Merge tag 'char-misc-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...
[linux-2.6-block.git] / security / integrity / ima / ima.h
CommitLineData
3323eec9
MZ
1/*
2 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
3 *
4 * Authors:
5 * Reiner Sailer <sailer@watson.ibm.com>
6 * Mimi Zohar <zohar@us.ibm.com>
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
11 * License.
12 *
13 * File: ima.h
14 * internal Integrity Measurement Architecture (IMA) definitions
15 */
16
17#ifndef __LINUX_IMA_H
18#define __LINUX_IMA_H
19
20#include <linux/types.h>
21#include <linux/crypto.h>
cf222217 22#include <linux/fs.h>
3323eec9
MZ
23#include <linux/security.h>
24#include <linux/hash.h>
25#include <linux/tpm.h>
26#include <linux/audit.h>
1525b06d 27#include <crypto/hash_info.h>
3323eec9 28
f381c272
MZ
29#include "../integrity.h"
30
3e8e5503 31enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
c019e307 32 IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
3323eec9
MZ
33enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
34
35/* digest size for IMA, fits SHA1 or MD5 */
f381c272 36#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
3323eec9
MZ
37#define IMA_EVENT_NAME_LEN_MAX 255
38
39#define IMA_HASH_BITS 9
40#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
41
adf53a77
RS
42#define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16
43#define IMA_TEMPLATE_NUM_FIELDS_MAX 15
44
3ce1217d
RS
45#define IMA_TEMPLATE_IMA_NAME "ima"
46#define IMA_TEMPLATE_IMA_FMT "d|n"
47
a756024e
RS
48/* current content of the policy */
49extern int ima_policy_flag;
50
3323eec9
MZ
51/* set during initialization */
52extern int ima_initialized;
53extern int ima_used_chip;
c7c8bb23 54extern int ima_hash_algo;
2fe5d6de 55extern int ima_appraise;
3323eec9 56
23b57419
RS
57/* IMA event related data */
58struct ima_event_data {
59 struct integrity_iint_cache *iint;
60 struct file *file;
61 const unsigned char *filename;
62 struct evm_ima_xattr_data *xattr_value;
63 int xattr_len;
8d94eb9b 64 const char *violation;
23b57419
RS
65};
66
adf53a77
RS
67/* IMA template field data definition */
68struct ima_field_data {
69 u8 *data;
70 u32 len;
71};
72
73/* IMA template field definition */
74struct ima_template_field {
75 const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
23b57419
RS
76 int (*field_init)(struct ima_event_data *event_data,
77 struct ima_field_data *field_data);
78 void (*field_show)(struct seq_file *m, enum ima_show_type show,
79 struct ima_field_data *field_data);
adf53a77
RS
80};
81
82/* IMA template descriptor definition */
83struct ima_template_desc {
84 char *name;
85 char *fmt;
86 int num_fields;
87 struct ima_template_field **fields;
88};
89
3323eec9 90struct ima_template_entry {
140d8022 91 u8 digest[TPM_DIGEST_SIZE]; /* sha1 or md5 measurement hash */
a71dc65d
RS
92 struct ima_template_desc *template_desc; /* template descriptor */
93 u32 template_data_len;
94 struct ima_field_data template_data[0]; /* template related data */
3323eec9
MZ
95};
96
97struct ima_queue_entry {
98 struct hlist_node hnext; /* place in hash collision list */
99 struct list_head later; /* place in ima_measurements list */
100 struct ima_template_entry *entry;
101};
102extern struct list_head ima_measurements; /* list of all measurements */
103
3323eec9 104/* Internal IMA function definitions */
3323eec9 105int ima_init(void);
bab73937 106int ima_fs_init(void);
3323eec9 107int ima_add_template_entry(struct ima_template_entry *entry, int violation,
9803d413
RS
108 const char *op, struct inode *inode,
109 const unsigned char *filename);
c7c8bb23 110int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
11d7646d
DK
111int ima_calc_buffer_hash(const void *buf, loff_t len,
112 struct ima_digest_data *hash);
b6f8f16f
RS
113int ima_calc_field_array_hash(struct ima_field_data *field_data,
114 struct ima_template_desc *desc, int num_fields,
a71dc65d 115 struct ima_digest_data *hash);
09ef5435 116int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
7d802a22 117void ima_add_violation(struct file *file, const unsigned char *filename,
8d94eb9b 118 struct integrity_iint_cache *iint,
3323eec9 119 const char *op, const char *cause);
76bb28f6 120int ima_init_crypto(void);
3ce1217d 121void ima_putc(struct seq_file *m, void *data, int datalen);
45b26133 122void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
a71dc65d
RS
123struct ima_template_desc *ima_template_desc_current(void);
124int ima_init_template(void);
3323eec9
MZ
125
126/*
127 * used to protect h_table and sha_table
128 */
129extern spinlock_t ima_queue_lock;
130
131struct ima_h_table {
132 atomic_long_t len; /* number of stored measurements in the list */
133 atomic_long_t violations;
134 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
135};
136extern struct ima_h_table ima_htable;
137
138static inline unsigned long ima_hash_key(u8 *digest)
139{
140 return hash_long(*digest, IMA_HASH_BITS);
141}
142
4ad87a3d
MZ
143enum ima_hooks {
144 FILE_CHECK = 1,
145 MMAP_CHECK,
146 BPRM_CHECK,
c6af8efe 147 POST_SETATTR,
4ad87a3d
MZ
148 MODULE_CHECK,
149 FIRMWARE_CHECK,
d9ddf077
MZ
150 KEXEC_KERNEL_CHECK,
151 KEXEC_INITRAMFS_CHECK,
19f8a847 152 POLICY_CHECK,
c6af8efe 153 MAX_CHECK
4ad87a3d
MZ
154};
155
3323eec9 156/* LIM API function definitions */
4ad87a3d
MZ
157int ima_get_action(struct inode *inode, int mask, enum ima_hooks func);
158int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
f381c272 159int ima_collect_measurement(struct integrity_iint_cache *iint,
cf222217
MZ
160 struct file *file, void *buf, loff_t size,
161 enum hash_algo algo);
f381c272 162void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
bcbc9b0c
MZ
163 const unsigned char *filename,
164 struct evm_ima_xattr_data *xattr_value,
165 int xattr_len);
e7c568e0
PM
166void ima_audit_measurement(struct integrity_iint_cache *iint,
167 const unsigned char *filename);
23b57419
RS
168int ima_alloc_init_template(struct ima_event_data *event_data,
169 struct ima_template_entry **entry);
3323eec9 170int ima_store_template(struct ima_template_entry *entry, int violation,
9803d413 171 struct inode *inode, const unsigned char *filename);
a7ed7c60 172void ima_free_template_entry(struct ima_template_entry *entry);
ea1046d4 173const char *ima_d_path(struct path *path, char **pathbuf);
3323eec9 174
3323eec9 175/* IMA policy related functions */
2fe5d6de
MZ
176int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
177 int flags);
3323eec9
MZ
178void ima_init_policy(void);
179void ima_update_policy(void);
a756024e 180void ima_update_policy_flag(void);
6ccd0456 181ssize_t ima_parse_add_rule(char *);
4af4662f 182void ima_delete_rules(void);
0112721d 183int ima_check_policy(void);
80eae209
PM
184void *ima_policy_start(struct seq_file *m, loff_t *pos);
185void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos);
186void ima_policy_stop(struct seq_file *m, void *v);
187int ima_policy_show(struct seq_file *m, void *v);
4af4662f 188
2fe5d6de
MZ
189/* Appraise integrity measurements */
190#define IMA_APPRAISE_ENFORCE 0x01
191#define IMA_APPRAISE_FIX 0x02
2faa6ef3
DK
192#define IMA_APPRAISE_LOG 0x04
193#define IMA_APPRAISE_MODULES 0x08
194#define IMA_APPRAISE_FIRMWARE 0x10
19f8a847 195#define IMA_APPRAISE_POLICY 0x20
2fe5d6de
MZ
196
197#ifdef CONFIG_IMA_APPRAISE
4ad87a3d
MZ
198int ima_appraise_measurement(enum ima_hooks func,
199 struct integrity_iint_cache *iint,
d3634d0f
DK
200 struct file *file, const unsigned char *filename,
201 struct evm_ima_xattr_data *xattr_value,
3034a146 202 int xattr_len, int opened);
d26e1936 203int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
2fe5d6de 204void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
d79d72e0 205enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
4ad87a3d 206 enum ima_hooks func);
1525b06d
DK
207enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
208 int xattr_len);
d3634d0f
DK
209int ima_read_xattr(struct dentry *dentry,
210 struct evm_ima_xattr_data **xattr_value);
2fe5d6de
MZ
211
212#else
4ad87a3d 213static inline int ima_appraise_measurement(enum ima_hooks func,
d79d72e0 214 struct integrity_iint_cache *iint,
2fe5d6de 215 struct file *file,
d3634d0f
DK
216 const unsigned char *filename,
217 struct evm_ima_xattr_data *xattr_value,
3034a146 218 int xattr_len, int opened)
2fe5d6de
MZ
219{
220 return INTEGRITY_UNKNOWN;
221}
222
d26e1936
DK
223static inline int ima_must_appraise(struct inode *inode, int mask,
224 enum ima_hooks func)
2fe5d6de
MZ
225{
226 return 0;
227}
228
229static inline void ima_update_xattr(struct integrity_iint_cache *iint,
230 struct file *file)
231{
232}
d79d72e0
MZ
233
234static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache
4ad87a3d
MZ
235 *iint,
236 enum ima_hooks func)
d79d72e0
MZ
237{
238 return INTEGRITY_UNKNOWN;
239}
d3634d0f 240
1525b06d
DK
241static inline enum hash_algo
242ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len)
d3634d0f 243{
1525b06d 244 return ima_hash_algo;
d3634d0f
DK
245}
246
247static inline int ima_read_xattr(struct dentry *dentry,
248 struct evm_ima_xattr_data **xattr_value)
249{
250 return 0;
251}
252
2fe5d6de
MZ
253#endif
254
4af4662f
MZ
255/* LSM based policy rules require audit */
256#ifdef CONFIG_IMA_LSM_RULES
257
258#define security_filter_rule_init security_audit_rule_init
259#define security_filter_rule_match security_audit_rule_match
260
261#else
262
263static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,
264 void **lsmrule)
265{
266 return -EINVAL;
267}
268
269static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,
270 void *lsmrule,
271 struct audit_context *actx)
272{
273 return -EINVAL;
274}
80eae209
PM
275#endif /* CONFIG_IMA_TRUSTED_KEYRING */
276
277#ifdef CONFIG_IMA_READ_POLICY
278#define POLICY_FILE_FLAGS (S_IWUSR | S_IRUSR)
279#else
280#define POLICY_FILE_FLAGS S_IWUSR
281#endif /* CONFIG_IMA_WRITE_POLICY */
282
283#endif /* __LINUX_IMA_H */