ima_appraise.c 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412
  1. /*
  2. * Copyright (C) 2011 IBM Corporation
  3. *
  4. * Author:
  5. * Mimi Zohar <zohar@us.ibm.com>
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation, version 2 of the License.
  10. */
  11. #include <linux/module.h>
  12. #include <linux/file.h>
  13. #include <linux/fs.h>
  14. #include <linux/xattr.h>
  15. #include <linux/magic.h>
  16. #include <linux/ima.h>
  17. #include <linux/evm.h>
  18. #include "ima.h"
  19. static int __init default_appraise_setup(char *str)
  20. {
  21. if (strncmp(str, "off", 3) == 0)
  22. ima_appraise = 0;
  23. else if (strncmp(str, "log", 3) == 0)
  24. ima_appraise = IMA_APPRAISE_LOG;
  25. else if (strncmp(str, "fix", 3) == 0)
  26. ima_appraise = IMA_APPRAISE_FIX;
  27. return 1;
  28. }
  29. __setup("ima_appraise=", default_appraise_setup);
  30. /*
  31. * ima_must_appraise - set appraise flag
  32. *
  33. * Return 1 to appraise
  34. */
  35. int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
  36. {
  37. if (!ima_appraise)
  38. return 0;
  39. return ima_match_policy(inode, func, mask, IMA_APPRAISE, NULL);
  40. }
  41. static int ima_fix_xattr(struct dentry *dentry,
  42. struct integrity_iint_cache *iint)
  43. {
  44. int rc, offset;
  45. u8 algo = iint->ima_hash->algo;
  46. if (algo <= HASH_ALGO_SHA1) {
  47. offset = 1;
  48. iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;
  49. } else {
  50. offset = 0;
  51. iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG;
  52. iint->ima_hash->xattr.ng.algo = algo;
  53. }
  54. rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA,
  55. &iint->ima_hash->xattr.data[offset],
  56. (sizeof(iint->ima_hash->xattr) - offset) +
  57. iint->ima_hash->length, 0);
  58. return rc;
  59. }
  60. /* Return specific func appraised cached result */
  61. enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
  62. enum ima_hooks func)
  63. {
  64. switch (func) {
  65. case MMAP_CHECK:
  66. return iint->ima_mmap_status;
  67. case BPRM_CHECK:
  68. return iint->ima_bprm_status;
  69. case FILE_CHECK:
  70. case POST_SETATTR:
  71. return iint->ima_file_status;
  72. case MODULE_CHECK ... MAX_CHECK - 1:
  73. default:
  74. return iint->ima_read_status;
  75. }
  76. }
  77. static void ima_set_cache_status(struct integrity_iint_cache *iint,
  78. enum ima_hooks func,
  79. enum integrity_status status)
  80. {
  81. switch (func) {
  82. case MMAP_CHECK:
  83. iint->ima_mmap_status = status;
  84. break;
  85. case BPRM_CHECK:
  86. iint->ima_bprm_status = status;
  87. break;
  88. case FILE_CHECK:
  89. case POST_SETATTR:
  90. iint->ima_file_status = status;
  91. break;
  92. case MODULE_CHECK ... MAX_CHECK - 1:
  93. default:
  94. iint->ima_read_status = status;
  95. break;
  96. }
  97. }
  98. static void ima_cache_flags(struct integrity_iint_cache *iint,
  99. enum ima_hooks func)
  100. {
  101. switch (func) {
  102. case MMAP_CHECK:
  103. iint->flags |= (IMA_MMAP_APPRAISED | IMA_APPRAISED);
  104. break;
  105. case BPRM_CHECK:
  106. iint->flags |= (IMA_BPRM_APPRAISED | IMA_APPRAISED);
  107. break;
  108. case FILE_CHECK:
  109. case POST_SETATTR:
  110. iint->flags |= (IMA_FILE_APPRAISED | IMA_APPRAISED);
  111. break;
  112. case MODULE_CHECK ... MAX_CHECK - 1:
  113. default:
  114. iint->flags |= (IMA_READ_APPRAISED | IMA_APPRAISED);
  115. break;
  116. }
  117. }
  118. enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
  119. int xattr_len)
  120. {
  121. struct signature_v2_hdr *sig;
  122. if (!xattr_value || xattr_len < 2)
  123. /* return default hash algo */
  124. return ima_hash_algo;
  125. switch (xattr_value->type) {
  126. case EVM_IMA_XATTR_DIGSIG:
  127. sig = (typeof(sig))xattr_value;
  128. if (sig->version != 2 || xattr_len <= sizeof(*sig))
  129. return ima_hash_algo;
  130. return sig->hash_algo;
  131. break;
  132. case IMA_XATTR_DIGEST_NG:
  133. return xattr_value->digest[0];
  134. break;
  135. case IMA_XATTR_DIGEST:
  136. /* this is for backward compatibility */
  137. if (xattr_len == 21) {
  138. unsigned int zero = 0;
  139. if (!memcmp(&xattr_value->digest[16], &zero, 4))
  140. return HASH_ALGO_MD5;
  141. else
  142. return HASH_ALGO_SHA1;
  143. } else if (xattr_len == 17)
  144. return HASH_ALGO_MD5;
  145. break;
  146. }
  147. /* return default hash algo */
  148. return ima_hash_algo;
  149. }
  150. int ima_read_xattr(struct dentry *dentry,
  151. struct evm_ima_xattr_data **xattr_value)
  152. {
  153. ssize_t ret;
  154. ret = vfs_getxattr_alloc(dentry, XATTR_NAME_IMA, (char **)xattr_value,
  155. 0, GFP_NOFS);
  156. if (ret == -EOPNOTSUPP)
  157. ret = 0;
  158. return ret;
  159. }
  160. /*
  161. * ima_appraise_measurement - appraise file measurement
  162. *
  163. * Call evm_verifyxattr() to verify the integrity of 'security.ima'.
  164. * Assuming success, compare the xattr hash with the collected measurement.
  165. *
  166. * Return 0 on success, error code otherwise
  167. */
  168. int ima_appraise_measurement(enum ima_hooks func,
  169. struct integrity_iint_cache *iint,
  170. struct file *file, const unsigned char *filename,
  171. struct evm_ima_xattr_data *xattr_value,
  172. int xattr_len, int opened)
  173. {
  174. static const char op[] = "appraise_data";
  175. char *cause = "unknown";
  176. struct dentry *dentry = file_dentry(file);
  177. struct inode *inode = d_backing_inode(dentry);
  178. enum integrity_status status = INTEGRITY_UNKNOWN;
  179. int rc = xattr_len, hash_start = 0;
  180. if (!(inode->i_opflags & IOP_XATTR))
  181. return INTEGRITY_UNKNOWN;
  182. if (rc <= 0) {
  183. if (rc && rc != -ENODATA)
  184. goto out;
  185. cause = "missing-hash";
  186. status = INTEGRITY_NOLABEL;
  187. if (opened & FILE_CREATED)
  188. iint->flags |= IMA_NEW_FILE;
  189. if ((iint->flags & IMA_NEW_FILE) &&
  190. (!(iint->flags & IMA_DIGSIG_REQUIRED) ||
  191. (inode->i_size == 0)))
  192. status = INTEGRITY_PASS;
  193. goto out;
  194. }
  195. status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);
  196. if ((status != INTEGRITY_PASS) && (status != INTEGRITY_UNKNOWN)) {
  197. if ((status == INTEGRITY_NOLABEL)
  198. || (status == INTEGRITY_NOXATTRS))
  199. cause = "missing-HMAC";
  200. else if (status == INTEGRITY_FAIL)
  201. cause = "invalid-HMAC";
  202. goto out;
  203. }
  204. switch (xattr_value->type) {
  205. case IMA_XATTR_DIGEST_NG:
  206. /* first byte contains algorithm id */
  207. hash_start = 1;
  208. case IMA_XATTR_DIGEST:
  209. if (iint->flags & IMA_DIGSIG_REQUIRED) {
  210. cause = "IMA-signature-required";
  211. status = INTEGRITY_FAIL;
  212. break;
  213. }
  214. if (xattr_len - sizeof(xattr_value->type) - hash_start >=
  215. iint->ima_hash->length)
  216. /* xattr length may be longer. md5 hash in previous
  217. version occupied 20 bytes in xattr, instead of 16
  218. */
  219. rc = memcmp(&xattr_value->digest[hash_start],
  220. iint->ima_hash->digest,
  221. iint->ima_hash->length);
  222. else
  223. rc = -EINVAL;
  224. if (rc) {
  225. cause = "invalid-hash";
  226. status = INTEGRITY_FAIL;
  227. break;
  228. }
  229. status = INTEGRITY_PASS;
  230. break;
  231. case EVM_IMA_XATTR_DIGSIG:
  232. iint->flags |= IMA_DIGSIG;
  233. rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
  234. (const char *)xattr_value, rc,
  235. iint->ima_hash->digest,
  236. iint->ima_hash->length);
  237. if (rc == -EOPNOTSUPP) {
  238. status = INTEGRITY_UNKNOWN;
  239. } else if (rc) {
  240. cause = "invalid-signature";
  241. status = INTEGRITY_FAIL;
  242. } else {
  243. status = INTEGRITY_PASS;
  244. }
  245. break;
  246. default:
  247. status = INTEGRITY_UNKNOWN;
  248. cause = "unknown-ima-data";
  249. break;
  250. }
  251. out:
  252. if (status != INTEGRITY_PASS) {
  253. if ((ima_appraise & IMA_APPRAISE_FIX) &&
  254. (!xattr_value ||
  255. xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
  256. if (!ima_fix_xattr(dentry, iint))
  257. status = INTEGRITY_PASS;
  258. } else if ((inode->i_size == 0) &&
  259. (iint->flags & IMA_NEW_FILE) &&
  260. (xattr_value &&
  261. xattr_value->type == EVM_IMA_XATTR_DIGSIG)) {
  262. status = INTEGRITY_PASS;
  263. }
  264. integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
  265. op, cause, rc, 0);
  266. } else {
  267. ima_cache_flags(iint, func);
  268. }
  269. ima_set_cache_status(iint, func, status);
  270. return status;
  271. }
  272. /*
  273. * ima_update_xattr - update 'security.ima' hash value
  274. */
  275. void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
  276. {
  277. struct dentry *dentry = file_dentry(file);
  278. int rc = 0;
  279. /* do not collect and update hash for digital signatures */
  280. if (iint->flags & IMA_DIGSIG)
  281. return;
  282. if (iint->ima_file_status != INTEGRITY_PASS)
  283. return;
  284. rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo);
  285. if (rc < 0)
  286. return;
  287. ima_fix_xattr(dentry, iint);
  288. }
  289. /**
  290. * ima_inode_post_setattr - reflect file metadata changes
  291. * @dentry: pointer to the affected dentry
  292. *
  293. * Changes to a dentry's metadata might result in needing to appraise.
  294. *
  295. * This function is called from notify_change(), which expects the caller
  296. * to lock the inode's i_mutex.
  297. */
  298. void ima_inode_post_setattr(struct dentry *dentry)
  299. {
  300. struct inode *inode = d_backing_inode(dentry);
  301. struct integrity_iint_cache *iint;
  302. int must_appraise;
  303. if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)
  304. || !(inode->i_opflags & IOP_XATTR))
  305. return;
  306. must_appraise = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
  307. iint = integrity_iint_find(inode);
  308. if (iint) {
  309. iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED |
  310. IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
  311. IMA_ACTION_RULE_FLAGS);
  312. if (must_appraise)
  313. iint->flags |= IMA_APPRAISE;
  314. }
  315. if (!must_appraise)
  316. __vfs_removexattr(dentry, XATTR_NAME_IMA);
  317. }
  318. /*
  319. * ima_protect_xattr - protect 'security.ima'
  320. *
  321. * Ensure that not just anyone can modify or remove 'security.ima'.
  322. */
  323. static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
  324. const void *xattr_value, size_t xattr_value_len)
  325. {
  326. if (strcmp(xattr_name, XATTR_NAME_IMA) == 0) {
  327. if (!capable(CAP_SYS_ADMIN))
  328. return -EPERM;
  329. return 1;
  330. }
  331. return 0;
  332. }
  333. static void ima_reset_appraise_flags(struct inode *inode, int digsig)
  334. {
  335. struct integrity_iint_cache *iint;
  336. if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode))
  337. return;
  338. iint = integrity_iint_find(inode);
  339. if (!iint)
  340. return;
  341. iint->flags &= ~IMA_DONE_MASK;
  342. iint->measured_pcrs = 0;
  343. if (digsig)
  344. iint->flags |= IMA_DIGSIG;
  345. return;
  346. }
  347. int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
  348. const void *xattr_value, size_t xattr_value_len)
  349. {
  350. const struct evm_ima_xattr_data *xvalue = xattr_value;
  351. int result;
  352. result = ima_protect_xattr(dentry, xattr_name, xattr_value,
  353. xattr_value_len);
  354. if (result == 1) {
  355. if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
  356. return -EINVAL;
  357. ima_reset_appraise_flags(d_backing_inode(dentry),
  358. (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
  359. result = 0;
  360. }
  361. return result;
  362. }
  363. int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name)
  364. {
  365. int result;
  366. result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
  367. if (result == 1) {
  368. ima_reset_appraise_flags(d_backing_inode(dentry), 0);
  369. result = 0;
  370. }
  371. return result;
  372. }