ima_api.c 8.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313
  1. /*
  2. * Copyright (C) 2008 IBM Corporation
  3. *
  4. * Author: Mimi Zohar <zohar@us.ibm.com>
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License as
  8. * published by the Free Software Foundation, version 2 of the
  9. * License.
  10. *
  11. * File: ima_api.c
  12. * Implements must_appraise_or_measure, collect_measurement,
  13. * appraise_measurement, store_measurement and store_template.
  14. */
  15. #include <linux/module.h>
  16. #include <linux/slab.h>
  17. #include <linux/file.h>
  18. #include <linux/fs.h>
  19. #include <linux/xattr.h>
  20. #include <linux/evm.h>
  21. #include <crypto/hash_info.h>
  22. #include "ima.h"
  23. /*
  24. * ima_alloc_init_template - create and initialize a new template entry
  25. */
  26. int ima_alloc_init_template(struct integrity_iint_cache *iint,
  27. struct file *file, const unsigned char *filename,
  28. struct ima_template_entry **entry)
  29. {
  30. struct ima_template_desc *template_desc = ima_template_desc_current();
  31. int i, result = 0;
  32. *entry = kzalloc(sizeof(**entry) + template_desc->num_fields *
  33. sizeof(struct ima_field_data), GFP_NOFS);
  34. if (!*entry)
  35. return -ENOMEM;
  36. for (i = 0; i < template_desc->num_fields; i++) {
  37. struct ima_template_field *field = template_desc->fields[i];
  38. u32 len;
  39. result = field->field_init(iint, file, filename,
  40. &((*entry)->template_data[i]));
  41. if (result != 0)
  42. goto out;
  43. len = (*entry)->template_data[i].len;
  44. (*entry)->template_data_len += sizeof(len);
  45. (*entry)->template_data_len += len;
  46. }
  47. (*entry)->template_desc = template_desc;
  48. return 0;
  49. out:
  50. kfree(*entry);
  51. *entry = NULL;
  52. return result;
  53. }
  54. /*
  55. * ima_store_template - store ima template measurements
  56. *
  57. * Calculate the hash of a template entry, add the template entry
  58. * to an ordered list of measurement entries maintained inside the kernel,
  59. * and also update the aggregate integrity value (maintained inside the
  60. * configured TPM PCR) over the hashes of the current list of measurement
  61. * entries.
  62. *
  63. * Applications retrieve the current kernel-held measurement list through
  64. * the securityfs entries in /sys/kernel/security/ima. The signed aggregate
  65. * TPM PCR (called quote) can be retrieved using a TPM user space library
  66. * and is used to validate the measurement list.
  67. *
  68. * Returns 0 on success, error code otherwise
  69. */
  70. int ima_store_template(struct ima_template_entry *entry,
  71. int violation, struct inode *inode,
  72. const unsigned char *filename)
  73. {
  74. const char *op = "add_template_measure";
  75. const char *audit_cause = "hashing_error";
  76. char *template_name = entry->template_desc->name;
  77. int result;
  78. struct {
  79. struct ima_digest_data hdr;
  80. char digest[TPM_DIGEST_SIZE];
  81. } hash;
  82. if (!violation) {
  83. int num_fields = entry->template_desc->num_fields;
  84. /* this function uses default algo */
  85. hash.hdr.algo = HASH_ALGO_SHA1;
  86. result = ima_calc_field_array_hash(&entry->template_data[0],
  87. num_fields, &hash.hdr);
  88. if (result < 0) {
  89. integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
  90. template_name, op,
  91. audit_cause, result, 0);
  92. return result;
  93. }
  94. memcpy(entry->digest, hash.hdr.digest, hash.hdr.length);
  95. }
  96. result = ima_add_template_entry(entry, violation, op, inode, filename);
  97. return result;
  98. }
  99. /*
  100. * ima_add_violation - add violation to measurement list.
  101. *
  102. * Violations are flagged in the measurement list with zero hash values.
  103. * By extending the PCR with 0xFF's instead of with zeroes, the PCR
  104. * value is invalidated.
  105. */
  106. void ima_add_violation(struct file *file, const unsigned char *filename,
  107. const char *op, const char *cause)
  108. {
  109. struct ima_template_entry *entry;
  110. struct inode *inode = file->f_dentry->d_inode;
  111. int violation = 1;
  112. int result;
  113. /* can overflow, only indicator */
  114. atomic_long_inc(&ima_htable.violations);
  115. result = ima_alloc_init_template(NULL, file, filename, &entry);
  116. if (result < 0) {
  117. result = -ENOMEM;
  118. goto err_out;
  119. }
  120. result = ima_store_template(entry, violation, inode, filename);
  121. if (result < 0)
  122. kfree(entry);
  123. err_out:
  124. integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
  125. op, cause, result, 0);
  126. }
  127. /**
  128. * ima_get_action - appraise & measure decision based on policy.
  129. * @inode: pointer to inode to measure
  130. * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE)
  131. * @function: calling function (FILE_CHECK, BPRM_CHECK, MMAP_CHECK, MODULE_CHECK)
  132. *
  133. * The policy is defined in terms of keypairs:
  134. * subj=, obj=, type=, func=, mask=, fsmagic=
  135. * subj,obj, and type: are LSM specific.
  136. * func: FILE_CHECK | BPRM_CHECK | MMAP_CHECK | MODULE_CHECK
  137. * mask: contains the permission mask
  138. * fsmagic: hex value
  139. *
  140. * Returns IMA_MEASURE, IMA_APPRAISE mask.
  141. *
  142. */
  143. int ima_get_action(struct inode *inode, int mask, int function)
  144. {
  145. int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE;
  146. if (!ima_appraise)
  147. flags &= ~IMA_APPRAISE;
  148. return ima_match_policy(inode, function, mask, flags);
  149. }
  150. int ima_must_measure(struct inode *inode, int mask, int function)
  151. {
  152. return ima_match_policy(inode, function, mask, IMA_MEASURE);
  153. }
  154. /*
  155. * ima_collect_measurement - collect file measurement
  156. *
  157. * Calculate the file hash, if it doesn't already exist,
  158. * storing the measurement and i_version in the iint.
  159. *
  160. * Must be called with iint->mutex held.
  161. *
  162. * Return 0 on success, error code otherwise
  163. */
  164. int ima_collect_measurement(struct integrity_iint_cache *iint,
  165. struct file *file,
  166. struct evm_ima_xattr_data **xattr_value,
  167. int *xattr_len)
  168. {
  169. struct inode *inode = file_inode(file);
  170. const char *filename = file->f_dentry->d_name.name;
  171. int result = 0;
  172. struct {
  173. struct ima_digest_data hdr;
  174. char digest[IMA_MAX_DIGEST_SIZE];
  175. } hash;
  176. if (xattr_value)
  177. *xattr_len = ima_read_xattr(file->f_dentry, xattr_value);
  178. if (!(iint->flags & IMA_COLLECTED)) {
  179. u64 i_version = file_inode(file)->i_version;
  180. /* use default hash algorithm */
  181. hash.hdr.algo = ima_hash_algo;
  182. if (xattr_value)
  183. ima_get_hash_algo(*xattr_value, *xattr_len, &hash.hdr);
  184. result = ima_calc_file_hash(file, &hash.hdr);
  185. if (!result) {
  186. int length = sizeof(hash.hdr) + hash.hdr.length;
  187. void *tmpbuf = krealloc(iint->ima_hash, length,
  188. GFP_NOFS);
  189. if (tmpbuf) {
  190. iint->ima_hash = tmpbuf;
  191. memcpy(iint->ima_hash, &hash, length);
  192. iint->version = i_version;
  193. iint->flags |= IMA_COLLECTED;
  194. } else
  195. result = -ENOMEM;
  196. }
  197. }
  198. if (result)
  199. integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
  200. filename, "collect_data", "failed",
  201. result, 0);
  202. return result;
  203. }
  204. /*
  205. * ima_store_measurement - store file measurement
  206. *
  207. * Create an "ima" template and then store the template by calling
  208. * ima_store_template.
  209. *
  210. * We only get here if the inode has not already been measured,
  211. * but the measurement could already exist:
  212. * - multiple copies of the same file on either the same or
  213. * different filesystems.
  214. * - the inode was previously flushed as well as the iint info,
  215. * containing the hashing info.
  216. *
  217. * Must be called with iint->mutex held.
  218. */
  219. void ima_store_measurement(struct integrity_iint_cache *iint,
  220. struct file *file, const unsigned char *filename)
  221. {
  222. const char *op = "add_template_measure";
  223. const char *audit_cause = "ENOMEM";
  224. int result = -ENOMEM;
  225. struct inode *inode = file_inode(file);
  226. struct ima_template_entry *entry;
  227. int violation = 0;
  228. if (iint->flags & IMA_MEASURED)
  229. return;
  230. result = ima_alloc_init_template(iint, file, filename, &entry);
  231. if (result < 0) {
  232. integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
  233. op, audit_cause, result, 0);
  234. return;
  235. }
  236. result = ima_store_template(entry, violation, inode, filename);
  237. if (!result || result == -EEXIST)
  238. iint->flags |= IMA_MEASURED;
  239. if (result < 0)
  240. kfree(entry);
  241. }
  242. void ima_audit_measurement(struct integrity_iint_cache *iint,
  243. const unsigned char *filename)
  244. {
  245. struct audit_buffer *ab;
  246. char hash[(iint->ima_hash->length * 2) + 1];
  247. int i;
  248. if (iint->flags & IMA_AUDITED)
  249. return;
  250. for (i = 0; i < iint->ima_hash->length; i++)
  251. hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
  252. hash[i * 2] = '\0';
  253. ab = audit_log_start(current->audit_context, GFP_KERNEL,
  254. AUDIT_INTEGRITY_RULE);
  255. if (!ab)
  256. return;
  257. audit_log_format(ab, "file=");
  258. audit_log_untrustedstring(ab, filename);
  259. audit_log_format(ab, " hash=");
  260. audit_log_untrustedstring(ab, hash);
  261. audit_log_task_info(ab, current);
  262. audit_log_end(ab);
  263. iint->flags |= IMA_AUDITED;
  264. }
  265. const char *ima_d_path(struct path *path, char **pathbuf)
  266. {
  267. char *pathname = NULL;
  268. /* We will allow 11 spaces for ' (deleted)' to be appended */
  269. *pathbuf = kmalloc(PATH_MAX + 11, GFP_KERNEL);
  270. if (*pathbuf) {
  271. pathname = d_path(path, *pathbuf, PATH_MAX + 11);
  272. if (IS_ERR(pathname)) {
  273. kfree(*pathbuf);
  274. *pathbuf = NULL;
  275. pathname = NULL;
  276. }
  277. }
  278. return pathname;
  279. }