1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19#include <linux/module.h>
20#include <linux/file.h>
21#include <linux/binfmts.h>
22#include <linux/mount.h>
23#include <linux/mman.h>
24#include <linux/slab.h>
25#include <linux/xattr.h>
26#include <linux/ima.h>
27
28#include "ima.h"
29
30int ima_initialized;
31
32#ifdef CONFIG_IMA_APPRAISE
33int ima_appraise = IMA_APPRAISE_ENFORCE;
34#else
35int ima_appraise;
36#endif
37
38char *ima_hash = "sha1";
39static int __init hash_setup(char *str)
40{
41 if (strncmp(str, "md5", 3) == 0)
42 ima_hash = "md5";
43 return 1;
44}
45__setup("ima_hash=", hash_setup);
46
47
48
49
50
51
52
53
54
55
56
57static void ima_rdwr_violation_check(struct file *file)
58{
59 struct dentry *dentry = file->f_path.dentry;
60 struct inode *inode = file_inode(file);
61 fmode_t mode = file->f_mode;
62 int must_measure;
63 bool send_tomtou = false, send_writers = false;
64 char *pathbuf = NULL;
65 const char *pathname;
66
67 if (!S_ISREG(inode->i_mode) || !ima_initialized)
68 return;
69
70 mutex_lock(&inode->i_mutex);
71
72 if (mode & FMODE_WRITE) {
73 if (atomic_read(&inode->i_readcount) && IS_IMA(inode))
74 send_tomtou = true;
75 goto out;
76 }
77
78 must_measure = ima_must_measure(inode, MAY_READ, FILE_CHECK);
79 if (!must_measure)
80 goto out;
81
82 if (atomic_read(&inode->i_writecount) > 0)
83 send_writers = true;
84out:
85 mutex_unlock(&inode->i_mutex);
86
87 if (!send_tomtou && !send_writers)
88 return;
89
90 pathname = ima_d_path(&file->f_path, &pathbuf);
91 if (!pathname || strlen(pathname) > IMA_EVENT_NAME_LEN_MAX)
92 pathname = dentry->d_name.name;
93
94 if (send_tomtou)
95 ima_add_violation(inode, pathname,
96 "invalid_pcr", "ToMToU");
97 if (send_writers)
98 ima_add_violation(inode, pathname,
99 "invalid_pcr", "open_writers");
100 kfree(pathbuf);
101}
102
103static void ima_check_last_writer(struct integrity_iint_cache *iint,
104 struct inode *inode, struct file *file)
105{
106 fmode_t mode = file->f_mode;
107
108 if (!(mode & FMODE_WRITE))
109 return;
110
111 mutex_lock(&inode->i_mutex);
112 if (atomic_read(&inode->i_writecount) == 1 &&
113 iint->version != inode->i_version) {
114 iint->flags &= ~IMA_DONE_MASK;
115 if (iint->flags & IMA_APPRAISE)
116 ima_update_xattr(iint, file);
117 }
118 mutex_unlock(&inode->i_mutex);
119}
120
121
122
123
124
125
126
127void ima_file_free(struct file *file)
128{
129 struct inode *inode = file_inode(file);
130 struct integrity_iint_cache *iint;
131
132 if (!iint_initialized || !S_ISREG(inode->i_mode))
133 return;
134
135 iint = integrity_iint_find(inode);
136 if (!iint)
137 return;
138
139 ima_check_last_writer(iint, inode, file);
140}
141
142static int process_measurement(struct file *file, const char *filename,
143 int mask, int function)
144{
145 struct inode *inode = file_inode(file);
146 struct integrity_iint_cache *iint;
147 char *pathbuf = NULL;
148 const char *pathname = NULL;
149 int rc = -ENOMEM, action, must_appraise, _func;
150
151 if (!ima_initialized || !S_ISREG(inode->i_mode))
152 return 0;
153
154
155
156
157
158 action = ima_get_action(inode, mask, function);
159 if (!action)
160 return 0;
161
162 must_appraise = action & IMA_APPRAISE;
163
164
165 _func = (action & IMA_FILE_APPRAISE) ? FILE_CHECK : function;
166
167 mutex_lock(&inode->i_mutex);
168
169 iint = integrity_inode_get(inode);
170 if (!iint)
171 goto out;
172
173
174
175
176
177 iint->flags |= action;
178 action &= IMA_DO_MASK;
179 action &= ~((iint->flags & IMA_DONE_MASK) >> 1);
180
181
182 if (!action) {
183 if (must_appraise)
184 rc = ima_get_cache_status(iint, _func);
185 goto out_digsig;
186 }
187
188 rc = ima_collect_measurement(iint, file);
189 if (rc != 0)
190 goto out_digsig;
191
192 pathname = !filename ? ima_d_path(&file->f_path, &pathbuf) : filename;
193 if (!pathname)
194 pathname = (const char *)file->f_dentry->d_name.name;
195
196 if (action & IMA_MEASURE)
197 ima_store_measurement(iint, file, pathname);
198 if (action & IMA_APPRAISE_SUBMASK)
199 rc = ima_appraise_measurement(_func, iint, file, pathname);
200 if (action & IMA_AUDIT)
201 ima_audit_measurement(iint, pathname);
202 kfree(pathbuf);
203out_digsig:
204 if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG))
205 rc = -EACCES;
206out:
207 mutex_unlock(&inode->i_mutex);
208 if ((rc && must_appraise) && (ima_appraise & IMA_APPRAISE_ENFORCE))
209 return -EACCES;
210 return 0;
211}
212
213
214
215
216
217
218
219
220
221
222
223
224int ima_file_mmap(struct file *file, unsigned long prot)
225{
226 if (file && (prot & PROT_EXEC))
227 return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK);
228 return 0;
229}
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244int ima_bprm_check(struct linux_binprm *bprm)
245{
246 return process_measurement(bprm->file,
247 (strcmp(bprm->filename, bprm->interp) == 0) ?
248 bprm->filename : bprm->interp,
249 MAY_EXEC, BPRM_CHECK);
250}
251
252
253
254
255
256
257
258
259
260
261
262int ima_file_check(struct file *file, int mask)
263{
264 ima_rdwr_violation_check(file);
265 return process_measurement(file, NULL,
266 mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
267 FILE_CHECK);
268}
269EXPORT_SYMBOL_GPL(ima_file_check);
270
271
272
273
274
275
276
277
278
279
280int ima_module_check(struct file *file)
281{
282 if (!file) {
283#ifndef CONFIG_MODULE_SIG_FORCE
284 if ((ima_appraise & IMA_APPRAISE_MODULES) &&
285 (ima_appraise & IMA_APPRAISE_ENFORCE))
286 return -EACCES;
287#endif
288 return 0;
289 }
290 return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK);
291}
292
293static int __init init_ima(void)
294{
295 int error;
296
297 error = ima_init();
298 if (!error)
299 ima_initialized = 1;
300 return error;
301}
302
303late_initcall(init_ima);
304
305MODULE_DESCRIPTION("Integrity Measurement Architecture");
306MODULE_LICENSE("GPL");
307