ima_api.c 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378
  1. /*
  2. * Copyright (C) 2008 IBM Corporation
  3. *
  4. * Author: Mimi Zohar <zohar@us.ibm.com>
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License as
  8. * published by the Free Software Foundation, version 2 of the
  9. * License.
  10. *
  11. * File: ima_api.c
  12. * Implements must_appraise_or_measure, collect_measurement,
  13. * appraise_measurement, store_measurement and store_template.
  14. */
  15. #include <linux/module.h>
  16. #include <linux/slab.h>
  17. #include <linux/file.h>
  18. #include <linux/fs.h>
  19. #include <linux/xattr.h>
  20. #include <linux/evm.h>
  21. #include <linux/iversion.h>
  22. #include "ima.h"
  23. /*
  24. * ima_free_template_entry - free an existing template entry
  25. */
  26. void ima_free_template_entry(struct ima_template_entry *entry)
  27. {
  28. int i;
  29. for (i = 0; i < entry->template_desc->num_fields; i++)
  30. kfree(entry->template_data[i].data);
  31. kfree(entry);
  32. }
  33. /*
  34. * ima_alloc_init_template - create and initialize a new template entry
  35. */
  36. int ima_alloc_init_template(struct ima_event_data *event_data,
  37. struct ima_template_entry **entry)
  38. {
  39. struct ima_template_desc *template_desc = ima_template_desc_current();
  40. int i, result = 0;
  41. *entry = kzalloc(sizeof(**entry) + template_desc->num_fields *
  42. sizeof(struct ima_field_data), GFP_NOFS);
  43. if (!*entry)
  44. return -ENOMEM;
  45. (*entry)->template_desc = template_desc;
  46. for (i = 0; i < template_desc->num_fields; i++) {
  47. struct ima_template_field *field = template_desc->fields[i];
  48. u32 len;
  49. result = field->field_init(event_data,
  50. &((*entry)->template_data[i]));
  51. if (result != 0)
  52. goto out;
  53. len = (*entry)->template_data[i].len;
  54. (*entry)->template_data_len += sizeof(len);
  55. (*entry)->template_data_len += len;
  56. }
  57. return 0;
  58. out:
  59. ima_free_template_entry(*entry);
  60. *entry = NULL;
  61. return result;
  62. }
  63. /*
  64. * ima_store_template - store ima template measurements
  65. *
  66. * Calculate the hash of a template entry, add the template entry
  67. * to an ordered list of measurement entries maintained inside the kernel,
  68. * and also update the aggregate integrity value (maintained inside the
  69. * configured TPM PCR) over the hashes of the current list of measurement
  70. * entries.
  71. *
  72. * Applications retrieve the current kernel-held measurement list through
  73. * the securityfs entries in /sys/kernel/security/ima. The signed aggregate
  74. * TPM PCR (called quote) can be retrieved using a TPM user space library
  75. * and is used to validate the measurement list.
  76. *
  77. * Returns 0 on success, error code otherwise
  78. */
  79. int ima_store_template(struct ima_template_entry *entry,
  80. int violation, struct inode *inode,
  81. const unsigned char *filename, int pcr)
  82. {
  83. static const char op[] = "add_template_measure";
  84. static const char audit_cause[] = "hashing_error";
  85. char *template_name = entry->template_desc->name;
  86. int result;
  87. struct {
  88. struct ima_digest_data hdr;
  89. char digest[TPM_DIGEST_SIZE];
  90. } hash;
  91. if (!violation) {
  92. int num_fields = entry->template_desc->num_fields;
  93. /* this function uses default algo */
  94. hash.hdr.algo = HASH_ALGO_SHA1;
  95. result = ima_calc_field_array_hash(&entry->template_data[0],
  96. entry->template_desc,
  97. num_fields, &hash.hdr);
  98. if (result < 0) {
  99. integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
  100. template_name, op,
  101. audit_cause, result, 0);
  102. return result;
  103. }
  104. memcpy(entry->digest, hash.hdr.digest, hash.hdr.length);
  105. }
  106. entry->pcr = pcr;
  107. result = ima_add_template_entry(entry, violation, op, inode, filename);
  108. return result;
  109. }
  110. /*
  111. * ima_add_violation - add violation to measurement list.
  112. *
  113. * Violations are flagged in the measurement list with zero hash values.
  114. * By extending the PCR with 0xFF's instead of with zeroes, the PCR
  115. * value is invalidated.
  116. */
  117. void ima_add_violation(struct file *file, const unsigned char *filename,
  118. struct integrity_iint_cache *iint,
  119. const char *op, const char *cause)
  120. {
  121. struct ima_template_entry *entry;
  122. struct inode *inode = file_inode(file);
  123. struct ima_event_data event_data = {iint, file, filename, NULL, 0,
  124. cause};
  125. int violation = 1;
  126. int result;
  127. /* can overflow, only indicator */
  128. atomic_long_inc(&ima_htable.violations);
  129. result = ima_alloc_init_template(&event_data, &entry);
  130. if (result < 0) {
  131. result = -ENOMEM;
  132. goto err_out;
  133. }
  134. result = ima_store_template(entry, violation, inode,
  135. filename, CONFIG_IMA_MEASURE_PCR_IDX);
  136. if (result < 0)
  137. ima_free_template_entry(entry);
  138. err_out:
  139. integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
  140. op, cause, result, 0);
  141. }
  142. /**
  143. * ima_get_action - appraise & measure decision based on policy.
  144. * @inode: pointer to inode to measure
  145. * @cred: pointer to credentials structure to validate
  146. * @secid: secid of the task being validated
  147. * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
  148. * MAY_APPEND)
  149. * @func: caller identifier
  150. * @pcr: pointer filled in if matched measure policy sets pcr=
  151. *
  152. * The policy is defined in terms of keypairs:
  153. * subj=, obj=, type=, func=, mask=, fsmagic=
  154. * subj,obj, and type: are LSM specific.
  155. * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK
  156. * mask: contains the permission mask
  157. * fsmagic: hex value
  158. *
  159. * Returns IMA_MEASURE, IMA_APPRAISE mask.
  160. *
  161. */
  162. int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
  163. int mask, enum ima_hooks func, int *pcr)
  164. {
  165. int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
  166. flags &= ima_policy_flag;
  167. return ima_match_policy(inode, cred, secid, func, mask, flags, pcr);
  168. }
  169. /*
  170. * ima_collect_measurement - collect file measurement
  171. *
  172. * Calculate the file hash, if it doesn't already exist,
  173. * storing the measurement and i_version in the iint.
  174. *
  175. * Must be called with iint->mutex held.
  176. *
  177. * Return 0 on success, error code otherwise
  178. */
  179. int ima_collect_measurement(struct integrity_iint_cache *iint,
  180. struct file *file, void *buf, loff_t size,
  181. enum hash_algo algo)
  182. {
  183. const char *audit_cause = "failed";
  184. struct inode *inode = file_inode(file);
  185. const char *filename = file->f_path.dentry->d_name.name;
  186. int result = 0;
  187. int length;
  188. void *tmpbuf;
  189. u64 i_version;
  190. struct {
  191. struct ima_digest_data hdr;
  192. char digest[IMA_MAX_DIGEST_SIZE];
  193. } hash;
  194. if (iint->flags & IMA_COLLECTED)
  195. goto out;
  196. /*
  197. * Dectecting file change is based on i_version. On filesystems
  198. * which do not support i_version, support is limited to an initial
  199. * measurement/appraisal/audit.
  200. */
  201. i_version = inode_query_iversion(inode);
  202. hash.hdr.algo = algo;
  203. /* Initialize hash digest to 0's in case of failure */
  204. memset(&hash.digest, 0, sizeof(hash.digest));
  205. if (buf)
  206. result = ima_calc_buffer_hash(buf, size, &hash.hdr);
  207. else
  208. result = ima_calc_file_hash(file, &hash.hdr);
  209. if (result && result != -EBADF && result != -EINVAL)
  210. goto out;
  211. length = sizeof(hash.hdr) + hash.hdr.length;
  212. tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS);
  213. if (!tmpbuf) {
  214. result = -ENOMEM;
  215. goto out;
  216. }
  217. iint->ima_hash = tmpbuf;
  218. memcpy(iint->ima_hash, &hash, length);
  219. iint->version = i_version;
  220. /* Possibly temporary failure due to type of read (eg. O_DIRECT) */
  221. if (!result)
  222. iint->flags |= IMA_COLLECTED;
  223. out:
  224. if (result) {
  225. if (file->f_flags & O_DIRECT)
  226. audit_cause = "failed(directio)";
  227. integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
  228. filename, "collect_data", audit_cause,
  229. result, 0);
  230. }
  231. return result;
  232. }
  233. /*
  234. * ima_store_measurement - store file measurement
  235. *
  236. * Create an "ima" template and then store the template by calling
  237. * ima_store_template.
  238. *
  239. * We only get here if the inode has not already been measured,
  240. * but the measurement could already exist:
  241. * - multiple copies of the same file on either the same or
  242. * different filesystems.
  243. * - the inode was previously flushed as well as the iint info,
  244. * containing the hashing info.
  245. *
  246. * Must be called with iint->mutex held.
  247. */
  248. void ima_store_measurement(struct integrity_iint_cache *iint,
  249. struct file *file, const unsigned char *filename,
  250. struct evm_ima_xattr_data *xattr_value,
  251. int xattr_len, int pcr)
  252. {
  253. static const char op[] = "add_template_measure";
  254. static const char audit_cause[] = "ENOMEM";
  255. int result = -ENOMEM;
  256. struct inode *inode = file_inode(file);
  257. struct ima_template_entry *entry;
  258. struct ima_event_data event_data = {iint, file, filename, xattr_value,
  259. xattr_len, NULL};
  260. int violation = 0;
  261. if (iint->measured_pcrs & (0x1 << pcr))
  262. return;
  263. result = ima_alloc_init_template(&event_data, &entry);
  264. if (result < 0) {
  265. integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
  266. op, audit_cause, result, 0);
  267. return;
  268. }
  269. result = ima_store_template(entry, violation, inode, filename, pcr);
  270. if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {
  271. iint->flags |= IMA_MEASURED;
  272. iint->measured_pcrs |= (0x1 << pcr);
  273. }
  274. if (result < 0)
  275. ima_free_template_entry(entry);
  276. }
  277. void ima_audit_measurement(struct integrity_iint_cache *iint,
  278. const unsigned char *filename)
  279. {
  280. struct audit_buffer *ab;
  281. char *hash;
  282. const char *algo_name = hash_algo_name[iint->ima_hash->algo];
  283. int i;
  284. if (iint->flags & IMA_AUDITED)
  285. return;
  286. hash = kzalloc((iint->ima_hash->length * 2) + 1, GFP_KERNEL);
  287. if (!hash)
  288. return;
  289. for (i = 0; i < iint->ima_hash->length; i++)
  290. hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
  291. hash[i * 2] = '\0';
  292. ab = audit_log_start(audit_context(), GFP_KERNEL,
  293. AUDIT_INTEGRITY_RULE);
  294. if (!ab)
  295. goto out;
  296. audit_log_format(ab, "file=");
  297. audit_log_untrustedstring(ab, filename);
  298. audit_log_format(ab, " hash=\"%s:%s\"", algo_name, hash);
  299. audit_log_task_info(ab, current);
  300. audit_log_end(ab);
  301. iint->flags |= IMA_AUDITED;
  302. out:
  303. kfree(hash);
  304. return;
  305. }
  306. /*
  307. * ima_d_path - return a pointer to the full pathname
  308. *
  309. * Attempt to return a pointer to the full pathname for use in the
  310. * IMA measurement list, IMA audit records, and auditing logs.
  311. *
  312. * On failure, return a pointer to a copy of the filename, not dname.
  313. * Returning a pointer to dname, could result in using the pointer
  314. * after the memory has been freed.
  315. */
  316. const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
  317. {
  318. char *pathname = NULL;
  319. *pathbuf = __getname();
  320. if (*pathbuf) {
  321. pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
  322. if (IS_ERR(pathname)) {
  323. __putname(*pathbuf);
  324. *pathbuf = NULL;
  325. pathname = NULL;
  326. }
  327. }
  328. if (!pathname) {
  329. strlcpy(namebuf, path->dentry->d_name.name, NAME_MAX);
  330. pathname = namebuf;
  331. }
  332. return pathname;
  333. }