1
2
3
4
5
6
7
8
9
10
11
12
13#include <linux/module.h>
14#include <linux/list.h>
15#include <linux/security.h>
16#include <linux/magic.h>
17#include <linux/parser.h>
18
19#include "ima.h"
20
21
22#define IMA_FUNC 0x0001
23#define IMA_MASK 0x0002
24#define IMA_FSMAGIC 0x0004
25#define IMA_UID 0x0008
26
27enum ima_action { UNKNOWN = -1, DONT_MEASURE = 0, MEASURE };
28
29#define MAX_LSM_RULES 6
30enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
31 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
32};
33
34struct ima_measure_rule_entry {
35 struct list_head list;
36 enum ima_action action;
37 unsigned int flags;
38 enum ima_hooks func;
39 int mask;
40 unsigned long fsmagic;
41 uid_t uid;
42 struct {
43 void *rule;
44 int type;
45 } lsm[MAX_LSM_RULES];
46};
47
48
49
50
51
52
53
54
55
56
57
58
59static struct ima_measure_rule_entry default_rules[] = {
60 {.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
61 {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
62 {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
63 {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
64 {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
65 {.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
66 {.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC,
67 .flags = IMA_FUNC | IMA_MASK},
68 {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
69 .flags = IMA_FUNC | IMA_MASK},
70 {.action = MEASURE,.func = PATH_CHECK,.mask = MAY_READ,.uid = 0,
71 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
72};
73
74static LIST_HEAD(measure_default_rules);
75static LIST_HEAD(measure_policy_rules);
76static struct list_head *ima_measure;
77
78static DEFINE_MUTEX(ima_measure_mutex);
79
80static bool ima_use_tcb __initdata;
81static int __init default_policy_setup(char *str)
82{
83 ima_use_tcb = 1;
84 return 1;
85}
86__setup("ima_tcb", default_policy_setup);
87
88
89
90
91
92
93
94
95
96
97static bool ima_match_rules(struct ima_measure_rule_entry *rule,
98 struct inode *inode, enum ima_hooks func, int mask)
99{
100 struct task_struct *tsk = current;
101 int i;
102
103 if ((rule->flags & IMA_FUNC) && rule->func != func)
104 return false;
105 if ((rule->flags & IMA_MASK) && rule->mask != mask)
106 return false;
107 if ((rule->flags & IMA_FSMAGIC)
108 && rule->fsmagic != inode->i_sb->s_magic)
109 return false;
110 if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid)
111 return false;
112 for (i = 0; i < MAX_LSM_RULES; i++) {
113 int rc = 0;
114 u32 osid, sid;
115
116 if (!rule->lsm[i].rule)
117 continue;
118
119 switch (i) {
120 case LSM_OBJ_USER:
121 case LSM_OBJ_ROLE:
122 case LSM_OBJ_TYPE:
123 security_inode_getsecid(inode, &osid);
124 rc = security_filter_rule_match(osid,
125 rule->lsm[i].type,
126 Audit_equal,
127 rule->lsm[i].rule,
128 NULL);
129 break;
130 case LSM_SUBJ_USER:
131 case LSM_SUBJ_ROLE:
132 case LSM_SUBJ_TYPE:
133 security_task_getsecid(tsk, &sid);
134 rc = security_filter_rule_match(sid,
135 rule->lsm[i].type,
136 Audit_equal,
137 rule->lsm[i].rule,
138 NULL);
139 default:
140 break;
141 }
142 if (!rc)
143 return false;
144 }
145 return true;
146}
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask)
162{
163 struct ima_measure_rule_entry *entry;
164
165 list_for_each_entry(entry, ima_measure, list) {
166 bool rc;
167
168 rc = ima_match_rules(entry, inode, func, mask);
169 if (rc)
170 return entry->action;
171 }
172 return 0;
173}
174
175
176
177
178
179
180
181void __init ima_init_policy(void)
182{
183 int i, entries;
184
185
186 if (ima_use_tcb)
187 entries = ARRAY_SIZE(default_rules);
188 else
189 entries = 0;
190
191 for (i = 0; i < entries; i++)
192 list_add_tail(&default_rules[i].list, &measure_default_rules);
193 ima_measure = &measure_default_rules;
194}
195
196
197
198
199
200
201
202
203void ima_update_policy(void)
204{
205 const char *op = "policy_update";
206 const char *cause = "already exists";
207 int result = 1;
208 int audit_info = 0;
209
210 if (ima_measure == &measure_default_rules) {
211 ima_measure = &measure_policy_rules;
212 cause = "complete";
213 result = 0;
214 }
215 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
216 NULL, op, cause, result, audit_info);
217}
218
219enum {
220 Opt_err = -1,
221 Opt_measure = 1, Opt_dont_measure,
222 Opt_obj_user, Opt_obj_role, Opt_obj_type,
223 Opt_subj_user, Opt_subj_role, Opt_subj_type,
224 Opt_func, Opt_mask, Opt_fsmagic, Opt_uid
225};
226
227static match_table_t policy_tokens = {
228 {Opt_measure, "measure"},
229 {Opt_dont_measure, "dont_measure"},
230 {Opt_obj_user, "obj_user=%s"},
231 {Opt_obj_role, "obj_role=%s"},
232 {Opt_obj_type, "obj_type=%s"},
233 {Opt_subj_user, "subj_user=%s"},
234 {Opt_subj_role, "subj_role=%s"},
235 {Opt_subj_type, "subj_type=%s"},
236 {Opt_func, "func=%s"},
237 {Opt_mask, "mask=%s"},
238 {Opt_fsmagic, "fsmagic=%s"},
239 {Opt_uid, "uid=%s"},
240 {Opt_err, NULL}
241};
242
243static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry,
244 char *args, int lsm_rule, int audit_type)
245{
246 int result;
247
248 entry->lsm[lsm_rule].type = audit_type;
249 result = security_filter_rule_init(entry->lsm[lsm_rule].type,
250 Audit_equal, args,
251 &entry->lsm[lsm_rule].rule);
252 return result;
253}
254
255static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry)
256{
257 struct audit_buffer *ab;
258 char *p;
259 int result = 0;
260
261 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
262
263 entry->action = -1;
264 while ((p = strsep(&rule, " \n")) != NULL) {
265 substring_t args[MAX_OPT_ARGS];
266 int token;
267 unsigned long lnum;
268
269 if (result < 0)
270 break;
271 if (!*p)
272 continue;
273 token = match_token(p, policy_tokens, args);
274 switch (token) {
275 case Opt_measure:
276 audit_log_format(ab, "%s ", "measure");
277 entry->action = MEASURE;
278 break;
279 case Opt_dont_measure:
280 audit_log_format(ab, "%s ", "dont_measure");
281 entry->action = DONT_MEASURE;
282 break;
283 case Opt_func:
284 audit_log_format(ab, "func=%s ", args[0].from);
285 if (strcmp(args[0].from, "PATH_CHECK") == 0)
286 entry->func = PATH_CHECK;
287 else if (strcmp(args[0].from, "FILE_MMAP") == 0)
288 entry->func = FILE_MMAP;
289 else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
290 entry->func = BPRM_CHECK;
291 else
292 result = -EINVAL;
293 if (!result)
294 entry->flags |= IMA_FUNC;
295 break;
296 case Opt_mask:
297 audit_log_format(ab, "mask=%s ", args[0].from);
298 if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
299 entry->mask = MAY_EXEC;
300 else if (strcmp(args[0].from, "MAY_WRITE") == 0)
301 entry->mask = MAY_WRITE;
302 else if (strcmp(args[0].from, "MAY_READ") == 0)
303 entry->mask = MAY_READ;
304 else if (strcmp(args[0].from, "MAY_APPEND") == 0)
305 entry->mask = MAY_APPEND;
306 else
307 result = -EINVAL;
308 if (!result)
309 entry->flags |= IMA_MASK;
310 break;
311 case Opt_fsmagic:
312 audit_log_format(ab, "fsmagic=%s ", args[0].from);
313 result = strict_strtoul(args[0].from, 16,
314 &entry->fsmagic);
315 if (!result)
316 entry->flags |= IMA_FSMAGIC;
317 break;
318 case Opt_uid:
319 audit_log_format(ab, "uid=%s ", args[0].from);
320 result = strict_strtoul(args[0].from, 10, &lnum);
321 if (!result) {
322 entry->uid = (uid_t) lnum;
323 if (entry->uid != lnum)
324 result = -EINVAL;
325 else
326 entry->flags |= IMA_UID;
327 }
328 break;
329 case Opt_obj_user:
330 audit_log_format(ab, "obj_user=%s ", args[0].from);
331 result = ima_lsm_rule_init(entry, args[0].from,
332 LSM_OBJ_USER,
333 AUDIT_OBJ_USER);
334 break;
335 case Opt_obj_role:
336 audit_log_format(ab, "obj_role=%s ", args[0].from);
337 result = ima_lsm_rule_init(entry, args[0].from,
338 LSM_OBJ_ROLE,
339 AUDIT_OBJ_ROLE);
340 break;
341 case Opt_obj_type:
342 audit_log_format(ab, "obj_type=%s ", args[0].from);
343 result = ima_lsm_rule_init(entry, args[0].from,
344 LSM_OBJ_TYPE,
345 AUDIT_OBJ_TYPE);
346 break;
347 case Opt_subj_user:
348 audit_log_format(ab, "subj_user=%s ", args[0].from);
349 result = ima_lsm_rule_init(entry, args[0].from,
350 LSM_SUBJ_USER,
351 AUDIT_SUBJ_USER);
352 break;
353 case Opt_subj_role:
354 audit_log_format(ab, "subj_role=%s ", args[0].from);
355 result = ima_lsm_rule_init(entry, args[0].from,
356 LSM_SUBJ_ROLE,
357 AUDIT_SUBJ_ROLE);
358 break;
359 case Opt_subj_type:
360 audit_log_format(ab, "subj_type=%s ", args[0].from);
361 result = ima_lsm_rule_init(entry, args[0].from,
362 LSM_SUBJ_TYPE,
363 AUDIT_SUBJ_TYPE);
364 break;
365 case Opt_err:
366 audit_log_format(ab, "UNKNOWN=%s ", p);
367 break;
368 }
369 }
370 if (entry->action == UNKNOWN)
371 result = -EINVAL;
372
373 audit_log_format(ab, "res=%d", !result ? 0 : 1);
374 audit_log_end(ab);
375 return result;
376}
377
378
379
380
381
382
383
384
385int ima_parse_add_rule(char *rule)
386{
387 const char *op = "update_policy";
388 struct ima_measure_rule_entry *entry;
389 int result = 0;
390 int audit_info = 0;
391
392
393 if (ima_measure != &measure_default_rules) {
394 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
395 NULL, op, "already exists",
396 -EACCES, audit_info);
397 return -EACCES;
398 }
399
400 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
401 if (!entry) {
402 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
403 NULL, op, "-ENOMEM", -ENOMEM, audit_info);
404 return -ENOMEM;
405 }
406
407 INIT_LIST_HEAD(&entry->list);
408
409 result = ima_parse_rule(rule, entry);
410 if (!result) {
411 mutex_lock(&ima_measure_mutex);
412 list_add_tail(&entry->list, &measure_policy_rules);
413 mutex_unlock(&ima_measure_mutex);
414 } else {
415 kfree(entry);
416 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
417 NULL, op, "invalid policy", result,
418 audit_info);
419 }
420 return result;
421}
422
423
424void ima_delete_rules(void)
425{
426 struct ima_measure_rule_entry *entry, *tmp;
427
428 mutex_lock(&ima_measure_mutex);
429 list_for_each_entry_safe(entry, tmp, &measure_policy_rules, list) {
430 list_del(&entry->list);
431 kfree(entry);
432 }
433 mutex_unlock(&ima_measure_mutex);
434}
435