159 enum ima_hooks func)
160{
161 return 0;
162}
163
164static inline void ima_update_xattr(struct integrity_iint_cache *iint,
165 struct file *file)
166{
167}
168#endif
169
170/* LSM based policy rules require audit */ 137/* LSM based policy rules require audit */
171#ifdef CONFIG_IMA_LSM_RULES 138#ifdef CONFIG_IMA_LSM_RULES
172 139
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 0cea3db2165..5335605571f 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -9,17 +9,13 @@
9 * License. 9 * License.
10 * 10 *
11 * File: ima_api.c 11 * File: ima_api.c
12 * Implements must_appraise_or_measure, collect_measurement, 12 * Implements must_measure, collect_measurement, store_measurement,
13 * appraise_measurement, store_measurement and store_template. 13 * and store_template.
14 */ 14 */
15#include <linux/module.h> 15#include <linux/module.h>
16#include <linux/slab.h> 16#include <linux/slab.h>
17#include <linux/file.h>
18#include <linux/fs.h>
19#include <linux/xattr.h>
20#include <linux/evm.h>
21#include "ima.h"
22 17
18#include "ima.h"
23static const char *IMA_TEMPLATE_NAME = "ima"; 19static const char *IMA_TEMPLATE_NAME = "ima";
24 20
25/* 21/*
@@ -97,34 +93,27 @@ err_out:
97} 93}
98 94
99/** 95/**
100 * ima_get_action - appraise & measure decision based on policy. 96 * ima_must_measure - measure decision based on policy.
101 * @inode: pointer to inode to measure 97 * @inode: pointer to inode to measure
102 * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE) 98 * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE)
103 * @function: calling function (FILE_CHECK, BPRM_CHECK, FILE_MMAP, MODULE_CHECK) 99 * @function: calling function (FILE_CHECK, BPRM_CHECK, FILE_MMAP)
104 * 100 *
105 * The policy is defined in terms of keypairs: 101 * The policy is defined in terms of keypairs:
106 * subj=, obj=, type=, func=, mask=, fsmagic= 102 * subj=, obj=, type=, func=, mask=, fsmagic=
107 * subj,obj, and type: are LSM specific. 103 * subj,obj, and type: are LSM specific.
108 * func: FILE_CHECK | BPRM_CHECK | FILE_MMAP | MODULE_CHECK 104 * func: FILE_CHECK | BPRM_CHECK | FILE_MMAP
109 * mask: contains the permission mask 105 * mask: contains the permission mask
110 * fsmagic: hex value 106 * fsmagic: hex value
111 * 107 *
112 * Returns IMA_MEASURE, IMA_APPRAISE mask. 108 * Return 0 to measure. For matching a DONT_MEASURE policy, no policy,
113 * 109 * or other error, return an error code.
114 */ 110*/
115int ima_get_action(struct inode *inode, int mask, int function)
116{
117 int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE;
118
119 if (!ima_appraise)
120 flags &= ~IMA_APPRAISE;
121
122 return ima_match_policy(inode, function, mask, flags);
123}
124
125int ima_must_measure(struct inode *inode, int mask, int function) 111int ima_must_measure(struct inode *inode, int mask, int function)
126{ 112{
127 return ima_match_policy(inode, function, mask, IMA_MEASURE); 113 int must_measure;
114
115 must_measure = ima_match_policy(inode, function, mask);
116 return must_measure ? 0 : -EACCES;
128} 117}
129 118
130/* 119/*
@@ -137,27 +126,18 @@ int ima_must_measure(struct inode *inode, int mask, int function)
137 * 126 *
138 * Return 0 on success, error code otherwise 127 * Return 0 on success, error code otherwise
139 */ 128 */
140int ima_collect_measurement(struct integrity_iint_cache *iint, 129int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file)
141 struct file *file)
142{ 130{
143 struct inode *inode = file->f_dentry->d_inode; 131 int result = -EEXIST;
144 const char *filename = file->f_dentry->d_name.name;
145 int result = 0;
146 132
147 if (!(iint->flags & IMA_COLLECTED)) { 133 if (!(iint->flags & IMA_MEASURED)) {
148 u64 i_version = file->f_dentry->d_inode->i_version; 134 u64 i_version = file->f_dentry->d_inode->i_version;
149 135
150 iint->ima_xattr.type = IMA_XATTR_DIGEST; 136 memset(iint->digest, 0, IMA_DIGEST_SIZE);
151 result = ima_calc_hash(file, iint->ima_xattr.digest); 137 result = ima_calc_hash(file, iint->digest);
152 if (!result) { 138 if (!result)
153 iint->version = i_version; 139 iint->version = i_version;
154 iint->flags |= IMA_COLLECTED;
155 }
156 } 140 }
157 if (result)
158 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
159 filename, "collect_data", "failed",
160 result, 0);
161 return result; 141 return result;
162} 142}
163 143
@@ -176,8 +156,8 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
176 * 156 *
177 * Must be called with iint->mutex held. 157 * Must be called with iint->mutex held.
178 */ 158 */
179void ima_store_measurement(struct integrity_iint_cache *iint, 159void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
180 struct file *file, const unsigned char *filename) 160 const unsigned char *filename)
181{ 161{
182 const char *op = "add_template_measure"; 162 const char *op = "add_template_measure";
183 const char *audit_cause = "ENOMEM"; 163 const char *audit_cause = "ENOMEM";
@@ -186,9 +166,6 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
186 struct ima_template_entry *entry; 166 struct ima_template_entry *entry;
187 int violation = 0; 167 int violation = 0;
188 168
189 if (iint->flags & IMA_MEASURED)
190 return;
191
192 entry = kmalloc(sizeof(*entry), GFP_KERNEL); 169 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
193 if (!entry) { 170 if (!entry) {
194 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, 171 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
@@ -196,10 +173,8 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
196 return; 173 return;
197 } 174 }
198 memset(&entry->template, 0, sizeof(entry->template)); 175 memset(&entry->template, 0, sizeof(entry->template));
199 memcpy(entry->template.digest, iint->ima_xattr.digest, IMA_DIGEST_SIZE); 176 memcpy(entry->template.digest, iint->digest, IMA_DIGEST_SIZE);
200 strcpy(entry->template.file_name, 177 strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
201 (strlen(filename) > IMA_EVENT_NAME_LEN_MAX) ?
202 file->f_dentry->d_name.name : filename);
203 178
204 result = ima_store_template(entry, violation, inode); 179 result = ima_store_template(entry, violation, inode);
205 if (!result || result == -EEXIST) 180 if (!result || result == -EEXIST)
@@ -207,33 +182,3 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
207 if (result < 0) 182 if (result < 0)
208 kfree(entry); 183 kfree(entry);
209} 184}
210
211void ima_audit_measurement(struct integrity_iint_cache *iint,
212 const unsigned char *filename)
213{
214 struct audit_buffer *ab;
215 char hash[(IMA_DIGEST_SIZE * 2) + 1];
216 int i;
217
218 if (iint->flags & IMA_AUDITED)
219 return;
220
221 for (i = 0; i < IMA_DIGEST_SIZE; i++)
222 hex_byte_pack(hash + (i * 2), iint->ima_xattr.digest[i]);
223 hash[i * 2] = '\0';
224
225 ab = audit_log_start(current->audit_context, GFP_KERNEL,
226 AUDIT_INTEGRITY_RULE);
227 if (!ab)
228 return;
229
230 audit_log_format(ab, "file=");
231 audit_log_untrustedstring(ab, filename);
232 audit_log_format(ab, " hash=");
233 audit_log_untrustedstring(ab, hash);
234
235 audit_log_task_info(ab, current);
236 audit_log_end(ab);
237
238 iint->flags |= IMA_AUDITED;
239}
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
deleted file mode 100644
index bdc8ba1d1d2..00000000000
--- a/security/integrity/ima/ima_appraise.c
+++ /dev/null
@@ -1,263 +0,0 @@
1/*
2 * Copyright (C) 2011 IBM Corporation
3 *
4 * Author:
5 * Mimi Zohar <zohar@us.ibm.com>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation, version 2 of the License.
10 */
11#include <linux/module.h>
12#include <linux/file.h>
13#include <linux/fs.h>
14#include <linux/xattr.h>
15#include <linux/magic.h>
16#include <linux/ima.h>
17#include <linux/evm.h>
18
19#include "ima.h"
20
21static int __init default_appraise_setup(char *str)
22{
23 if (strncmp(str, "off", 3) == 0)
24 ima_appraise = 0;
25 else if (strncmp(str, "fix", 3) == 0)
26 ima_appraise = IMA_APPRAISE_FIX;
27 return 1;
28}
29
30__setup("ima_appraise=", default_appraise_setup);
31
32/*
33 * ima_must_appraise - set appraise flag
34 *
35 * Return 1 to appraise
36 */
37int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
38{
39 if (!ima_appraise)
40 return 0;
41
42 return ima_match_policy(inode, func, mask, IMA_APPRAISE);
43}
44
45static void ima_fix_xattr(struct dentry *dentry,
46 struct integrity_iint_cache *iint)
47{
48 iint->ima_xattr.type = IMA_XATTR_DIGEST;
49 __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA, (u8 *)&iint->ima_xattr,
50 sizeof iint->ima_xattr, 0);
51}
52
53/*
54 * ima_appraise_measurement - appraise file measurement
55 *
56 * Call evm_verifyxattr() to verify the integrity of 'security.ima'.
57 * Assuming success, compare the xattr hash with the collected measurement.
58 *
59 * Return 0 on success, error code otherwise
60 */
61int ima_appraise_measurement(struct integrity_iint_cache *iint,
62 struct file *file, const unsigned char *filename)
63{
64 struct dentry *dentry = file->f_dentry;
65 struct inode *inode = dentry->d_inode;
66 struct evm_ima_xattr_data *xattr_value = NULL;
67 enum integrity_status status = INTEGRITY_UNKNOWN;
68 const char *op = "appraise_data";
69 char *cause = "unknown";
70 int rc;
71
72 if (!ima_appraise)
73 return 0;
74 if (!inode->i_op->getxattr)
75 return INTEGRITY_UNKNOWN;
76
77 if (iint->flags & IMA_APPRAISED)
78 return iint->ima_status;
79
80 rc = vfs_getxattr_alloc(dentry, XATTR_NAME_IMA, (char **)&xattr_value,
81 0, GFP_NOFS);
82 if (rc <= 0) {
83 if (rc && rc != -ENODATA)
84 goto out;
85
86 cause = "missing-hash";
87 status =
88 (inode->i_size == 0) ? INTEGRITY_PASS : INTEGRITY_NOLABEL;
89 goto out;
90 }
91
92 status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);
93 if ((status != INTEGRITY_PASS) && (status != INTEGRITY_UNKNOWN)) {
94 if ((status == INTEGRITY_NOLABEL)
95 || (status == INTEGRITY_NOXATTRS))
96 cause = "missing-HMAC";
97 else if (status == INTEGRITY_FAIL)
98 cause = "invalid-HMAC";
99 goto out;
100 }
101
102 switch (xattr_value->type) {
103 case IMA_XATTR_DIGEST:
104 rc = memcmp(xattr_value->digest, iint->ima_xattr.digest,
105 IMA_DIGEST_SIZE);
106 if (rc) {
107 cause = "invalid-hash";
108 status = INTEGRITY_FAIL;
109 print_hex_dump_bytes("security.ima: ", DUMP_PREFIX_NONE,
110 xattr_value, sizeof(*xattr_value));
111 print_hex_dump_bytes("collected: ", DUMP_PREFIX_NONE,
112 (u8 *)&iint->ima_xattr,
113 sizeof iint->ima_xattr);
114 break;
115 }
116 status = INTEGRITY_PASS;
117 break;
118 case EVM_IMA_XATTR_DIGSIG:
119 iint->flags |= IMA_DIGSIG;
120 rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
121 xattr_value->digest, rc - 1,
122 iint->ima_xattr.digest,
123 IMA_DIGEST_SIZE);
124 if (rc == -EOPNOTSUPP) {
125 status = INTEGRITY_UNKNOWN;
126 } else if (rc) {
127 cause = "invalid-signature";
128 status = INTEGRITY_FAIL;
129 } else {
130 status = INTEGRITY_PASS;
131 }
132 break;
133 default:
134 status = INTEGRITY_UNKNOWN;
135 cause = "unknown-ima-data";
136 break;
137 }
138
139out:
140 if (status != INTEGRITY_PASS) {
141 if ((ima_appraise & IMA_APPRAISE_FIX) &&
142 (!xattr_value ||
143 xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
144 ima_fix_xattr(dentry, iint);
145 status = INTEGRITY_PASS;
146 }
147 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
148 op, cause, rc, 0);
149 } else {
150 iint->flags |= IMA_APPRAISED;
151 }
152 iint->ima_status = status;
153 kfree(xattr_value);
154 return status;
155}
156
157/*
158 * ima_update_xattr - update 'security.ima' hash value
159 */
160void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
161{
162 struct dentry *dentry = file->f_dentry;
163 int rc = 0;
164
165 /* do not collect and update hash for digital signatures */
166 if (iint->flags & IMA_DIGSIG)
167 return;
168
169 rc = ima_collect_measurement(iint, file);
170 if (rc < 0)
171 return;
172
173 ima_fix_xattr(dentry, iint);
174}
175
176/**
177 * ima_inode_post_setattr - reflect file metadata changes
178 * @dentry: pointer to the affected dentry
179 *
180 * Changes to a dentry's metadata might result in needing to appraise.
181 *
182 * This function is called from notify_change(), which expects the caller
183 * to lock the inode's i_mutex.
184 */
185void ima_inode_post_setattr(struct dentry *dentry)
186{
187 struct inode *inode = dentry->d_inode;
188 struct integrity_iint_cache *iint;
189 int must_appraise, rc;
190
191 if (!ima_initialized || !ima_appraise || !S_ISREG(inode->i_mode)
192 || !inode->i_op->removexattr)
193 return;
194
195 must_appraise = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
196 iint = integrity_iint_find(inode);
197 if (iint) {
198 if (must_appraise)
199 iint->flags |= IMA_APPRAISE;
200 else
201 iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED);
202 }
203 if (!must_appraise)
204 rc = inode->i_op->removexattr(dentry, XATTR_NAME_IMA);
205 return;
206}
207
208/*
209 * ima_protect_xattr - protect 'security.ima'
210 *
211 * Ensure that not just anyone can modify or remove 'security.ima'.
212 */
213static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
214 const void *xattr_value, size_t xattr_value_len)
215{
216 if (strcmp(xattr_name, XATTR_NAME_IMA) == 0) {
217 if (!capable(CAP_SYS_ADMIN))
218 return -EPERM;
219 return 1;
220 }
221 return 0;
222}
223
224static void ima_reset_appraise_flags(struct inode *inode)
225{
226 struct integrity_iint_cache *iint;
227
228 if (!ima_initialized || !ima_appraise || !S_ISREG(inode->i_mode))
229 return;
230
231 iint = integrity_iint_find(inode);
232 if (!iint)
233 return;
234
235 iint->flags &= ~IMA_DONE_MASK;
236 return;
237}
238
239int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
240 const void *xattr_value, size_t xattr_value_len)
241{
242 int result;
243
244 result = ima_protect_xattr(dentry, xattr_name, xattr_value,
245 xattr_value_len);
246 if (result == 1) {
247 ima_reset_appraise_flags(dentry->d_inode);
248 result = 0;
249 }
250 return result;
251}
252
253int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name)
254{
255 int result;
256
257 result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
258 if (result == 1) {
259 ima_reset_appraise_flags(dentry->d_inode);
260 result = 0;
261 }
262 return result;
263}
diff --git a/security/integrity/ima/ima_audit.c b/security/integrity/ima/ima_audit.c
index c586faae8fd..c5c5a72c30b 100644
--- a/security/integrity/ima/ima_audit.c
+++ b/security/integrity/ima/ima_audit.c
@@ -17,6 +17,8 @@
17 17
18static int ima_audit; 18static int ima_audit;
19 19
20#ifdef CONFIG_IMA_AUDIT
21
20/* ima_audit_setup - enable informational auditing messages */ 22/* ima_audit_setup - enable informational auditing messages */
21static int __init ima_audit_setup(char *str) 23static int __init ima_audit_setup(char *str)
22{ 24{
@@ -27,6 +29,7 @@ static int __init ima_audit_setup(char *str)
27 return 1; 29 return 1;
28} 30}
29__setup("ima_audit=", ima_audit_setup); 31__setup("ima_audit=", ima_audit_setup);
32#endif
30 33
31void integrity_audit_msg(int audit_msgno, struct inode *inode, 34void integrity_audit_msg(int audit_msgno, struct inode *inode,
32 const unsigned char *fname, const char *op, 35 const unsigned char *fname, const char *op,
@@ -39,9 +42,8 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
39 42
40 ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno); 43 ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);
41 audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u", 44 audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u",
42 current->pid, 45 current->pid, current_cred()->uid,
43 from_kuid(&init_user_ns, current_cred()->uid), 46 audit_get_loginuid(current),
44 from_kuid(&init_user_ns, audit_get_loginuid(current)),
45 audit_get_sessionid(current)); 47 audit_get_sessionid(current));
46 audit_log_task_context(ab); 48 audit_log_task_context(ab);
47 audit_log_format(ab, " op="); 49 audit_log_format(ab, " op=");
@@ -54,11 +56,9 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
54 audit_log_format(ab, " name="); 56 audit_log_format(ab, " name=");
55 audit_log_untrustedstring(ab, fname); 57 audit_log_untrustedstring(ab, fname);
56 } 58 }
57 if (inode) { 59 if (inode)
58 audit_log_format(ab, " dev="); 60 audit_log_format(ab, " dev=%s ino=%lu",
59 audit_log_untrustedstring(ab, inode->i_sb->s_id); 61 inode->i_sb->s_id, inode->i_ino);
60 audit_log_format(ab, " ino=%lu", inode->i_ino); 62 audit_log_format(ab, " res=%d", !result ? 0 : 1);
61 }
62 audit_log_format(ab, " res=%d", !result);
63 audit_log_end(ab); 63 audit_log_end(ab);
64} 64}
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index b21ee5b5495..9b3ade7468b 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -48,7 +48,7 @@ int ima_calc_hash(struct file *file, char *digest)
48 struct scatterlist sg[1]; 48 struct scatterlist sg[1];
49 loff_t i_size, offset = 0; 49 loff_t i_size, offset = 0;
50 char *rbuf; 50 char *rbuf;
51 int rc, read = 0; 51 int rc;
52 52
53 rc = init_desc(&desc); 53 rc = init_desc(&desc);
54 if (rc != 0) 54 if (rc != 0)
@@ -59,10 +59,6 @@ int ima_calc_hash(struct file *file, char *digest)
59 rc = -ENOMEM; 59 rc = -ENOMEM;
60 goto out; 60 goto out;
61 } 61 }
62 if (!(file->f_mode & FMODE_READ)) {
63 file->f_mode |= FMODE_READ;
64 read = 1;
65 }
66 i_size = i_size_read(file->f_dentry->d_inode); 62 i_size = i_size_read(file->f_dentry->d_inode);
67 while (offset < i_size) { 63 while (offset < i_size) {
68 int rbuf_len; 64 int rbuf_len;
@@ -84,8 +80,6 @@ int ima_calc_hash(struct file *file, char *digest)
84 kfree(rbuf); 80 kfree(rbuf);
85 if (!rc) 81 if (!rc)
86 rc = crypto_hash_final(&desc, digest); 82 rc = crypto_hash_final(&desc, digest);
87 if (read)
88 file->f_mode &= ~FMODE_READ;
89out: 83out:
90 crypto_free_hash(desc.tfm); 84 crypto_free_hash(desc.tfm);
91 return rc; 85 return rc;
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 38477c9c341..ef21b96a0b4 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -287,7 +287,7 @@ static atomic_t policy_opencount = ATOMIC_INIT(1);
287/* 287/*
288 * ima_open_policy: sequentialize access to the policy file 288 * ima_open_policy: sequentialize access to the policy file
289 */ 289 */
290static int ima_open_policy(struct inode * inode, struct file * filp) 290int ima_open_policy(struct inode * inode, struct file * filp)
291{ 291{
292 /* No point in being allowed to open it if you aren't going to write */ 292 /* No point in being allowed to open it if you aren't going to write */
293 if (!(filp->f_flags & O_WRONLY)) 293 if (!(filp->f_flags & O_WRONLY))
@@ -367,7 +367,6 @@ int __init ima_fs_init(void)
367 367
368 return 0; 368 return 0;
369out: 369out:
370 securityfs_remove(violations);
371 securityfs_remove(runtime_measurements_count); 370 securityfs_remove(runtime_measurements_count);
372 securityfs_remove(ascii_runtime_measurements); 371 securityfs_remove(ascii_runtime_measurements);
373 securityfs_remove(binary_runtime_measurements); 372 securityfs_remove(binary_runtime_measurements);
@@ -375,3 +374,13 @@ out:
375 securityfs_remove(ima_policy); 374 securityfs_remove(ima_policy);
376 return -1; 375 return -1;
377} 376}
377
378void __exit ima_fs_cleanup(void)
379{
380 securityfs_remove(violations);
381 securityfs_remove(runtime_measurements_count);
382 securityfs_remove(ascii_runtime_measurements);
383 securityfs_remove(binary_runtime_measurements);
384 securityfs_remove(ima_dir);
385 securityfs_remove(ima_policy);
386}
diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
index b5dfd534f13..17f1f060306 100644
--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c
@@ -90,3 +90,8 @@ int __init ima_init(void)
90 90
91 return ima_fs_init(); 91 return ima_fs_init();
92} 92}
93
94void __exit ima_cleanup(void)
95{
96 ima_fs_cleanup();
97}
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index dba965de90d..26b46ff7466 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -22,19 +22,11 @@
22#include <linux/mount.h> 22#include <linux/mount.h>
23#include <linux/mman.h> 23#include <linux/mman.h>
24#include <linux/slab.h> 24#include <linux/slab.h>
25#include <linux/xattr.h>
26#include <linux/ima.h>
27 25
28#include "ima.h" 26#include "ima.h"
29 27
30int ima_initialized; 28int ima_initialized;
31 29
32#ifdef CONFIG_IMA_APPRAISE
33int ima_appraise = IMA_APPRAISE_ENFORCE;
34#else
35int ima_appraise;
36#endif
37
38char *ima_hash = "sha1"; 30char *ima_hash = "sha1";
39static int __init hash_setup(char *str) 31static int __init hash_setup(char *str)
40{ 32{
@@ -59,9 +51,8 @@ static void ima_rdwr_violation_check(struct file *file)
59 struct dentry *dentry = file->f_path.dentry; 51 struct dentry *dentry = file->f_path.dentry;
60 struct inode *inode = dentry->d_inode; 52 struct inode *inode = dentry->d_inode;
61 fmode_t mode = file->f_mode; 53 fmode_t mode = file->f_mode;
62 int must_measure; 54 int rc;
63 bool send_tomtou = false, send_writers = false; 55 bool send_tomtou = false, send_writers = false;
64 unsigned char *pathname = NULL, *pathbuf = NULL;
65 56
66 if (!S_ISREG(inode->i_mode) || !ima_initialized) 57 if (!S_ISREG(inode->i_mode) || !ima_initialized)
67 return; 58 return;
@@ -74,8 +65,8 @@ static void ima_rdwr_violation_check(struct file *file)
74 goto out; 65 goto out;
75 } 66 }
76 67
77 must_measure = ima_must_measure(inode, MAY_READ, FILE_CHECK); 68 rc = ima_must_measure(inode, MAY_READ, FILE_CHECK);
78 if (!must_measure) 69 if (rc < 0)
79 goto out; 70 goto out;
80 71
81 if (atomic_read(&inode->i_writecount) > 0) 72 if (atomic_read(&inode->i_writecount) > 0)
@@ -83,45 +74,26 @@ static void ima_rdwr_violation_check(struct file *file)
83out: 74out:
84 mutex_unlock(&inode->i_mutex); 75 mutex_unlock(&inode->i_mutex);
85 76
86 if (!send_tomtou && !send_writers)
87 return;
88
89 /* We will allow 11 spaces for ' (deleted)' to be appended */
90 pathbuf = kmalloc(PATH_MAX + 11, GFP_KERNEL);
91 if (pathbuf) {
92 pathname = d_path(&file->f_path, pathbuf, PATH_MAX + 11);
93 if (IS_ERR(pathname))
94 pathname = NULL;
95 else if (strlen(pathname) > IMA_EVENT_NAME_LEN_MAX)
96 pathname = NULL;
97 }
98 if (send_tomtou) 77 if (send_tomtou)
99 ima_add_violation(inode, 78 ima_add_violation(inode, dentry->d_name.name, "invalid_pcr",
100 !pathname ? dentry->d_name.name : pathname, 79 "ToMToU");
101 "invalid_pcr", "ToMToU");
102 if (send_writers) 80 if (send_writers)
103 ima_add_violation(inode, 81 ima_add_violation(inode, dentry->d_name.name, "invalid_pcr",
104 !pathname ? dentry->d_name.name : pathname, 82 "open_writers");
105 "invalid_pcr", "open_writers");
106 kfree(pathbuf);
107} 83}
108 84
109static void ima_check_last_writer(struct integrity_iint_cache *iint, 85static void ima_check_last_writer(struct ima_iint_cache *iint,
110 struct inode *inode, struct file *file) 86 struct inode *inode,
87 struct file *file)
111{ 88{
112 fmode_t mode = file->f_mode; 89 fmode_t mode = file->f_mode;
113 90
114 if (!(mode & FMODE_WRITE)) 91 mutex_lock(&iint->mutex);
115 return; 92 if (mode & FMODE_WRITE &&
116 93 atomic_read(&inode->i_writecount) == 1 &&
117 mutex_lock(&inode->i_mutex); 94 iint->version != inode->i_version)
118 if (atomic_read(&inode->i_writecount) == 1 && 95 iint->flags &= ~IMA_MEASURED;
119 iint->version != inode->i_version) { 96 mutex_unlock(&iint->mutex);
120 iint->flags &= ~IMA_DONE_MASK;
121 if (iint->flags & IMA_APPRAISE)
122 ima_update_xattr(iint, file);
123 }
124 mutex_unlock(&inode->i_mutex);
125} 97}
126 98
127/** 99/**
@@ -133,12 +105,12 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
133void ima_file_free(struct file *file) 105void ima_file_free(struct file *file)
134{ 106{
135 struct inode *inode = file->f_dentry->d_inode; 107 struct inode *inode = file->f_dentry->d_inode;
136 struct integrity_iint_cache *iint; 108 struct ima_iint_cache *iint;
137 109
138 if (!iint_initialized || !S_ISREG(inode->i_mode)) 110 if (!iint_initialized || !S_ISREG(inode->i_mode))
139 return; 111 return;
140 112
141 iint = integrity_iint_find(inode); 113 iint = ima_iint_find(inode);
142 if (!iint) 114 if (!iint)
143 return; 115 return;
144 116
@@ -149,66 +121,36 @@ static int process_measurement(struct file *file, const unsigned char *filename,
149 int mask, int function) 121 int mask, int function)
150{ 122{
151 struct inode *inode = file->f_dentry->d_inode; 123 struct inode *inode = file->f_dentry->d_inode;
152 struct integrity_iint_cache *iint; 124 struct ima_iint_cache *iint;
153 unsigned char *pathname = NULL, *pathbuf = NULL; 125 int rc = 0;
154 int rc = -ENOMEM, action, must_appraise;
155 126
156 if (!ima_initialized || !S_ISREG(inode->i_mode)) 127 if (!ima_initialized || !S_ISREG(inode->i_mode))
157 return 0; 128 return 0;
158 129
159 /* Determine if in appraise/audit/measurement policy, 130 rc = ima_must_measure(inode, mask, function);
160 * returns IMA_MEASURE, IMA_APPRAISE, IMA_AUDIT bitmask. */ 131 if (rc != 0)
161 action = ima_get_action(inode, mask, function); 132 return rc;
162 if (!action) 133retry:
163 return 0; 134 iint = ima_iint_find(inode);
164 135 if (!iint) {
165 must_appraise = action & IMA_APPRAISE; 136 rc = ima_inode_alloc(inode);
166 137 if (!rc || rc == -EEXIST)
167 mutex_lock(&inode->i_mutex); 138 goto retry;
168 139 return rc;
169 iint = integrity_inode_get(inode);
170 if (!iint)
171 goto out;
172
173 /* Determine if already appraised/measured based on bitmask
174 * (IMA_MEASURE, IMA_MEASURED, IMA_APPRAISE, IMA_APPRAISED,
175 * IMA_AUDIT, IMA_AUDITED) */
176 iint->flags |= action;
177 action &= ~((iint->flags & IMA_DONE_MASK) >> 1);
178
179 /* Nothing to do, just return existing appraised status */
180 if (!action) {
181 if (iint->flags & IMA_APPRAISED)
182 rc = iint->ima_status;
183 goto out;
184 } 140 }
185 141
186 rc = ima_collect_measurement(iint, file); 142 mutex_lock(&iint->mutex);
143
144 rc = iint->flags & IMA_MEASURED ? 1 : 0;
187 if (rc != 0) 145 if (rc != 0)
188 goto out; 146 goto out;
189 147
190 if (function != BPRM_CHECK) { 148 rc = ima_collect_measurement(iint, file);
191 /* We will allow 11 spaces for ' (deleted)' to be appended */ 149 if (!rc)
192 pathbuf = kmalloc(PATH_MAX + 11, GFP_KERNEL); 150 ima_store_measurement(iint, file, filename);
193 if (pathbuf) {
194 pathname =
195 d_path(&file->f_path, pathbuf, PATH_MAX + 11);
196 if (IS_ERR(pathname))
197 pathname = NULL;
198 }
199 }
200 if (action & IMA_MEASURE)
201 ima_store_measurement(iint, file,
202 !pathname ? filename : pathname);
203 if (action & IMA_APPRAISE)
204 rc = ima_appraise_measurement(iint, file,
205 !pathname ? filename : pathname);
206 if (action & IMA_AUDIT)
207 ima_audit_measurement(iint, !pathname ? filename : pathname);
208 kfree(pathbuf);
209out: 151out:
210 mutex_unlock(&inode->i_mutex); 152 mutex_unlock(&iint->mutex);
211 return (rc && must_appraise) ? -EACCES : 0; 153 return rc;
212} 154}
213 155
214/** 156/**
@@ -224,14 +166,14 @@ out:
224 */ 166 */
225int ima_file_mmap(struct file *file, unsigned long prot) 167int ima_file_mmap(struct file *file, unsigned long prot)
226{ 168{
227 int rc = 0; 169 int rc;
228 170
229 if (!file) 171 if (!file)
230 return 0; 172 return 0;
231 if (prot & PROT_EXEC) 173 if (prot & PROT_EXEC)
232 rc = process_measurement(file, file->f_dentry->d_name.name, 174 rc = process_measurement(file, file->f_dentry->d_name.name,
233 MAY_EXEC, FILE_MMAP); 175 MAY_EXEC, FILE_MMAP);
234 return (ima_appraise & IMA_APPRAISE_ENFORCE) ? rc : 0; 176 return 0;
235} 177}
236 178
237/** 179/**
@@ -251,11 +193,9 @@ int ima_bprm_check(struct linux_binprm *bprm)
251{ 193{
252 int rc; 194 int rc;
253 195
254 rc = process_measurement(bprm->file, 196 rc = process_measurement(bprm->file, bprm->filename,
255 (strcmp(bprm->filename, bprm->interp) == 0) ?
256 bprm->filename : bprm->interp,
257 MAY_EXEC, BPRM_CHECK); 197 MAY_EXEC, BPRM_CHECK);
258 return (ima_appraise & IMA_APPRAISE_ENFORCE) ? rc : 0; 198 return 0;
259} 199}
260 200
261/** 201/**
@@ -276,45 +216,24 @@ int ima_file_check(struct file *file, int mask)
276 rc = process_measurement(file, file->f_dentry->d_name.name, 216 rc = process_measurement(file, file->f_dentry->d_name.name,
277 mask & (MAY_READ | MAY_WRITE | MAY_EXEC), 217 mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
278 FILE_CHECK); 218 FILE_CHECK);
279 return (ima_appraise & IMA_APPRAISE_ENFORCE) ? rc : 0; 219 return 0;
280} 220}
281EXPORT_SYMBOL_GPL(ima_file_check); 221EXPORT_SYMBOL_GPL(ima_file_check);
282 222
283/**
284 * ima_module_check - based on policy, collect/store/appraise measurement.
285 * @file: pointer to the file to be measured/appraised
286 *
287 * Measure/appraise kernel modules based on policy.
288 *
289 * Always return 0 and audit dentry_open failures.
290 * Return code is based upon measurement appraisal.
291 */
292int ima_module_check(struct file *file)
293{
294 int rc = 0;
295
296 if (!file) {
297 if (ima_appraise & IMA_APPRAISE_MODULES) {
298#ifndef CONFIG_MODULE_SIG_FORCE
299 rc = -EACCES; /* INTEGRITY_UNKNOWN */
300#endif
301 }
302 } else
303 rc = process_measurement(file, file->f_dentry->d_name.name,
304 MAY_EXEC, MODULE_CHECK);
305 return (ima_appraise & IMA_APPRAISE_ENFORCE) ? rc : 0;
306}
307
308static int __init init_ima(void) 223static int __init init_ima(void)
309{ 224{
310 int error; 225 int error;
311 226
312 error = ima_init(); 227 error = ima_init();
313 if (!error) 228 ima_initialized = 1;
314 ima_initialized = 1;
315 return error; 229 return error;
316} 230}
317 231
232static void __exit cleanup_ima(void)
233{
234 ima_cleanup();
235}
236
318late_initcall(init_ima); /* Start IMA after the TPM is available */ 237late_initcall(init_ima); /* Start IMA after the TPM is available */
319 238
320MODULE_DESCRIPTION("Integrity Measurement Architecture"); 239MODULE_DESCRIPTION("Integrity Measurement Architecture");
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 479fca940bb..d661afbe474 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -24,29 +24,22 @@
24#define IMA_MASK 0x0002 24#define IMA_MASK 0x0002
25#define IMA_FSMAGIC 0x0004 25#define IMA_FSMAGIC 0x0004
26#define IMA_UID 0x0008 26#define IMA_UID 0x0008
27#define IMA_FOWNER 0x0010
28 27
29#define UNKNOWN 0 28enum ima_action { UNKNOWN = -1, DONT_MEASURE = 0, MEASURE };
30#define MEASURE 0x0001 /* same as IMA_MEASURE */
31#define DONT_MEASURE 0x0002
32#define APPRAISE 0x0004 /* same as IMA_APPRAISE */
33#define DONT_APPRAISE 0x0008
34#define AUDIT 0x0040
35 29
36#define MAX_LSM_RULES 6 30#define MAX_LSM_RULES 6
37enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, 31enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
38 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE 32 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
39}; 33};
40 34
41struct ima_rule_entry { 35struct ima_measure_rule_entry {
42 struct list_head list; 36 struct list_head list;
43 int action; 37 enum ima_action action;
44 unsigned int flags; 38 unsigned int flags;
45 enum ima_hooks func; 39 enum ima_hooks func;
46 int mask; 40 int mask;
47 unsigned long fsmagic; 41 unsigned long fsmagic;
48 kuid_t uid; 42 uid_t uid;
49 kuid_t fowner;
50 struct { 43 struct {
51 void *rule; /* LSM file metadata specific */ 44 void *rule; /* LSM file metadata specific */
52 int type; /* audit type */ 45 int type; /* audit type */
@@ -55,7 +48,7 @@ struct ima_rule_entry {
55 48
56/* 49/*
57 * Without LSM specific knowledge, the default policy can only be 50 * Without LSM specific knowledge, the default policy can only be
58 * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner 51 * written in terms of .action, .func, .mask, .fsmagic, and .uid
59 */ 52 */
60 53
61/* 54/*
@@ -64,60 +57,34 @@ struct ima_rule_entry {
64 * normal users can easily run the machine out of memory simply building 57 * normal users can easily run the machine out of memory simply building
65 * and running executables. 58 * and running executables.
66 */ 59 */
67static struct ima_rule_entry default_rules[] = { 60static struct ima_measure_rule_entry default_rules[] = {
68 {.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC}, 61 {.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
69 {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC}, 62 {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
70 {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC}, 63 {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
71 {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC}, 64 {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
72 {.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
73 {.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
74 {.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
75 {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC}, 65 {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
76 {.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC}, 66 {.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
77 {.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC, 67 {.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC,
78 .flags = IMA_FUNC | IMA_MASK}, 68 .flags = IMA_FUNC | IMA_MASK},
79 {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC, 69 {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
80 .flags = IMA_FUNC | IMA_MASK}, 70 .flags = IMA_FUNC | IMA_MASK},
81 {.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = GLOBAL_ROOT_UID, 71 {.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = 0,
82 .flags = IMA_FUNC | IMA_MASK | IMA_UID}, 72 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
83 {.action = MEASURE,.func = MODULE_CHECK, .flags = IMA_FUNC},
84}; 73};
85 74
86static struct ima_rule_entry default_appraise_rules[] = { 75static LIST_HEAD(measure_default_rules);
87 {.action = DONT_APPRAISE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC}, 76static LIST_HEAD(measure_policy_rules);
88 {.action = DONT_APPRAISE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC}, 77static struct list_head *ima_measure;
89 {.action = DONT_APPRAISE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
90 {.action = DONT_APPRAISE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
91 {.action = DONT_APPRAISE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
92 {.action = DONT_APPRAISE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
93 {.action = DONT_APPRAISE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
94 {.action = DONT_APPRAISE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
95 {.action = DONT_APPRAISE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
96 {.action = DONT_APPRAISE,.fsmagic = CGROUP_SUPER_MAGIC,.flags = IMA_FSMAGIC},
97 {.action = APPRAISE,.fowner = GLOBAL_ROOT_UID,.flags = IMA_FOWNER},
98};
99
100static LIST_HEAD(ima_default_rules);
101static LIST_HEAD(ima_policy_rules);
102static struct list_head *ima_rules;
103 78
104static DEFINE_MUTEX(ima_rules_mutex); 79static DEFINE_MUTEX(ima_measure_mutex);
105 80
106static bool ima_use_tcb __initdata; 81static bool ima_use_tcb __initdata;
107static int __init default_measure_policy_setup(char *str) 82static int __init default_policy_setup(char *str)
108{ 83{
109 ima_use_tcb = 1; 84 ima_use_tcb = 1;
110 return 1; 85 return 1;
111} 86}
112__setup("ima_tcb", default_measure_policy_setup); 87__setup("ima_tcb", default_policy_setup);
113
114static bool ima_use_appraise_tcb __initdata;
115static int __init default_appraise_policy_setup(char *str)
116{
117 ima_use_appraise_tcb = 1;
118 return 1;
119}
120__setup("ima_appraise_tcb", default_appraise_policy_setup);
121 88
122/** 89/**
123 * ima_match_rules - determine whether an inode matches the measure rule. 90 * ima_match_rules - determine whether an inode matches the measure rule.
@@ -128,11 +95,10 @@ __setup("ima_appraise_tcb", default_appraise_policy_setup);
128 * 95 *
129 * Returns true on rule match, false on failure. 96 * Returns true on rule match, false on failure.
130 */ 97 */
131static bool ima_match_rules(struct ima_rule_entry *rule, 98static bool ima_match_rules(struct ima_measure_rule_entry *rule,
132 struct inode *inode, enum ima_hooks func, int mask) 99 struct inode *inode, enum ima_hooks func, int mask)
133{ 100{
134 struct task_struct *tsk = current; 101 struct task_struct *tsk = current;
135 const struct cred *cred = current_cred();
136 int i; 102 int i;
137 103
138 if ((rule->flags & IMA_FUNC) && rule->func != func) 104 if ((rule->flags & IMA_FUNC) && rule->func != func)
@@ -142,9 +108,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
142 if ((rule->flags & IMA_FSMAGIC) 108 if ((rule->flags & IMA_FSMAGIC)
143 && rule->fsmagic != inode->i_sb->s_magic) 109 && rule->fsmagic != inode->i_sb->s_magic)
144 return false; 110 return false;
145 if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid)) 111 if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid)
146 return false;
147 if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
148 return false; 112 return false;
149 for (i = 0; i < MAX_LSM_RULES; i++) { 113 for (i = 0; i < MAX_LSM_RULES; i++) {
150 int rc = 0; 114 int rc = 0;
@@ -195,61 +159,39 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
195 * as elements in the list are never deleted, nor does the list 159 * as elements in the list are never deleted, nor does the list
196 * change.) 160 * change.)
197 */ 161 */
198int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, 162int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask)
199 int flags)
200{ 163{
201 struct ima_rule_entry *entry; 164 struct ima_measure_rule_entry *entry;
202 int action = 0, actmask = flags | (flags << 1);
203
204 list_for_each_entry(entry, ima_rules, list) {
205
206 if (!(entry->action & actmask))
207 continue;
208
209 if (!ima_match_rules(entry, inode, func, mask))
210 continue;
211 165
212 action |= entry->action & IMA_DO_MASK; 166 list_for_each_entry(entry, ima_measure, list) {
213 if (entry->action & IMA_DO_MASK) 167 bool rc;
214 actmask &= ~(entry->action | entry->action << 1);
215 else
216 actmask &= ~(entry->action | entry->action >> 1);
217 168
218 if (!actmask) 169 rc = ima_match_rules(entry, inode, func, mask);
219 break; 170 if (rc)
171 return entry->action;
220 } 172 }
221 173 return 0;
222 return action;
223} 174}
224 175
225/** 176/**
226 * ima_init_policy - initialize the default measure rules. 177 * ima_init_policy - initialize the default measure rules.
227 * 178 *
228 * ima_rules points to either the ima_default_rules or the 179 * ima_measure points to either the measure_default_rules or the
229 * the new ima_policy_rules. 180 * the new measure_policy_rules.
230 */ 181 */
231void __init ima_init_policy(void) 182void __init ima_init_policy(void)
232{ 183{
233 int i, measure_entries, appraise_entries; 184 int i, entries;
234 185
235 /* if !ima_use_tcb set entries = 0 so we load NO default rules */ 186 /* if !ima_use_tcb set entries = 0 so we load NO default rules */
236 measure_entries = ima_use_tcb ? ARRAY_SIZE(default_rules) : 0; 187 if (ima_use_tcb)
237 appraise_entries = ima_use_appraise_tcb ? 188 entries = ARRAY_SIZE(default_rules);
238 ARRAY_SIZE(default_appraise_rules) : 0; 189 else
239 190 entries = 0;
240 for (i = 0; i < measure_entries + appraise_entries; i++) { 191
241 if (i < measure_entries) 192 for (i = 0; i < entries; i++)
242 list_add_tail(&default_rules[i].list, 193 list_add_tail(&default_rules[i].list, &measure_default_rules);
243 &ima_default_rules); 194 ima_measure = &measure_default_rules;
244 else {
245 int j = i - measure_entries;
246
247 list_add_tail(&default_appraise_rules[j].list,
248 &ima_default_rules);
249 }
250 }
251
252 ima_rules = &ima_default_rules;
253} 195}
254 196
255/** 197/**
@@ -266,8 +208,8 @@ void ima_update_policy(void)
266 int result = 1; 208 int result = 1;
267 int audit_info = 0; 209 int audit_info = 0;
268 210
269 if (ima_rules == &ima_default_rules) { 211 if (ima_measure == &measure_default_rules) {
270 ima_rules = &ima_policy_rules; 212 ima_measure = &measure_policy_rules;
271 cause = "complete"; 213 cause = "complete";
272 result = 0; 214 result = 0;
273 } 215 }
@@ -278,19 +220,14 @@ void ima_update_policy(void)
278enum { 220enum {
279 Opt_err = -1, 221 Opt_err = -1,
280 Opt_measure = 1, Opt_dont_measure, 222 Opt_measure = 1, Opt_dont_measure,
281 Opt_appraise, Opt_dont_appraise,
282 Opt_audit,
283 Opt_obj_user, Opt_obj_role, Opt_obj_type, 223 Opt_obj_user, Opt_obj_role, Opt_obj_type,
284 Opt_subj_user, Opt_subj_role, Opt_subj_type, 224 Opt_subj_user, Opt_subj_role, Opt_subj_type,
285 Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner 225 Opt_func, Opt_mask, Opt_fsmagic, Opt_uid
286}; 226};
287 227
288static match_table_t policy_tokens = { 228static match_table_t policy_tokens = {
289 {Opt_measure, "measure"}, 229 {Opt_measure, "measure"},
290 {Opt_dont_measure, "dont_measure"}, 230 {Opt_dont_measure, "dont_measure"},
291 {Opt_appraise, "appraise"},
292 {Opt_dont_appraise, "dont_appraise"},
293 {Opt_audit, "audit"},
294 {Opt_obj_user, "obj_user=%s"}, 231 {Opt_obj_user, "obj_user=%s"},
295 {Opt_obj_role, "obj_role=%s"}, 232 {Opt_obj_role, "obj_role=%s"},
296 {Opt_obj_type, "obj_type=%s"}, 233 {Opt_obj_type, "obj_type=%s"},
@@ -301,11 +238,10 @@ static match_table_t policy_tokens = {
301 {Opt_mask, "mask=%s"}, 238 {Opt_mask, "mask=%s"},
302 {Opt_fsmagic, "fsmagic=%s"}, 239 {Opt_fsmagic, "fsmagic=%s"},
303 {Opt_uid, "uid=%s"}, 240 {Opt_uid, "uid=%s"},
304 {Opt_fowner, "fowner=%s"},
305 {Opt_err, NULL} 241 {Opt_err, NULL}
306}; 242};
307 243
308static int ima_lsm_rule_init(struct ima_rule_entry *entry, 244static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry,
309 char *args, int lsm_rule, int audit_type) 245 char *args, int lsm_rule, int audit_type)
310{ 246{
311 int result; 247 int result;
@@ -329,7 +265,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
329 audit_log_format(ab, " "); 265 audit_log_format(ab, " ");
330} 266}
331 267
332static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) 268static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry)
333{ 269{
334 struct audit_buffer *ab; 270 struct audit_buffer *ab;
335 char *p; 271 char *p;
@@ -337,8 +273,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
337 273
338 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE); 274 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
339 275
340 entry->uid = INVALID_UID; 276 entry->uid = -1;
341 entry->fowner = INVALID_UID;
342 entry->action = UNKNOWN; 277 entry->action = UNKNOWN;
343 while ((p = strsep(&rule, " \t")) != NULL) { 278 while ((p = strsep(&rule, " \t")) != NULL) {
344 substring_t args[MAX_OPT_ARGS]; 279 substring_t args[MAX_OPT_ARGS];
@@ -367,43 +302,17 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
367 302
368 entry->action = DONT_MEASURE; 303 entry->action = DONT_MEASURE;
369 break; 304 break;
370 case Opt_appraise:
371 ima_log_string(ab, "action", "appraise");
372
373 if (entry->action != UNKNOWN)
374 result = -EINVAL;
375
376 entry->action = APPRAISE;
377 break;
378 case Opt_dont_appraise:
379 ima_log_string(ab, "action", "dont_appraise");
380
381 if (entry->action != UNKNOWN)
382 result = -EINVAL;
383
384 entry->action = DONT_APPRAISE;
385 break;
386 case Opt_audit:
387 ima_log_string(ab, "action", "audit");
388
389 if (entry->action != UNKNOWN)
390 result = -EINVAL;
391
392 entry->action = AUDIT;
393 break;
394 case Opt_func: 305 case Opt_func:
395 ima_log_string(ab, "func", args[0].from); 306 ima_log_string(ab, "func", args[0].from);
396 307
397 if (entry->func) 308 if (entry->func)
398 result = -EINVAL; 309 result = -EINVAL;
399 310
400 if (strcmp(args[0].from, "FILE_CHECK") == 0) 311 if (strcmp(args[0].from, "FILE_CHECK") == 0)
401 entry->func = FILE_CHECK; 312 entry->func = FILE_CHECK;
402 /* PATH_CHECK is for backwards compat */ 313 /* PATH_CHECK is for backwards compat */
403 else if (strcmp(args[0].from, "PATH_CHECK") == 0) 314 else if (strcmp(args[0].from, "PATH_CHECK") == 0)
404 entry->func = FILE_CHECK; 315 entry->func = FILE_CHECK;
405 else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
406 entry->func = MODULE_CHECK;
407 else if (strcmp(args[0].from, "FILE_MMAP") == 0) 316 else if (strcmp(args[0].from, "FILE_MMAP") == 0)
408 entry->func = FILE_MMAP; 317 entry->func = FILE_MMAP;
409 else if (strcmp(args[0].from, "BPRM_CHECK") == 0) 318 else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
@@ -448,37 +357,20 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
448 case Opt_uid: 357 case Opt_uid:
449 ima_log_string(ab, "uid", args[0].from); 358 ima_log_string(ab, "uid", args[0].from);
450 359
451 if (uid_valid(entry->uid)) { 360 if (entry->uid != -1) {
452 result = -EINVAL; 361 result = -EINVAL;
453 break; 362 break;
454 } 363 }
455 364
456 result = strict_strtoul(args[0].from, 10, &lnum); 365 result = strict_strtoul(args[0].from, 10, &lnum);
457 if (!result) { 366 if (!result) {
458 entry->uid = make_kuid(current_user_ns(), (uid_t)lnum); 367 entry->uid = (uid_t) lnum;
459 if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum)) 368 if (entry->uid != lnum)
460 result = -EINVAL; 369 result = -EINVAL;
461 else 370 else
462 entry->flags |= IMA_UID; 371 entry->flags |= IMA_UID;
463 } 372 }
464 break; 373 break;
465 case Opt_fowner:
466 ima_log_string(ab, "fowner", args[0].from);
467
468 if (uid_valid(entry->fowner)) {
469 result = -EINVAL;
470 break;
471 }
472
473 result = strict_strtoul(args[0].from, 10, &lnum);
474 if (!result) {
475 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
476 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
477 result = -EINVAL;
478 else
479 entry->flags |= IMA_FOWNER;
480 }
481 break;
482 case Opt_obj_user: 374 case Opt_obj_user:
483 ima_log_string(ab, "obj_user", args[0].from); 375 ima_log_string(ab, "obj_user", args[0].from);
484 result = ima_lsm_rule_init(entry, args[0].from, 376 result = ima_lsm_rule_init(entry, args[0].from,
@@ -523,15 +415,14 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
523 } 415 }
524 if (!result && (entry->action == UNKNOWN)) 416 if (!result && (entry->action == UNKNOWN))
525 result = -EINVAL; 417 result = -EINVAL;
526 else if (entry->func == MODULE_CHECK) 418
527 ima_appraise |= IMA_APPRAISE_MODULES; 419 audit_log_format(ab, "res=%d", !!result);
528 audit_log_format(ab, "res=%d", !result);
529 audit_log_end(ab); 420 audit_log_end(ab);
530 return result; 421 return result;
531} 422}
532 423
533/** 424/**
534 * ima_parse_add_rule - add a rule to ima_policy_rules 425 * ima_parse_add_rule - add a rule to measure_policy_rules
535 * @rule - ima measurement policy rule 426 * @rule - ima measurement policy rule
536 * 427 *
537 * Uses a mutex to protect the policy list from multiple concurrent writers. 428 * Uses a mutex to protect the policy list from multiple concurrent writers.
@@ -541,12 +432,12 @@ ssize_t ima_parse_add_rule(char *rule)
541{ 432{
542 const char *op = "update_policy"; 433 const char *op = "update_policy";
543 char *p; 434 char *p;
544 struct ima_rule_entry *entry; 435 struct ima_measure_rule_entry *entry;
545 ssize_t result, len; 436 ssize_t result, len;
546 int audit_info = 0; 437 int audit_info = 0;
547 438
548 /* Prevent installed policy from changing */ 439 /* Prevent installed policy from changing */
549 if (ima_rules != &ima_default_rules) { 440 if (ima_measure != &measure_default_rules) {
550 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 441 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
551 NULL, op, "already exists", 442 NULL, op, "already exists",
552 -EACCES, audit_info); 443 -EACCES, audit_info);
@@ -579,9 +470,9 @@ ssize_t ima_parse_add_rule(char *rule)
579 return result; 470 return result;
580 } 471 }
581 472
582 mutex_lock(&ima_rules_mutex); 473 mutex_lock(&ima_measure_mutex);
583 list_add_tail(&entry->list, &ima_policy_rules); 474 list_add_tail(&entry->list, &measure_policy_rules);
584 mutex_unlock(&ima_rules_mutex); 475 mutex_unlock(&ima_measure_mutex);
585 476
586 return len; 477 return len;
587} 478}
@@ -589,12 +480,12 @@ ssize_t ima_parse_add_rule(char *rule)
589/* ima_delete_rules called to cleanup invalid policy */ 480/* ima_delete_rules called to cleanup invalid policy */
590void ima_delete_rules(void) 481void ima_delete_rules(void)
591{ 482{
592 struct ima_rule_entry *entry, *tmp; 483 struct ima_measure_rule_entry *entry, *tmp;
593 484
594 mutex_lock(&ima_rules_mutex); 485 mutex_lock(&ima_measure_mutex);
595 list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) { 486 list_for_each_entry_safe(entry, tmp, &measure_policy_rules, list) {
596 list_del(&entry->list); 487 list_del(&entry->list);
597 kfree(entry); 488 kfree(entry);
598 } 489 }
599 mutex_unlock(&ima_rules_mutex); 490 mutex_unlock(&ima_measure_mutex);
600} 491}
generated by cgit v1.2.2 (git 2.25.0) at 2026-04-27 13:31:27 -0400