2 * Copyright (C) 2008 IBM Corporation
4 * Author: Mimi Zohar <zohar@us.ibm.com>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License as
8 * published by the Free Software Foundation, version 2 of the
12 * Implements must_appraise_or_measure, collect_measurement,
13 * appraise_measurement, store_measurement and store_template.
15 #include <linux/module.h>
16 #include <linux/slab.h>
17 #include <linux/file.h>
19 #include <linux/xattr.h>
20 #include <linux/evm.h>
21 #include <crypto/hash_info.h>
25 * ima_free_template_entry - free an existing template entry
27 void ima_free_template_entry(struct ima_template_entry
*entry
)
31 for (i
= 0; i
< entry
->template_desc
->num_fields
; i
++)
32 kfree(entry
->template_data
[i
].data
);
38 * ima_alloc_init_template - create and initialize a new template entry
40 int ima_alloc_init_template(struct integrity_iint_cache
*iint
,
41 struct file
*file
, const unsigned char *filename
,
42 struct evm_ima_xattr_data
*xattr_value
,
43 int xattr_len
, struct ima_template_entry
**entry
)
45 struct ima_template_desc
*template_desc
= ima_template_desc_current();
48 *entry
= kzalloc(sizeof(**entry
) + template_desc
->num_fields
*
49 sizeof(struct ima_field_data
), GFP_NOFS
);
53 (*entry
)->template_desc
= template_desc
;
54 for (i
= 0; i
< template_desc
->num_fields
; i
++) {
55 struct ima_template_field
*field
= template_desc
->fields
[i
];
58 result
= field
->field_init(iint
, file
, filename
,
59 xattr_value
, xattr_len
,
60 &((*entry
)->template_data
[i
]));
64 len
= (*entry
)->template_data
[i
].len
;
65 (*entry
)->template_data_len
+= sizeof(len
);
66 (*entry
)->template_data_len
+= len
;
70 ima_free_template_entry(*entry
);
76 * ima_store_template - store ima template measurements
78 * Calculate the hash of a template entry, add the template entry
79 * to an ordered list of measurement entries maintained inside the kernel,
80 * and also update the aggregate integrity value (maintained inside the
81 * configured TPM PCR) over the hashes of the current list of measurement
84 * Applications retrieve the current kernel-held measurement list through
85 * the securityfs entries in /sys/kernel/security/ima. The signed aggregate
86 * TPM PCR (called quote) can be retrieved using a TPM user space library
87 * and is used to validate the measurement list.
89 * Returns 0 on success, error code otherwise
91 int ima_store_template(struct ima_template_entry
*entry
,
92 int violation
, struct inode
*inode
,
93 const unsigned char *filename
)
95 static const char op
[] = "add_template_measure";
96 static const char audit_cause
[] = "hashing_error";
97 char *template_name
= entry
->template_desc
->name
;
100 struct ima_digest_data hdr
;
101 char digest
[TPM_DIGEST_SIZE
];
105 int num_fields
= entry
->template_desc
->num_fields
;
107 /* this function uses default algo */
108 hash
.hdr
.algo
= HASH_ALGO_SHA1
;
109 result
= ima_calc_field_array_hash(&entry
->template_data
[0],
110 entry
->template_desc
,
111 num_fields
, &hash
.hdr
);
113 integrity_audit_msg(AUDIT_INTEGRITY_PCR
, inode
,
115 audit_cause
, result
, 0);
118 memcpy(entry
->digest
, hash
.hdr
.digest
, hash
.hdr
.length
);
120 result
= ima_add_template_entry(entry
, violation
, op
, inode
, filename
);
125 * ima_add_violation - add violation to measurement list.
127 * Violations are flagged in the measurement list with zero hash values.
128 * By extending the PCR with 0xFF's instead of with zeroes, the PCR
129 * value is invalidated.
131 void ima_add_violation(struct file
*file
, const unsigned char *filename
,
132 const char *op
, const char *cause
)
134 struct ima_template_entry
*entry
;
135 struct inode
*inode
= file_inode(file
);
139 /* can overflow, only indicator */
140 atomic_long_inc(&ima_htable
.violations
);
142 result
= ima_alloc_init_template(NULL
, file
, filename
,
148 result
= ima_store_template(entry
, violation
, inode
, filename
);
150 ima_free_template_entry(entry
);
152 integrity_audit_msg(AUDIT_INTEGRITY_PCR
, inode
, filename
,
153 op
, cause
, result
, 0);
157 * ima_get_action - appraise & measure decision based on policy.
158 * @inode: pointer to inode to measure
159 * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE)
160 * @function: calling function (FILE_CHECK, BPRM_CHECK, MMAP_CHECK, MODULE_CHECK)
162 * The policy is defined in terms of keypairs:
163 * subj=, obj=, type=, func=, mask=, fsmagic=
164 * subj,obj, and type: are LSM specific.
165 * func: FILE_CHECK | BPRM_CHECK | MMAP_CHECK | MODULE_CHECK
166 * mask: contains the permission mask
169 * Returns IMA_MEASURE, IMA_APPRAISE mask.
172 int ima_get_action(struct inode
*inode
, int mask
, int function
)
174 int flags
= IMA_MEASURE
| IMA_AUDIT
| IMA_APPRAISE
;
176 flags
&= ima_policy_flag
;
178 return ima_match_policy(inode
, function
, mask
, flags
);
182 * ima_collect_measurement - collect file measurement
184 * Calculate the file hash, if it doesn't already exist,
185 * storing the measurement and i_version in the iint.
187 * Must be called with iint->mutex held.
189 * Return 0 on success, error code otherwise
191 int ima_collect_measurement(struct integrity_iint_cache
*iint
,
193 struct evm_ima_xattr_data
**xattr_value
,
196 const char *audit_cause
= "failed";
197 struct inode
*inode
= file_inode(file
);
198 const char *filename
= file
->f_path
.dentry
->d_name
.name
;
201 struct ima_digest_data hdr
;
202 char digest
[IMA_MAX_DIGEST_SIZE
];
206 *xattr_len
= ima_read_xattr(file
->f_path
.dentry
, xattr_value
);
208 if (!(iint
->flags
& IMA_COLLECTED
)) {
209 u64 i_version
= file_inode(file
)->i_version
;
211 if (file
->f_flags
& O_DIRECT
) {
212 audit_cause
= "failed(directio)";
217 /* use default hash algorithm */
218 hash
.hdr
.algo
= ima_hash_algo
;
221 ima_get_hash_algo(*xattr_value
, *xattr_len
, &hash
.hdr
);
223 result
= ima_calc_file_hash(file
, &hash
.hdr
);
225 int length
= sizeof(hash
.hdr
) + hash
.hdr
.length
;
226 void *tmpbuf
= krealloc(iint
->ima_hash
, length
,
229 iint
->ima_hash
= tmpbuf
;
230 memcpy(iint
->ima_hash
, &hash
, length
);
231 iint
->version
= i_version
;
232 iint
->flags
|= IMA_COLLECTED
;
239 integrity_audit_msg(AUDIT_INTEGRITY_DATA
, inode
,
240 filename
, "collect_data", audit_cause
,
246 * ima_store_measurement - store file measurement
248 * Create an "ima" template and then store the template by calling
249 * ima_store_template.
251 * We only get here if the inode has not already been measured,
252 * but the measurement could already exist:
253 * - multiple copies of the same file on either the same or
254 * different filesystems.
255 * - the inode was previously flushed as well as the iint info,
256 * containing the hashing info.
258 * Must be called with iint->mutex held.
260 void ima_store_measurement(struct integrity_iint_cache
*iint
,
261 struct file
*file
, const unsigned char *filename
,
262 struct evm_ima_xattr_data
*xattr_value
,
265 static const char op
[] = "add_template_measure";
266 static const char audit_cause
[] = "ENOMEM";
267 int result
= -ENOMEM
;
268 struct inode
*inode
= file_inode(file
);
269 struct ima_template_entry
*entry
;
272 if (iint
->flags
& IMA_MEASURED
)
275 result
= ima_alloc_init_template(iint
, file
, filename
,
276 xattr_value
, xattr_len
, &entry
);
278 integrity_audit_msg(AUDIT_INTEGRITY_PCR
, inode
, filename
,
279 op
, audit_cause
, result
, 0);
283 result
= ima_store_template(entry
, violation
, inode
, filename
);
284 if (!result
|| result
== -EEXIST
)
285 iint
->flags
|= IMA_MEASURED
;
287 ima_free_template_entry(entry
);
290 void ima_audit_measurement(struct integrity_iint_cache
*iint
,
291 const unsigned char *filename
)
293 struct audit_buffer
*ab
;
294 char hash
[(iint
->ima_hash
->length
* 2) + 1];
295 const char *algo_name
= hash_algo_name
[iint
->ima_hash
->algo
];
296 char algo_hash
[sizeof(hash
) + strlen(algo_name
) + 2];
299 if (iint
->flags
& IMA_AUDITED
)
302 for (i
= 0; i
< iint
->ima_hash
->length
; i
++)
303 hex_byte_pack(hash
+ (i
* 2), iint
->ima_hash
->digest
[i
]);
306 ab
= audit_log_start(current
->audit_context
, GFP_KERNEL
,
307 AUDIT_INTEGRITY_RULE
);
311 audit_log_format(ab
, "file=");
312 audit_log_untrustedstring(ab
, filename
);
313 audit_log_format(ab
, " hash=");
314 snprintf(algo_hash
, sizeof(algo_hash
), "%s:%s", algo_name
, hash
);
315 audit_log_untrustedstring(ab
, algo_hash
);
317 audit_log_task_info(ab
, current
);
320 iint
->flags
|= IMA_AUDITED
;
323 const char *ima_d_path(struct path
*path
, char **pathbuf
)
325 char *pathname
= NULL
;
327 *pathbuf
= __getname();
329 pathname
= d_absolute_path(path
, *pathbuf
, PATH_MAX
);
330 if (IS_ERR(pathname
)) {
336 return pathname
?: (const char *)path
->dentry
->d_name
.name
;
This page took 0.0371359999999999 seconds and 5 git commands to generate.