1 files changed, 117 insertions, 37 deletions

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 1c03e8f1e0e1..c38bbce8c6a6 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -18,9 +18,59 @@
 #include <linux/fs.h>
 #include <linux/xattr.h>
 #include <linux/evm.h>
+#include <crypto/hash_info.h>
 #include "ima.h"
 
-static const char *IMA_TEMPLATE_NAME = "ima";
+/*
+ * ima_free_template_entry - free an existing template entry
+ */
+void ima_free_template_entry(struct ima_template_entry *entry)
+{
+        int i;
+
+        for (i = 0; i < entry->template_desc->num_fields; i++)
+                kfree(entry->template_data[i].data);
+
+        kfree(entry);
+}
+
+/*
+ * ima_alloc_init_template - create and initialize a new template entry
+ */
+int ima_alloc_init_template(struct integrity_iint_cache *iint,
+                            struct file *file, const unsigned char *filename,
+                            struct evm_ima_xattr_data *xattr_value,
+                            int xattr_len, struct ima_template_entry **entry)
+{
+        struct ima_template_desc *template_desc = ima_template_desc_current();
+        int i, result = 0;
+
+        *entry = kzalloc(sizeof(**entry) + template_desc->num_fields *
+                         sizeof(struct ima_field_data), GFP_NOFS);
+        if (!*entry)
+                return -ENOMEM;
+
+        (*entry)->template_desc = template_desc;
+        for (i = 0; i < template_desc->num_fields; i++) {
+                struct ima_template_field *field = template_desc->fields[i];
+                u32 len;
+
+                result = field->field_init(iint, file, filename,
+                                           xattr_value, xattr_len,
+                                           &((*entry)->template_data[i]));
+                if (result != 0)
+                        goto out;
+
+                len = (*entry)->template_data[i].len;
+                (*entry)->template_data_len += sizeof(len);
+                (*entry)->template_data_len += len;
+        }
+        return 0;
+out:
+        ima_free_template_entry(*entry);
+        *entry = NULL;
+        return result;
+}
 
 /*
  * ima_store_template - store ima template measurements
@@ -39,28 +89,35 @@ static const char *IMA_TEMPLATE_NAME = "ima";
  * Returns 0 on success, error code otherwise
  */
 int ima_store_template(struct ima_template_entry *entry,
-                       int violation, struct inode *inode)
+                       int violation, struct inode *inode,
+                       const unsigned char *filename)
 {
         const char *op = "add_template_measure";
         const char *audit_cause = "hashing_error";
+        char *template_name = entry->template_desc->name;
         int result;
-
-        memset(entry->digest, 0, sizeof(entry->digest));
-        entry->template_name = IMA_TEMPLATE_NAME;
-        entry->template_len = sizeof(entry->template);
+        struct {
+                struct ima_digest_data hdr;
+                char digest[TPM_DIGEST_SIZE];
+        } hash;
 
         if (!violation) {
-                result = ima_calc_buffer_hash(&entry->template,
-                                                entry->template_len,
-                                                entry->digest);
+                int num_fields = entry->template_desc->num_fields;
+
+                /* this function uses default algo */
+                hash.hdr.algo = HASH_ALGO_SHA1;
+                result = ima_calc_field_array_hash(&entry->template_data[0],
+                                                   entry->template_desc,
+                                                   num_fields, &hash.hdr);
                 if (result < 0) {
                         integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
-                                            entry->template_name, op,
+                                            template_name, op,
                                             audit_cause, result, 0);
                         return result;
                 }
+                memcpy(entry->digest, hash.hdr.digest, hash.hdr.length);
         }
-        result = ima_add_template_entry(entry, violation, op, inode);
+        result = ima_add_template_entry(entry, violation, op, inode, filename);
         return result;
 }
 
@@ -71,26 +128,26 @@ int ima_store_template(struct ima_template_entry *entry,
  * By extending the PCR with 0xFF's instead of with zeroes, the PCR
  * value is invalidated.
  */
-void ima_add_violation(struct inode *inode, const unsigned char *filename,
+void ima_add_violation(struct file *file, const unsigned char *filename,
                        const char *op, const char *cause)
 {
         struct ima_template_entry *entry;
+        struct inode *inode = file->f_dentry->d_inode;
         int violation = 1;
         int result;
 
         /* can overflow, only indicator */
         atomic_long_inc(&ima_htable.violations);
 
-        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
-        if (!entry) {
+        result = ima_alloc_init_template(NULL, file, filename,
+                                         NULL, 0, &entry);
+        if (result < 0) {
                 result = -ENOMEM;
                 goto err_out;
         }
-        memset(&entry->template, 0, sizeof(entry->template));
-        strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
-        result = ima_store_template(entry, violation, inode);
+        result = ima_store_template(entry, violation, inode, filename);
         if (result < 0)
-                kfree(entry);
+                ima_free_template_entry(entry);
 err_out:
         integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
                             op, cause, result, 0);
@@ -138,20 +195,42 @@ int ima_must_measure(struct inode *inode, int mask, int function)
  * Return 0 on success, error code otherwise
  */
 int ima_collect_measurement(struct integrity_iint_cache *iint,
-                            struct file *file)
+                            struct file *file,
+                            struct evm_ima_xattr_data **xattr_value,
+                            int *xattr_len)
 {
         struct inode *inode = file_inode(file);
         const char *filename = file->f_dentry->d_name.name;
         int result = 0;
+        struct {
+                struct ima_digest_data hdr;
+                char digest[IMA_MAX_DIGEST_SIZE];
+        } hash;
+
+        if (xattr_value)
+                *xattr_len = ima_read_xattr(file->f_dentry, xattr_value);
 
         if (!(iint->flags & IMA_COLLECTED)) {
                 u64 i_version = file_inode(file)->i_version;
 
-                iint->ima_xattr.type = IMA_XATTR_DIGEST;
-                result = ima_calc_file_hash(file, iint->ima_xattr.digest);
+                /* use default hash algorithm */
+                hash.hdr.algo = ima_hash_algo;
+
+                if (xattr_value)
+                        ima_get_hash_algo(*xattr_value, *xattr_len, &hash.hdr);
+
+                result = ima_calc_file_hash(file, &hash.hdr);
                 if (!result) {
-                        iint->version = i_version;
-                        iint->flags |= IMA_COLLECTED;
+                        int length = sizeof(hash.hdr) + hash.hdr.length;
+                        void *tmpbuf = krealloc(iint->ima_hash, length,
+                                                GFP_NOFS);
+                        if (tmpbuf) {
+                                iint->ima_hash = tmpbuf;
+                                memcpy(iint->ima_hash, &hash, length);
+                                iint->version = i_version;
+                                iint->flags |= IMA_COLLECTED;
+                        } else
+                                result = -ENOMEM;
                 }
         }
         if (result)
@@ -177,7 +256,9 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
  * Must be called with iint->mutex held.
  */
 void ima_store_measurement(struct integrity_iint_cache *iint,
-                           struct file *file, const unsigned char *filename)
+                           struct file *file, const unsigned char *filename,
+                           struct evm_ima_xattr_data *xattr_value,
+                           int xattr_len)
 {
         const char *op = "add_template_measure";
         const char *audit_cause = "ENOMEM";
@@ -189,37 +270,35 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
         if (iint->flags & IMA_MEASURED)
                 return;
 
-        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
-        if (!entry) {
+        result = ima_alloc_init_template(iint, file, filename,
+                                         xattr_value, xattr_len, &entry);
+        if (result < 0) {
                 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
                                     op, audit_cause, result, 0);
                 return;
         }
-        memset(&entry->template, 0, sizeof(entry->template));
-        memcpy(entry->template.digest, iint->ima_xattr.digest, IMA_DIGEST_SIZE);
-        strcpy(entry->template.file_name,
-               (strlen(filename) > IMA_EVENT_NAME_LEN_MAX) ?
-               file->f_dentry->d_name.name : filename);
 
-        result = ima_store_template(entry, violation, inode);
+        result = ima_store_template(entry, violation, inode, filename);
         if (!result || result == -EEXIST)
                 iint->flags |= IMA_MEASURED;
         if (result < 0)
-                kfree(entry);
+                ima_free_template_entry(entry);
 }
 
 void ima_audit_measurement(struct integrity_iint_cache *iint,
                            const unsigned char *filename)
 {
         struct audit_buffer *ab;
-        char hash[(IMA_DIGEST_SIZE * 2) + 1];
+        char hash[(iint->ima_hash->length * 2) + 1];
+        const char *algo_name = hash_algo_name[iint->ima_hash->algo];
+        char algo_hash[sizeof(hash) + strlen(algo_name) + 2];
         int i;
 
         if (iint->flags & IMA_AUDITED)
                 return;
 
-        for (i = 0; i < IMA_DIGEST_SIZE; i++)
-                hex_byte_pack(hash + (i * 2), iint->ima_xattr.digest[i]);
+        for (i = 0; i < iint->ima_hash->length; i++)
+                hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
         hash[i * 2] = '\0';
 
         ab = audit_log_start(current->audit_context, GFP_KERNEL,
@@ -230,7 +309,8 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
         audit_log_format(ab, "file=");
         audit_log_untrustedstring(ab, filename);
         audit_log_format(ab, " hash=");
-        audit_log_untrustedstring(ab, hash);
+        snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);
+        audit_log_untrustedstring(ab, algo_hash);
 
         audit_log_task_info(ab, current);
         audit_log_end(ab);