ima.h 9.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324
  1. /*
  2. * Copyright (C) 2005,2006,2007,2008 IBM Corporation
  3. *
  4. * Authors:
  5. * Reiner Sailer <sailer@watson.ibm.com>
  6. * Mimi Zohar <zohar@us.ibm.com>
  7. *
  8. * This program is free software; you can redistribute it and/or
  9. * modify it under the terms of the GNU General Public License as
  10. * published by the Free Software Foundation, version 2 of the
  11. * License.
  12. *
  13. * File: ima.h
  14. * internal Integrity Measurement Architecture (IMA) definitions
  15. */
  16. #ifndef __LINUX_IMA_H
  17. #define __LINUX_IMA_H
  18. #include <linux/types.h>
  19. #include <linux/crypto.h>
  20. #include <linux/fs.h>
  21. #include <linux/security.h>
  22. #include <linux/hash.h>
  23. #include <linux/tpm.h>
  24. #include <linux/audit.h>
  25. #include <crypto/hash_info.h>
  26. #include "../integrity.h"
  27. #ifdef CONFIG_HAVE_IMA_KEXEC
  28. #include <asm/ima.h>
  29. #endif
  30. enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
  31. IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
  32. enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
  33. /* digest size for IMA, fits SHA1 or MD5 */
  34. #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
  35. #define IMA_EVENT_NAME_LEN_MAX 255
  36. #define IMA_HASH_BITS 9
  37. #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
  38. #define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16
  39. #define IMA_TEMPLATE_NUM_FIELDS_MAX 15
  40. #define IMA_TEMPLATE_IMA_NAME "ima"
  41. #define IMA_TEMPLATE_IMA_FMT "d|n"
  42. /* current content of the policy */
  43. extern int ima_policy_flag;
  44. /* set during initialization */
  45. extern int ima_hash_algo;
  46. extern int ima_appraise;
  47. extern struct tpm_chip *ima_tpm_chip;
  48. /* IMA event related data */
  49. struct ima_event_data {
  50. struct integrity_iint_cache *iint;
  51. struct file *file;
  52. const unsigned char *filename;
  53. struct evm_ima_xattr_data *xattr_value;
  54. int xattr_len;
  55. const char *violation;
  56. };
  57. /* IMA template field data definition */
  58. struct ima_field_data {
  59. u8 *data;
  60. u32 len;
  61. };
  62. /* IMA template field definition */
  63. struct ima_template_field {
  64. const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
  65. int (*field_init)(struct ima_event_data *event_data,
  66. struct ima_field_data *field_data);
  67. void (*field_show)(struct seq_file *m, enum ima_show_type show,
  68. struct ima_field_data *field_data);
  69. };
  70. /* IMA template descriptor definition */
  71. struct ima_template_desc {
  72. struct list_head list;
  73. char *name;
  74. char *fmt;
  75. int num_fields;
  76. struct ima_template_field **fields;
  77. };
  78. struct ima_template_entry {
  79. int pcr;
  80. u8 digest[TPM_DIGEST_SIZE]; /* sha1 or md5 measurement hash */
  81. struct ima_template_desc *template_desc; /* template descriptor */
  82. u32 template_data_len;
  83. struct ima_field_data template_data[0]; /* template related data */
  84. };
  85. struct ima_queue_entry {
  86. struct hlist_node hnext; /* place in hash collision list */
  87. struct list_head later; /* place in ima_measurements list */
  88. struct ima_template_entry *entry;
  89. };
  90. extern struct list_head ima_measurements; /* list of all measurements */
  91. /* Some details preceding the binary serialized measurement list */
  92. struct ima_kexec_hdr {
  93. u16 version;
  94. u16 _reserved0;
  95. u32 _reserved1;
  96. u64 buffer_size;
  97. u64 count;
  98. };
  99. #ifdef CONFIG_HAVE_IMA_KEXEC
  100. void ima_load_kexec_buffer(void);
  101. #else
  102. static inline void ima_load_kexec_buffer(void) {}
  103. #endif /* CONFIG_HAVE_IMA_KEXEC */
  104. /*
  105. * The default binary_runtime_measurements list format is defined as the
  106. * platform native format. The canonical format is defined as little-endian.
  107. */
  108. extern bool ima_canonical_fmt;
  109. /* Internal IMA function definitions */
  110. int ima_init(void);
  111. int ima_fs_init(void);
  112. int ima_add_template_entry(struct ima_template_entry *entry, int violation,
  113. const char *op, struct inode *inode,
  114. const unsigned char *filename);
  115. int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
  116. int ima_calc_buffer_hash(const void *buf, loff_t len,
  117. struct ima_digest_data *hash);
  118. int ima_calc_field_array_hash(struct ima_field_data *field_data,
  119. struct ima_template_desc *desc, int num_fields,
  120. struct ima_digest_data *hash);
  121. int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
  122. void ima_add_violation(struct file *file, const unsigned char *filename,
  123. struct integrity_iint_cache *iint,
  124. const char *op, const char *cause);
  125. int ima_init_crypto(void);
  126. void ima_putc(struct seq_file *m, void *data, int datalen);
  127. void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
  128. struct ima_template_desc *ima_template_desc_current(void);
  129. int ima_restore_measurement_entry(struct ima_template_entry *entry);
  130. int ima_restore_measurement_list(loff_t bufsize, void *buf);
  131. int ima_measurements_show(struct seq_file *m, void *v);
  132. unsigned long ima_get_binary_runtime_size(void);
  133. int ima_init_template(void);
  134. void ima_init_template_list(void);
  135. /*
  136. * used to protect h_table and sha_table
  137. */
  138. extern spinlock_t ima_queue_lock;
  139. struct ima_h_table {
  140. atomic_long_t len; /* number of stored measurements in the list */
  141. atomic_long_t violations;
  142. struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
  143. };
  144. extern struct ima_h_table ima_htable;
  145. static inline unsigned long ima_hash_key(u8 *digest)
  146. {
  147. return hash_long(*digest, IMA_HASH_BITS);
  148. }
  149. #define __ima_hooks(hook) \
  150. hook(NONE) \
  151. hook(FILE_CHECK) \
  152. hook(MMAP_CHECK) \
  153. hook(BPRM_CHECK) \
  154. hook(CREDS_CHECK) \
  155. hook(POST_SETATTR) \
  156. hook(MODULE_CHECK) \
  157. hook(FIRMWARE_CHECK) \
  158. hook(KEXEC_KERNEL_CHECK) \
  159. hook(KEXEC_INITRAMFS_CHECK) \
  160. hook(POLICY_CHECK) \
  161. hook(MAX_CHECK)
  162. #define __ima_hook_enumify(ENUM) ENUM,
  163. enum ima_hooks {
  164. __ima_hooks(__ima_hook_enumify)
  165. };
  166. /* LIM API function definitions */
  167. int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
  168. int mask, enum ima_hooks func, int *pcr);
  169. int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
  170. int ima_collect_measurement(struct integrity_iint_cache *iint,
  171. struct file *file, void *buf, loff_t size,
  172. enum hash_algo algo);
  173. void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
  174. const unsigned char *filename,
  175. struct evm_ima_xattr_data *xattr_value,
  176. int xattr_len, int pcr);
  177. void ima_audit_measurement(struct integrity_iint_cache *iint,
  178. const unsigned char *filename);
  179. int ima_alloc_init_template(struct ima_event_data *event_data,
  180. struct ima_template_entry **entry);
  181. int ima_store_template(struct ima_template_entry *entry, int violation,
  182. struct inode *inode,
  183. const unsigned char *filename, int pcr);
  184. void ima_free_template_entry(struct ima_template_entry *entry);
  185. const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
  186. /* IMA policy related functions */
  187. int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
  188. enum ima_hooks func, int mask, int flags, int *pcr);
  189. void ima_init_policy(void);
  190. void ima_update_policy(void);
  191. void ima_update_policy_flag(void);
  192. ssize_t ima_parse_add_rule(char *);
  193. void ima_delete_rules(void);
  194. int ima_check_policy(void);
  195. void *ima_policy_start(struct seq_file *m, loff_t *pos);
  196. void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos);
  197. void ima_policy_stop(struct seq_file *m, void *v);
  198. int ima_policy_show(struct seq_file *m, void *v);
  199. /* Appraise integrity measurements */
  200. #define IMA_APPRAISE_ENFORCE 0x01
  201. #define IMA_APPRAISE_FIX 0x02
  202. #define IMA_APPRAISE_LOG 0x04
  203. #define IMA_APPRAISE_MODULES 0x08
  204. #define IMA_APPRAISE_FIRMWARE 0x10
  205. #define IMA_APPRAISE_POLICY 0x20
  206. #define IMA_APPRAISE_KEXEC 0x40
  207. #ifdef CONFIG_IMA_APPRAISE
  208. int ima_appraise_measurement(enum ima_hooks func,
  209. struct integrity_iint_cache *iint,
  210. struct file *file, const unsigned char *filename,
  211. struct evm_ima_xattr_data *xattr_value,
  212. int xattr_len);
  213. int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
  214. void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
  215. enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
  216. enum ima_hooks func);
  217. enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
  218. int xattr_len);
  219. int ima_read_xattr(struct dentry *dentry,
  220. struct evm_ima_xattr_data **xattr_value);
  221. #else
  222. static inline int ima_appraise_measurement(enum ima_hooks func,
  223. struct integrity_iint_cache *iint,
  224. struct file *file,
  225. const unsigned char *filename,
  226. struct evm_ima_xattr_data *xattr_value,
  227. int xattr_len)
  228. {
  229. return INTEGRITY_UNKNOWN;
  230. }
  231. static inline int ima_must_appraise(struct inode *inode, int mask,
  232. enum ima_hooks func)
  233. {
  234. return 0;
  235. }
  236. static inline void ima_update_xattr(struct integrity_iint_cache *iint,
  237. struct file *file)
  238. {
  239. }
  240. static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache
  241. *iint,
  242. enum ima_hooks func)
  243. {
  244. return INTEGRITY_UNKNOWN;
  245. }
  246. static inline enum hash_algo
  247. ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len)
  248. {
  249. return ima_hash_algo;
  250. }
  251. static inline int ima_read_xattr(struct dentry *dentry,
  252. struct evm_ima_xattr_data **xattr_value)
  253. {
  254. return 0;
  255. }
  256. #endif /* CONFIG_IMA_APPRAISE */
  257. /* LSM based policy rules require audit */
  258. #ifdef CONFIG_IMA_LSM_RULES
  259. #define security_filter_rule_init security_audit_rule_init
  260. #define security_filter_rule_match security_audit_rule_match
  261. #else
  262. static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,
  263. void **lsmrule)
  264. {
  265. return -EINVAL;
  266. }
  267. static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,
  268. void *lsmrule,
  269. struct audit_context *actx)
  270. {
  271. return -EINVAL;
  272. }
  273. #endif /* CONFIG_IMA_LSM_RULES */
  274. #ifdef CONFIG_IMA_READ_POLICY
  275. #define POLICY_FILE_FLAGS (S_IWUSR | S_IRUSR)
  276. #else
  277. #define POLICY_FILE_FLAGS S_IWUSR
  278. #endif /* CONFIG_IMA_READ_POLICY */
  279. #endif /* __LINUX_IMA_H */