Commit | Line | Data |
---|---|---|
3323eec9 MZ |
1 | /* |
2 | * Copyright (C) 2008 IBM Corporation | |
3 | * Author: Mimi Zohar <zohar@us.ibm.com> | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of the GNU General Public License as published by | |
7 | * the Free Software Foundation, version 2 of the License. | |
8 | * | |
9 | * ima_policy.c | |
10 | * - initialize default measure policy rules | |
11 | * | |
12 | */ | |
13 | #include <linux/module.h> | |
14 | #include <linux/list.h> | |
3323eec9 MZ |
15 | #include <linux/security.h> |
16 | #include <linux/magic.h> | |
4af4662f | 17 | #include <linux/parser.h> |
5a0e3ad6 | 18 | #include <linux/slab.h> |
3323eec9 MZ |
19 | |
20 | #include "ima.h" | |
21 | ||
22 | /* flags definitions */ | |
23 | #define IMA_FUNC 0x0001 | |
24 | #define IMA_MASK 0x0002 | |
25 | #define IMA_FSMAGIC 0x0004 | |
26 | #define IMA_UID 0x0008 | |
27 | ||
4af4662f MZ |
28 | enum ima_action { UNKNOWN = -1, DONT_MEASURE = 0, MEASURE }; |
29 | ||
30 | #define MAX_LSM_RULES 6 | |
31 | enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, | |
32 | LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE | |
33 | }; | |
3323eec9 MZ |
34 | |
35 | struct ima_measure_rule_entry { | |
36 | struct list_head list; | |
37 | enum ima_action action; | |
38 | unsigned int flags; | |
39 | enum ima_hooks func; | |
40 | int mask; | |
41 | unsigned long fsmagic; | |
42 | uid_t uid; | |
4af4662f MZ |
43 | struct { |
44 | void *rule; /* LSM file metadata specific */ | |
45 | int type; /* audit type */ | |
46 | } lsm[MAX_LSM_RULES]; | |
3323eec9 MZ |
47 | }; |
48 | ||
5789ba3b EP |
49 | /* |
50 | * Without LSM specific knowledge, the default policy can only be | |
4af4662f MZ |
51 | * written in terms of .action, .func, .mask, .fsmagic, and .uid |
52 | */ | |
5789ba3b EP |
53 | |
54 | /* | |
55 | * The minimum rule set to allow for full TCB coverage. Measures all files | |
56 | * opened or mmap for exec and everything read by root. Dangerous because | |
57 | * normal users can easily run the machine out of memory simply building | |
58 | * and running executables. | |
59 | */ | |
3323eec9 | 60 | static struct ima_measure_rule_entry default_rules[] = { |
75834fc3 | 61 | {.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC}, |
3323eec9 MZ |
62 | {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC}, |
63 | {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC}, | |
64 | {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC}, | |
75834fc3 EP |
65 | {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC}, |
66 | {.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC}, | |
3323eec9 MZ |
67 | {.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC, |
68 | .flags = IMA_FUNC | IMA_MASK}, | |
69 | {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC, | |
70 | .flags = IMA_FUNC | IMA_MASK}, | |
1e93d005 | 71 | {.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = 0, |
5789ba3b | 72 | .flags = IMA_FUNC | IMA_MASK | IMA_UID}, |
3323eec9 MZ |
73 | }; |
74 | ||
75 | static LIST_HEAD(measure_default_rules); | |
4af4662f | 76 | static LIST_HEAD(measure_policy_rules); |
3323eec9 MZ |
77 | static struct list_head *ima_measure; |
78 | ||
4af4662f MZ |
79 | static DEFINE_MUTEX(ima_measure_mutex); |
80 | ||
5789ba3b EP |
81 | static bool ima_use_tcb __initdata; |
82 | static int __init default_policy_setup(char *str) | |
83 | { | |
84 | ima_use_tcb = 1; | |
85 | return 1; | |
86 | } | |
87 | __setup("ima_tcb", default_policy_setup); | |
88 | ||
3323eec9 MZ |
89 | /** |
90 | * ima_match_rules - determine whether an inode matches the measure rule. | |
91 | * @rule: a pointer to a rule | |
92 | * @inode: a pointer to an inode | |
93 | * @func: LIM hook identifier | |
94 | * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) | |
95 | * | |
96 | * Returns true on rule match, false on failure. | |
97 | */ | |
98 | static bool ima_match_rules(struct ima_measure_rule_entry *rule, | |
99 | struct inode *inode, enum ima_hooks func, int mask) | |
100 | { | |
101 | struct task_struct *tsk = current; | |
4af4662f | 102 | int i; |
3323eec9 MZ |
103 | |
104 | if ((rule->flags & IMA_FUNC) && rule->func != func) | |
105 | return false; | |
106 | if ((rule->flags & IMA_MASK) && rule->mask != mask) | |
107 | return false; | |
108 | if ((rule->flags & IMA_FSMAGIC) | |
109 | && rule->fsmagic != inode->i_sb->s_magic) | |
110 | return false; | |
111 | if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid) | |
112 | return false; | |
4af4662f | 113 | for (i = 0; i < MAX_LSM_RULES; i++) { |
53fc0e22 | 114 | int rc = 0; |
4af4662f MZ |
115 | u32 osid, sid; |
116 | ||
117 | if (!rule->lsm[i].rule) | |
118 | continue; | |
119 | ||
120 | switch (i) { | |
121 | case LSM_OBJ_USER: | |
122 | case LSM_OBJ_ROLE: | |
123 | case LSM_OBJ_TYPE: | |
124 | security_inode_getsecid(inode, &osid); | |
125 | rc = security_filter_rule_match(osid, | |
126 | rule->lsm[i].type, | |
53fc0e22 | 127 | Audit_equal, |
4af4662f MZ |
128 | rule->lsm[i].rule, |
129 | NULL); | |
130 | break; | |
131 | case LSM_SUBJ_USER: | |
132 | case LSM_SUBJ_ROLE: | |
133 | case LSM_SUBJ_TYPE: | |
134 | security_task_getsecid(tsk, &sid); | |
135 | rc = security_filter_rule_match(sid, | |
136 | rule->lsm[i].type, | |
53fc0e22 | 137 | Audit_equal, |
4af4662f MZ |
138 | rule->lsm[i].rule, |
139 | NULL); | |
140 | default: | |
141 | break; | |
142 | } | |
143 | if (!rc) | |
144 | return false; | |
145 | } | |
3323eec9 MZ |
146 | return true; |
147 | } | |
148 | ||
149 | /** | |
150 | * ima_match_policy - decision based on LSM and other conditions | |
151 | * @inode: pointer to an inode for which the policy decision is being made | |
152 | * @func: IMA hook identifier | |
153 | * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) | |
154 | * | |
155 | * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type) | |
156 | * conditions. | |
157 | * | |
158 | * (There is no need for locking when walking the policy list, | |
159 | * as elements in the list are never deleted, nor does the list | |
160 | * change.) | |
161 | */ | |
162 | int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask) | |
163 | { | |
164 | struct ima_measure_rule_entry *entry; | |
165 | ||
166 | list_for_each_entry(entry, ima_measure, list) { | |
167 | bool rc; | |
168 | ||
169 | rc = ima_match_rules(entry, inode, func, mask); | |
170 | if (rc) | |
171 | return entry->action; | |
172 | } | |
173 | return 0; | |
174 | } | |
175 | ||
176 | /** | |
177 | * ima_init_policy - initialize the default measure rules. | |
178 | * | |
3323eec9 | 179 | * ima_measure points to either the measure_default_rules or the |
4af4662f | 180 | * the new measure_policy_rules. |
3323eec9 | 181 | */ |
932995f0 | 182 | void __init ima_init_policy(void) |
3323eec9 | 183 | { |
5789ba3b EP |
184 | int i, entries; |
185 | ||
186 | /* if !ima_use_tcb set entries = 0 so we load NO default rules */ | |
187 | if (ima_use_tcb) | |
188 | entries = ARRAY_SIZE(default_rules); | |
189 | else | |
190 | entries = 0; | |
3323eec9 | 191 | |
5789ba3b | 192 | for (i = 0; i < entries; i++) |
3323eec9 MZ |
193 | list_add_tail(&default_rules[i].list, &measure_default_rules); |
194 | ima_measure = &measure_default_rules; | |
195 | } | |
4af4662f MZ |
196 | |
197 | /** | |
198 | * ima_update_policy - update default_rules with new measure rules | |
199 | * | |
200 | * Called on file .release to update the default rules with a complete new | |
201 | * policy. Once updated, the policy is locked, no additional rules can be | |
202 | * added to the policy. | |
203 | */ | |
204 | void ima_update_policy(void) | |
205 | { | |
206 | const char *op = "policy_update"; | |
207 | const char *cause = "already exists"; | |
208 | int result = 1; | |
209 | int audit_info = 0; | |
210 | ||
211 | if (ima_measure == &measure_default_rules) { | |
212 | ima_measure = &measure_policy_rules; | |
213 | cause = "complete"; | |
214 | result = 0; | |
215 | } | |
216 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
217 | NULL, op, cause, result, audit_info); | |
218 | } | |
219 | ||
220 | enum { | |
221 | Opt_err = -1, | |
222 | Opt_measure = 1, Opt_dont_measure, | |
223 | Opt_obj_user, Opt_obj_role, Opt_obj_type, | |
224 | Opt_subj_user, Opt_subj_role, Opt_subj_type, | |
225 | Opt_func, Opt_mask, Opt_fsmagic, Opt_uid | |
226 | }; | |
227 | ||
228 | static match_table_t policy_tokens = { | |
229 | {Opt_measure, "measure"}, | |
230 | {Opt_dont_measure, "dont_measure"}, | |
231 | {Opt_obj_user, "obj_user=%s"}, | |
232 | {Opt_obj_role, "obj_role=%s"}, | |
233 | {Opt_obj_type, "obj_type=%s"}, | |
234 | {Opt_subj_user, "subj_user=%s"}, | |
235 | {Opt_subj_role, "subj_role=%s"}, | |
236 | {Opt_subj_type, "subj_type=%s"}, | |
237 | {Opt_func, "func=%s"}, | |
238 | {Opt_mask, "mask=%s"}, | |
239 | {Opt_fsmagic, "fsmagic=%s"}, | |
240 | {Opt_uid, "uid=%s"}, | |
241 | {Opt_err, NULL} | |
242 | }; | |
243 | ||
244 | static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry, | |
245 | char *args, int lsm_rule, int audit_type) | |
246 | { | |
247 | int result; | |
248 | ||
249 | entry->lsm[lsm_rule].type = audit_type; | |
250 | result = security_filter_rule_init(entry->lsm[lsm_rule].type, | |
53fc0e22 | 251 | Audit_equal, args, |
4af4662f MZ |
252 | &entry->lsm[lsm_rule].rule); |
253 | return result; | |
254 | } | |
255 | ||
256 | static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry) | |
257 | { | |
258 | struct audit_buffer *ab; | |
259 | char *p; | |
260 | int result = 0; | |
261 | ||
523979ad | 262 | ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE); |
4af4662f MZ |
263 | |
264 | entry->action = -1; | |
265 | while ((p = strsep(&rule, " \n")) != NULL) { | |
266 | substring_t args[MAX_OPT_ARGS]; | |
267 | int token; | |
268 | unsigned long lnum; | |
269 | ||
270 | if (result < 0) | |
271 | break; | |
272 | if (!*p) | |
273 | continue; | |
274 | token = match_token(p, policy_tokens, args); | |
275 | switch (token) { | |
276 | case Opt_measure: | |
277 | audit_log_format(ab, "%s ", "measure"); | |
278 | entry->action = MEASURE; | |
279 | break; | |
280 | case Opt_dont_measure: | |
281 | audit_log_format(ab, "%s ", "dont_measure"); | |
282 | entry->action = DONT_MEASURE; | |
283 | break; | |
284 | case Opt_func: | |
285 | audit_log_format(ab, "func=%s ", args[0].from); | |
1e93d005 MZ |
286 | if (strcmp(args[0].from, "FILE_CHECK") == 0) |
287 | entry->func = FILE_CHECK; | |
288 | /* PATH_CHECK is for backwards compat */ | |
289 | else if (strcmp(args[0].from, "PATH_CHECK") == 0) | |
290 | entry->func = FILE_CHECK; | |
4af4662f MZ |
291 | else if (strcmp(args[0].from, "FILE_MMAP") == 0) |
292 | entry->func = FILE_MMAP; | |
293 | else if (strcmp(args[0].from, "BPRM_CHECK") == 0) | |
294 | entry->func = BPRM_CHECK; | |
295 | else | |
296 | result = -EINVAL; | |
297 | if (!result) | |
298 | entry->flags |= IMA_FUNC; | |
299 | break; | |
300 | case Opt_mask: | |
301 | audit_log_format(ab, "mask=%s ", args[0].from); | |
302 | if ((strcmp(args[0].from, "MAY_EXEC")) == 0) | |
303 | entry->mask = MAY_EXEC; | |
304 | else if (strcmp(args[0].from, "MAY_WRITE") == 0) | |
305 | entry->mask = MAY_WRITE; | |
306 | else if (strcmp(args[0].from, "MAY_READ") == 0) | |
307 | entry->mask = MAY_READ; | |
308 | else if (strcmp(args[0].from, "MAY_APPEND") == 0) | |
309 | entry->mask = MAY_APPEND; | |
310 | else | |
311 | result = -EINVAL; | |
312 | if (!result) | |
313 | entry->flags |= IMA_MASK; | |
314 | break; | |
315 | case Opt_fsmagic: | |
316 | audit_log_format(ab, "fsmagic=%s ", args[0].from); | |
317 | result = strict_strtoul(args[0].from, 16, | |
318 | &entry->fsmagic); | |
319 | if (!result) | |
320 | entry->flags |= IMA_FSMAGIC; | |
321 | break; | |
322 | case Opt_uid: | |
323 | audit_log_format(ab, "uid=%s ", args[0].from); | |
324 | result = strict_strtoul(args[0].from, 10, &lnum); | |
325 | if (!result) { | |
326 | entry->uid = (uid_t) lnum; | |
327 | if (entry->uid != lnum) | |
328 | result = -EINVAL; | |
329 | else | |
330 | entry->flags |= IMA_UID; | |
331 | } | |
332 | break; | |
333 | case Opt_obj_user: | |
334 | audit_log_format(ab, "obj_user=%s ", args[0].from); | |
335 | result = ima_lsm_rule_init(entry, args[0].from, | |
336 | LSM_OBJ_USER, | |
337 | AUDIT_OBJ_USER); | |
338 | break; | |
339 | case Opt_obj_role: | |
340 | audit_log_format(ab, "obj_role=%s ", args[0].from); | |
341 | result = ima_lsm_rule_init(entry, args[0].from, | |
342 | LSM_OBJ_ROLE, | |
343 | AUDIT_OBJ_ROLE); | |
344 | break; | |
345 | case Opt_obj_type: | |
346 | audit_log_format(ab, "obj_type=%s ", args[0].from); | |
347 | result = ima_lsm_rule_init(entry, args[0].from, | |
348 | LSM_OBJ_TYPE, | |
349 | AUDIT_OBJ_TYPE); | |
350 | break; | |
351 | case Opt_subj_user: | |
352 | audit_log_format(ab, "subj_user=%s ", args[0].from); | |
353 | result = ima_lsm_rule_init(entry, args[0].from, | |
354 | LSM_SUBJ_USER, | |
355 | AUDIT_SUBJ_USER); | |
356 | break; | |
357 | case Opt_subj_role: | |
358 | audit_log_format(ab, "subj_role=%s ", args[0].from); | |
359 | result = ima_lsm_rule_init(entry, args[0].from, | |
360 | LSM_SUBJ_ROLE, | |
361 | AUDIT_SUBJ_ROLE); | |
362 | break; | |
363 | case Opt_subj_type: | |
364 | audit_log_format(ab, "subj_type=%s ", args[0].from); | |
365 | result = ima_lsm_rule_init(entry, args[0].from, | |
366 | LSM_SUBJ_TYPE, | |
367 | AUDIT_SUBJ_TYPE); | |
368 | break; | |
369 | case Opt_err: | |
523979ad | 370 | audit_log_format(ab, "UNKNOWN=%s ", p); |
4af4662f MZ |
371 | break; |
372 | } | |
373 | } | |
374 | if (entry->action == UNKNOWN) | |
375 | result = -EINVAL; | |
376 | ||
523979ad | 377 | audit_log_format(ab, "res=%d", !result ? 0 : 1); |
4af4662f MZ |
378 | audit_log_end(ab); |
379 | return result; | |
380 | } | |
381 | ||
382 | /** | |
383 | * ima_parse_add_rule - add a rule to measure_policy_rules | |
384 | * @rule - ima measurement policy rule | |
385 | * | |
386 | * Uses a mutex to protect the policy list from multiple concurrent writers. | |
387 | * Returns 0 on success, an error code on failure. | |
388 | */ | |
389 | int ima_parse_add_rule(char *rule) | |
390 | { | |
523979ad | 391 | const char *op = "update_policy"; |
4af4662f MZ |
392 | struct ima_measure_rule_entry *entry; |
393 | int result = 0; | |
394 | int audit_info = 0; | |
395 | ||
396 | /* Prevent installed policy from changing */ | |
397 | if (ima_measure != &measure_default_rules) { | |
398 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
399 | NULL, op, "already exists", | |
400 | -EACCES, audit_info); | |
401 | return -EACCES; | |
402 | } | |
403 | ||
404 | entry = kzalloc(sizeof(*entry), GFP_KERNEL); | |
405 | if (!entry) { | |
406 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
407 | NULL, op, "-ENOMEM", -ENOMEM, audit_info); | |
408 | return -ENOMEM; | |
409 | } | |
410 | ||
411 | INIT_LIST_HEAD(&entry->list); | |
412 | ||
413 | result = ima_parse_rule(rule, entry); | |
414 | if (!result) { | |
415 | mutex_lock(&ima_measure_mutex); | |
416 | list_add_tail(&entry->list, &measure_policy_rules); | |
417 | mutex_unlock(&ima_measure_mutex); | |
523979ad | 418 | } else { |
4af4662f | 419 | kfree(entry); |
523979ad MZ |
420 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, |
421 | NULL, op, "invalid policy", result, | |
422 | audit_info); | |
423 | } | |
4af4662f MZ |
424 | return result; |
425 | } | |
426 | ||
427 | /* ima_delete_rules called to cleanup invalid policy */ | |
64c61d80 | 428 | void ima_delete_rules(void) |
4af4662f MZ |
429 | { |
430 | struct ima_measure_rule_entry *entry, *tmp; | |
431 | ||
432 | mutex_lock(&ima_measure_mutex); | |
433 | list_for_each_entry_safe(entry, tmp, &measure_policy_rules, list) { | |
434 | list_del(&entry->list); | |
435 | kfree(entry); | |
436 | } | |
437 | mutex_unlock(&ima_measure_mutex); | |
438 | } |