[linux-2.6-block.git] / security / integrity / ima / ima.h

/* SPDX-License-Identifier: GPL-2.0-only */
/*
 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
 *
 * Authors:
 * Reiner Sailer <sailer@watson.ibm.com>
 * Mimi Zohar <zohar@us.ibm.com>
 *
 * File: ima.h
 *	internal Integrity Measurement Architecture (IMA) definitions
 */

#ifndef __LINUX_IMA_H
#define __LINUX_IMA_H

#include <linux/types.h>
#include <linux/crypto.h>
#include <linux/fs.h>
#include <linux/security.h>
#include <linux/hash.h>
#include <linux/tpm.h>
#include <linux/audit.h>
#include <crypto/hash_info.h>

#include "../integrity.h"

enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
		     IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };

/* digest size for IMA, fits SHA1 or MD5 */
#define IMA_DIGEST_SIZE		SHA1_DIGEST_SIZE
#define IMA_EVENT_NAME_LEN_MAX	255

#define IMA_HASH_BITS 10
#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)

#define IMA_TEMPLATE_FIELD_ID_MAX_LEN	16
#define IMA_TEMPLATE_NUM_FIELDS_MAX	15

#define IMA_TEMPLATE_IMA_NAME "ima"
#define IMA_TEMPLATE_IMA_FMT "d|n"

#define NR_BANKS(chip) ((chip != NULL) ? chip->nr_allocated_banks : 0)

/* current content of the policy */
extern int ima_policy_flag;

/* bitset of digests algorithms allowed in the setxattr hook */
extern atomic_t ima_setxattr_allowed_hash_algorithms;

/* set during initialization */
extern int ima_hash_algo __ro_after_init;
extern int ima_sha1_idx __ro_after_init;
extern int ima_hash_algo_idx __ro_after_init;
extern int ima_extra_slots __ro_after_init;
extern int ima_appraise;
extern struct tpm_chip *ima_tpm_chip;
extern const char boot_aggregate_name[];

/* IMA event related data */
struct ima_event_data {
	struct integrity_iint_cache *iint;
	struct file *file;
	const unsigned char *filename;
	struct evm_ima_xattr_data *xattr_value;
	int xattr_len;
	const struct modsig *modsig;
	const char *violation;
	const void *buf;
	int buf_len;
};

/* IMA template field data definition */
struct ima_field_data {
	u8 *data;
	u32 len;
};

/* IMA template field definition */
struct ima_template_field {
	const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
	int (*field_init)(struct ima_event_data *event_data,
			  struct ima_field_data *field_data);
	void (*field_show)(struct seq_file *m, enum ima_show_type show,
			   struct ima_field_data *field_data);
};

/* IMA template descriptor definition */
struct ima_template_desc {
	struct list_head list;
	char *name;
	char *fmt;
	int num_fields;
	const struct ima_template_field **fields;
};

struct ima_template_entry {
	int pcr;
	struct tpm_digest *digests;
	struct ima_template_desc *template_desc; /* template descriptor */
	u32 template_data_len;
	struct ima_field_data template_data[];	/* template related data */
};

struct ima_queue_entry {
	struct hlist_node hnext;	/* place in hash collision list */
	struct list_head later;		/* place in ima_measurements list */
	struct ima_template_entry *entry;
};
extern struct list_head ima_measurements;	/* list of all measurements */

/* Some details preceding the binary serialized measurement list */
struct ima_kexec_hdr {
	u16 version;
	u16 _reserved0;
	u32 _reserved1;
	u64 buffer_size;
	u64 count;
};

extern const int read_idmap[];

#ifdef CONFIG_HAVE_IMA_KEXEC
void ima_load_kexec_buffer(void);
#else
static inline void ima_load_kexec_buffer(void) {}
#endif /* CONFIG_HAVE_IMA_KEXEC */

#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
void ima_post_key_create_or_update(struct key *keyring, struct key *key,
				   const void *payload, size_t plen,
				   unsigned long flags, bool create);
#endif

/*
 * The default binary_runtime_measurements list format is defined as the
 * platform native format.  The canonical format is defined as little-endian.
 */
extern bool ima_canonical_fmt;

/* Internal IMA function definitions */
int ima_init(void);
int ima_fs_init(void);
int ima_add_template_entry(struct ima_template_entry *entry, int violation,
			   const char *op, struct inode *inode,
			   const unsigned char *filename);
int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
int ima_calc_buffer_hash(const void *buf, loff_t len,
			 struct ima_digest_data *hash);
int ima_calc_field_array_hash(struct ima_field_data *field_data,
			      struct ima_template_entry *entry);
int ima_calc_boot_aggregate(struct ima_digest_data *hash);
void ima_add_violation(struct file *file, const unsigned char *filename,
		       struct integrity_iint_cache *iint,
		       const char *op, const char *cause);
int ima_init_crypto(void);
void ima_putc(struct seq_file *m, void *data, int datalen);
void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
int template_desc_init_fields(const char *template_fmt,
			      const struct ima_template_field ***fields,
			      int *num_fields);
struct ima_template_desc *ima_template_desc_current(void);
struct ima_template_desc *ima_template_desc_buf(void);
struct ima_template_desc *lookup_template_desc(const char *name);
bool ima_template_has_modsig(const struct ima_template_desc *ima_template);
int ima_restore_measurement_entry(struct ima_template_entry *entry);
int ima_restore_measurement_list(loff_t bufsize, void *buf);
int ima_measurements_show(struct seq_file *m, void *v);
unsigned long ima_get_binary_runtime_size(void);
int ima_init_template(void);
void ima_init_template_list(void);
int __init ima_init_digests(void);
int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
			  void *lsm_data);

/*
 * used to protect h_table and sha_table
 */
extern spinlock_t ima_queue_lock;

struct ima_h_table {
	atomic_long_t len;	/* number of stored measurements in the list */
	atomic_long_t violations;
	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
};
extern struct ima_h_table ima_htable;

static inline unsigned int ima_hash_key(u8 *digest)
{
	/* there is no point in taking a hash of part of a digest */
	return (digest[0] | digest[1] << 8) % IMA_MEASURE_HTABLE_SIZE;
}

#define __ima_hooks(hook)				\
	hook(NONE, none)				\
	hook(FILE_CHECK, file)				\
	hook(MMAP_CHECK, mmap)				\
	hook(MMAP_CHECK_REQPROT, mmap_reqprot)		\
	hook(BPRM_CHECK, bprm)				\
	hook(CREDS_CHECK, creds)			\
	hook(POST_SETATTR, post_setattr)		\
	hook(MODULE_CHECK, module)			\
	hook(FIRMWARE_CHECK, firmware)			\
	hook(KEXEC_KERNEL_CHECK, kexec_kernel)		\
	hook(KEXEC_INITRAMFS_CHECK, kexec_initramfs)	\
	hook(POLICY_CHECK, policy)			\
	hook(KEXEC_CMDLINE, kexec_cmdline)		\
	hook(KEY_CHECK, key)				\
	hook(CRITICAL_DATA, critical_data)		\
	hook(SETXATTR_CHECK, setxattr_check)		\
	hook(MAX_CHECK, none)

#define __ima_hook_enumify(ENUM, str)	ENUM,
#define __ima_stringify(arg) (#arg)
#define __ima_hook_measuring_stringify(ENUM, str) \
		(__ima_stringify(measuring_ ##str)),

enum ima_hooks {
	__ima_hooks(__ima_hook_enumify)
};

static const char * const ima_hooks_measure_str[] = {
	__ima_hooks(__ima_hook_measuring_stringify)
};

static inline const char *func_measure_str(enum ima_hooks func)
{
	if (func >= MAX_CHECK)
		return ima_hooks_measure_str[NONE];

	return ima_hooks_measure_str[func];
}

extern const char *const func_tokens[];

struct modsig;

#ifdef CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS
/*
 * To track keys that need to be measured.
 */
struct ima_key_entry {
	struct list_head list;
	void *payload;
	size_t payload_len;
	char *keyring_name;
};
void ima_init_key_queue(void);
bool ima_should_queue_key(void);
bool ima_queue_key(struct key *keyring, const void *payload,
		   size_t payload_len);
void ima_process_queued_keys(void);
#else
static inline void ima_init_key_queue(void) {}
static inline bool ima_should_queue_key(void) { return false; }
static inline bool ima_queue_key(struct key *keyring,
				 const void *payload,
				 size_t payload_len) { return false; }
static inline void ima_process_queued_keys(void) {}
#endif /* CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS */

/* LIM API function definitions */
int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
		   const struct cred *cred, u32 secid, int mask,
		   enum ima_hooks func, int *pcr,
		   struct ima_template_desc **template_desc,
		   const char *func_data, unsigned int *allowed_algos);
int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
int ima_collect_measurement(struct integrity_iint_cache *iint,
			    struct file *file, void *buf, loff_t size,
			    enum hash_algo algo, struct modsig *modsig);
void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
			   const unsigned char *filename,
			   struct evm_ima_xattr_data *xattr_value,
			   int xattr_len, const struct modsig *modsig, int pcr,
			   struct ima_template_desc *template_desc);
int process_buffer_measurement(struct mnt_idmap *idmap,
			       struct inode *inode, const void *buf, int size,
			       const char *eventname, enum ima_hooks func,
			       int pcr, const char *func_data,
			       bool buf_hash, u8 *digest, size_t digest_len);
void ima_audit_measurement(struct integrity_iint_cache *iint,
			   const unsigned char *filename);
int ima_alloc_init_template(struct ima_event_data *event_data,
			    struct ima_template_entry **entry,
			    struct ima_template_desc *template_desc);
int ima_store_template(struct ima_template_entry *entry, int violation,
		       struct inode *inode,
		       const unsigned char *filename, int pcr);
void ima_free_template_entry(struct ima_template_entry *entry);
const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);

/* IMA policy related functions */
int ima_match_policy(struct mnt_idmap *idmap, struct inode *inode,
		     const struct cred *cred, u32 secid, enum ima_hooks func,
		     int mask, int flags, int *pcr,
		     struct ima_template_desc **template_desc,
		     const char *func_data, unsigned int *allowed_algos);
void ima_init_policy(void);
void ima_update_policy(void);
void ima_update_policy_flags(void);
ssize_t ima_parse_add_rule(char *);
void ima_delete_rules(void);
int ima_check_policy(void);
void *ima_policy_start(struct seq_file *m, loff_t *pos);
void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos);
void ima_policy_stop(struct seq_file *m, void *v);
int ima_policy_show(struct seq_file *m, void *v);

/* Appraise integrity measurements */
#define IMA_APPRAISE_ENFORCE	0x01
#define IMA_APPRAISE_FIX	0x02
#define IMA_APPRAISE_LOG	0x04
#define IMA_APPRAISE_MODULES	0x08
#define IMA_APPRAISE_FIRMWARE	0x10
#define IMA_APPRAISE_POLICY	0x20
#define IMA_APPRAISE_KEXEC	0x40

#ifdef CONFIG_IMA_APPRAISE
int ima_check_blacklist(struct integrity_iint_cache *iint,
			const struct modsig *modsig, int pcr);
int ima_appraise_measurement(enum ima_hooks func,
			     struct integrity_iint_cache *iint,
			     struct file *file, const unsigned char *filename,
			     struct evm_ima_xattr_data *xattr_value,
			     int xattr_len, const struct modsig *modsig);
int ima_must_appraise(struct mnt_idmap *idmap, struct inode *inode,
		      int mask, enum ima_hooks func);
void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
					   enum ima_hooks func);
enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value,
				 int xattr_len);
int ima_read_xattr(struct dentry *dentry,
		   struct evm_ima_xattr_data **xattr_value, int xattr_len);
void __init init_ima_appraise_lsm(const struct lsm_id *lsmid);

#else
static inline int ima_check_blacklist(struct integrity_iint_cache *iint,
				      const struct modsig *modsig, int pcr)
{
	return 0;
}

static inline int ima_appraise_measurement(enum ima_hooks func,
					   struct integrity_iint_cache *iint,
					   struct file *file,
					   const unsigned char *filename,
					   struct evm_ima_xattr_data *xattr_value,
					   int xattr_len,
					   const struct modsig *modsig)
{
	return INTEGRITY_UNKNOWN;
}

static inline int ima_must_appraise(struct mnt_idmap *idmap,
				    struct inode *inode, int mask,
				    enum ima_hooks func)
{
	return 0;
}

static inline void ima_update_xattr(struct integrity_iint_cache *iint,
				    struct file *file)
{
}

static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache
							 *iint,
							 enum ima_hooks func)
{
	return INTEGRITY_UNKNOWN;
}

static inline enum hash_algo
ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len)
{
	return ima_hash_algo;
}

static inline int ima_read_xattr(struct dentry *dentry,
				 struct evm_ima_xattr_data **xattr_value,
				 int xattr_len)
{
	return 0;
}

static inline void __init init_ima_appraise_lsm(const struct lsm_id *lsmid)
{
}

#endif /* CONFIG_IMA_APPRAISE */

#ifdef CONFIG_IMA_APPRAISE_MODSIG
int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len,
		    struct modsig **modsig);
void ima_collect_modsig(struct modsig *modsig, const void *buf, loff_t size);
int ima_get_modsig_digest(const struct modsig *modsig, enum hash_algo *algo,
			  const u8 **digest, u32 *digest_size);
int ima_get_raw_modsig(const struct modsig *modsig, const void **data,
		       u32 *data_len);
void ima_free_modsig(struct modsig *modsig);
#else
static inline int ima_read_modsig(enum ima_hooks func, const void *buf,
				  loff_t buf_len, struct modsig **modsig)
{
	return -EOPNOTSUPP;
}

static inline void ima_collect_modsig(struct modsig *modsig, const void *buf,
				      loff_t size)
{
}

static inline int ima_get_modsig_digest(const struct modsig *modsig,
					enum hash_algo *algo, const u8 **digest,
					u32 *digest_size)
{
	return -EOPNOTSUPP;
}

static inline int ima_get_raw_modsig(const struct modsig *modsig,
				     const void **data, u32 *data_len)
{
	return -EOPNOTSUPP;
}

static inline void ima_free_modsig(struct modsig *modsig)
{
}
#endif /* CONFIG_IMA_APPRAISE_MODSIG */

/* LSM based policy rules require audit */
#ifdef CONFIG_IMA_LSM_RULES

#define ima_filter_rule_init security_audit_rule_init
#define ima_filter_rule_free security_audit_rule_free
#define ima_filter_rule_match security_audit_rule_match

#else

static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr,
				       void **lsmrule)
{
	return -EINVAL;
}

static inline void ima_filter_rule_free(void *lsmrule)
{
}

static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
					void *lsmrule)
{
	return -EINVAL;
}
#endif /* CONFIG_IMA_LSM_RULES */

#ifdef	CONFIG_IMA_READ_POLICY
#define	POLICY_FILE_FLAGS	(S_IWUSR | S_IRUSR)
#else
#define	POLICY_FILE_FLAGS	S_IWUSR
#endif /* CONFIG_IMA_READ_POLICY */

#endif /* __LINUX_IMA_H */
Commit	Line	Data
b886d83c	1	/* SPDX-License-Identifier: GPL-2.0-only */
3323eec9 MZ	2	/*
	3	* Copyright (C) 2005,2006,2007,2008 IBM Corporation
	4	*
	5	* Authors:
	6	* Reiner Sailer <sailer@watson.ibm.com>
	7	* Mimi Zohar <zohar@us.ibm.com>
	8	*
3323eec9 MZ	9	* File: ima.h
	10	* internal Integrity Measurement Architecture (IMA) definitions
	11	*/
	12
	13	#ifndef __LINUX_IMA_H
	14	#define __LINUX_IMA_H
	15
	16	#include <linux/types.h>
	17	#include <linux/crypto.h>
cf222217	18	#include <linux/fs.h>
3323eec9 MZ	19	#include <linux/security.h>
	20	#include <linux/hash.h>
	21	#include <linux/tpm.h>
	22	#include <linux/audit.h>
1525b06d	23	#include <crypto/hash_info.h>
3323eec9	24
f381c272 MZ	25	#include "../integrity.h"
f381c272 MZ	26
3e8e5503	27	enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
c019e307	28	IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
20c59ce0	29	enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };
3323eec9 MZ	30
3323eec9 MZ	31	/* digest size for IMA, fits SHA1 or MD5 */
f381c272	32	#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
3323eec9 MZ	33	#define IMA_EVENT_NAME_LEN_MAX 255
3323eec9 MZ	34
1129d31b	35	#define IMA_HASH_BITS 10
3323eec9 MZ	36	#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
3323eec9 MZ	37
adf53a77 RS	38	#define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16
	39	#define IMA_TEMPLATE_NUM_FIELDS_MAX 15
	40
3ce1217d RS	41	#define IMA_TEMPLATE_IMA_NAME "ima"
	42	#define IMA_TEMPLATE_IMA_FMT "d\|n"
	43
aa724fe1 RS	44	#define NR_BANKS(chip) ((chip != NULL) ? chip->nr_allocated_banks : 0)
aa724fe1 RS	45
a756024e RS	46	/* current content of the policy */
	47	extern int ima_policy_flag;
	48
4f2946aa TS	49	/* bitset of digests algorithms allowed in the setxattr hook */
	50	extern atomic_t ima_setxattr_allowed_hash_algorithms;
	51
3323eec9	52	/* set during initialization */
1624dc00	53	extern int ima_hash_algo __ro_after_init;
aa724fe1	54	extern int ima_sha1_idx __ro_after_init;
2592677c	55	extern int ima_hash_algo_idx __ro_after_init;
aa724fe1	56	extern int ima_extra_slots __ro_after_init;
2fe5d6de	57	extern int ima_appraise;
5c2a640a	58	extern struct tpm_chip *ima_tpm_chip;
6cc7c266	59	extern const char boot_aggregate_name[];
3323eec9	60
23b57419 RS	61	/* IMA event related data */
	62	struct ima_event_data {
	63	struct integrity_iint_cache *iint;
	64	struct file *file;
	65	const unsigned char *filename;
	66	struct evm_ima_xattr_data *xattr_value;
	67	int xattr_len;
3878d505	68	const struct modsig *modsig;
8d94eb9b	69	const char *violation;
86b4da8c PS	70	const void *buf;
86b4da8c PS	71	int buf_len;
23b57419 RS	72	};
23b57419 RS	73
adf53a77 RS	74	/* IMA template field data definition */
	75	struct ima_field_data {
	76	u8 *data;
	77	u32 len;
	78	};
	79
	80	/* IMA template field definition */
	81	struct ima_template_field {
	82	const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
23b57419 RS	83	int (field_init)(struct ima_event_data event_data,
	84	struct ima_field_data *field_data);
	85	void (field_show)(struct seq_file m, enum ima_show_type show,
	86	struct ima_field_data *field_data);
adf53a77 RS	87	};
	88
	89	/* IMA template descriptor definition */
	90	struct ima_template_desc {
3f23d624	91	struct list_head list;
adf53a77 RS	92	char *name;
	93	char *fmt;
	94	int num_fields;
b2724d58	95	const struct ima_template_field **fields;
adf53a77 RS	96	};
adf53a77 RS	97
3323eec9	98	struct ima_template_entry {
14b1da85	99	int pcr;
aa724fe1	100	struct tpm_digest *digests;
a71dc65d RS	101	struct ima_template_desc template_desc; / template descriptor */
a71dc65d RS	102	u32 template_data_len;
4739eeaf	103	struct ima_field_data template_data[]; /* template related data */
3323eec9 MZ	104	};
	105
	106	struct ima_queue_entry {
	107	struct hlist_node hnext; /* place in hash collision list */
	108	struct list_head later; /* place in ima_measurements list */
	109	struct ima_template_entry *entry;
	110	};
	111	extern struct list_head ima_measurements; /* list of all measurements */
	112
94c3aac5 MZ	113	/* Some details preceding the binary serialized measurement list */
	114	struct ima_kexec_hdr {
	115	u16 version;
	116	u16 _reserved0;
	117	u32 _reserved1;
	118	u64 buffer_size;
	119	u64 count;
	120	};
	121
29d3c1c8 MG	122	extern const int read_idmap[];
29d3c1c8 MG	123
94c3aac5 MZ	124	#ifdef CONFIG_HAVE_IMA_KEXEC
	125	void ima_load_kexec_buffer(void);
	126	#else
	127	static inline void ima_load_kexec_buffer(void) {}
	128	#endif /* CONFIG_HAVE_IMA_KEXEC */
	129
cd3cec0a RS	130	#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
	131	void ima_post_key_create_or_update(struct key keyring, struct key key,
	132	const void *payload, size_t plen,
	133	unsigned long flags, bool create);
	134	#endif
	135
d68a6fe9 MZ	136	/*
	137	* The default binary_runtime_measurements list format is defined as the
	138	* platform native format. The canonical format is defined as little-endian.
	139	*/
	140	extern bool ima_canonical_fmt;
	141
3323eec9	142	/* Internal IMA function definitions */
3323eec9	143	int ima_init(void);
bab73937	144	int ima_fs_init(void);
3323eec9	145	int ima_add_template_entry(struct ima_template_entry *entry, int violation,
9803d413 RS	146	const char op, struct inode inode,
9803d413 RS	147	const unsigned char *filename);
c7c8bb23	148	int ima_calc_file_hash(struct file file, struct ima_digest_data hash);
11d7646d DK	149	int ima_calc_buffer_hash(const void *buf, loff_t len,
11d7646d DK	150	struct ima_digest_data *hash);
b6f8f16f	151	int ima_calc_field_array_hash(struct ima_field_data *field_data,
7ca79645	152	struct ima_template_entry *entry);
6cc7c266	153	int ima_calc_boot_aggregate(struct ima_digest_data *hash);
7d802a22	154	void ima_add_violation(struct file file, const unsigned char filename,
8d94eb9b	155	struct integrity_iint_cache *iint,
3323eec9	156	const char op, const char cause);
76bb28f6	157	int ima_init_crypto(void);
3ce1217d	158	void ima_putc(struct seq_file m, void data, int datalen);
45b26133	159	void ima_print_digest(struct seq_file m, u8 digest, u32 size);
19453ce0 MG	160	int template_desc_init_fields(const char *template_fmt,
	161	const struct ima_template_field ***fields,
	162	int *num_fields);
a71dc65d	163	struct ima_template_desc *ima_template_desc_current(void);
dea87d08	164	struct ima_template_desc *ima_template_desc_buf(void);
19453ce0	165	struct ima_template_desc lookup_template_desc(const char name);
e5092255	166	bool ima_template_has_modsig(const struct ima_template_desc *ima_template);
94c3aac5 MZ	167	int ima_restore_measurement_entry(struct ima_template_entry *entry);
94c3aac5 MZ	168	int ima_restore_measurement_list(loff_t bufsize, void *buf);
7b8589cc	169	int ima_measurements_show(struct seq_file m, void v);
d158847a	170	unsigned long ima_get_binary_runtime_size(void);
a71dc65d	171	int ima_init_template(void);
3f23d624	172	void ima_init_template_list(void);
0b6cf6b9	173	int __init ima_init_digests(void);
b1694245 JK	174	int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
b1694245 JK	175	void *lsm_data);
3323eec9 MZ	176
	177	/*
	178	* used to protect h_table and sha_table
	179	*/
	180	extern spinlock_t ima_queue_lock;
	181
	182	struct ima_h_table {
	183	atomic_long_t len; /* number of stored measurements in the list */
	184	atomic_long_t violations;
	185	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
	186	};
	187	extern struct ima_h_table ima_htable;
	188
1129d31b	189	static inline unsigned int ima_hash_key(u8 *digest)
3323eec9	190	{
1129d31b KS	191	/* there is no point in taking a hash of part of a digest */
1129d31b KS	192	return (digest[0] \| digest[1] << 8) % IMA_MEASURE_HTABLE_SIZE;
3323eec9 MZ	193	}
3323eec9 MZ	194
34e980bb LR	195	#define __ima_hooks(hook) \
	196	hook(NONE, none) \
	197	hook(FILE_CHECK, file) \
	198	hook(MMAP_CHECK, mmap) \
4958db32	199	hook(MMAP_CHECK_REQPROT, mmap_reqprot) \
34e980bb LR	200	hook(BPRM_CHECK, bprm) \
	201	hook(CREDS_CHECK, creds) \
	202	hook(POST_SETATTR, post_setattr) \
	203	hook(MODULE_CHECK, module) \
	204	hook(FIRMWARE_CHECK, firmware) \
	205	hook(KEXEC_KERNEL_CHECK, kexec_kernel) \
	206	hook(KEXEC_INITRAMFS_CHECK, kexec_initramfs) \
	207	hook(POLICY_CHECK, policy) \
	208	hook(KEXEC_CMDLINE, kexec_cmdline) \
	209	hook(KEY_CHECK, key) \
d6e64501	210	hook(CRITICAL_DATA, critical_data) \
4f2946aa	211	hook(SETXATTR_CHECK, setxattr_check) \
34e980bb LR	212	hook(MAX_CHECK, none)
	213
	214	#define __ima_hook_enumify(ENUM, str) ENUM,
	215	#define __ima_stringify(arg) (#arg)
	216	#define __ima_hook_measuring_stringify(ENUM, str) \
	217	(__ima_stringify(measuring_ ##str)),
2663218b	218
4ad87a3d	219	enum ima_hooks {
2663218b	220	__ima_hooks(__ima_hook_enumify)
4ad87a3d MZ	221	};
4ad87a3d MZ	222
34e980bb LR	223	static const char * const ima_hooks_measure_str[] = {
	224	__ima_hooks(__ima_hook_measuring_stringify)
	225	};
	226
	227	static inline const char *func_measure_str(enum ima_hooks func)
	228	{
	229	if (func >= MAX_CHECK)
	230	return ima_hooks_measure_str[NONE];
	231
	232	return ima_hooks_measure_str[func];
	233	}
	234
39b07096 TJB	235	extern const char *const func_tokens[];
	236
	237	struct modsig;
	238
9f81a2ed LR	239	#ifdef CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS
	240	/*
	241	* To track keys that need to be measured.
	242	*/
	243	struct ima_key_entry {
	244	struct list_head list;
	245	void *payload;
	246	size_t payload_len;
	247	char *keyring_name;
	248	};
5b3014b9	249	void ima_init_key_queue(void);
9f81a2ed LR	250	bool ima_should_queue_key(void);
	251	bool ima_queue_key(struct key keyring, const void payload,
	252	size_t payload_len);
	253	void ima_process_queued_keys(void);
	254	#else
5b3014b9	255	static inline void ima_init_key_queue(void) {}
9f81a2ed LR	256	static inline bool ima_should_queue_key(void) { return false; }
	257	static inline bool ima_queue_key(struct key *keyring,
	258	const void *payload,
	259	size_t payload_len) { return false; }
	260	static inline void ima_process_queued_keys(void) {}
	261	#endif /* CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS */
	262
3323eec9	263	/* LIM API function definitions */
39f60c1c	264	int ima_get_action(struct mnt_idmap idmap, struct inode inode,
a2d2329e CB	265	const struct cred *cred, u32 secid, int mask,
a2d2329e CB	266	enum ima_hooks func, int *pcr,
e9085e0a	267	struct ima_template_desc **template_desc,
1624dc00	268	const char func_data, unsigned int allowed_algos);
4ad87a3d	269	int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
f381c272	270	int ima_collect_measurement(struct integrity_iint_cache *iint,
cf222217	271	struct file file, void buf, loff_t size,
15588227	272	enum hash_algo algo, struct modsig *modsig);
f381c272	273	void ima_store_measurement(struct integrity_iint_cache iint, struct file file,
bcbc9b0c MZ	274	const unsigned char *filename,
bcbc9b0c MZ	275	struct evm_ima_xattr_data *xattr_value,
3878d505	276	int xattr_len, const struct modsig *modsig, int pcr,
19453ce0	277	struct ima_template_desc *template_desc);
39f60c1c	278	int process_buffer_measurement(struct mnt_idmap *idmap,
ce5bb5a8 RS	279	struct inode inode, const void buf, int size,
	280	const char *eventname, enum ima_hooks func,
	281	int pcr, const char *func_data,
ca3c9bdb	282	bool buf_hash, u8 *digest, size_t digest_len);
e7c568e0 PM	283	void ima_audit_measurement(struct integrity_iint_cache *iint,
e7c568e0 PM	284	const unsigned char *filename);
23b57419	285	int ima_alloc_init_template(struct ima_event_data *event_data,
19453ce0 MG	286	struct ima_template_entry **entry,
19453ce0 MG	287	struct ima_template_desc *template_desc);
3323eec9	288	int ima_store_template(struct ima_template_entry *entry, int violation,
14b1da85 ER	289	struct inode *inode,
14b1da85 ER	290	const unsigned char *filename, int pcr);
a7ed7c60	291	void ima_free_template_entry(struct ima_template_entry *entry);
bc15ed66	292	const char ima_d_path(const struct path path, char *pathbuf, char filename);
3323eec9	293
3323eec9	294	/* IMA policy related functions */
39f60c1c	295	int ima_match_policy(struct mnt_idmap idmap, struct inode inode,
a2d2329e CB	296	const struct cred *cred, u32 secid, enum ima_hooks func,
a2d2329e CB	297	int mask, int flags, int *pcr,
e9085e0a	298	struct ima_template_desc **template_desc,
1624dc00	299	const char func_data, unsigned int allowed_algos);
3323eec9 MZ	300	void ima_init_policy(void);
3323eec9 MZ	301	void ima_update_policy(void);
4f2946aa	302	void ima_update_policy_flags(void);
6ccd0456	303	ssize_t ima_parse_add_rule(char *);
4af4662f	304	void ima_delete_rules(void);
0112721d	305	int ima_check_policy(void);
80eae209 PM	306	void ima_policy_start(struct seq_file m, loff_t *pos);
	307	void ima_policy_next(struct seq_file m, void v, loff_t pos);
	308	void ima_policy_stop(struct seq_file m, void v);
	309	int ima_policy_show(struct seq_file m, void v);
4af4662f	310
2fe5d6de MZ	311	/* Appraise integrity measurements */
	312	#define IMA_APPRAISE_ENFORCE 0x01
	313	#define IMA_APPRAISE_FIX 0x02
2faa6ef3 DK	314	#define IMA_APPRAISE_LOG 0x04
	315	#define IMA_APPRAISE_MODULES 0x08
	316	#define IMA_APPRAISE_FIRMWARE 0x10
19f8a847	317	#define IMA_APPRAISE_POLICY 0x20
16c267aa	318	#define IMA_APPRAISE_KEXEC 0x40
2fe5d6de MZ	319
2fe5d6de MZ	320	#ifdef CONFIG_IMA_APPRAISE
273df864 NJ	321	int ima_check_blacklist(struct integrity_iint_cache *iint,
273df864 NJ	322	const struct modsig *modsig, int pcr);
4ad87a3d MZ	323	int ima_appraise_measurement(enum ima_hooks func,
4ad87a3d MZ	324	struct integrity_iint_cache *iint,
d3634d0f DK	325	struct file file, const unsigned char filename,
d3634d0f DK	326	struct evm_ima_xattr_data *xattr_value,
39b07096	327	int xattr_len, const struct modsig *modsig);
39f60c1c	328	int ima_must_appraise(struct mnt_idmap idmap, struct inode inode,
a2d2329e	329	int mask, enum ima_hooks func);
2fe5d6de	330	void ima_update_xattr(struct integrity_iint_cache iint, struct file file);
d79d72e0	331	enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
4ad87a3d	332	enum ima_hooks func);
50f742dd	333	enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value,
1525b06d	334	int xattr_len);
d3634d0f	335	int ima_read_xattr(struct dentry *dentry,
f6fbd8cb	336	struct evm_ima_xattr_data **xattr_value, int xattr_len);
84594c9e	337	void __init init_ima_appraise_lsm(const struct lsm_id *lsmid);
2fe5d6de MZ	338
2fe5d6de MZ	339	#else
273df864 NJ	340	static inline int ima_check_blacklist(struct integrity_iint_cache *iint,
	341	const struct modsig *modsig, int pcr)
	342	{
	343	return 0;
	344	}
	345
4ad87a3d	346	static inline int ima_appraise_measurement(enum ima_hooks func,
d79d72e0	347	struct integrity_iint_cache *iint,
2fe5d6de	348	struct file *file,
d3634d0f DK	349	const unsigned char *filename,
d3634d0f DK	350	struct evm_ima_xattr_data *xattr_value,
39b07096 TJB	351	int xattr_len,
39b07096 TJB	352	const struct modsig *modsig)
2fe5d6de MZ	353	{
	354	return INTEGRITY_UNKNOWN;
	355	}
	356
39f60c1c	357	static inline int ima_must_appraise(struct mnt_idmap *idmap,
a2d2329e	358	struct inode *inode, int mask,
d26e1936	359	enum ima_hooks func)
2fe5d6de MZ	360	{
	361	return 0;
	362	}
	363
	364	static inline void ima_update_xattr(struct integrity_iint_cache *iint,
	365	struct file *file)
	366	{
	367	}
d79d72e0 MZ	368
d79d72e0 MZ	369	static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache
4ad87a3d MZ	370	*iint,
4ad87a3d MZ	371	enum ima_hooks func)
d79d72e0 MZ	372	{
	373	return INTEGRITY_UNKNOWN;
	374	}
d3634d0f	375
1525b06d DK	376	static inline enum hash_algo
1525b06d DK	377	ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len)
d3634d0f	378	{
1525b06d	379	return ima_hash_algo;
d3634d0f DK	380	}
	381
	382	static inline int ima_read_xattr(struct dentry *dentry,
f6fbd8cb PM	383	struct evm_ima_xattr_data **xattr_value,
f6fbd8cb PM	384	int xattr_len)
d3634d0f DK	385	{
	386	return 0;
	387	}
	388
84594c9e RS	389	static inline void __init init_ima_appraise_lsm(const struct lsm_id *lsmid)
	390	{
	391	}
	392
bb543e39	393	#endif /* CONFIG_IMA_APPRAISE */
2fe5d6de	394
9044d627	395	#ifdef CONFIG_IMA_APPRAISE_MODSIG
39b07096 TJB	396	int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len,
39b07096 TJB	397	struct modsig **modsig);
15588227	398	void ima_collect_modsig(struct modsig modsig, const void buf, loff_t size);
3878d505 TJB	399	int ima_get_modsig_digest(const struct modsig modsig, enum hash_algo algo,
	400	const u8 *digest, u32 digest_size);
	401	int ima_get_raw_modsig(const struct modsig modsig, const void *data,
	402	u32 *data_len);
39b07096	403	void ima_free_modsig(struct modsig *modsig);
9044d627	404	#else
39b07096 TJB	405	static inline int ima_read_modsig(enum ima_hooks func, const void *buf,
	406	loff_t buf_len, struct modsig **modsig)
	407	{
	408	return -EOPNOTSUPP;
	409	}
	410
15588227 TJB	411	static inline void ima_collect_modsig(struct modsig modsig, const void buf,
	412	loff_t size)
	413	{
	414	}
	415
3878d505 TJB	416	static inline int ima_get_modsig_digest(const struct modsig *modsig,
	417	enum hash_algo algo, const u8 *digest,
	418	u32 *digest_size)
	419	{
	420	return -EOPNOTSUPP;
	421	}
	422
	423	static inline int ima_get_raw_modsig(const struct modsig *modsig,
	424	const void *data, u32 data_len)
	425	{
	426	return -EOPNOTSUPP;
	427	}
	428
39b07096 TJB	429	static inline void ima_free_modsig(struct modsig *modsig)
	430	{
	431	}
9044d627 TJB	432	#endif /* CONFIG_IMA_APPRAISE_MODSIG */
9044d627 TJB	433
4af4662f MZ	434	/* LSM based policy rules require audit */
	435	#ifdef CONFIG_IMA_LSM_RULES
	436
b8867eed TH	437	#define ima_filter_rule_init security_audit_rule_init
	438	#define ima_filter_rule_free security_audit_rule_free
	439	#define ima_filter_rule_match security_audit_rule_match
4af4662f MZ	440
	441	#else
	442
b8867eed TH	443	static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr,
b8867eed TH	444	void **lsmrule)
4af4662f MZ	445	{
	446	return -EINVAL;
	447	}
	448
b8867eed	449	static inline void ima_filter_rule_free(void *lsmrule)
9ff8a616 TH	450	{
	451	}
	452
b8867eed TH	453	static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
b8867eed TH	454	void *lsmrule)
4af4662f MZ	455	{
	456	return -EINVAL;
	457	}
5d659f28	458	#endif /* CONFIG_IMA_LSM_RULES */
80eae209 PM	459
	460	#ifdef CONFIG_IMA_READ_POLICY
	461	#define POLICY_FILE_FLAGS (S_IWUSR \| S_IRUSR)
	462	#else
	463	#define POLICY_FILE_FLAGS S_IWUSR
5d659f28	464	#endif /* CONFIG_IMA_READ_POLICY */
80eae209 PM	465
80eae209 PM	466	#endif /* __LINUX_IMA_H */