projects / linux-block.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Merge tag 'pci-v6.16-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
[linux-block.git] / security / integrity / ima / ima_appraise.c
... / ...
CommitLineData
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (C) 2011 IBM Corporation
4 *
5 * Author:
6 * Mimi Zohar <zohar@us.ibm.com>
7 */
8#include <linux/module.h>
9#include <linux/init.h>
10#include <linux/file.h>
11#include <linux/binfmts.h>
12#include <linux/fs.h>
13#include <linux/xattr.h>
14#include <linux/magic.h>
15#include <linux/ima.h>
16#include <linux/evm.h>
17#include <linux/fsverity.h>
18#include <keys/system_keyring.h>
19#include <uapi/linux/fsverity.h>
20
21#include "ima.h"
22
23#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
24static char *ima_appraise_cmdline_default __initdata;
25core_param(ima_appraise, ima_appraise_cmdline_default, charp, 0);
26
27void __init ima_appraise_parse_cmdline(void)
28{
29 const char *str = ima_appraise_cmdline_default;
30 bool sb_state = arch_ima_get_secureboot();
31 int appraisal_state = ima_appraise;
32
33 if (!str)
34 return;
35
36 if (strncmp(str, "off", 3) == 0)
37 appraisal_state = 0;
38 else if (strncmp(str, "log", 3) == 0)
39 appraisal_state = IMA_APPRAISE_LOG;
40 else if (strncmp(str, "fix", 3) == 0)
41 appraisal_state = IMA_APPRAISE_FIX;
42 else if (strncmp(str, "enforce", 7) == 0)
43 appraisal_state = IMA_APPRAISE_ENFORCE;
44 else
45 pr_err("invalid \"%s\" appraise option", str);
46
47 /* If appraisal state was changed, but secure boot is enabled,
48 * keep its default */
49 if (sb_state) {
50 if (!(appraisal_state & IMA_APPRAISE_ENFORCE))
51 pr_info("Secure boot enabled: ignoring ima_appraise=%s option",
52 str);
53 } else {
54 ima_appraise = appraisal_state;
55 }
56}
57#endif
58
59/*
60 * is_ima_appraise_enabled - return appraise status
61 *
62 * Only return enabled, if not in ima_appraise="fix" or "log" modes.
63 */
64bool is_ima_appraise_enabled(void)
65{
66 return ima_appraise & IMA_APPRAISE_ENFORCE;
67}
68
69/*
70 * ima_must_appraise - set appraise flag
71 *
72 * Return 1 to appraise or hash
73 */
74int ima_must_appraise(struct mnt_idmap *idmap, struct inode *inode,
75 int mask, enum ima_hooks func)
76{
77 struct lsm_prop prop;
78
79 if (!ima_appraise)
80 return 0;
81
82 security_current_getlsmprop_subj(&prop);
83 return ima_match_policy(idmap, inode, current_cred(), &prop,
84 func, mask, IMA_APPRAISE | IMA_HASH, NULL,
85 NULL, NULL, NULL);
86}
87
88static int ima_fix_xattr(struct dentry *dentry, struct ima_iint_cache *iint)
89{
90 int rc, offset;
91 u8 algo = iint->ima_hash->algo;
92
93 if (algo <= HASH_ALGO_SHA1) {
94 offset = 1;
95 iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;
96 } else {
97 offset = 0;
98 iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG;
99 iint->ima_hash->xattr.ng.algo = algo;
100 }
101 rc = __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_IMA,
102 &iint->ima_hash->xattr.data[offset],
103 (sizeof(iint->ima_hash->xattr) - offset) +
104 iint->ima_hash->length, 0);
105 return rc;
106}
107
108/* Return specific func appraised cached result */
109enum integrity_status ima_get_cache_status(struct ima_iint_cache *iint,
110 enum ima_hooks func)
111{
112 switch (func) {
113 case MMAP_CHECK:
114 case MMAP_CHECK_REQPROT:
115 return iint->ima_mmap_status;
116 case BPRM_CHECK:
117 return iint->ima_bprm_status;
118 case CREDS_CHECK:
119 return iint->ima_creds_status;
120 case FILE_CHECK:
121 case POST_SETATTR:
122 return iint->ima_file_status;
123 case MODULE_CHECK ... MAX_CHECK - 1:
124 default:
125 return iint->ima_read_status;
126 }
127}
128
129static void ima_set_cache_status(struct ima_iint_cache *iint,
130 enum ima_hooks func,
131 enum integrity_status status)
132{
133 switch (func) {
134 case MMAP_CHECK:
135 case MMAP_CHECK_REQPROT:
136 iint->ima_mmap_status = status;
137 break;
138 case BPRM_CHECK:
139 iint->ima_bprm_status = status;
140 break;
141 case CREDS_CHECK:
142 iint->ima_creds_status = status;
143 break;
144 case FILE_CHECK:
145 case POST_SETATTR:
146 iint->ima_file_status = status;
147 break;
148 case MODULE_CHECK ... MAX_CHECK - 1:
149 default:
150 iint->ima_read_status = status;
151 break;
152 }
153}
154
155static void ima_cache_flags(struct ima_iint_cache *iint, enum ima_hooks func)
156{
157 switch (func) {
158 case MMAP_CHECK:
159 case MMAP_CHECK_REQPROT:
160 iint->flags |= (IMA_MMAP_APPRAISED | IMA_APPRAISED);
161 break;
162 case BPRM_CHECK:
163 iint->flags |= (IMA_BPRM_APPRAISED | IMA_APPRAISED);
164 break;
165 case CREDS_CHECK:
166 iint->flags |= (IMA_CREDS_APPRAISED | IMA_APPRAISED);
167 break;
168 case FILE_CHECK:
169 case POST_SETATTR:
170 iint->flags |= (IMA_FILE_APPRAISED | IMA_APPRAISED);
171 break;
172 case MODULE_CHECK ... MAX_CHECK - 1:
173 default:
174 iint->flags |= (IMA_READ_APPRAISED | IMA_APPRAISED);
175 break;
176 }
177}
178
179enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value,
180 int xattr_len)
181{
182 struct signature_v2_hdr *sig;
183 enum hash_algo ret;
184
185 if (!xattr_value || xattr_len < 2)
186 /* return default hash algo */
187 return ima_hash_algo;
188
189 switch (xattr_value->type) {
190 case IMA_VERITY_DIGSIG:
191 sig = (typeof(sig))xattr_value;
192 if (sig->version != 3 || xattr_len <= sizeof(*sig) ||
193 sig->hash_algo >= HASH_ALGO__LAST)
194 return ima_hash_algo;
195 return sig->hash_algo;
196 case EVM_IMA_XATTR_DIGSIG:
197 sig = (typeof(sig))xattr_value;
198 if (sig->version != 2 || xattr_len <= sizeof(*sig)
199 || sig->hash_algo >= HASH_ALGO__LAST)
200 return ima_hash_algo;
201 return sig->hash_algo;
202 case IMA_XATTR_DIGEST_NG:
203 /* first byte contains algorithm id */
204 ret = xattr_value->data[0];
205 if (ret < HASH_ALGO__LAST)
206 return ret;
207 break;
208 case IMA_XATTR_DIGEST:
209 /* this is for backward compatibility */
210 if (xattr_len == 21) {
211 unsigned int zero = 0;
212 if (!memcmp(&xattr_value->data[16], &zero, 4))
213 return HASH_ALGO_MD5;
214 else
215 return HASH_ALGO_SHA1;
216 } else if (xattr_len == 17)
217 return HASH_ALGO_MD5;
218 break;
219 }
220
221 /* return default hash algo */
222 return ima_hash_algo;
223}
224
225int ima_read_xattr(struct dentry *dentry,
226 struct evm_ima_xattr_data **xattr_value, int xattr_len)
227{
228 int ret;
229
230 ret = vfs_getxattr_alloc(&nop_mnt_idmap, dentry, XATTR_NAME_IMA,
231 (char **)xattr_value, xattr_len, GFP_NOFS);
232 if (ret == -EOPNOTSUPP)
233 ret = 0;
234 return ret;
235}
236
237/*
238 * calc_file_id_hash - calculate the hash of the ima_file_id struct data
239 * @type: xattr type [enum evm_ima_xattr_type]
240 * @algo: hash algorithm [enum hash_algo]
241 * @digest: pointer to the digest to be hashed
242 * @hash: (out) pointer to the hash
243 *
244 * IMA signature version 3 disambiguates the data that is signed by
245 * indirectly signing the hash of the ima_file_id structure data.
246 *
247 * Signing the ima_file_id struct is currently only supported for
248 * IMA_VERITY_DIGSIG type xattrs.
249 *
250 * Return 0 on success, error code otherwise.
251 */
252static int calc_file_id_hash(enum evm_ima_xattr_type type,
253 enum hash_algo algo, const u8 *digest,
254 struct ima_digest_data *hash)
255{
256 struct ima_file_id file_id = {
257 .hash_type = IMA_VERITY_DIGSIG, .hash_algorithm = algo};
258 unsigned int unused = HASH_MAX_DIGESTSIZE - hash_digest_size[algo];
259
260 if (type != IMA_VERITY_DIGSIG)
261 return -EINVAL;
262
263 memcpy(file_id.hash, digest, hash_digest_size[algo]);
264
265 hash->algo = algo;
266 hash->length = hash_digest_size[algo];
267
268 return ima_calc_buffer_hash(&file_id, sizeof(file_id) - unused, hash);
269}
270
271/*
272 * xattr_verify - verify xattr digest or signature
273 *
274 * Verify whether the hash or signature matches the file contents.
275 *
276 * Return 0 on success, error code otherwise.
277 */
278static int xattr_verify(enum ima_hooks func, struct ima_iint_cache *iint,
279 struct evm_ima_xattr_data *xattr_value, int xattr_len,
280 enum integrity_status *status, const char **cause)
281{
282 struct ima_max_digest_data hash;
283 struct signature_v2_hdr *sig;
284 int rc = -EINVAL, hash_start = 0;
285 int mask;
286
287 switch (xattr_value->type) {
288 case IMA_XATTR_DIGEST_NG:
289 /* first byte contains algorithm id */
290 hash_start = 1;
291 fallthrough;
292 case IMA_XATTR_DIGEST:
293 if (*status != INTEGRITY_PASS_IMMUTABLE) {
294 if (iint->flags & IMA_DIGSIG_REQUIRED) {
295 if (iint->flags & IMA_VERITY_REQUIRED)
296 *cause = "verity-signature-required";
297 else
298 *cause = "IMA-signature-required";
299 *status = INTEGRITY_FAIL;
300 break;
301 }
302 clear_bit(IMA_DIGSIG, &iint->atomic_flags);
303 } else {
304 set_bit(IMA_DIGSIG, &iint->atomic_flags);
305 }
306 if (xattr_len - sizeof(xattr_value->type) - hash_start >=
307 iint->ima_hash->length)
308 /*
309 * xattr length may be longer. md5 hash in previous
310 * version occupied 20 bytes in xattr, instead of 16
311 */
312 rc = memcmp(&xattr_value->data[hash_start],
313 iint->ima_hash->digest,
314 iint->ima_hash->length);
315 else
316 rc = -EINVAL;
317 if (rc) {
318 *cause = "invalid-hash";
319 *status = INTEGRITY_FAIL;
320 break;
321 }
322 *status = INTEGRITY_PASS;
323 break;
324 case EVM_IMA_XATTR_DIGSIG:
325 set_bit(IMA_DIGSIG, &iint->atomic_flags);
326
327 mask = IMA_DIGSIG_REQUIRED | IMA_VERITY_REQUIRED;
328 if ((iint->flags & mask) == mask) {
329 *cause = "verity-signature-required";
330 *status = INTEGRITY_FAIL;
331 break;
332 }
333
334 sig = (typeof(sig))xattr_value;
335 if (sig->version >= 3) {
336 *cause = "invalid-signature-version";
337 *status = INTEGRITY_FAIL;
338 break;
339 }
340 rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
341 (const char *)xattr_value,
342 xattr_len,
343 iint->ima_hash->digest,
344 iint->ima_hash->length);
345 if (rc == -EOPNOTSUPP) {
346 *status = INTEGRITY_UNKNOWN;
347 break;
348 }
349 if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc &&
350 func == KEXEC_KERNEL_CHECK)
351 rc = integrity_digsig_verify(INTEGRITY_KEYRING_PLATFORM,
352 (const char *)xattr_value,
353 xattr_len,
354 iint->ima_hash->digest,
355 iint->ima_hash->length);
356 if (rc) {
357 *cause = "invalid-signature";
358 *status = INTEGRITY_FAIL;
359 } else {
360 *status = INTEGRITY_PASS;
361 }
362 break;
363 case IMA_VERITY_DIGSIG:
364 set_bit(IMA_DIGSIG, &iint->atomic_flags);
365
366 if (iint->flags & IMA_DIGSIG_REQUIRED) {
367 if (!(iint->flags & IMA_VERITY_REQUIRED)) {
368 *cause = "IMA-signature-required";
369 *status = INTEGRITY_FAIL;
370 break;
371 }
372 }
373
374 sig = (typeof(sig))xattr_value;
375 if (sig->version != 3) {
376 *cause = "invalid-signature-version";
377 *status = INTEGRITY_FAIL;
378 break;
379 }
380
381 rc = calc_file_id_hash(IMA_VERITY_DIGSIG, iint->ima_hash->algo,
382 iint->ima_hash->digest,
383 container_of(&hash.hdr,
384 struct ima_digest_data, hdr));
385 if (rc) {
386 *cause = "sigv3-hashing-error";
387 *status = INTEGRITY_FAIL;
388 break;
389 }
390
391 rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
392 (const char *)xattr_value,
393 xattr_len, hash.digest,
394 hash.hdr.length);
395 if (rc) {
396 *cause = "invalid-verity-signature";
397 *status = INTEGRITY_FAIL;
398 } else {
399 *status = INTEGRITY_PASS;
400 }
401
402 break;
403 default:
404 *status = INTEGRITY_UNKNOWN;
405 *cause = "unknown-ima-data";
406 break;
407 }
408
409 return rc;
410}
411
412/*
413 * modsig_verify - verify modsig signature
414 *
415 * Verify whether the signature matches the file contents.
416 *
417 * Return 0 on success, error code otherwise.
418 */
419static int modsig_verify(enum ima_hooks func, const struct modsig *modsig,
420 enum integrity_status *status, const char **cause)
421{
422 int rc;
423
424 rc = integrity_modsig_verify(INTEGRITY_KEYRING_IMA, modsig);
425 if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc &&
426 func == KEXEC_KERNEL_CHECK)
427 rc = integrity_modsig_verify(INTEGRITY_KEYRING_PLATFORM,
428 modsig);
429 if (rc) {
430 *cause = "invalid-signature";
431 *status = INTEGRITY_FAIL;
432 } else {
433 *status = INTEGRITY_PASS;
434 }
435
436 return rc;
437}
438
439/*
440 * ima_check_blacklist - determine if the binary is blacklisted.
441 *
442 * Add the hash of the blacklisted binary to the measurement list, based
443 * on policy.
444 *
445 * Returns -EPERM if the hash is blacklisted.
446 */
447int ima_check_blacklist(struct ima_iint_cache *iint,
448 const struct modsig *modsig, int pcr)
449{
450 enum hash_algo hash_algo;
451 const u8 *digest = NULL;
452 u32 digestsize = 0;
453 int rc = 0;
454
455 if (!(iint->flags & IMA_CHECK_BLACKLIST))
456 return 0;
457
458 if (iint->flags & IMA_MODSIG_ALLOWED && modsig) {
459 ima_get_modsig_digest(modsig, &hash_algo, &digest, &digestsize);
460
461 rc = is_binary_blacklisted(digest, digestsize);
462 } else if (iint->flags & IMA_DIGSIG_REQUIRED && iint->ima_hash)
463 rc = is_binary_blacklisted(iint->ima_hash->digest, iint->ima_hash->length);
464
465 if ((rc == -EPERM) && (iint->flags & IMA_MEASURE))
466 process_buffer_measurement(&nop_mnt_idmap, NULL, digest, digestsize,
467 "blacklisted-hash", NONE,
468 pcr, NULL, false, NULL, 0);
469
470 return rc;
471}
472
473static bool is_bprm_creds_for_exec(enum ima_hooks func, struct file *file)
474{
475 struct linux_binprm *bprm;
476
477 if (func == BPRM_CHECK) {
478 bprm = container_of(&file, struct linux_binprm, file);
479 return bprm->is_check;
480 }
481 return false;
482}
483
484/*
485 * ima_appraise_measurement - appraise file measurement
486 *
487 * Call evm_verifyxattr() to verify the integrity of 'security.ima'.
488 * Assuming success, compare the xattr hash with the collected measurement.
489 *
490 * Return 0 on success, error code otherwise
491 */
492int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
493 struct file *file, const unsigned char *filename,
494 struct evm_ima_xattr_data *xattr_value,
495 int xattr_len, const struct modsig *modsig)
496{
497 static const char op[] = "appraise_data";
498 int audit_msgno = AUDIT_INTEGRITY_DATA;
499 const char *cause = "unknown";
500 struct dentry *dentry = file_dentry(file);
501 struct inode *inode = d_backing_inode(dentry);
502 enum integrity_status status = INTEGRITY_UNKNOWN;
503 int rc = xattr_len;
504 bool try_modsig = iint->flags & IMA_MODSIG_ALLOWED && modsig;
505
506 /* If not appraising a modsig, we need an xattr. */
507 if (!(inode->i_opflags & IOP_XATTR) && !try_modsig)
508 return INTEGRITY_UNKNOWN;
509
510 /*
511 * Unlike any of the other LSM hooks where the kernel enforces file
512 * integrity, enforcing file integrity for the bprm_creds_for_exec()
513 * LSM hook with the AT_EXECVE_CHECK flag is left up to the discretion
514 * of the script interpreter(userspace). Differentiate kernel and
515 * userspace enforced integrity audit messages.
516 */
517 if (is_bprm_creds_for_exec(func, file))
518 audit_msgno = AUDIT_INTEGRITY_USERSPACE;
519
520 /* If reading the xattr failed and there's no modsig, error out. */
521 if (rc <= 0 && !try_modsig) {
522 if (rc && rc != -ENODATA)
523 goto out;
524
525 if (iint->flags & IMA_DIGSIG_REQUIRED) {
526 if (iint->flags & IMA_VERITY_REQUIRED)
527 cause = "verity-signature-required";
528 else
529 cause = "IMA-signature-required";
530 } else {
531 cause = "missing-hash";
532 }
533
534 status = INTEGRITY_NOLABEL;
535 if (file->f_mode & FMODE_CREATED)
536 iint->flags |= IMA_NEW_FILE;
537 if ((iint->flags & IMA_NEW_FILE) &&
538 (!(iint->flags & IMA_DIGSIG_REQUIRED) ||
539 (inode->i_size == 0)))
540 status = INTEGRITY_PASS;
541 goto out;
542 }
543
544 status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value,
545 rc < 0 ? 0 : rc);
546 switch (status) {
547 case INTEGRITY_PASS:
548 case INTEGRITY_PASS_IMMUTABLE:
549 case INTEGRITY_UNKNOWN:
550 break;
551 case INTEGRITY_NOXATTRS: /* No EVM protected xattrs. */
552 /* It's fine not to have xattrs when using a modsig. */
553 if (try_modsig)
554 break;
555 fallthrough;
556 case INTEGRITY_NOLABEL: /* No security.evm xattr. */
557 cause = "missing-HMAC";
558 goto out;
559 case INTEGRITY_FAIL_IMMUTABLE:
560 set_bit(IMA_DIGSIG, &iint->atomic_flags);
561 cause = "invalid-fail-immutable";
562 goto out;
563 case INTEGRITY_FAIL: /* Invalid HMAC/signature. */
564 cause = "invalid-HMAC";
565 goto out;
566 default:
567 WARN_ONCE(true, "Unexpected integrity status %d\n", status);
568 }
569
570 if (xattr_value)
571 rc = xattr_verify(func, iint, xattr_value, xattr_len, &status,
572 &cause);
573
574 /*
575 * If we have a modsig and either no imasig or the imasig's key isn't
576 * known, then try verifying the modsig.
577 */
578 if (try_modsig &&
579 (!xattr_value || xattr_value->type == IMA_XATTR_DIGEST_NG ||
580 rc == -ENOKEY))
581 rc = modsig_verify(func, modsig, &status, &cause);
582
583out:
584 /*
585 * File signatures on some filesystems can not be properly verified.
586 * When such filesystems are mounted by an untrusted mounter or on a
587 * system not willing to accept such a risk, fail the file signature
588 * verification.
589 */
590 if ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) &&
591 ((inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER) ||
592 (iint->flags & IMA_FAIL_UNVERIFIABLE_SIGS))) {
593 status = INTEGRITY_FAIL;
594 cause = "unverifiable-signature";
595 integrity_audit_msg(audit_msgno, inode, filename,
596 op, cause, rc, 0);
597 } else if (status != INTEGRITY_PASS) {
598 /* Fix mode, but don't replace file signatures. */
599 if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig &&
600 (!xattr_value ||
601 xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
602 if (!ima_fix_xattr(dentry, iint))
603 status = INTEGRITY_PASS;
604 }
605
606 /*
607 * Permit new files with file/EVM portable signatures, but
608 * without data.
609 */
610 if (inode->i_size == 0 && iint->flags & IMA_NEW_FILE &&
611 test_bit(IMA_DIGSIG, &iint->atomic_flags)) {
612 status = INTEGRITY_PASS;
613 }
614
615 integrity_audit_msg(audit_msgno, inode, filename,
616 op, cause, rc, 0);
617 } else {
618 ima_cache_flags(iint, func);
619 }
620
621 ima_set_cache_status(iint, func, status);
622 return status;
623}
624
625/*
626 * ima_update_xattr - update 'security.ima' hash value
627 */
628void ima_update_xattr(struct ima_iint_cache *iint, struct file *file)
629{
630 struct dentry *dentry = file_dentry(file);
631 int rc = 0;
632
633 /* do not collect and update hash for digital signatures */
634 if (test_bit(IMA_DIGSIG, &iint->atomic_flags))
635 return;
636
637 if ((iint->ima_file_status != INTEGRITY_PASS) &&
638 !(iint->flags & IMA_HASH))
639 return;
640
641 rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo, NULL);
642 if (rc < 0)
643 return;
644
645 inode_lock(file_inode(file));
646 ima_fix_xattr(dentry, iint);
647 inode_unlock(file_inode(file));
648}
649
650/**
651 * ima_inode_post_setattr - reflect file metadata changes
652 * @idmap: idmap of the mount the inode was found from
653 * @dentry: pointer to the affected dentry
654 * @ia_valid: for the UID and GID status
655 *
656 * Changes to a dentry's metadata might result in needing to appraise.
657 *
658 * This function is called from notify_change(), which expects the caller
659 * to lock the inode's i_mutex.
660 */
661static void ima_inode_post_setattr(struct mnt_idmap *idmap,
662 struct dentry *dentry, int ia_valid)
663{
664 struct inode *inode = d_backing_inode(dentry);
665 struct ima_iint_cache *iint;
666 int action;
667
668 if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)
669 || !(inode->i_opflags & IOP_XATTR))
670 return;
671
672 action = ima_must_appraise(idmap, inode, MAY_ACCESS, POST_SETATTR);
673 iint = ima_iint_find(inode);
674 if (iint) {
675 set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
676 if (!action)
677 clear_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
678 }
679}
680
681/*
682 * ima_protect_xattr - protect 'security.ima'
683 *
684 * Ensure that not just anyone can modify or remove 'security.ima'.
685 */
686static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
687 const void *xattr_value, size_t xattr_value_len)
688{
689 if (strcmp(xattr_name, XATTR_NAME_IMA) == 0) {
690 if (!capable(CAP_SYS_ADMIN))
691 return -EPERM;
692 return 1;
693 }
694 return 0;
695}
696
697static void ima_reset_appraise_flags(struct inode *inode, int digsig)
698{
699 struct ima_iint_cache *iint;
700
701 if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode))
702 return;
703
704 iint = ima_iint_find(inode);
705 if (!iint)
706 return;
707 iint->measured_pcrs = 0;
708 set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags);
709 if (digsig)
710 set_bit(IMA_DIGSIG, &iint->atomic_flags);
711 else
712 clear_bit(IMA_DIGSIG, &iint->atomic_flags);
713}
714
715/**
716 * validate_hash_algo() - Block setxattr with unsupported hash algorithms
717 * @dentry: object of the setxattr()
718 * @xattr_value: userland supplied xattr value
719 * @xattr_value_len: length of xattr_value
720 *
721 * The xattr value is mapped to its hash algorithm, and this algorithm
722 * must be built in the kernel for the setxattr to be allowed.
723 *
724 * Emit an audit message when the algorithm is invalid.
725 *
726 * Return: 0 on success, else an error.
727 */
728static int validate_hash_algo(struct dentry *dentry,
729 const struct evm_ima_xattr_data *xattr_value,
730 size_t xattr_value_len)
731{
732 char *path = NULL, *pathbuf = NULL;
733 enum hash_algo xattr_hash_algo;
734 const char *errmsg = "unavailable-hash-algorithm";
735 unsigned int allowed_hashes;
736
737 xattr_hash_algo = ima_get_hash_algo(xattr_value, xattr_value_len);
738
739 allowed_hashes = atomic_read(&ima_setxattr_allowed_hash_algorithms);
740
741 if (allowed_hashes) {
742 /* success if the algorithm is allowed in the ima policy */
743 if (allowed_hashes & (1U << xattr_hash_algo))
744 return 0;
745
746 /*
747 * We use a different audit message when the hash algorithm
748 * is denied by a policy rule, instead of not being built
749 * in the kernel image
750 */
751 errmsg = "denied-hash-algorithm";
752 } else {
753 if (likely(xattr_hash_algo == ima_hash_algo))
754 return 0;
755
756 /* allow any xattr using an algorithm built in the kernel */
757 if (crypto_has_alg(hash_algo_name[xattr_hash_algo], 0, 0))
758 return 0;
759 }
760
761 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
762 if (!pathbuf)
763 return -EACCES;
764
765 path = dentry_path(dentry, pathbuf, PATH_MAX);
766
767 integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path,
768 "set_data", errmsg, -EACCES, 0);
769
770 kfree(pathbuf);
771
772 return -EACCES;
773}
774
775static int ima_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
776 const char *xattr_name, const void *xattr_value,
777 size_t xattr_value_len, int flags)
778{
779 const struct evm_ima_xattr_data *xvalue = xattr_value;
780 int digsig = 0;
781 int result;
782 int err;
783
784 result = ima_protect_xattr(dentry, xattr_name, xattr_value,
785 xattr_value_len);
786 if (result == 1) {
787 if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
788 return -EINVAL;
789
790 err = validate_hash_algo(dentry, xvalue, xattr_value_len);
791 if (err)
792 return err;
793
794 digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
795 } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
796 digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
797 }
798 if (result == 1 || evm_revalidate_status(xattr_name)) {
799 ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
800 if (result == 1)
801 result = 0;
802 }
803 return result;
804}
805
806static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
807 const char *acl_name, struct posix_acl *kacl)
808{
809 if (evm_revalidate_status(acl_name))
810 ima_reset_appraise_flags(d_backing_inode(dentry), 0);
811
812 return 0;
813}
814
815static int ima_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,
816 const char *xattr_name)
817{
818 int result;
819
820 result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
821 if (result == 1 || evm_revalidate_status(xattr_name)) {
822 ima_reset_appraise_flags(d_backing_inode(dentry), 0);
823 if (result == 1)
824 result = 0;
825 }
826 return result;
827}
828
829static int ima_inode_remove_acl(struct mnt_idmap *idmap, struct dentry *dentry,
830 const char *acl_name)
831{
832 return ima_inode_set_acl(idmap, dentry, acl_name, NULL);
833}
834
835static struct security_hook_list ima_appraise_hooks[] __ro_after_init = {
836 LSM_HOOK_INIT(inode_post_setattr, ima_inode_post_setattr),
837 LSM_HOOK_INIT(inode_setxattr, ima_inode_setxattr),
838 LSM_HOOK_INIT(inode_set_acl, ima_inode_set_acl),
839 LSM_HOOK_INIT(inode_removexattr, ima_inode_removexattr),
840 LSM_HOOK_INIT(inode_remove_acl, ima_inode_remove_acl),
841};
842
843void __init init_ima_appraise_lsm(const struct lsm_id *lsmid)
844{
845 security_add_hooks(ima_appraise_hooks, ARRAY_SIZE(ima_appraise_hooks),
846 lsmid);
847}
Linux 6.x block layer and io_uring tree(s)