Commit | Line | Data |
---|---|---|
b886d83c | 1 | // SPDX-License-Identifier: GPL-2.0-only |
3323eec9 MZ |
2 | /* |
3 | * Copyright (C) 2008 IBM Corporation | |
4 | * | |
5 | * Author: Mimi Zohar <zohar@us.ibm.com> | |
6 | * | |
3323eec9 | 7 | * File: ima_api.c |
2fe5d6de MZ |
8 | * Implements must_appraise_or_measure, collect_measurement, |
9 | * appraise_measurement, store_measurement and store_template. | |
3323eec9 | 10 | */ |
5a0e3ad6 | 11 | #include <linux/slab.h> |
2fe5d6de MZ |
12 | #include <linux/file.h> |
13 | #include <linux/fs.h> | |
14 | #include <linux/xattr.h> | |
15 | #include <linux/evm.h> | |
54f03916 | 16 | #include <linux/fsverity.h> |
1525b06d | 17 | |
3323eec9 | 18 | #include "ima.h" |
2fe5d6de | 19 | |
a7ed7c60 RS |
20 | /* |
21 | * ima_free_template_entry - free an existing template entry | |
22 | */ | |
23 | void ima_free_template_entry(struct ima_template_entry *entry) | |
24 | { | |
25 | int i; | |
26 | ||
27 | for (i = 0; i < entry->template_desc->num_fields; i++) | |
28 | kfree(entry->template_data[i].data); | |
29 | ||
aa724fe1 | 30 | kfree(entry->digests); |
a7ed7c60 RS |
31 | kfree(entry); |
32 | } | |
33 | ||
7bc5f447 RS |
34 | /* |
35 | * ima_alloc_init_template - create and initialize a new template entry | |
36 | */ | |
23b57419 | 37 | int ima_alloc_init_template(struct ima_event_data *event_data, |
19453ce0 MG |
38 | struct ima_template_entry **entry, |
39 | struct ima_template_desc *desc) | |
7bc5f447 | 40 | { |
19453ce0 | 41 | struct ima_template_desc *template_desc; |
aa724fe1 | 42 | struct tpm_digest *digests; |
a71dc65d | 43 | int i, result = 0; |
7bc5f447 | 44 | |
19453ce0 MG |
45 | if (desc) |
46 | template_desc = desc; | |
47 | else | |
48 | template_desc = ima_template_desc_current(); | |
49 | ||
2a7f0e53 GS |
50 | *entry = kzalloc(struct_size(*entry, template_data, |
51 | template_desc->num_fields), GFP_NOFS); | |
a71dc65d | 52 | if (!*entry) |
7bc5f447 RS |
53 | return -ENOMEM; |
54 | ||
aa724fe1 RS |
55 | digests = kcalloc(NR_BANKS(ima_tpm_chip) + ima_extra_slots, |
56 | sizeof(*digests), GFP_NOFS); | |
57 | if (!digests) { | |
42413b49 RS |
58 | kfree(*entry); |
59 | *entry = NULL; | |
60 | return -ENOMEM; | |
aa724fe1 RS |
61 | } |
62 | ||
63 | (*entry)->digests = digests; | |
a7ed7c60 | 64 | (*entry)->template_desc = template_desc; |
a71dc65d | 65 | for (i = 0; i < template_desc->num_fields; i++) { |
b2724d58 EB |
66 | const struct ima_template_field *field = |
67 | template_desc->fields[i]; | |
a71dc65d | 68 | u32 len; |
7bc5f447 | 69 | |
23b57419 | 70 | result = field->field_init(event_data, |
a71dc65d RS |
71 | &((*entry)->template_data[i])); |
72 | if (result != 0) | |
73 | goto out; | |
7bc5f447 | 74 | |
a71dc65d RS |
75 | len = (*entry)->template_data[i].len; |
76 | (*entry)->template_data_len += sizeof(len); | |
77 | (*entry)->template_data_len += len; | |
78 | } | |
7bc5f447 | 79 | return 0; |
a71dc65d | 80 | out: |
a7ed7c60 | 81 | ima_free_template_entry(*entry); |
a71dc65d | 82 | *entry = NULL; |
7bc5f447 RS |
83 | return result; |
84 | } | |
85 | ||
3323eec9 MZ |
86 | /* |
87 | * ima_store_template - store ima template measurements | |
88 | * | |
89 | * Calculate the hash of a template entry, add the template entry | |
90 | * to an ordered list of measurement entries maintained inside the kernel, | |
91 | * and also update the aggregate integrity value (maintained inside the | |
92 | * configured TPM PCR) over the hashes of the current list of measurement | |
93 | * entries. | |
94 | * | |
95 | * Applications retrieve the current kernel-held measurement list through | |
96 | * the securityfs entries in /sys/kernel/security/ima. The signed aggregate | |
97 | * TPM PCR (called quote) can be retrieved using a TPM user space library | |
98 | * and is used to validate the measurement list. | |
99 | * | |
100 | * Returns 0 on success, error code otherwise | |
101 | */ | |
102 | int ima_store_template(struct ima_template_entry *entry, | |
9803d413 | 103 | int violation, struct inode *inode, |
14b1da85 | 104 | const unsigned char *filename, int pcr) |
3323eec9 | 105 | { |
52a13284 MZ |
106 | static const char op[] = "add_template_measure"; |
107 | static const char audit_cause[] = "hashing_error"; | |
a71dc65d | 108 | char *template_name = entry->template_desc->name; |
3323eec9 MZ |
109 | int result; |
110 | ||
3323eec9 | 111 | if (!violation) { |
a71dc65d | 112 | result = ima_calc_field_array_hash(&entry->template_data[0], |
7ca79645 | 113 | entry); |
3323eec9 MZ |
114 | if (result < 0) { |
115 | integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, | |
a71dc65d | 116 | template_name, op, |
3323eec9 MZ |
117 | audit_cause, result, 0); |
118 | return result; | |
119 | } | |
120 | } | |
14b1da85 | 121 | entry->pcr = pcr; |
9803d413 | 122 | result = ima_add_template_entry(entry, violation, op, inode, filename); |
3323eec9 MZ |
123 | return result; |
124 | } | |
125 | ||
126 | /* | |
127 | * ima_add_violation - add violation to measurement list. | |
128 | * | |
129 | * Violations are flagged in the measurement list with zero hash values. | |
130 | * By extending the PCR with 0xFF's instead of with zeroes, the PCR | |
131 | * value is invalidated. | |
132 | */ | |
7d802a22 | 133 | void ima_add_violation(struct file *file, const unsigned char *filename, |
4de2f084 RS |
134 | struct ima_iint_cache *iint, const char *op, |
135 | const char *cause) | |
3323eec9 MZ |
136 | { |
137 | struct ima_template_entry *entry; | |
31d4b761 | 138 | struct inode *inode = file_inode(file); |
e038f5f6 TJB |
139 | struct ima_event_data event_data = { .iint = iint, |
140 | .file = file, | |
141 | .filename = filename, | |
142 | .violation = cause }; | |
3323eec9 MZ |
143 | int violation = 1; |
144 | int result; | |
145 | ||
146 | /* can overflow, only indicator */ | |
147 | atomic_long_inc(&ima_htable.violations); | |
148 | ||
19453ce0 | 149 | result = ima_alloc_init_template(&event_data, &entry, NULL); |
7bc5f447 | 150 | if (result < 0) { |
3323eec9 MZ |
151 | result = -ENOMEM; |
152 | goto err_out; | |
153 | } | |
14b1da85 ER |
154 | result = ima_store_template(entry, violation, inode, |
155 | filename, CONFIG_IMA_MEASURE_PCR_IDX); | |
3323eec9 | 156 | if (result < 0) |
a7ed7c60 | 157 | ima_free_template_entry(entry); |
3323eec9 MZ |
158 | err_out: |
159 | integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, | |
160 | op, cause, result, 0); | |
161 | } | |
162 | ||
163 | /** | |
d9d300cd | 164 | * ima_get_action - appraise & measure decision based on policy. |
39f60c1c | 165 | * @idmap: idmap of the mount the inode was found from |
4834177e | 166 | * @inode: pointer to the inode associated with the object being validated |
d906c10d MG |
167 | * @cred: pointer to credentials structure to validate |
168 | * @secid: secid of the task being validated | |
20f482ab LZ |
169 | * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC, |
170 | * MAY_APPEND) | |
4ad87a3d | 171 | * @func: caller identifier |
725de7fa | 172 | * @pcr: pointer filled in if matched measure policy sets pcr= |
19453ce0 | 173 | * @template_desc: pointer filled in if matched measure policy sets template= |
2b4a2474 | 174 | * @func_data: func specific data, may be NULL |
1624dc00 | 175 | * @allowed_algos: allowlist of hash algorithms for the IMA xattr |
3323eec9 MZ |
176 | * |
177 | * The policy is defined in terms of keypairs: | |
2bb930ab | 178 | * subj=, obj=, type=, func=, mask=, fsmagic= |
3323eec9 | 179 | * subj,obj, and type: are LSM specific. |
d906c10d | 180 | * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK |
4958db32 RS |
181 | * | KEXEC_CMDLINE | KEY_CHECK | CRITICAL_DATA | SETXATTR_CHECK |
182 | * | MMAP_CHECK_REQPROT | |
2bb930ab | 183 | * mask: contains the permission mask |
3323eec9 MZ |
184 | * fsmagic: hex value |
185 | * | |
2fe5d6de MZ |
186 | * Returns IMA_MEASURE, IMA_APPRAISE mask. |
187 | * | |
188 | */ | |
39f60c1c | 189 | int ima_get_action(struct mnt_idmap *idmap, struct inode *inode, |
a2d2329e CB |
190 | const struct cred *cred, u32 secid, int mask, |
191 | enum ima_hooks func, int *pcr, | |
e9085e0a | 192 | struct ima_template_desc **template_desc, |
1624dc00 | 193 | const char *func_data, unsigned int *allowed_algos) |
3323eec9 | 194 | { |
da1b0029 | 195 | int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH; |
2fe5d6de | 196 | |
fd5f4e90 | 197 | flags &= ima_policy_flag; |
2fe5d6de | 198 | |
39f60c1c | 199 | return ima_match_policy(idmap, inode, cred, secid, func, mask, |
1624dc00 TS |
200 | flags, pcr, template_desc, func_data, |
201 | allowed_algos); | |
2fe5d6de | 202 | } |
3323eec9 | 203 | |
4de2f084 RS |
204 | static bool ima_get_verity_digest(struct ima_iint_cache *iint, |
205 | struct inode *inode, | |
74836ecb | 206 | struct ima_max_digest_data *hash) |
54f03916 | 207 | { |
74836ecb EB |
208 | enum hash_algo alg; |
209 | int digest_len; | |
54f03916 MZ |
210 | |
211 | /* | |
212 | * On failure, 'measure' policy rules will result in a file data | |
213 | * hash containing 0's. | |
214 | */ | |
4de2f084 | 215 | digest_len = fsverity_get_digest(inode, hash->digest, NULL, &alg); |
74836ecb EB |
216 | if (digest_len == 0) |
217 | return false; | |
54f03916 MZ |
218 | |
219 | /* | |
220 | * Unlike in the case of actually calculating the file hash, in | |
221 | * the fsverity case regardless of the hash algorithm, return | |
222 | * the verity digest to be included in the measurement list. A | |
223 | * mismatch between the verity algorithm and the xattr signature | |
224 | * algorithm, if one exists, will be detected later. | |
225 | */ | |
74836ecb EB |
226 | hash->hdr.algo = alg; |
227 | hash->hdr.length = digest_len; | |
228 | return true; | |
54f03916 MZ |
229 | } |
230 | ||
3323eec9 MZ |
231 | /* |
232 | * ima_collect_measurement - collect file measurement | |
233 | * | |
234 | * Calculate the file hash, if it doesn't already exist, | |
235 | * storing the measurement and i_version in the iint. | |
236 | * | |
237 | * Must be called with iint->mutex held. | |
238 | * | |
239 | * Return 0 on success, error code otherwise | |
240 | */ | |
4de2f084 RS |
241 | int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file, |
242 | void *buf, loff_t size, enum hash_algo algo, | |
243 | struct modsig *modsig) | |
3323eec9 | 244 | { |
f9b2a735 | 245 | const char *audit_cause = "failed"; |
496ad9aa | 246 | struct inode *inode = file_inode(file); |
b836c4d2 | 247 | struct inode *real_inode = d_real_inode(file_dentry(file)); |
8c54135e | 248 | struct ima_max_digest_data hash; |
38aa3f5a GS |
249 | struct ima_digest_data *hash_hdr = container_of(&hash.hdr, |
250 | struct ima_digest_data, hdr); | |
be84f32b | 251 | struct name_snapshot filename; |
db1d1e8b | 252 | struct kstat stat; |
2fe5d6de | 253 | int result = 0; |
f3cc6b25 MZ |
254 | int length; |
255 | void *tmpbuf; | |
db1d1e8b | 256 | u64 i_version = 0; |
3323eec9 | 257 | |
e5092255 TJB |
258 | /* |
259 | * Always collect the modsig, because IMA might have already collected | |
260 | * the file digest without collecting the modsig in a previous | |
261 | * measurement rule. | |
262 | */ | |
263 | if (modsig) | |
264 | ima_collect_modsig(modsig, buf, size); | |
265 | ||
f3cc6b25 MZ |
266 | if (iint->flags & IMA_COLLECTED) |
267 | goto out; | |
3323eec9 | 268 | |
f3cc6b25 | 269 | /* |
65603435 | 270 | * Detecting file change is based on i_version. On filesystems |
8c54135e MZ |
271 | * which do not support i_version, support was originally limited |
272 | * to an initial measurement/appraisal/audit, but was modified to | |
273 | * assume the file changed. | |
f3cc6b25 | 274 | */ |
db1d1e8b JL |
275 | result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE, |
276 | AT_STATX_SYNC_AS_STAT); | |
277 | if (!result && (stat.result_mask & STATX_CHANGE_COOKIE)) | |
278 | i_version = stat.change_cookie; | |
f3cc6b25 | 279 | hash.hdr.algo = algo; |
54f03916 | 280 | hash.hdr.length = hash_digest_size[algo]; |
f9b2a735 | 281 | |
f3cc6b25 MZ |
282 | /* Initialize hash digest to 0's in case of failure */ |
283 | memset(&hash.digest, 0, sizeof(hash.digest)); | |
284 | ||
54f03916 | 285 | if (iint->flags & IMA_VERITY_REQUIRED) { |
4de2f084 | 286 | if (!ima_get_verity_digest(iint, inode, &hash)) { |
54f03916 | 287 | audit_cause = "no-verity-digest"; |
74836ecb | 288 | result = -ENODATA; |
54f03916 MZ |
289 | } |
290 | } else if (buf) { | |
38aa3f5a | 291 | result = ima_calc_buffer_hash(buf, size, hash_hdr); |
54f03916 | 292 | } else { |
38aa3f5a | 293 | result = ima_calc_file_hash(file, hash_hdr); |
54f03916 | 294 | } |
f3cc6b25 | 295 | |
6dc387d5 | 296 | if (result && result != -EBADF && result != -EINVAL) |
f3cc6b25 MZ |
297 | goto out; |
298 | ||
299 | length = sizeof(hash.hdr) + hash.hdr.length; | |
300 | tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS); | |
301 | if (!tmpbuf) { | |
302 | result = -ENOMEM; | |
303 | goto out; | |
3323eec9 | 304 | } |
f3cc6b25 MZ |
305 | |
306 | iint->ima_hash = tmpbuf; | |
307 | memcpy(iint->ima_hash, &hash, length); | |
308 | iint->version = i_version; | |
b836c4d2 MZ |
309 | if (real_inode != inode) { |
310 | iint->real_ino = real_inode->i_ino; | |
311 | iint->real_dev = real_inode->i_sb->s_dev; | |
312 | } | |
f3cc6b25 MZ |
313 | |
314 | /* Possibly temporary failure due to type of read (eg. O_DIRECT) */ | |
315 | if (!result) | |
316 | iint->flags |= IMA_COLLECTED; | |
f9b2a735 | 317 | out: |
f3cc6b25 MZ |
318 | if (result) { |
319 | if (file->f_flags & O_DIRECT) | |
320 | audit_cause = "failed(directio)"; | |
321 | ||
be84f32b SB |
322 | take_dentry_name_snapshot(&filename, file->f_path.dentry); |
323 | ||
2fe5d6de | 324 | integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, |
be84f32b SB |
325 | filename.name.name, "collect_data", |
326 | audit_cause, result, 0); | |
327 | ||
328 | release_dentry_name_snapshot(&filename); | |
f3cc6b25 | 329 | } |
3323eec9 MZ |
330 | return result; |
331 | } | |
332 | ||
333 | /* | |
334 | * ima_store_measurement - store file measurement | |
335 | * | |
336 | * Create an "ima" template and then store the template by calling | |
337 | * ima_store_template. | |
338 | * | |
339 | * We only get here if the inode has not already been measured, | |
340 | * but the measurement could already exist: | |
2bb930ab | 341 | * - multiple copies of the same file on either the same or |
3323eec9 MZ |
342 | * different filesystems. |
343 | * - the inode was previously flushed as well as the iint info, | |
344 | * containing the hashing info. | |
345 | * | |
346 | * Must be called with iint->mutex held. | |
347 | */ | |
4de2f084 RS |
348 | void ima_store_measurement(struct ima_iint_cache *iint, struct file *file, |
349 | const unsigned char *filename, | |
bcbc9b0c | 350 | struct evm_ima_xattr_data *xattr_value, |
3878d505 | 351 | int xattr_len, const struct modsig *modsig, int pcr, |
19453ce0 | 352 | struct ima_template_desc *template_desc) |
3323eec9 | 353 | { |
52a13284 MZ |
354 | static const char op[] = "add_template_measure"; |
355 | static const char audit_cause[] = "ENOMEM"; | |
3323eec9 | 356 | int result = -ENOMEM; |
496ad9aa | 357 | struct inode *inode = file_inode(file); |
3323eec9 | 358 | struct ima_template_entry *entry; |
e038f5f6 TJB |
359 | struct ima_event_data event_data = { .iint = iint, |
360 | .file = file, | |
361 | .filename = filename, | |
362 | .xattr_value = xattr_value, | |
3878d505 TJB |
363 | .xattr_len = xattr_len, |
364 | .modsig = modsig }; | |
3323eec9 MZ |
365 | int violation = 0; |
366 | ||
e5092255 TJB |
367 | /* |
368 | * We still need to store the measurement in the case of MODSIG because | |
369 | * we only have its contents to put in the list at the time of | |
370 | * appraisal, but a file measurement from earlier might already exist in | |
371 | * the measurement list. | |
372 | */ | |
373 | if (iint->measured_pcrs & (0x1 << pcr) && !modsig) | |
2fe5d6de MZ |
374 | return; |
375 | ||
19453ce0 | 376 | result = ima_alloc_init_template(&event_data, &entry, template_desc); |
7bc5f447 | 377 | if (result < 0) { |
3323eec9 MZ |
378 | integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, |
379 | op, audit_cause, result, 0); | |
380 | return; | |
381 | } | |
3323eec9 | 382 | |
14b1da85 | 383 | result = ima_store_template(entry, violation, inode, filename, pcr); |
f3cc6b25 | 384 | if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) { |
3323eec9 | 385 | iint->flags |= IMA_MEASURED; |
a422638d ER |
386 | iint->measured_pcrs |= (0x1 << pcr); |
387 | } | |
45fae749 | 388 | if (result < 0) |
a7ed7c60 | 389 | ima_free_template_entry(entry); |
3323eec9 | 390 | } |
e7c568e0 | 391 | |
4de2f084 | 392 | void ima_audit_measurement(struct ima_iint_cache *iint, |
e7c568e0 PM |
393 | const unsigned char *filename) |
394 | { | |
395 | struct audit_buffer *ab; | |
e456ef88 | 396 | char *hash; |
5278aa52 | 397 | const char *algo_name = hash_algo_name[iint->ima_hash->algo]; |
e7c568e0 PM |
398 | int i; |
399 | ||
400 | if (iint->flags & IMA_AUDITED) | |
401 | return; | |
402 | ||
e456ef88 TA |
403 | hash = kzalloc((iint->ima_hash->length * 2) + 1, GFP_KERNEL); |
404 | if (!hash) | |
405 | return; | |
406 | ||
a35c3fb6 DK |
407 | for (i = 0; i < iint->ima_hash->length; i++) |
408 | hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]); | |
e7c568e0 PM |
409 | hash[i * 2] = '\0'; |
410 | ||
cdfb6b34 | 411 | ab = audit_log_start(audit_context(), GFP_KERNEL, |
e7c568e0 PM |
412 | AUDIT_INTEGRITY_RULE); |
413 | if (!ab) | |
e456ef88 | 414 | goto out; |
e7c568e0 PM |
415 | |
416 | audit_log_format(ab, "file="); | |
417 | audit_log_untrustedstring(ab, filename); | |
e456ef88 | 418 | audit_log_format(ab, " hash=\"%s:%s\"", algo_name, hash); |
e7c568e0 | 419 | |
2a1fe215 | 420 | audit_log_task_info(ab); |
e7c568e0 PM |
421 | audit_log_end(ab); |
422 | ||
423 | iint->flags |= IMA_AUDITED; | |
e456ef88 TA |
424 | out: |
425 | kfree(hash); | |
426 | return; | |
e7c568e0 | 427 | } |
ea1046d4 | 428 | |
bc15ed66 MZ |
429 | /* |
430 | * ima_d_path - return a pointer to the full pathname | |
431 | * | |
432 | * Attempt to return a pointer to the full pathname for use in the | |
433 | * IMA measurement list, IMA audit records, and auditing logs. | |
434 | * | |
435 | * On failure, return a pointer to a copy of the filename, not dname. | |
436 | * Returning a pointer to dname, could result in using the pointer | |
437 | * after the memory has been freed. | |
438 | */ | |
439 | const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf) | |
ea1046d4 | 440 | { |
be84f32b | 441 | struct name_snapshot filename; |
ea1046d4 DK |
442 | char *pathname = NULL; |
443 | ||
456f5fd3 | 444 | *pathbuf = __getname(); |
ea1046d4 | 445 | if (*pathbuf) { |
17f4bad3 | 446 | pathname = d_absolute_path(path, *pathbuf, PATH_MAX); |
ea1046d4 | 447 | if (IS_ERR(pathname)) { |
456f5fd3 | 448 | __putname(*pathbuf); |
ea1046d4 DK |
449 | *pathbuf = NULL; |
450 | pathname = NULL; | |
451 | } | |
452 | } | |
bc15ed66 MZ |
453 | |
454 | if (!pathname) { | |
be84f32b SB |
455 | take_dentry_name_snapshot(&filename, path->dentry); |
456 | strscpy(namebuf, filename.name.name, NAME_MAX); | |
457 | release_dentry_name_snapshot(&filename); | |
458 | ||
bc15ed66 MZ |
459 | pathname = namebuf; |
460 | } | |
461 | ||
462 | return pathname; | |
ea1046d4 | 463 | } |