ima_policy.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413
  1. /*
  2. * Copyright (C) 2008 IBM Corporation
  3. * Author: Mimi Zohar <zohar@us.ibm.com>
  4. *
  5. * This program is free software; you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License as published by
  7. * the Free Software Foundation, version 2 of the License.
  8. *
  9. * ima_policy.c
  10. * - initialize default measure policy rules
  11. *
  12. */
  13. #include <linux/module.h>
  14. #include <linux/list.h>
  15. #include <linux/audit.h>
  16. #include <linux/security.h>
  17. #include <linux/magic.h>
  18. #include <linux/parser.h>
  19. #include "ima.h"
  20. /* flags definitions */
  21. #define IMA_FUNC 0x0001
  22. #define IMA_MASK 0x0002
  23. #define IMA_FSMAGIC 0x0004
  24. #define IMA_UID 0x0008
  25. enum ima_action { UNKNOWN = -1, DONT_MEASURE = 0, MEASURE };
  26. #define MAX_LSM_RULES 6
  27. enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  28. LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  29. };
  30. struct ima_measure_rule_entry {
  31. struct list_head list;
  32. enum ima_action action;
  33. unsigned int flags;
  34. enum ima_hooks func;
  35. int mask;
  36. unsigned long fsmagic;
  37. uid_t uid;
  38. struct {
  39. void *rule; /* LSM file metadata specific */
  40. int type; /* audit type */
  41. } lsm[MAX_LSM_RULES];
  42. };
  43. /* Without LSM specific knowledge, the default policy can only be
  44. * written in terms of .action, .func, .mask, .fsmagic, and .uid
  45. */
  46. static struct ima_measure_rule_entry default_rules[] = {
  47. {.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,
  48. .flags = IMA_FSMAGIC},
  49. {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
  50. {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
  51. {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
  52. {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,
  53. .flags = IMA_FSMAGIC},
  54. {.action = DONT_MEASURE,.fsmagic = 0xF97CFF8C,.flags = IMA_FSMAGIC},
  55. {.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC,
  56. .flags = IMA_FUNC | IMA_MASK},
  57. {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
  58. .flags = IMA_FUNC | IMA_MASK},
  59. {.action = MEASURE,.func = PATH_CHECK,.mask = MAY_READ,.uid = 0,
  60. .flags = IMA_FUNC | IMA_MASK | IMA_UID}
  61. };
  62. static LIST_HEAD(measure_default_rules);
  63. static LIST_HEAD(measure_policy_rules);
  64. static struct list_head *ima_measure;
  65. static DEFINE_MUTEX(ima_measure_mutex);
  66. /**
  67. * ima_match_rules - determine whether an inode matches the measure rule.
  68. * @rule: a pointer to a rule
  69. * @inode: a pointer to an inode
  70. * @func: LIM hook identifier
  71. * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
  72. *
  73. * Returns true on rule match, false on failure.
  74. */
  75. static bool ima_match_rules(struct ima_measure_rule_entry *rule,
  76. struct inode *inode, enum ima_hooks func, int mask)
  77. {
  78. struct task_struct *tsk = current;
  79. int i;
  80. if ((rule->flags & IMA_FUNC) && rule->func != func)
  81. return false;
  82. if ((rule->flags & IMA_MASK) && rule->mask != mask)
  83. return false;
  84. if ((rule->flags & IMA_FSMAGIC)
  85. && rule->fsmagic != inode->i_sb->s_magic)
  86. return false;
  87. if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid)
  88. return false;
  89. for (i = 0; i < MAX_LSM_RULES; i++) {
  90. int rc;
  91. u32 osid, sid;
  92. if (!rule->lsm[i].rule)
  93. continue;
  94. switch (i) {
  95. case LSM_OBJ_USER:
  96. case LSM_OBJ_ROLE:
  97. case LSM_OBJ_TYPE:
  98. security_inode_getsecid(inode, &osid);
  99. rc = security_filter_rule_match(osid,
  100. rule->lsm[i].type,
  101. AUDIT_EQUAL,
  102. rule->lsm[i].rule,
  103. NULL);
  104. break;
  105. case LSM_SUBJ_USER:
  106. case LSM_SUBJ_ROLE:
  107. case LSM_SUBJ_TYPE:
  108. security_task_getsecid(tsk, &sid);
  109. rc = security_filter_rule_match(sid,
  110. rule->lsm[i].type,
  111. AUDIT_EQUAL,
  112. rule->lsm[i].rule,
  113. NULL);
  114. default:
  115. break;
  116. }
  117. if (!rc)
  118. return false;
  119. }
  120. return true;
  121. }
  122. /**
  123. * ima_match_policy - decision based on LSM and other conditions
  124. * @inode: pointer to an inode for which the policy decision is being made
  125. * @func: IMA hook identifier
  126. * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
  127. *
  128. * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
  129. * conditions.
  130. *
  131. * (There is no need for locking when walking the policy list,
  132. * as elements in the list are never deleted, nor does the list
  133. * change.)
  134. */
  135. int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask)
  136. {
  137. struct ima_measure_rule_entry *entry;
  138. list_for_each_entry(entry, ima_measure, list) {
  139. bool rc;
  140. rc = ima_match_rules(entry, inode, func, mask);
  141. if (rc)
  142. return entry->action;
  143. }
  144. return 0;
  145. }
  146. /**
  147. * ima_init_policy - initialize the default measure rules.
  148. *
  149. * ima_measure points to either the measure_default_rules or the
  150. * the new measure_policy_rules.
  151. */
  152. void ima_init_policy(void)
  153. {
  154. int i;
  155. for (i = 0; i < ARRAY_SIZE(default_rules); i++)
  156. list_add_tail(&default_rules[i].list, &measure_default_rules);
  157. ima_measure = &measure_default_rules;
  158. }
  159. /**
  160. * ima_update_policy - update default_rules with new measure rules
  161. *
  162. * Called on file .release to update the default rules with a complete new
  163. * policy. Once updated, the policy is locked, no additional rules can be
  164. * added to the policy.
  165. */
  166. void ima_update_policy(void)
  167. {
  168. const char *op = "policy_update";
  169. const char *cause = "already exists";
  170. int result = 1;
  171. int audit_info = 0;
  172. if (ima_measure == &measure_default_rules) {
  173. ima_measure = &measure_policy_rules;
  174. cause = "complete";
  175. result = 0;
  176. }
  177. integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
  178. NULL, op, cause, result, audit_info);
  179. }
  180. enum {
  181. Opt_err = -1,
  182. Opt_measure = 1, Opt_dont_measure,
  183. Opt_obj_user, Opt_obj_role, Opt_obj_type,
  184. Opt_subj_user, Opt_subj_role, Opt_subj_type,
  185. Opt_func, Opt_mask, Opt_fsmagic, Opt_uid
  186. };
  187. static match_table_t policy_tokens = {
  188. {Opt_measure, "measure"},
  189. {Opt_dont_measure, "dont_measure"},
  190. {Opt_obj_user, "obj_user=%s"},
  191. {Opt_obj_role, "obj_role=%s"},
  192. {Opt_obj_type, "obj_type=%s"},
  193. {Opt_subj_user, "subj_user=%s"},
  194. {Opt_subj_role, "subj_role=%s"},
  195. {Opt_subj_type, "subj_type=%s"},
  196. {Opt_func, "func=%s"},
  197. {Opt_mask, "mask=%s"},
  198. {Opt_fsmagic, "fsmagic=%s"},
  199. {Opt_uid, "uid=%s"},
  200. {Opt_err, NULL}
  201. };
  202. static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry,
  203. char *args, int lsm_rule, int audit_type)
  204. {
  205. int result;
  206. entry->lsm[lsm_rule].type = audit_type;
  207. result = security_filter_rule_init(entry->lsm[lsm_rule].type,
  208. AUDIT_EQUAL, args,
  209. &entry->lsm[lsm_rule].rule);
  210. return result;
  211. }
  212. static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry)
  213. {
  214. struct audit_buffer *ab;
  215. char *p;
  216. int result = 0;
  217. ab = audit_log_start(current->audit_context, GFP_KERNEL,
  218. AUDIT_INTEGRITY_STATUS);
  219. entry->action = -1;
  220. while ((p = strsep(&rule, " \n")) != NULL) {
  221. substring_t args[MAX_OPT_ARGS];
  222. int token;
  223. unsigned long lnum;
  224. if (result < 0)
  225. break;
  226. if (!*p)
  227. continue;
  228. token = match_token(p, policy_tokens, args);
  229. switch (token) {
  230. case Opt_measure:
  231. audit_log_format(ab, "%s ", "measure");
  232. entry->action = MEASURE;
  233. break;
  234. case Opt_dont_measure:
  235. audit_log_format(ab, "%s ", "dont_measure");
  236. entry->action = DONT_MEASURE;
  237. break;
  238. case Opt_func:
  239. audit_log_format(ab, "func=%s ", args[0].from);
  240. if (strcmp(args[0].from, "PATH_CHECK") == 0)
  241. entry->func = PATH_CHECK;
  242. else if (strcmp(args[0].from, "FILE_MMAP") == 0)
  243. entry->func = FILE_MMAP;
  244. else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
  245. entry->func = BPRM_CHECK;
  246. else
  247. result = -EINVAL;
  248. if (!result)
  249. entry->flags |= IMA_FUNC;
  250. break;
  251. case Opt_mask:
  252. audit_log_format(ab, "mask=%s ", args[0].from);
  253. if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
  254. entry->mask = MAY_EXEC;
  255. else if (strcmp(args[0].from, "MAY_WRITE") == 0)
  256. entry->mask = MAY_WRITE;
  257. else if (strcmp(args[0].from, "MAY_READ") == 0)
  258. entry->mask = MAY_READ;
  259. else if (strcmp(args[0].from, "MAY_APPEND") == 0)
  260. entry->mask = MAY_APPEND;
  261. else
  262. result = -EINVAL;
  263. if (!result)
  264. entry->flags |= IMA_MASK;
  265. break;
  266. case Opt_fsmagic:
  267. audit_log_format(ab, "fsmagic=%s ", args[0].from);
  268. result = strict_strtoul(args[0].from, 16,
  269. &entry->fsmagic);
  270. if (!result)
  271. entry->flags |= IMA_FSMAGIC;
  272. break;
  273. case Opt_uid:
  274. audit_log_format(ab, "uid=%s ", args[0].from);
  275. result = strict_strtoul(args[0].from, 10, &lnum);
  276. if (!result) {
  277. entry->uid = (uid_t) lnum;
  278. if (entry->uid != lnum)
  279. result = -EINVAL;
  280. else
  281. entry->flags |= IMA_UID;
  282. }
  283. break;
  284. case Opt_obj_user:
  285. audit_log_format(ab, "obj_user=%s ", args[0].from);
  286. result = ima_lsm_rule_init(entry, args[0].from,
  287. LSM_OBJ_USER,
  288. AUDIT_OBJ_USER);
  289. break;
  290. case Opt_obj_role:
  291. audit_log_format(ab, "obj_role=%s ", args[0].from);
  292. result = ima_lsm_rule_init(entry, args[0].from,
  293. LSM_OBJ_ROLE,
  294. AUDIT_OBJ_ROLE);
  295. break;
  296. case Opt_obj_type:
  297. audit_log_format(ab, "obj_type=%s ", args[0].from);
  298. result = ima_lsm_rule_init(entry, args[0].from,
  299. LSM_OBJ_TYPE,
  300. AUDIT_OBJ_TYPE);
  301. break;
  302. case Opt_subj_user:
  303. audit_log_format(ab, "subj_user=%s ", args[0].from);
  304. result = ima_lsm_rule_init(entry, args[0].from,
  305. LSM_SUBJ_USER,
  306. AUDIT_SUBJ_USER);
  307. break;
  308. case Opt_subj_role:
  309. audit_log_format(ab, "subj_role=%s ", args[0].from);
  310. result = ima_lsm_rule_init(entry, args[0].from,
  311. LSM_SUBJ_ROLE,
  312. AUDIT_SUBJ_ROLE);
  313. break;
  314. case Opt_subj_type:
  315. audit_log_format(ab, "subj_type=%s ", args[0].from);
  316. result = ima_lsm_rule_init(entry, args[0].from,
  317. LSM_SUBJ_TYPE,
  318. AUDIT_SUBJ_TYPE);
  319. break;
  320. case Opt_err:
  321. printk(KERN_INFO "%s: unknown token: %s\n",
  322. __FUNCTION__, p);
  323. break;
  324. }
  325. }
  326. if (entry->action == UNKNOWN)
  327. result = -EINVAL;
  328. audit_log_format(ab, "res=%d", result);
  329. audit_log_end(ab);
  330. return result;
  331. }
  332. /**
  333. * ima_parse_add_rule - add a rule to measure_policy_rules
  334. * @rule - ima measurement policy rule
  335. *
  336. * Uses a mutex to protect the policy list from multiple concurrent writers.
  337. * Returns 0 on success, an error code on failure.
  338. */
  339. int ima_parse_add_rule(char *rule)
  340. {
  341. const char *op = "add_rule";
  342. struct ima_measure_rule_entry *entry;
  343. int result = 0;
  344. int audit_info = 0;
  345. /* Prevent installed policy from changing */
  346. if (ima_measure != &measure_default_rules) {
  347. integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
  348. NULL, op, "already exists",
  349. -EACCES, audit_info);
  350. return -EACCES;
  351. }
  352. entry = kzalloc(sizeof(*entry), GFP_KERNEL);
  353. if (!entry) {
  354. integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
  355. NULL, op, "-ENOMEM", -ENOMEM, audit_info);
  356. return -ENOMEM;
  357. }
  358. INIT_LIST_HEAD(&entry->list);
  359. result = ima_parse_rule(rule, entry);
  360. if (!result) {
  361. mutex_lock(&ima_measure_mutex);
  362. list_add_tail(&entry->list, &measure_policy_rules);
  363. mutex_unlock(&ima_measure_mutex);
  364. } else
  365. kfree(entry);
  366. return result;
  367. }
  368. /* ima_delete_rules called to cleanup invalid policy */
  369. void ima_delete_rules(void)
  370. {
  371. struct ima_measure_rule_entry *entry, *tmp;
  372. mutex_lock(&ima_measure_mutex);
  373. list_for_each_entry_safe(entry, tmp, &measure_policy_rules, list) {
  374. list_del(&entry->list);
  375. kfree(entry);
  376. }
  377. mutex_unlock(&ima_measure_mutex);
  378. }