2 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
5 * Reiner Sailer <sailer@watson.ibm.com>
6 * Mimi Zohar <zohar@us.ibm.com>
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
14 * internal Integrity Measurement Architecture (IMA) definitions
20 #include <linux/types.h>
21 #include <linux/crypto.h>
22 #include <linux/security.h>
23 #include <linux/hash.h>
24 #include <linux/tpm.h>
25 #include <linux/audit.h>
27 #include "../integrity.h"
29 enum ima_show_type
{ IMA_SHOW_BINARY
, IMA_SHOW_BINARY_NO_FIELD_LEN
,
30 IMA_SHOW_BINARY_OLD_STRING_FMT
, IMA_SHOW_ASCII
};
31 enum tpm_pcrs
{ TPM_PCR0
= 0, TPM_PCR8
= 8 };
33 /* digest size for IMA, fits SHA1 or MD5 */
34 #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
35 #define IMA_EVENT_NAME_LEN_MAX 255
37 #define IMA_HASH_BITS 9
38 #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
40 #define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16
41 #define IMA_TEMPLATE_NUM_FIELDS_MAX 15
43 #define IMA_TEMPLATE_IMA_NAME "ima"
44 #define IMA_TEMPLATE_IMA_FMT "d|n"
46 /* current content of the policy */
47 extern int ima_policy_flag
;
49 /* set during initialization */
50 extern int ima_initialized
;
51 extern int ima_used_chip
;
52 extern int ima_hash_algo
;
53 extern int ima_appraise
;
55 /* IMA template field data definition */
56 struct ima_field_data
{
61 /* IMA template field definition */
62 struct ima_template_field
{
63 const char field_id
[IMA_TEMPLATE_FIELD_ID_MAX_LEN
];
64 int (*field_init
) (struct integrity_iint_cache
*iint
, struct file
*file
,
65 const unsigned char *filename
,
66 struct evm_ima_xattr_data
*xattr_value
,
67 int xattr_len
, struct ima_field_data
*field_data
);
68 void (*field_show
) (struct seq_file
*m
, enum ima_show_type show
,
69 struct ima_field_data
*field_data
);
72 /* IMA template descriptor definition */
73 struct ima_template_desc
{
77 struct ima_template_field
**fields
;
80 struct ima_template_entry
{
81 u8 digest
[TPM_DIGEST_SIZE
]; /* sha1 or md5 measurement hash */
82 struct ima_template_desc
*template_desc
; /* template descriptor */
83 u32 template_data_len
;
84 struct ima_field_data template_data
[0]; /* template related data */
87 struct ima_queue_entry
{
88 struct hlist_node hnext
; /* place in hash collision list */
89 struct list_head later
; /* place in ima_measurements list */
90 struct ima_template_entry
*entry
;
92 extern struct list_head ima_measurements
; /* list of all measurements */
94 /* Internal IMA function definitions */
96 int ima_fs_init(void);
97 int ima_add_template_entry(struct ima_template_entry
*entry
, int violation
,
98 const char *op
, struct inode
*inode
,
99 const unsigned char *filename
);
100 int ima_calc_file_hash(struct file
*file
, struct ima_digest_data
*hash
);
101 int ima_calc_field_array_hash(struct ima_field_data
*field_data
,
102 struct ima_template_desc
*desc
, int num_fields
,
103 struct ima_digest_data
*hash
);
104 int __init
ima_calc_boot_aggregate(struct ima_digest_data
*hash
);
105 void ima_add_violation(struct file
*file
, const unsigned char *filename
,
106 const char *op
, const char *cause
);
107 int ima_init_crypto(void);
108 void ima_putc(struct seq_file
*m
, void *data
, int datalen
);
109 void ima_print_digest(struct seq_file
*m
, u8
*digest
, int size
);
110 struct ima_template_desc
*ima_template_desc_current(void);
111 int ima_init_template(void);
114 * used to protect h_table and sha_table
116 extern spinlock_t ima_queue_lock
;
119 atomic_long_t len
; /* number of stored measurements in the list */
120 atomic_long_t violations
;
121 struct hlist_head queue
[IMA_MEASURE_HTABLE_SIZE
];
123 extern struct ima_h_table ima_htable
;
125 static inline unsigned long ima_hash_key(u8
*digest
)
127 return hash_long(*digest
, IMA_HASH_BITS
);
130 /* LIM API function definitions */
131 int ima_get_action(struct inode
*inode
, int mask
, int function
);
132 int ima_must_measure(struct inode
*inode
, int mask
, int function
);
133 int ima_collect_measurement(struct integrity_iint_cache
*iint
,
135 struct evm_ima_xattr_data
**xattr_value
,
137 void ima_store_measurement(struct integrity_iint_cache
*iint
, struct file
*file
,
138 const unsigned char *filename
,
139 struct evm_ima_xattr_data
*xattr_value
,
141 void ima_audit_measurement(struct integrity_iint_cache
*iint
,
142 const unsigned char *filename
);
143 int ima_alloc_init_template(struct integrity_iint_cache
*iint
,
144 struct file
*file
, const unsigned char *filename
,
145 struct evm_ima_xattr_data
*xattr_value
,
146 int xattr_len
, struct ima_template_entry
**entry
);
147 int ima_store_template(struct ima_template_entry
*entry
, int violation
,
148 struct inode
*inode
, const unsigned char *filename
);
149 void ima_free_template_entry(struct ima_template_entry
*entry
);
150 const char *ima_d_path(struct path
*path
, char **pathbuf
);
152 /* IMA policy related functions */
153 enum ima_hooks
{ FILE_CHECK
= 1, MMAP_CHECK
, BPRM_CHECK
, MODULE_CHECK
, FIRMWARE_CHECK
, POST_SETATTR
};
155 int ima_match_policy(struct inode
*inode
, enum ima_hooks func
, int mask
,
157 void ima_init_policy(void);
158 void ima_update_policy(void);
159 void ima_update_policy_flag(void);
160 ssize_t
ima_parse_add_rule(char *);
161 void ima_delete_rules(void);
163 /* Appraise integrity measurements */
164 #define IMA_APPRAISE_ENFORCE 0x01
165 #define IMA_APPRAISE_FIX 0x02
166 #define IMA_APPRAISE_LOG 0x04
167 #define IMA_APPRAISE_MODULES 0x08
168 #define IMA_APPRAISE_FIRMWARE 0x10
170 #ifdef CONFIG_IMA_APPRAISE
171 int ima_appraise_measurement(int func
, struct integrity_iint_cache
*iint
,
172 struct file
*file
, const unsigned char *filename
,
173 struct evm_ima_xattr_data
*xattr_value
,
174 int xattr_len
, int opened
);
175 int ima_must_appraise(struct inode
*inode
, int mask
, enum ima_hooks func
);
176 void ima_update_xattr(struct integrity_iint_cache
*iint
, struct file
*file
);
177 enum integrity_status
ima_get_cache_status(struct integrity_iint_cache
*iint
,
179 void ima_get_hash_algo(struct evm_ima_xattr_data
*xattr_value
, int xattr_len
,
180 struct ima_digest_data
*hash
);
181 int ima_read_xattr(struct dentry
*dentry
,
182 struct evm_ima_xattr_data
**xattr_value
);
185 static inline int ima_appraise_measurement(int func
,
186 struct integrity_iint_cache
*iint
,
188 const unsigned char *filename
,
189 struct evm_ima_xattr_data
*xattr_value
,
190 int xattr_len
, int opened
)
192 return INTEGRITY_UNKNOWN
;
195 static inline int ima_must_appraise(struct inode
*inode
, int mask
,
201 static inline void ima_update_xattr(struct integrity_iint_cache
*iint
,
206 static inline enum integrity_status
ima_get_cache_status(struct integrity_iint_cache
209 return INTEGRITY_UNKNOWN
;
212 static inline void ima_get_hash_algo(struct evm_ima_xattr_data
*xattr_value
,
214 struct ima_digest_data
*hash
)
218 static inline int ima_read_xattr(struct dentry
*dentry
,
219 struct evm_ima_xattr_data
**xattr_value
)
226 /* LSM based policy rules require audit */
227 #ifdef CONFIG_IMA_LSM_RULES
229 #define security_filter_rule_init security_audit_rule_init
230 #define security_filter_rule_match security_audit_rule_match
234 static inline int security_filter_rule_init(u32 field
, u32 op
, char *rulestr
,
240 static inline int security_filter_rule_match(u32 secid
, u32 field
, u32 op
,
242 struct audit_context
*actx
)
246 #endif /* CONFIG_IMA_LSM_RULES */
248 #ifdef CONFIG_IMA_TRUSTED_KEYRING
249 static inline int ima_init_keyring(const unsigned int id
)
251 return integrity_init_keyring(id
);
254 static inline int ima_init_keyring(const unsigned int id
)
258 #endif /* CONFIG_IMA_TRUSTED_KEYRING */