[linux-2.6-block.git] / security / integrity / ima / ima_queue.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
 *
 * Authors:
 * Serge Hallyn <serue@us.ibm.com>
 * Reiner Sailer <sailer@watson.ibm.com>
 * Mimi Zohar <zohar@us.ibm.com>
 *
 * File: ima_queue.c
 *       Implements queues that store template measurements and
 *       maintains aggregate over the stored measurements
 *       in the pre-configured TPM PCR (if available).
 *       The measurement list is append-only. No entry is
 *       ever removed or changed during the boot-cycle.
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/rculist.h>
#include <linux/slab.h>
#include "ima.h"

#define AUDIT_CAUSE_LEN_MAX 32

/* pre-allocated array of tpm_digest structures to extend a PCR */
static struct tpm_digest *digests;

LIST_HEAD(ima_measurements);	/* list of all measurements */
#ifdef CONFIG_IMA_KEXEC
static unsigned long binary_runtime_size;
#else
static unsigned long binary_runtime_size = ULONG_MAX;
#endif

/* key: inode (before secure-hashing a file) */
struct ima_h_table ima_htable = {
	.len = ATOMIC_LONG_INIT(0),
	.violations = ATOMIC_LONG_INIT(0),
	.queue[0 ... IMA_MEASURE_HTABLE_SIZE - 1] = HLIST_HEAD_INIT
};

/* mutex protects atomicity of extending measurement list
 * and extending the TPM PCR aggregate. Since tpm_extend can take
 * long (and the tpm driver uses a mutex), we can't use the spinlock.
 */
static DEFINE_MUTEX(ima_extend_list_mutex);

/* lookup up the digest value in the hash table, and return the entry */
static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value,
						       int pcr)
{
	struct ima_queue_entry *qe, *ret = NULL;
	unsigned int key;
	int rc;

	key = ima_hash_key(digest_value);
	rcu_read_lock();
	hlist_for_each_entry_rcu(qe, &ima_htable.queue[key], hnext) {
		rc = memcmp(qe->entry->digest, digest_value, TPM_DIGEST_SIZE);
		if ((rc == 0) && (qe->entry->pcr == pcr)) {
			ret = qe;
			break;
		}
	}
	rcu_read_unlock();
	return ret;
}

/*
 * Calculate the memory required for serializing a single
 * binary_runtime_measurement list entry, which contains a
 * couple of variable length fields (e.g template name and data).
 */
static int get_binary_runtime_size(struct ima_template_entry *entry)
{
	int size = 0;

	size += sizeof(u32);	/* pcr */
	size += sizeof(entry->digest);
	size += sizeof(int);	/* template name size field */
	size += strlen(entry->template_desc->name);
	size += sizeof(entry->template_data_len);
	size += entry->template_data_len;
	return size;
}

/* ima_add_template_entry helper function:
 * - Add template entry to the measurement list and hash table, for
 *   all entries except those carried across kexec.
 *
 * (Called with ima_extend_list_mutex held.)
 */
static int ima_add_digest_entry(struct ima_template_entry *entry,
				bool update_htable)
{
	struct ima_queue_entry *qe;
	unsigned int key;

	qe = kmalloc(sizeof(*qe), GFP_KERNEL);
	if (qe == NULL) {
		pr_err("OUT OF MEMORY ERROR creating queue entry\n");
		return -ENOMEM;
	}
	qe->entry = entry;

	INIT_LIST_HEAD(&qe->later);
	list_add_tail_rcu(&qe->later, &ima_measurements);

	atomic_long_inc(&ima_htable.len);
	if (update_htable) {
		key = ima_hash_key(entry->digest);
		hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
	}

	if (binary_runtime_size != ULONG_MAX) {
		int size;

		size = get_binary_runtime_size(entry);
		binary_runtime_size = (binary_runtime_size < ULONG_MAX - size) ?
		     binary_runtime_size + size : ULONG_MAX;
	}
	return 0;
}

/*
 * Return the amount of memory required for serializing the
 * entire binary_runtime_measurement list, including the ima_kexec_hdr
 * structure.
 */
unsigned long ima_get_binary_runtime_size(void)
{
	if (binary_runtime_size >= (ULONG_MAX - sizeof(struct ima_kexec_hdr)))
		return ULONG_MAX;
	else
		return binary_runtime_size + sizeof(struct ima_kexec_hdr);
};

static int ima_pcr_extend(const u8 *hash, int pcr)
{
	int result = 0;
	int i;

	if (!ima_tpm_chip)
		return result;

	for (i = 0; i < ima_tpm_chip->nr_allocated_banks; i++)
		memcpy(digests[i].digest, hash, TPM_DIGEST_SIZE);

	result = tpm_pcr_extend(ima_tpm_chip, pcr, digests);
	if (result != 0)
		pr_err("Error Communicating to TPM chip, result: %d\n", result);
	return result;
}

/*
 * Add template entry to the measurement list and hash table, and
 * extend the pcr.
 *
 * On systems which support carrying the IMA measurement list across
 * kexec, maintain the total memory size required for serializing the
 * binary_runtime_measurements.
 */
int ima_add_template_entry(struct ima_template_entry *entry, int violation,
			   const char *op, struct inode *inode,
			   const unsigned char *filename)
{
	u8 digest[TPM_DIGEST_SIZE];
	const char *audit_cause = "hash_added";
	char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
	int audit_info = 1;
	int result = 0, tpmresult = 0;

	mutex_lock(&ima_extend_list_mutex);
	if (!violation) {
		memcpy(digest, entry->digest, sizeof(digest));
		if (ima_lookup_digest_entry(digest, entry->pcr)) {
			audit_cause = "hash_exists";
			result = -EEXIST;
			goto out;
		}
	}

	result = ima_add_digest_entry(entry, 1);
	if (result < 0) {
		audit_cause = "ENOMEM";
		audit_info = 0;
		goto out;
	}

	if (violation)		/* invalidate pcr */
		memset(digest, 0xff, sizeof(digest));

	tpmresult = ima_pcr_extend(digest, entry->pcr);
	if (tpmresult != 0) {
		snprintf(tpm_audit_cause, AUDIT_CAUSE_LEN_MAX, "TPM_error(%d)",
			 tpmresult);
		audit_cause = tpm_audit_cause;
		audit_info = 0;
	}
out:
	mutex_unlock(&ima_extend_list_mutex);
	integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
			    op, audit_cause, result, audit_info);
	return result;
}

int ima_restore_measurement_entry(struct ima_template_entry *entry)
{
	int result = 0;

	mutex_lock(&ima_extend_list_mutex);
	result = ima_add_digest_entry(entry, 0);
	mutex_unlock(&ima_extend_list_mutex);
	return result;
}

int __init ima_init_digests(void)
{
	int i;

	if (!ima_tpm_chip)
		return 0;

	digests = kcalloc(ima_tpm_chip->nr_allocated_banks, sizeof(*digests),
			  GFP_NOFS);
	if (!digests)
		return -ENOMEM;

	for (i = 0; i < ima_tpm_chip->nr_allocated_banks; i++)
		digests[i].alg_id = ima_tpm_chip->allocated_banks[i].alg_id;

	return 0;
}
Commit	Line	Data
b886d83c	1	// SPDX-License-Identifier: GPL-2.0-only
3323eec9 MZ	2	/*
	3	* Copyright (C) 2005,2006,2007,2008 IBM Corporation
	4	*
	5	* Authors:
	6	* Serge Hallyn <serue@us.ibm.com>
	7	* Reiner Sailer <sailer@watson.ibm.com>
	8	* Mimi Zohar <zohar@us.ibm.com>
	9	*
3323eec9 MZ	10	* File: ima_queue.c
	11	* Implements queues that store template measurements and
	12	* maintains aggregate over the stored measurements
	13	* in the pre-configured TPM PCR (if available).
	14	* The measurement list is append-only. No entry is
	15	* ever removed or changed during the boot-cycle.
	16	*/
20ee451f JP	17
	18	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
	19
3323eec9	20	#include <linux/rculist.h>
5a0e3ad6	21	#include <linux/slab.h>
3323eec9 MZ	22	#include "ima.h"
3323eec9 MZ	23
7b7e5916 RS	24	#define AUDIT_CAUSE_LEN_MAX 32
7b7e5916 RS	25
0b6cf6b9 RS	26	/* pre-allocated array of tpm_digest structures to extend a PCR */
	27	static struct tpm_digest *digests;
	28
3323eec9	29	LIST_HEAD(ima_measurements); /* list of all measurements */
d158847a MZ	30	#ifdef CONFIG_IMA_KEXEC
	31	static unsigned long binary_runtime_size;
	32	#else
	33	static unsigned long binary_runtime_size = ULONG_MAX;
	34	#endif
3323eec9 MZ	35
	36	/* key: inode (before secure-hashing a file) */
	37	struct ima_h_table ima_htable = {
	38	.len = ATOMIC_LONG_INIT(0),
	39	.violations = ATOMIC_LONG_INIT(0),
	40	.queue[0 ... IMA_MEASURE_HTABLE_SIZE - 1] = HLIST_HEAD_INIT
	41	};
	42
	43	/* mutex protects atomicity of extending measurement list
	44	* and extending the TPM PCR aggregate. Since tpm_extend can take
	45	* long (and the tpm driver uses a mutex), we can't use the spinlock.
	46	*/
	47	static DEFINE_MUTEX(ima_extend_list_mutex);
	48
	49	/* lookup up the digest value in the hash table, and return the entry */
67696f6d ER	50	static struct ima_queue_entry ima_lookup_digest_entry(u8 digest_value,
67696f6d ER	51	int pcr)
3323eec9 MZ	52	{
	53	struct ima_queue_entry qe, ret = NULL;
	54	unsigned int key;
3323eec9 MZ	55	int rc;
	56
	57	key = ima_hash_key(digest_value);
	58	rcu_read_lock();
b67bfe0d	59	hlist_for_each_entry_rcu(qe, &ima_htable.queue[key], hnext) {
140d8022	60	rc = memcmp(qe->entry->digest, digest_value, TPM_DIGEST_SIZE);
67696f6d	61	if ((rc == 0) && (qe->entry->pcr == pcr)) {
3323eec9 MZ	62	ret = qe;
	63	break;
	64	}
	65	}
	66	rcu_read_unlock();
	67	return ret;
	68	}
	69
d158847a MZ	70	/*
	71	* Calculate the memory required for serializing a single
	72	* binary_runtime_measurement list entry, which contains a
	73	* couple of variable length fields (e.g template name and data).
	74	*/
	75	static int get_binary_runtime_size(struct ima_template_entry *entry)
	76	{
	77	int size = 0;
	78
	79	size += sizeof(u32); /* pcr */
	80	size += sizeof(entry->digest);
	81	size += sizeof(int); /* template name size field */
e4586c79	82	size += strlen(entry->template_desc->name);
d158847a MZ	83	size += sizeof(entry->template_data_len);
	84	size += entry->template_data_len;
	85	return size;
	86	}
	87
3323eec9	88	/* ima_add_template_entry helper function:
dcfc5693 MZ	89	* - Add template entry to the measurement list and hash table, for
dcfc5693 MZ	90	* all entries except those carried across kexec.
3323eec9 MZ	91	*
	92	* (Called with ima_extend_list_mutex held.)
	93	*/
dcfc5693 MZ	94	static int ima_add_digest_entry(struct ima_template_entry *entry,
dcfc5693 MZ	95	bool update_htable)
3323eec9 MZ	96	{
	97	struct ima_queue_entry *qe;
	98	unsigned int key;
	99
	100	qe = kmalloc(sizeof(*qe), GFP_KERNEL);
	101	if (qe == NULL) {
20ee451f	102	pr_err("OUT OF MEMORY ERROR creating queue entry\n");
3323eec9 MZ	103	return -ENOMEM;
	104	}
	105	qe->entry = entry;
	106
	107	INIT_LIST_HEAD(&qe->later);
	108	list_add_tail_rcu(&qe->later, &ima_measurements);
	109
	110	atomic_long_inc(&ima_htable.len);
dcfc5693 MZ	111	if (update_htable) {
	112	key = ima_hash_key(entry->digest);
	113	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
	114	}
d158847a MZ	115
	116	if (binary_runtime_size != ULONG_MAX) {
	117	int size;
	118
	119	size = get_binary_runtime_size(entry);
	120	binary_runtime_size = (binary_runtime_size < ULONG_MAX - size) ?
	121	binary_runtime_size + size : ULONG_MAX;
	122	}
3323eec9 MZ	123	return 0;
	124	}
	125
d158847a MZ	126	/*
	127	* Return the amount of memory required for serializing the
	128	* entire binary_runtime_measurement list, including the ima_kexec_hdr
	129	* structure.
	130	*/
	131	unsigned long ima_get_binary_runtime_size(void)
	132	{
	133	if (binary_runtime_size >= (ULONG_MAX - sizeof(struct ima_kexec_hdr)))
	134	return ULONG_MAX;
	135	else
	136	return binary_runtime_size + sizeof(struct ima_kexec_hdr);
	137	};
	138
544e1cea	139	static int ima_pcr_extend(const u8 *hash, int pcr)
3323eec9 MZ	140	{
3323eec9 MZ	141	int result = 0;
0b6cf6b9	142	int i;
3323eec9	143
ec403d8e	144	if (!ima_tpm_chip)
3323eec9 MZ	145	return result;
3323eec9 MZ	146
0b6cf6b9 RS	147	for (i = 0; i < ima_tpm_chip->nr_allocated_banks; i++)
	148	memcpy(digests[i].digest, hash, TPM_DIGEST_SIZE);
	149
	150	result = tpm_pcr_extend(ima_tpm_chip, pcr, digests);
3323eec9	151	if (result != 0)
20ee451f	152	pr_err("Error Communicating to TPM chip, result: %d\n", result);
3323eec9 MZ	153	return result;
	154	}
	155
d158847a MZ	156	/*
	157	* Add template entry to the measurement list and hash table, and
	158	* extend the pcr.
	159	*
	160	* On systems which support carrying the IMA measurement list across
	161	* kexec, maintain the total memory size required for serializing the
	162	* binary_runtime_measurements.
3323eec9 MZ	163	*/
3323eec9 MZ	164	int ima_add_template_entry(struct ima_template_entry *entry, int violation,
9803d413 RS	165	const char op, struct inode inode,
9803d413 RS	166	const unsigned char *filename)
3323eec9	167	{
140d8022	168	u8 digest[TPM_DIGEST_SIZE];
3323eec9	169	const char *audit_cause = "hash_added";
7b7e5916	170	char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
3323eec9	171	int audit_info = 1;
7b7e5916	172	int result = 0, tpmresult = 0;
3323eec9 MZ	173
	174	mutex_lock(&ima_extend_list_mutex);
	175	if (!violation) {
2bb930ab	176	memcpy(digest, entry->digest, sizeof(digest));
67696f6d	177	if (ima_lookup_digest_entry(digest, entry->pcr)) {
3323eec9	178	audit_cause = "hash_exists";
45fae749	179	result = -EEXIST;
3323eec9 MZ	180	goto out;
	181	}
	182	}
	183
dcfc5693	184	result = ima_add_digest_entry(entry, 1);
3323eec9 MZ	185	if (result < 0) {
	186	audit_cause = "ENOMEM";
	187	audit_info = 0;
	188	goto out;
	189	}
	190
	191	if (violation) /* invalidate pcr */
2bb930ab	192	memset(digest, 0xff, sizeof(digest));
3323eec9	193
544e1cea	194	tpmresult = ima_pcr_extend(digest, entry->pcr);
7b7e5916 RS	195	if (tpmresult != 0) {
	196	snprintf(tpm_audit_cause, AUDIT_CAUSE_LEN_MAX, "TPM_error(%d)",
	197	tpmresult);
	198	audit_cause = tpm_audit_cause;
3323eec9 MZ	199	audit_info = 0;
	200	}
	201	out:
	202	mutex_unlock(&ima_extend_list_mutex);
9803d413	203	integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
3323eec9 MZ	204	op, audit_cause, result, audit_info);
	205	return result;
	206	}
94c3aac5 MZ	207
	208	int ima_restore_measurement_entry(struct ima_template_entry *entry)
	209	{
	210	int result = 0;
	211
	212	mutex_lock(&ima_extend_list_mutex);
dcfc5693	213	result = ima_add_digest_entry(entry, 0);
94c3aac5 MZ	214	mutex_unlock(&ima_extend_list_mutex);
	215	return result;
	216	}
0b6cf6b9 RS	217
	218	int __init ima_init_digests(void)
	219	{
	220	int i;
	221
	222	if (!ima_tpm_chip)
	223	return 0;
	224
	225	digests = kcalloc(ima_tpm_chip->nr_allocated_banks, sizeof(*digests),
	226	GFP_NOFS);
	227	if (!digests)
	228	return -ENOMEM;
	229
	230	for (i = 0; i < ima_tpm_chip->nr_allocated_banks; i++)
	231	digests[i].alg_id = ima_tpm_chip->allocated_banks[i].alg_id;
	232
	233	return 0;
	234	}