Commit | Line | Data |
---|---|---|
3323eec9 MZ |
1 | /* |
2 | * Copyright (C) 2008 IBM Corporation | |
3 | * Author: Mimi Zohar <zohar@us.ibm.com> | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of the GNU General Public License as published by | |
7 | * the Free Software Foundation, version 2 of the License. | |
8 | * | |
9 | * ima_policy.c | |
10 | * - initialize default measure policy rules | |
11 | * | |
12 | */ | |
13 | #include <linux/module.h> | |
14 | #include <linux/list.h> | |
3323eec9 MZ |
15 | #include <linux/security.h> |
16 | #include <linux/magic.h> | |
4af4662f | 17 | #include <linux/parser.h> |
3323eec9 MZ |
18 | |
19 | #include "ima.h" | |
20 | ||
21 | /* flags definitions */ | |
22 | #define IMA_FUNC 0x0001 | |
23 | #define IMA_MASK 0x0002 | |
24 | #define IMA_FSMAGIC 0x0004 | |
25 | #define IMA_UID 0x0008 | |
26 | ||
4af4662f MZ |
27 | enum ima_action { UNKNOWN = -1, DONT_MEASURE = 0, MEASURE }; |
28 | ||
29 | #define MAX_LSM_RULES 6 | |
30 | enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, | |
31 | LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE | |
32 | }; | |
3323eec9 MZ |
33 | |
34 | struct ima_measure_rule_entry { | |
35 | struct list_head list; | |
36 | enum ima_action action; | |
37 | unsigned int flags; | |
38 | enum ima_hooks func; | |
39 | int mask; | |
40 | unsigned long fsmagic; | |
41 | uid_t uid; | |
4af4662f MZ |
42 | struct { |
43 | void *rule; /* LSM file metadata specific */ | |
44 | int type; /* audit type */ | |
45 | } lsm[MAX_LSM_RULES]; | |
3323eec9 MZ |
46 | }; |
47 | ||
4af4662f MZ |
48 | /* Without LSM specific knowledge, the default policy can only be |
49 | * written in terms of .action, .func, .mask, .fsmagic, and .uid | |
50 | */ | |
3323eec9 | 51 | static struct ima_measure_rule_entry default_rules[] = { |
75834fc3 | 52 | {.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC}, |
3323eec9 MZ |
53 | {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC}, |
54 | {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC}, | |
55 | {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC}, | |
75834fc3 EP |
56 | {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC}, |
57 | {.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC}, | |
3323eec9 MZ |
58 | {.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC, |
59 | .flags = IMA_FUNC | IMA_MASK}, | |
60 | {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC, | |
61 | .flags = IMA_FUNC | IMA_MASK}, | |
3323eec9 MZ |
62 | }; |
63 | ||
64 | static LIST_HEAD(measure_default_rules); | |
4af4662f | 65 | static LIST_HEAD(measure_policy_rules); |
3323eec9 MZ |
66 | static struct list_head *ima_measure; |
67 | ||
4af4662f MZ |
68 | static DEFINE_MUTEX(ima_measure_mutex); |
69 | ||
3323eec9 MZ |
70 | /** |
71 | * ima_match_rules - determine whether an inode matches the measure rule. | |
72 | * @rule: a pointer to a rule | |
73 | * @inode: a pointer to an inode | |
74 | * @func: LIM hook identifier | |
75 | * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) | |
76 | * | |
77 | * Returns true on rule match, false on failure. | |
78 | */ | |
79 | static bool ima_match_rules(struct ima_measure_rule_entry *rule, | |
80 | struct inode *inode, enum ima_hooks func, int mask) | |
81 | { | |
82 | struct task_struct *tsk = current; | |
4af4662f | 83 | int i; |
3323eec9 MZ |
84 | |
85 | if ((rule->flags & IMA_FUNC) && rule->func != func) | |
86 | return false; | |
87 | if ((rule->flags & IMA_MASK) && rule->mask != mask) | |
88 | return false; | |
89 | if ((rule->flags & IMA_FSMAGIC) | |
90 | && rule->fsmagic != inode->i_sb->s_magic) | |
91 | return false; | |
92 | if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid) | |
93 | return false; | |
4af4662f | 94 | for (i = 0; i < MAX_LSM_RULES; i++) { |
53fc0e22 | 95 | int rc = 0; |
4af4662f MZ |
96 | u32 osid, sid; |
97 | ||
98 | if (!rule->lsm[i].rule) | |
99 | continue; | |
100 | ||
101 | switch (i) { | |
102 | case LSM_OBJ_USER: | |
103 | case LSM_OBJ_ROLE: | |
104 | case LSM_OBJ_TYPE: | |
105 | security_inode_getsecid(inode, &osid); | |
106 | rc = security_filter_rule_match(osid, | |
107 | rule->lsm[i].type, | |
53fc0e22 | 108 | Audit_equal, |
4af4662f MZ |
109 | rule->lsm[i].rule, |
110 | NULL); | |
111 | break; | |
112 | case LSM_SUBJ_USER: | |
113 | case LSM_SUBJ_ROLE: | |
114 | case LSM_SUBJ_TYPE: | |
115 | security_task_getsecid(tsk, &sid); | |
116 | rc = security_filter_rule_match(sid, | |
117 | rule->lsm[i].type, | |
53fc0e22 | 118 | Audit_equal, |
4af4662f MZ |
119 | rule->lsm[i].rule, |
120 | NULL); | |
121 | default: | |
122 | break; | |
123 | } | |
124 | if (!rc) | |
125 | return false; | |
126 | } | |
3323eec9 MZ |
127 | return true; |
128 | } | |
129 | ||
130 | /** | |
131 | * ima_match_policy - decision based on LSM and other conditions | |
132 | * @inode: pointer to an inode for which the policy decision is being made | |
133 | * @func: IMA hook identifier | |
134 | * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) | |
135 | * | |
136 | * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type) | |
137 | * conditions. | |
138 | * | |
139 | * (There is no need for locking when walking the policy list, | |
140 | * as elements in the list are never deleted, nor does the list | |
141 | * change.) | |
142 | */ | |
143 | int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask) | |
144 | { | |
145 | struct ima_measure_rule_entry *entry; | |
146 | ||
147 | list_for_each_entry(entry, ima_measure, list) { | |
148 | bool rc; | |
149 | ||
150 | rc = ima_match_rules(entry, inode, func, mask); | |
151 | if (rc) | |
152 | return entry->action; | |
153 | } | |
154 | return 0; | |
155 | } | |
156 | ||
157 | /** | |
158 | * ima_init_policy - initialize the default measure rules. | |
159 | * | |
3323eec9 | 160 | * ima_measure points to either the measure_default_rules or the |
4af4662f | 161 | * the new measure_policy_rules. |
3323eec9 MZ |
162 | */ |
163 | void ima_init_policy(void) | |
164 | { | |
165 | int i; | |
166 | ||
167 | for (i = 0; i < ARRAY_SIZE(default_rules); i++) | |
168 | list_add_tail(&default_rules[i].list, &measure_default_rules); | |
169 | ima_measure = &measure_default_rules; | |
170 | } | |
4af4662f MZ |
171 | |
172 | /** | |
173 | * ima_update_policy - update default_rules with new measure rules | |
174 | * | |
175 | * Called on file .release to update the default rules with a complete new | |
176 | * policy. Once updated, the policy is locked, no additional rules can be | |
177 | * added to the policy. | |
178 | */ | |
179 | void ima_update_policy(void) | |
180 | { | |
181 | const char *op = "policy_update"; | |
182 | const char *cause = "already exists"; | |
183 | int result = 1; | |
184 | int audit_info = 0; | |
185 | ||
186 | if (ima_measure == &measure_default_rules) { | |
187 | ima_measure = &measure_policy_rules; | |
188 | cause = "complete"; | |
189 | result = 0; | |
190 | } | |
191 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
192 | NULL, op, cause, result, audit_info); | |
193 | } | |
194 | ||
195 | enum { | |
196 | Opt_err = -1, | |
197 | Opt_measure = 1, Opt_dont_measure, | |
198 | Opt_obj_user, Opt_obj_role, Opt_obj_type, | |
199 | Opt_subj_user, Opt_subj_role, Opt_subj_type, | |
200 | Opt_func, Opt_mask, Opt_fsmagic, Opt_uid | |
201 | }; | |
202 | ||
203 | static match_table_t policy_tokens = { | |
204 | {Opt_measure, "measure"}, | |
205 | {Opt_dont_measure, "dont_measure"}, | |
206 | {Opt_obj_user, "obj_user=%s"}, | |
207 | {Opt_obj_role, "obj_role=%s"}, | |
208 | {Opt_obj_type, "obj_type=%s"}, | |
209 | {Opt_subj_user, "subj_user=%s"}, | |
210 | {Opt_subj_role, "subj_role=%s"}, | |
211 | {Opt_subj_type, "subj_type=%s"}, | |
212 | {Opt_func, "func=%s"}, | |
213 | {Opt_mask, "mask=%s"}, | |
214 | {Opt_fsmagic, "fsmagic=%s"}, | |
215 | {Opt_uid, "uid=%s"}, | |
216 | {Opt_err, NULL} | |
217 | }; | |
218 | ||
219 | static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry, | |
220 | char *args, int lsm_rule, int audit_type) | |
221 | { | |
222 | int result; | |
223 | ||
224 | entry->lsm[lsm_rule].type = audit_type; | |
225 | result = security_filter_rule_init(entry->lsm[lsm_rule].type, | |
53fc0e22 | 226 | Audit_equal, args, |
4af4662f MZ |
227 | &entry->lsm[lsm_rule].rule); |
228 | return result; | |
229 | } | |
230 | ||
231 | static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry) | |
232 | { | |
233 | struct audit_buffer *ab; | |
234 | char *p; | |
235 | int result = 0; | |
236 | ||
523979ad | 237 | ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE); |
4af4662f MZ |
238 | |
239 | entry->action = -1; | |
240 | while ((p = strsep(&rule, " \n")) != NULL) { | |
241 | substring_t args[MAX_OPT_ARGS]; | |
242 | int token; | |
243 | unsigned long lnum; | |
244 | ||
245 | if (result < 0) | |
246 | break; | |
247 | if (!*p) | |
248 | continue; | |
249 | token = match_token(p, policy_tokens, args); | |
250 | switch (token) { | |
251 | case Opt_measure: | |
252 | audit_log_format(ab, "%s ", "measure"); | |
253 | entry->action = MEASURE; | |
254 | break; | |
255 | case Opt_dont_measure: | |
256 | audit_log_format(ab, "%s ", "dont_measure"); | |
257 | entry->action = DONT_MEASURE; | |
258 | break; | |
259 | case Opt_func: | |
260 | audit_log_format(ab, "func=%s ", args[0].from); | |
261 | if (strcmp(args[0].from, "PATH_CHECK") == 0) | |
262 | entry->func = PATH_CHECK; | |
263 | else if (strcmp(args[0].from, "FILE_MMAP") == 0) | |
264 | entry->func = FILE_MMAP; | |
265 | else if (strcmp(args[0].from, "BPRM_CHECK") == 0) | |
266 | entry->func = BPRM_CHECK; | |
267 | else | |
268 | result = -EINVAL; | |
269 | if (!result) | |
270 | entry->flags |= IMA_FUNC; | |
271 | break; | |
272 | case Opt_mask: | |
273 | audit_log_format(ab, "mask=%s ", args[0].from); | |
274 | if ((strcmp(args[0].from, "MAY_EXEC")) == 0) | |
275 | entry->mask = MAY_EXEC; | |
276 | else if (strcmp(args[0].from, "MAY_WRITE") == 0) | |
277 | entry->mask = MAY_WRITE; | |
278 | else if (strcmp(args[0].from, "MAY_READ") == 0) | |
279 | entry->mask = MAY_READ; | |
280 | else if (strcmp(args[0].from, "MAY_APPEND") == 0) | |
281 | entry->mask = MAY_APPEND; | |
282 | else | |
283 | result = -EINVAL; | |
284 | if (!result) | |
285 | entry->flags |= IMA_MASK; | |
286 | break; | |
287 | case Opt_fsmagic: | |
288 | audit_log_format(ab, "fsmagic=%s ", args[0].from); | |
289 | result = strict_strtoul(args[0].from, 16, | |
290 | &entry->fsmagic); | |
291 | if (!result) | |
292 | entry->flags |= IMA_FSMAGIC; | |
293 | break; | |
294 | case Opt_uid: | |
295 | audit_log_format(ab, "uid=%s ", args[0].from); | |
296 | result = strict_strtoul(args[0].from, 10, &lnum); | |
297 | if (!result) { | |
298 | entry->uid = (uid_t) lnum; | |
299 | if (entry->uid != lnum) | |
300 | result = -EINVAL; | |
301 | else | |
302 | entry->flags |= IMA_UID; | |
303 | } | |
304 | break; | |
305 | case Opt_obj_user: | |
306 | audit_log_format(ab, "obj_user=%s ", args[0].from); | |
307 | result = ima_lsm_rule_init(entry, args[0].from, | |
308 | LSM_OBJ_USER, | |
309 | AUDIT_OBJ_USER); | |
310 | break; | |
311 | case Opt_obj_role: | |
312 | audit_log_format(ab, "obj_role=%s ", args[0].from); | |
313 | result = ima_lsm_rule_init(entry, args[0].from, | |
314 | LSM_OBJ_ROLE, | |
315 | AUDIT_OBJ_ROLE); | |
316 | break; | |
317 | case Opt_obj_type: | |
318 | audit_log_format(ab, "obj_type=%s ", args[0].from); | |
319 | result = ima_lsm_rule_init(entry, args[0].from, | |
320 | LSM_OBJ_TYPE, | |
321 | AUDIT_OBJ_TYPE); | |
322 | break; | |
323 | case Opt_subj_user: | |
324 | audit_log_format(ab, "subj_user=%s ", args[0].from); | |
325 | result = ima_lsm_rule_init(entry, args[0].from, | |
326 | LSM_SUBJ_USER, | |
327 | AUDIT_SUBJ_USER); | |
328 | break; | |
329 | case Opt_subj_role: | |
330 | audit_log_format(ab, "subj_role=%s ", args[0].from); | |
331 | result = ima_lsm_rule_init(entry, args[0].from, | |
332 | LSM_SUBJ_ROLE, | |
333 | AUDIT_SUBJ_ROLE); | |
334 | break; | |
335 | case Opt_subj_type: | |
336 | audit_log_format(ab, "subj_type=%s ", args[0].from); | |
337 | result = ima_lsm_rule_init(entry, args[0].from, | |
338 | LSM_SUBJ_TYPE, | |
339 | AUDIT_SUBJ_TYPE); | |
340 | break; | |
341 | case Opt_err: | |
523979ad | 342 | audit_log_format(ab, "UNKNOWN=%s ", p); |
4af4662f MZ |
343 | break; |
344 | } | |
345 | } | |
346 | if (entry->action == UNKNOWN) | |
347 | result = -EINVAL; | |
348 | ||
523979ad | 349 | audit_log_format(ab, "res=%d", !result ? 0 : 1); |
4af4662f MZ |
350 | audit_log_end(ab); |
351 | return result; | |
352 | } | |
353 | ||
354 | /** | |
355 | * ima_parse_add_rule - add a rule to measure_policy_rules | |
356 | * @rule - ima measurement policy rule | |
357 | * | |
358 | * Uses a mutex to protect the policy list from multiple concurrent writers. | |
359 | * Returns 0 on success, an error code on failure. | |
360 | */ | |
361 | int ima_parse_add_rule(char *rule) | |
362 | { | |
523979ad | 363 | const char *op = "update_policy"; |
4af4662f MZ |
364 | struct ima_measure_rule_entry *entry; |
365 | int result = 0; | |
366 | int audit_info = 0; | |
367 | ||
368 | /* Prevent installed policy from changing */ | |
369 | if (ima_measure != &measure_default_rules) { | |
370 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
371 | NULL, op, "already exists", | |
372 | -EACCES, audit_info); | |
373 | return -EACCES; | |
374 | } | |
375 | ||
376 | entry = kzalloc(sizeof(*entry), GFP_KERNEL); | |
377 | if (!entry) { | |
378 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
379 | NULL, op, "-ENOMEM", -ENOMEM, audit_info); | |
380 | return -ENOMEM; | |
381 | } | |
382 | ||
383 | INIT_LIST_HEAD(&entry->list); | |
384 | ||
385 | result = ima_parse_rule(rule, entry); | |
386 | if (!result) { | |
387 | mutex_lock(&ima_measure_mutex); | |
388 | list_add_tail(&entry->list, &measure_policy_rules); | |
389 | mutex_unlock(&ima_measure_mutex); | |
523979ad | 390 | } else { |
4af4662f | 391 | kfree(entry); |
523979ad MZ |
392 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, |
393 | NULL, op, "invalid policy", result, | |
394 | audit_info); | |
395 | } | |
4af4662f MZ |
396 | return result; |
397 | } | |
398 | ||
399 | /* ima_delete_rules called to cleanup invalid policy */ | |
64c61d80 | 400 | void ima_delete_rules(void) |
4af4662f MZ |
401 | { |
402 | struct ima_measure_rule_entry *entry, *tmp; | |
403 | ||
404 | mutex_lock(&ima_measure_mutex); | |
405 | list_for_each_entry_safe(entry, tmp, &measure_policy_rules, list) { | |
406 | list_del(&entry->list); | |
407 | kfree(entry); | |
408 | } | |
409 | mutex_unlock(&ima_measure_mutex); | |
410 | } |