Commit | Line | Data |
---|---|---|
9c92ab61 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
9b091556 KC |
2 | /* |
3 | * Module and Firmware Pinning Security Module | |
4 | * | |
5 | * Copyright 2011-2016 Google Inc. | |
6 | * | |
7 | * Author: Kees Cook <keescook@chromium.org> | |
9b091556 KC |
8 | */ |
9 | ||
10 | #define pr_fmt(fmt) "LoadPin: " fmt | |
11 | ||
12 | #include <linux/module.h> | |
13 | #include <linux/fs.h> | |
b89999d0 | 14 | #include <linux/kernel_read_file.h> |
9b091556 KC |
15 | #include <linux/lsm_hooks.h> |
16 | #include <linux/mount.h> | |
3f1266f1 | 17 | #include <linux/blkdev.h> |
9b091556 KC |
18 | #include <linux/path.h> |
19 | #include <linux/sched.h> /* current */ | |
20 | #include <linux/string_helpers.h> | |
3f805f8c MK |
21 | #include <linux/dm-verity-loadpin.h> |
22 | #include <uapi/linux/loadpin.h> | |
9b091556 | 23 | |
6e42aec7 MK |
24 | #define VERITY_DIGEST_FILE_HEADER "# LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS" |
25 | ||
9b091556 KC |
26 | static void report_load(const char *origin, struct file *file, char *operation) |
27 | { | |
28 | char *cmdline, *pathname; | |
29 | ||
30 | pathname = kstrdup_quotable_file(file, GFP_KERNEL); | |
31 | cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL); | |
32 | ||
33 | pr_notice("%s %s obj=%s%s%s pid=%d cmdline=%s%s%s\n", | |
34 | origin, operation, | |
35 | (pathname && pathname[0] != '<') ? "\"" : "", | |
36 | pathname, | |
37 | (pathname && pathname[0] != '<') ? "\"" : "", | |
38 | task_pid_nr(current), | |
39 | cmdline ? "\"" : "", cmdline, cmdline ? "\"" : ""); | |
40 | ||
41 | kfree(cmdline); | |
42 | kfree(pathname); | |
43 | } | |
44 | ||
13523bef | 45 | static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE); |
0ff98480 KW |
46 | static char *exclude_read_files[READING_MAX_ID]; |
47 | static int ignore_read_file_id[READING_MAX_ID] __ro_after_init; | |
9b091556 KC |
48 | static struct super_block *pinned_root; |
49 | static DEFINE_SPINLOCK(pinned_root_spinlock); | |
3f805f8c MK |
50 | #ifdef CONFIG_SECURITY_LOADPIN_VERITY |
51 | static bool deny_reading_verity_digests; | |
52 | #endif | |
9b091556 KC |
53 | |
54 | #ifdef CONFIG_SYSCTL | |
9b091556 KC |
55 | static struct ctl_table loadpin_sysctl_table[] = { |
56 | { | |
13523bef KC |
57 | .procname = "enforce", |
58 | .data = &enforce, | |
9b091556 KC |
59 | .maxlen = sizeof(int), |
60 | .mode = 0644, | |
61 | .proc_handler = proc_dointvec_minmax, | |
60ba1028 | 62 | .extra1 = SYSCTL_ONE, |
eec4844f | 63 | .extra2 = SYSCTL_ONE, |
9b091556 KC |
64 | }, |
65 | { } | |
66 | }; | |
67 | ||
60ba1028 | 68 | static void set_sysctl(bool is_writable) |
9b091556 | 69 | { |
9b091556 KC |
70 | /* |
71 | * If load pinning is not enforced via a read-only block | |
72 | * device, allow sysctl to change modes for testing. | |
73 | */ | |
60ba1028 KC |
74 | if (is_writable) |
75 | loadpin_sysctl_table[0].extra1 = SYSCTL_ZERO; | |
76 | else | |
77 | loadpin_sysctl_table[0].extra1 = SYSCTL_ONE; | |
78 | } | |
79 | #else | |
80 | static inline void set_sysctl(bool is_writable) { } | |
81 | #endif | |
82 | ||
83 | static void report_writable(struct super_block *mnt_sb, bool writable) | |
84 | { | |
9b091556 | 85 | if (mnt_sb->s_bdev) { |
ed5edd5a | 86 | pr_info("%pg (%u:%u): %s\n", mnt_sb->s_bdev, |
9b091556 KC |
87 | MAJOR(mnt_sb->s_bdev->bd_dev), |
88 | MINOR(mnt_sb->s_bdev->bd_dev), | |
b76ded21 | 89 | writable ? "writable" : "read-only"); |
9b091556 KC |
90 | } else |
91 | pr_info("mnt_sb lacks block device, treating as: writable\n"); | |
92 | ||
60ba1028 | 93 | if (!writable) |
9b091556 KC |
94 | pr_info("load pinning engaged.\n"); |
95 | } | |
9b091556 | 96 | |
b76ded21 KC |
97 | /* |
98 | * This must be called after early kernel init, since then the rootdev | |
99 | * is available. | |
100 | */ | |
101 | static bool sb_is_writable(struct super_block *mnt_sb) | |
102 | { | |
103 | bool writable = true; | |
104 | ||
105 | if (mnt_sb->s_bdev) | |
106 | writable = !bdev_read_only(mnt_sb->s_bdev); | |
107 | ||
108 | return writable; | |
109 | } | |
110 | ||
9b091556 KC |
111 | static void loadpin_sb_free_security(struct super_block *mnt_sb) |
112 | { | |
113 | /* | |
114 | * When unmounting the filesystem we were using for load | |
115 | * pinning, we acknowledge the superblock release, but make sure | |
eba77359 KC |
116 | * no other modules or firmware can be loaded when we are in |
117 | * enforcing mode. Otherwise, allow the root to be reestablished. | |
9b091556 KC |
118 | */ |
119 | if (!IS_ERR_OR_NULL(pinned_root) && mnt_sb == pinned_root) { | |
eba77359 KC |
120 | if (enforce) { |
121 | pinned_root = ERR_PTR(-EIO); | |
122 | pr_info("umount pinned fs: refusing further loads\n"); | |
123 | } else { | |
124 | pinned_root = NULL; | |
125 | } | |
9b091556 KC |
126 | } |
127 | } | |
128 | ||
1a17e5b5 | 129 | static int loadpin_check(struct file *file, enum kernel_read_file_id id) |
9b091556 KC |
130 | { |
131 | struct super_block *load_root; | |
132 | const char *origin = kernel_read_file_id_str(id); | |
2cfaa84e | 133 | bool first_root_pin = false; |
b76ded21 | 134 | bool load_root_writable; |
9b091556 | 135 | |
0ff98480 KW |
136 | /* If the file id is excluded, ignore the pinning. */ |
137 | if ((unsigned int)id < ARRAY_SIZE(ignore_read_file_id) && | |
138 | ignore_read_file_id[id]) { | |
139 | report_load(origin, file, "pinning-excluded"); | |
140 | return 0; | |
141 | } | |
142 | ||
9b091556 KC |
143 | /* This handles the older init_module API that has a NULL file. */ |
144 | if (!file) { | |
13523bef | 145 | if (!enforce) { |
9b091556 KC |
146 | report_load(origin, NULL, "old-api-pinning-ignored"); |
147 | return 0; | |
148 | } | |
149 | ||
150 | report_load(origin, NULL, "old-api-denied"); | |
151 | return -EPERM; | |
152 | } | |
153 | ||
154 | load_root = file->f_path.mnt->mnt_sb; | |
b76ded21 | 155 | load_root_writable = sb_is_writable(load_root); |
9b091556 KC |
156 | |
157 | /* First loaded module/firmware defines the root for all others. */ | |
158 | spin_lock(&pinned_root_spinlock); | |
159 | /* | |
eba77359 KC |
160 | * pinned_root is only NULL at startup or when the pinned root has |
161 | * been unmounted while we are not in enforcing mode. Otherwise, it | |
162 | * is either a valid reference, or an ERR_PTR. | |
9b091556 KC |
163 | */ |
164 | if (!pinned_root) { | |
165 | pinned_root = load_root; | |
2cfaa84e KC |
166 | first_root_pin = true; |
167 | } | |
168 | spin_unlock(&pinned_root_spinlock); | |
169 | ||
170 | if (first_root_pin) { | |
b76ded21 | 171 | report_writable(pinned_root, load_root_writable); |
60ba1028 | 172 | set_sysctl(load_root_writable); |
9b091556 | 173 | report_load(origin, file, "pinned"); |
9b091556 KC |
174 | } |
175 | ||
3f805f8c MK |
176 | if (IS_ERR_OR_NULL(pinned_root) || |
177 | ((load_root != pinned_root) && !dm_verity_loadpin_is_bdev_trusted(load_root->s_bdev))) { | |
13523bef | 178 | if (unlikely(!enforce)) { |
9b091556 KC |
179 | report_load(origin, file, "pinning-ignored"); |
180 | return 0; | |
181 | } | |
182 | ||
183 | report_load(origin, file, "denied"); | |
184 | return -EPERM; | |
185 | } | |
186 | ||
187 | return 0; | |
188 | } | |
189 | ||
1a17e5b5 KC |
190 | static int loadpin_read_file(struct file *file, enum kernel_read_file_id id, |
191 | bool contents) | |
192 | { | |
193 | /* | |
194 | * LoadPin only cares about the _origin_ of a file, not its | |
195 | * contents, so we can ignore the "are full contents available" | |
196 | * argument here. | |
197 | */ | |
198 | return loadpin_check(file, id); | |
199 | } | |
200 | ||
b64fcae7 | 201 | static int loadpin_load_data(enum kernel_load_data_id id, bool contents) |
c77b8cdf | 202 | { |
1a17e5b5 KC |
203 | /* |
204 | * LoadPin only cares about the _origin_ of a file, not its | |
205 | * contents, so a NULL file is passed, and we can ignore the | |
206 | * state of "contents". | |
207 | */ | |
208 | return loadpin_check(NULL, (enum kernel_read_file_id) id); | |
c77b8cdf MZ |
209 | } |
210 | ||
f22f9aaf | 211 | static struct security_hook_list loadpin_hooks[] __ro_after_init = { |
9b091556 KC |
212 | LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security), |
213 | LSM_HOOK_INIT(kernel_read_file, loadpin_read_file), | |
c77b8cdf | 214 | LSM_HOOK_INIT(kernel_load_data, loadpin_load_data), |
9b091556 KC |
215 | }; |
216 | ||
0ff98480 KW |
217 | static void __init parse_exclude(void) |
218 | { | |
219 | int i, j; | |
220 | char *cur; | |
221 | ||
222 | /* | |
223 | * Make sure all the arrays stay within expected sizes. This | |
224 | * is slightly weird because kernel_read_file_str[] includes | |
225 | * READING_MAX_ID, which isn't actually meaningful here. | |
226 | */ | |
227 | BUILD_BUG_ON(ARRAY_SIZE(exclude_read_files) != | |
228 | ARRAY_SIZE(ignore_read_file_id)); | |
229 | BUILD_BUG_ON(ARRAY_SIZE(kernel_read_file_str) < | |
230 | ARRAY_SIZE(ignore_read_file_id)); | |
231 | ||
232 | for (i = 0; i < ARRAY_SIZE(exclude_read_files); i++) { | |
233 | cur = exclude_read_files[i]; | |
234 | if (!cur) | |
235 | break; | |
236 | if (*cur == '\0') | |
237 | continue; | |
238 | ||
239 | for (j = 0; j < ARRAY_SIZE(ignore_read_file_id); j++) { | |
240 | if (strcmp(cur, kernel_read_file_str[j]) == 0) { | |
241 | pr_info("excluding: %s\n", | |
242 | kernel_read_file_str[j]); | |
243 | ignore_read_file_id[j] = 1; | |
244 | /* | |
245 | * Can not break, because one read_file_str | |
246 | * may map to more than on read_file_id. | |
247 | */ | |
248 | } | |
249 | } | |
250 | } | |
251 | } | |
252 | ||
70b62c25 | 253 | static int __init loadpin_init(void) |
9b091556 | 254 | { |
13523bef KC |
255 | pr_info("ready to pin (currently %senforcing)\n", |
256 | enforce ? "" : "not "); | |
0ff98480 | 257 | parse_exclude(); |
60ba1028 | 258 | #ifdef CONFIG_SYSCTL |
5df5bdc3 | 259 | if (!register_sysctl("kernel/loadpin", loadpin_sysctl_table)) |
60ba1028 KC |
260 | pr_notice("sysctl registration failed!\n"); |
261 | #endif | |
d69dece5 | 262 | security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin"); |
3f805f8c | 263 | |
70b62c25 | 264 | return 0; |
9b091556 KC |
265 | } |
266 | ||
70b62c25 KC |
267 | DEFINE_LSM(loadpin) = { |
268 | .name = "loadpin", | |
269 | .init = loadpin_init, | |
270 | }; | |
271 | ||
3f805f8c MK |
272 | #ifdef CONFIG_SECURITY_LOADPIN_VERITY |
273 | ||
274 | enum loadpin_securityfs_interface_index { | |
275 | LOADPIN_DM_VERITY, | |
276 | }; | |
277 | ||
278 | static int read_trusted_verity_root_digests(unsigned int fd) | |
279 | { | |
280 | struct fd f; | |
281 | void *data; | |
282 | int rc; | |
283 | char *p, *d; | |
284 | ||
285 | if (deny_reading_verity_digests) | |
286 | return -EPERM; | |
287 | ||
288 | /* The list of trusted root digests can only be set up once */ | |
289 | if (!list_empty(&dm_verity_loadpin_trusted_root_digests)) | |
290 | return -EPERM; | |
291 | ||
292 | f = fdget(fd); | |
293 | if (!f.file) | |
294 | return -EINVAL; | |
295 | ||
296 | data = kzalloc(SZ_4K, GFP_KERNEL); | |
297 | if (!data) { | |
298 | rc = -ENOMEM; | |
299 | goto err; | |
300 | } | |
301 | ||
302 | rc = kernel_read_file(f.file, 0, (void **)&data, SZ_4K - 1, NULL, READING_POLICY); | |
303 | if (rc < 0) | |
304 | goto err; | |
305 | ||
306 | p = data; | |
307 | p[rc] = '\0'; | |
308 | p = strim(p); | |
309 | ||
310 | p = strim(data); | |
311 | while ((d = strsep(&p, "\n")) != NULL) { | |
6e42aec7 | 312 | int len; |
3f805f8c MK |
313 | struct dm_verity_loadpin_trusted_root_digest *trd; |
314 | ||
6e42aec7 MK |
315 | if (d == data) { |
316 | /* first line, validate header */ | |
317 | if (strcmp(d, VERITY_DIGEST_FILE_HEADER)) { | |
318 | rc = -EPROTO; | |
319 | goto err; | |
320 | } | |
321 | ||
322 | continue; | |
323 | } | |
324 | ||
325 | len = strlen(d); | |
326 | ||
3f805f8c MK |
327 | if (len % 2) { |
328 | rc = -EPROTO; | |
329 | goto err; | |
330 | } | |
331 | ||
332 | len /= 2; | |
333 | ||
334 | trd = kzalloc(struct_size(trd, data, len), GFP_KERNEL); | |
335 | if (!trd) { | |
336 | rc = -ENOMEM; | |
337 | goto err; | |
338 | } | |
5f536ac6 | 339 | trd->len = len; |
3f805f8c MK |
340 | |
341 | if (hex2bin(trd->data, d, len)) { | |
342 | kfree(trd); | |
343 | rc = -EPROTO; | |
344 | goto err; | |
345 | } | |
346 | ||
3f805f8c MK |
347 | list_add_tail(&trd->node, &dm_verity_loadpin_trusted_root_digests); |
348 | } | |
349 | ||
350 | if (list_empty(&dm_verity_loadpin_trusted_root_digests)) { | |
351 | rc = -EPROTO; | |
352 | goto err; | |
353 | } | |
354 | ||
355 | kfree(data); | |
356 | fdput(f); | |
357 | ||
358 | return 0; | |
359 | ||
360 | err: | |
361 | kfree(data); | |
362 | ||
363 | /* any failure in loading/parsing invalidates the entire list */ | |
364 | { | |
365 | struct dm_verity_loadpin_trusted_root_digest *trd, *tmp; | |
366 | ||
367 | list_for_each_entry_safe(trd, tmp, &dm_verity_loadpin_trusted_root_digests, node) { | |
368 | list_del(&trd->node); | |
369 | kfree(trd); | |
370 | } | |
371 | } | |
372 | ||
373 | /* disallow further attempts after reading a corrupt/invalid file */ | |
374 | deny_reading_verity_digests = true; | |
375 | ||
376 | fdput(f); | |
377 | ||
378 | return rc; | |
379 | } | |
380 | ||
381 | /******************************** securityfs ********************************/ | |
382 | ||
383 | static long dm_verity_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) | |
384 | { | |
385 | void __user *uarg = (void __user *)arg; | |
386 | unsigned int fd; | |
3f805f8c MK |
387 | |
388 | switch (cmd) { | |
389 | case LOADPIN_IOC_SET_TRUSTED_VERITY_DIGESTS: | |
6a3981af KC |
390 | if (copy_from_user(&fd, uarg, sizeof(fd))) |
391 | return -EFAULT; | |
3f805f8c MK |
392 | |
393 | return read_trusted_verity_root_digests(fd); | |
394 | ||
395 | default: | |
396 | return -EINVAL; | |
397 | } | |
398 | } | |
399 | ||
400 | static const struct file_operations loadpin_dm_verity_ops = { | |
401 | .unlocked_ioctl = dm_verity_ioctl, | |
402 | .compat_ioctl = compat_ptr_ioctl, | |
403 | }; | |
404 | ||
405 | /** | |
406 | * init_loadpin_securityfs - create the securityfs directory for LoadPin | |
407 | * | |
408 | * We can not put this method normally under the loadpin_init() code path since | |
409 | * the security subsystem gets initialized before the vfs caches. | |
410 | * | |
411 | * Returns 0 if the securityfs directory creation was successful. | |
412 | */ | |
413 | static int __init init_loadpin_securityfs(void) | |
414 | { | |
415 | struct dentry *loadpin_dir, *dentry; | |
416 | ||
417 | loadpin_dir = securityfs_create_dir("loadpin", NULL); | |
418 | if (IS_ERR(loadpin_dir)) { | |
419 | pr_err("LoadPin: could not create securityfs dir: %ld\n", | |
420 | PTR_ERR(loadpin_dir)); | |
421 | return PTR_ERR(loadpin_dir); | |
422 | } | |
423 | ||
424 | dentry = securityfs_create_file("dm-verity", 0600, loadpin_dir, | |
425 | (void *)LOADPIN_DM_VERITY, &loadpin_dm_verity_ops); | |
426 | if (IS_ERR(dentry)) { | |
427 | pr_err("LoadPin: could not create securityfs entry 'dm-verity': %ld\n", | |
428 | PTR_ERR(dentry)); | |
429 | return PTR_ERR(dentry); | |
430 | } | |
431 | ||
432 | return 0; | |
433 | } | |
434 | ||
435 | fs_initcall(init_loadpin_securityfs); | |
436 | ||
437 | #endif /* CONFIG_SECURITY_LOADPIN_VERITY */ | |
438 | ||
9b091556 | 439 | /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */ |
13523bef KC |
440 | module_param(enforce, int, 0); |
441 | MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning"); | |
0ff98480 KW |
442 | module_param_array_named(exclude, exclude_read_files, charp, NULL, 0); |
443 | MODULE_PARM_DESC(exclude, "Exclude pinning specific read file types"); |