1
2
3
4
5
6
7
8
9
10
11
12
13#include <linux/module.h>
14#include <linux/list.h>
15#include <linux/fs.h>
16#include <linux/security.h>
17#include <linux/magic.h>
18#include <linux/parser.h>
19#include <linux/slab.h>
20#include <linux/rculist.h>
21#include <linux/genhd.h>
22#include <linux/seq_file.h>
23
24#include "ima.h"
25
26
27#define IMA_FUNC 0x0001
28#define IMA_MASK 0x0002
29#define IMA_FSMAGIC 0x0004
30#define IMA_UID 0x0008
31#define IMA_FOWNER 0x0010
32#define IMA_FSUUID 0x0020
33#define IMA_INMASK 0x0040
34#define IMA_EUID 0x0080
35#define IMA_PCR 0x0100
36
37#define UNKNOWN 0
38#define MEASURE 0x0001
39#define DONT_MEASURE 0x0002
40#define APPRAISE 0x0004
41#define DONT_APPRAISE 0x0008
42#define AUDIT 0x0040
43#define HASH 0x0100
44#define DONT_HASH 0x0200
45
46#define INVALID_PCR(a) (((a) < 0) || \
47 (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
48
49int ima_policy_flag;
50static int temp_ima_appraise;
51
52#define MAX_LSM_RULES 6
53enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
54 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
55};
56
57enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
58
59struct ima_rule_entry {
60 struct list_head list;
61 int action;
62 unsigned int flags;
63 enum ima_hooks func;
64 int mask;
65 unsigned long fsmagic;
66 uuid_t fsuuid;
67 kuid_t uid;
68 kuid_t fowner;
69 bool (*uid_op)(kuid_t, kuid_t);
70 bool (*fowner_op)(kuid_t, kuid_t);
71 int pcr;
72 struct {
73 void *rule;
74 void *args_p;
75 int type;
76 } lsm[MAX_LSM_RULES];
77};
78
79
80
81
82
83
84
85
86
87
88
89
90static struct ima_rule_entry dont_measure_rules[] __ro_after_init = {
91 {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
92 {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
93 {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
94 {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
95 {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
96 {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
97 {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
98 {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
99 {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
100 .flags = IMA_FSMAGIC},
101 {.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC,
102 .flags = IMA_FSMAGIC},
103 {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
104};
105
106static struct ima_rule_entry original_measurement_rules[] __ro_after_init = {
107 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
108 .flags = IMA_FUNC | IMA_MASK},
109 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
110 .flags = IMA_FUNC | IMA_MASK},
111 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
112 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
113 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
114 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
115 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
116};
117
118static struct ima_rule_entry default_measurement_rules[] __ro_after_init = {
119 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
120 .flags = IMA_FUNC | IMA_MASK},
121 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
122 .flags = IMA_FUNC | IMA_MASK},
123 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
124 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
125 .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
126 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
127 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
128 .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
129 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
130 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
131 {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
132};
133
134static struct ima_rule_entry default_appraise_rules[] __ro_after_init = {
135 {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
136 {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
137 {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
138 {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
139 {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
140 {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
141 {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
142 {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
143 {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
144 {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
145 {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
146 {.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC},
147#ifdef CONFIG_IMA_WRITE_POLICY
148 {.action = APPRAISE, .func = POLICY_CHECK,
149 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
150#endif
151#ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
152 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
153 .flags = IMA_FOWNER},
154#else
155
156 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
157 .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
158#endif
159};
160
161static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
162 {.action = APPRAISE, .func = MODULE_CHECK,
163 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
164 {.action = APPRAISE, .func = FIRMWARE_CHECK,
165 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
166 {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
167 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
168 {.action = APPRAISE, .func = POLICY_CHECK,
169 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
170};
171
172static LIST_HEAD(ima_default_rules);
173static LIST_HEAD(ima_policy_rules);
174static LIST_HEAD(ima_temp_rules);
175static struct list_head *ima_rules;
176
177static int ima_policy __initdata;
178
179static int __init default_measure_policy_setup(char *str)
180{
181 if (ima_policy)
182 return 1;
183
184 ima_policy = ORIGINAL_TCB;
185 return 1;
186}
187__setup("ima_tcb", default_measure_policy_setup);
188
189static bool ima_use_appraise_tcb __initdata;
190static bool ima_use_secure_boot __initdata;
191static int __init policy_setup(char *str)
192{
193 char *p;
194
195 while ((p = strsep(&str, " |\n")) != NULL) {
196 if (*p == ' ')
197 continue;
198 if ((strcmp(p, "tcb") == 0) && !ima_policy)
199 ima_policy = DEFAULT_TCB;
200 else if (strcmp(p, "appraise_tcb") == 0)
201 ima_use_appraise_tcb = true;
202 else if (strcmp(p, "secure_boot") == 0)
203 ima_use_secure_boot = true;
204 }
205
206 return 1;
207}
208__setup("ima_policy=", policy_setup);
209
210static int __init default_appraise_policy_setup(char *str)
211{
212 ima_use_appraise_tcb = true;
213 return 1;
214}
215__setup("ima_appraise_tcb", default_appraise_policy_setup);
216
217
218
219
220
221
222
223static void ima_lsm_update_rules(void)
224{
225 struct ima_rule_entry *entry;
226 int result;
227 int i;
228
229 list_for_each_entry(entry, &ima_policy_rules, list) {
230 for (i = 0; i < MAX_LSM_RULES; i++) {
231 if (!entry->lsm[i].rule)
232 continue;
233 result = security_filter_rule_init(entry->lsm[i].type,
234 Audit_equal,
235 entry->lsm[i].args_p,
236 &entry->lsm[i].rule);
237 BUG_ON(!entry->lsm[i].rule);
238 }
239 }
240}
241
242
243
244
245
246
247
248
249
250
251static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
252 enum ima_hooks func, int mask)
253{
254 struct task_struct *tsk = current;
255 const struct cred *cred = current_cred();
256 int i;
257
258 if ((rule->flags & IMA_FUNC) &&
259 (rule->func != func && func != POST_SETATTR))
260 return false;
261 if ((rule->flags & IMA_MASK) &&
262 (rule->mask != mask && func != POST_SETATTR))
263 return false;
264 if ((rule->flags & IMA_INMASK) &&
265 (!(rule->mask & mask) && func != POST_SETATTR))
266 return false;
267 if ((rule->flags & IMA_FSMAGIC)
268 && rule->fsmagic != inode->i_sb->s_magic)
269 return false;
270 if ((rule->flags & IMA_FSUUID) &&
271 !uuid_equal(&rule->fsuuid, &inode->i_sb->s_uuid))
272 return false;
273 if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
274 return false;
275 if (rule->flags & IMA_EUID) {
276 if (has_capability_noaudit(current, CAP_SETUID)) {
277 if (!rule->uid_op(cred->euid, rule->uid)
278 && !rule->uid_op(cred->suid, rule->uid)
279 && !rule->uid_op(cred->uid, rule->uid))
280 return false;
281 } else if (!rule->uid_op(cred->euid, rule->uid))
282 return false;
283 }
284
285 if ((rule->flags & IMA_FOWNER) &&
286 !rule->fowner_op(inode->i_uid, rule->fowner))
287 return false;
288 for (i = 0; i < MAX_LSM_RULES; i++) {
289 int rc = 0;
290 u32 osid, sid;
291 int retried = 0;
292
293 if (!rule->lsm[i].rule)
294 continue;
295retry:
296 switch (i) {
297 case LSM_OBJ_USER:
298 case LSM_OBJ_ROLE:
299 case LSM_OBJ_TYPE:
300 security_inode_getsecid(inode, &osid);
301 rc = security_filter_rule_match(osid,
302 rule->lsm[i].type,
303 Audit_equal,
304 rule->lsm[i].rule,
305 NULL);
306 break;
307 case LSM_SUBJ_USER:
308 case LSM_SUBJ_ROLE:
309 case LSM_SUBJ_TYPE:
310 security_task_getsecid(tsk, &sid);
311 rc = security_filter_rule_match(sid,
312 rule->lsm[i].type,
313 Audit_equal,
314 rule->lsm[i].rule,
315 NULL);
316 default:
317 break;
318 }
319 if ((rc < 0) && (!retried)) {
320 retried = 1;
321 ima_lsm_update_rules();
322 goto retry;
323 }
324 if (!rc)
325 return false;
326 }
327 return true;
328}
329
330
331
332
333
334static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
335{
336 if (!(rule->flags & IMA_FUNC))
337 return IMA_FILE_APPRAISE;
338
339 switch (func) {
340 case MMAP_CHECK:
341 return IMA_MMAP_APPRAISE;
342 case BPRM_CHECK:
343 return IMA_BPRM_APPRAISE;
344 case FILE_CHECK:
345 case POST_SETATTR:
346 return IMA_FILE_APPRAISE;
347 case MODULE_CHECK ... MAX_CHECK - 1:
348 default:
349 return IMA_READ_APPRAISE;
350 }
351}
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
368 int flags, int *pcr)
369{
370 struct ima_rule_entry *entry;
371 int action = 0, actmask = flags | (flags << 1);
372
373 rcu_read_lock();
374 list_for_each_entry_rcu(entry, ima_rules, list) {
375
376 if (!(entry->action & actmask))
377 continue;
378
379 if (!ima_match_rules(entry, inode, func, mask))
380 continue;
381
382 action |= entry->flags & IMA_ACTION_FLAGS;
383
384 action |= entry->action & IMA_DO_MASK;
385 if (entry->action & IMA_APPRAISE) {
386 action |= get_subaction(entry, func);
387 action ^= IMA_HASH;
388 }
389
390 if (entry->action & IMA_DO_MASK)
391 actmask &= ~(entry->action | entry->action << 1);
392 else
393 actmask &= ~(entry->action | entry->action >> 1);
394
395 if ((pcr) && (entry->flags & IMA_PCR))
396 *pcr = entry->pcr;
397
398 if (!actmask)
399 break;
400 }
401 rcu_read_unlock();
402
403 return action;
404}
405
406
407
408
409
410
411
412void ima_update_policy_flag(void)
413{
414 struct ima_rule_entry *entry;
415
416 list_for_each_entry(entry, ima_rules, list) {
417 if (entry->action & IMA_DO_MASK)
418 ima_policy_flag |= entry->action;
419 }
420
421 ima_appraise |= temp_ima_appraise;
422 if (!ima_appraise)
423 ima_policy_flag &= ~IMA_APPRAISE;
424}
425
426
427
428
429
430
431
432void __init ima_init_policy(void)
433{
434 int i, measure_entries, appraise_entries, secure_boot_entries;
435
436
437 measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
438 appraise_entries = ima_use_appraise_tcb ?
439 ARRAY_SIZE(default_appraise_rules) : 0;
440 secure_boot_entries = ima_use_secure_boot ?
441 ARRAY_SIZE(secure_boot_rules) : 0;
442
443 for (i = 0; i < measure_entries; i++)
444 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
445
446 switch (ima_policy) {
447 case ORIGINAL_TCB:
448 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
449 list_add_tail(&original_measurement_rules[i].list,
450 &ima_default_rules);
451 break;
452 case DEFAULT_TCB:
453 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
454 list_add_tail(&default_measurement_rules[i].list,
455 &ima_default_rules);
456 default:
457 break;
458 }
459
460
461
462
463
464 for (i = 0; i < secure_boot_entries; i++)
465 list_add_tail(&secure_boot_rules[i].list,
466 &ima_default_rules);
467
468 for (i = 0; i < appraise_entries; i++) {
469 list_add_tail(&default_appraise_rules[i].list,
470 &ima_default_rules);
471 if (default_appraise_rules[i].func == POLICY_CHECK)
472 temp_ima_appraise |= IMA_APPRAISE_POLICY;
473 }
474
475 ima_rules = &ima_default_rules;
476 ima_update_policy_flag();
477}
478
479
480int ima_check_policy(void)
481{
482 if (list_empty(&ima_temp_rules))
483 return -EINVAL;
484 return 0;
485}
486
487
488
489
490
491
492
493
494
495
496
497
498void ima_update_policy(void)
499{
500 struct list_head *first, *last, *policy;
501
502
503 first = (&ima_temp_rules)->next;
504 last = (&ima_temp_rules)->prev;
505 policy = &ima_policy_rules;
506
507 synchronize_rcu();
508
509 last->next = policy;
510 rcu_assign_pointer(list_next_rcu(policy->prev), first);
511 first->prev = policy->prev;
512 policy->prev = last;
513
514
515 INIT_LIST_HEAD(&ima_temp_rules);
516
517 if (ima_rules != policy) {
518 ima_policy_flag = 0;
519 ima_rules = policy;
520 }
521 ima_update_policy_flag();
522}
523
524enum {
525 Opt_err = -1,
526 Opt_measure = 1, Opt_dont_measure,
527 Opt_appraise, Opt_dont_appraise,
528 Opt_audit, Opt_hash, Opt_dont_hash,
529 Opt_obj_user, Opt_obj_role, Opt_obj_type,
530 Opt_subj_user, Opt_subj_role, Opt_subj_type,
531 Opt_func, Opt_mask, Opt_fsmagic,
532 Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq,
533 Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt,
534 Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt,
535 Opt_appraise_type, Opt_permit_directio,
536 Opt_pcr
537};
538
539static match_table_t policy_tokens = {
540 {Opt_measure, "measure"},
541 {Opt_dont_measure, "dont_measure"},
542 {Opt_appraise, "appraise"},
543 {Opt_dont_appraise, "dont_appraise"},
544 {Opt_audit, "audit"},
545 {Opt_hash, "hash"},
546 {Opt_dont_hash, "dont_hash"},
547 {Opt_obj_user, "obj_user=%s"},
548 {Opt_obj_role, "obj_role=%s"},
549 {Opt_obj_type, "obj_type=%s"},
550 {Opt_subj_user, "subj_user=%s"},
551 {Opt_subj_role, "subj_role=%s"},
552 {Opt_subj_type, "subj_type=%s"},
553 {Opt_func, "func=%s"},
554 {Opt_mask, "mask=%s"},
555 {Opt_fsmagic, "fsmagic=%s"},
556 {Opt_fsuuid, "fsuuid=%s"},
557 {Opt_uid_eq, "uid=%s"},
558 {Opt_euid_eq, "euid=%s"},
559 {Opt_fowner_eq, "fowner=%s"},
560 {Opt_uid_gt, "uid>%s"},
561 {Opt_euid_gt, "euid>%s"},
562 {Opt_fowner_gt, "fowner>%s"},
563 {Opt_uid_lt, "uid<%s"},
564 {Opt_euid_lt, "euid<%s"},
565 {Opt_fowner_lt, "fowner<%s"},
566 {Opt_appraise_type, "appraise_type=%s"},
567 {Opt_permit_directio, "permit_directio"},
568 {Opt_pcr, "pcr=%s"},
569 {Opt_err, NULL}
570};
571
572static int ima_lsm_rule_init(struct ima_rule_entry *entry,
573 substring_t *args, int lsm_rule, int audit_type)
574{
575 int result;
576
577 if (entry->lsm[lsm_rule].rule)
578 return -EINVAL;
579
580 entry->lsm[lsm_rule].args_p = match_strdup(args);
581 if (!entry->lsm[lsm_rule].args_p)
582 return -ENOMEM;
583
584 entry->lsm[lsm_rule].type = audit_type;
585 result = security_filter_rule_init(entry->lsm[lsm_rule].type,
586 Audit_equal,
587 entry->lsm[lsm_rule].args_p,
588 &entry->lsm[lsm_rule].rule);
589 if (!entry->lsm[lsm_rule].rule) {
590 kfree(entry->lsm[lsm_rule].args_p);
591 return -EINVAL;
592 }
593
594 return result;
595}
596
597static void ima_log_string_op(struct audit_buffer *ab, char *key, char *value,
598 bool (*rule_operator)(kuid_t, kuid_t))
599{
600 if (rule_operator == &uid_gt)
601 audit_log_format(ab, "%s>", key);
602 else if (rule_operator == &uid_lt)
603 audit_log_format(ab, "%s<", key);
604 else
605 audit_log_format(ab, "%s=", key);
606 audit_log_untrustedstring(ab, value);
607 audit_log_format(ab, " ");
608}
609static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
610{
611 ima_log_string_op(ab, key, value, NULL);
612}
613
614static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
615{
616 struct audit_buffer *ab;
617 char *from;
618 char *p;
619 bool uid_token;
620 int result = 0;
621
622 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
623
624 entry->uid = INVALID_UID;
625 entry->fowner = INVALID_UID;
626 entry->uid_op = &uid_eq;
627 entry->fowner_op = &uid_eq;
628 entry->action = UNKNOWN;
629 while ((p = strsep(&rule, " \t")) != NULL) {
630 substring_t args[MAX_OPT_ARGS];
631 int token;
632 unsigned long lnum;
633
634 if (result < 0)
635 break;
636 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
637 continue;
638 token = match_token(p, policy_tokens, args);
639 switch (token) {
640 case Opt_measure:
641 ima_log_string(ab, "action", "measure");
642
643 if (entry->action != UNKNOWN)
644 result = -EINVAL;
645
646 entry->action = MEASURE;
647 break;
648 case Opt_dont_measure:
649 ima_log_string(ab, "action", "dont_measure");
650
651 if (entry->action != UNKNOWN)
652 result = -EINVAL;
653
654 entry->action = DONT_MEASURE;
655 break;
656 case Opt_appraise:
657 ima_log_string(ab, "action", "appraise");
658
659 if (entry->action != UNKNOWN)
660 result = -EINVAL;
661
662 entry->action = APPRAISE;
663 break;
664 case Opt_dont_appraise:
665 ima_log_string(ab, "action", "dont_appraise");
666
667 if (entry->action != UNKNOWN)
668 result = -EINVAL;
669
670 entry->action = DONT_APPRAISE;
671 break;
672 case Opt_audit:
673 ima_log_string(ab, "action", "audit");
674
675 if (entry->action != UNKNOWN)
676 result = -EINVAL;
677
678 entry->action = AUDIT;
679 break;
680 case Opt_hash:
681 ima_log_string(ab, "action", "hash");
682
683 if (entry->action != UNKNOWN)
684 result = -EINVAL;
685
686 entry->action = HASH;
687 break;
688 case Opt_dont_hash:
689 ima_log_string(ab, "action", "dont_hash");
690
691 if (entry->action != UNKNOWN)
692 result = -EINVAL;
693
694 entry->action = DONT_HASH;
695 break;
696 case Opt_func:
697 ima_log_string(ab, "func", args[0].from);
698
699 if (entry->func)
700 result = -EINVAL;
701
702 if (strcmp(args[0].from, "FILE_CHECK") == 0)
703 entry->func = FILE_CHECK;
704
705 else if (strcmp(args[0].from, "PATH_CHECK") == 0)
706 entry->func = FILE_CHECK;
707 else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
708 entry->func = MODULE_CHECK;
709 else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
710 entry->func = FIRMWARE_CHECK;
711 else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
712 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
713 entry->func = MMAP_CHECK;
714 else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
715 entry->func = BPRM_CHECK;
716 else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
717 0)
718 entry->func = KEXEC_KERNEL_CHECK;
719 else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
720 == 0)
721 entry->func = KEXEC_INITRAMFS_CHECK;
722 else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
723 entry->func = POLICY_CHECK;
724 else
725 result = -EINVAL;
726 if (!result)
727 entry->flags |= IMA_FUNC;
728 break;
729 case Opt_mask:
730 ima_log_string(ab, "mask", args[0].from);
731
732 if (entry->mask)
733 result = -EINVAL;
734
735 from = args[0].from;
736 if (*from == '^')
737 from++;
738
739 if ((strcmp(from, "MAY_EXEC")) == 0)
740 entry->mask = MAY_EXEC;
741 else if (strcmp(from, "MAY_WRITE") == 0)
742 entry->mask = MAY_WRITE;
743 else if (strcmp(from, "MAY_READ") == 0)
744 entry->mask = MAY_READ;
745 else if (strcmp(from, "MAY_APPEND") == 0)
746 entry->mask = MAY_APPEND;
747 else
748 result = -EINVAL;
749 if (!result)
750 entry->flags |= (*args[0].from == '^')
751 ? IMA_INMASK : IMA_MASK;
752 break;
753 case Opt_fsmagic:
754 ima_log_string(ab, "fsmagic", args[0].from);
755
756 if (entry->fsmagic) {
757 result = -EINVAL;
758 break;
759 }
760
761 result = kstrtoul(args[0].from, 16, &entry->fsmagic);
762 if (!result)
763 entry->flags |= IMA_FSMAGIC;
764 break;
765 case Opt_fsuuid:
766 ima_log_string(ab, "fsuuid", args[0].from);
767
768 if (!uuid_is_null(&entry->fsuuid)) {
769 result = -EINVAL;
770 break;
771 }
772
773 result = uuid_parse(args[0].from, &entry->fsuuid);
774 if (!result)
775 entry->flags |= IMA_FSUUID;
776 break;
777 case Opt_uid_gt:
778 case Opt_euid_gt:
779 entry->uid_op = &uid_gt;
780 case Opt_uid_lt:
781 case Opt_euid_lt:
782 if ((token == Opt_uid_lt) || (token == Opt_euid_lt))
783 entry->uid_op = &uid_lt;
784 case Opt_uid_eq:
785 case Opt_euid_eq:
786 uid_token = (token == Opt_uid_eq) ||
787 (token == Opt_uid_gt) ||
788 (token == Opt_uid_lt);
789
790 ima_log_string_op(ab, uid_token ? "uid" : "euid",
791 args[0].from, entry->uid_op);
792
793 if (uid_valid(entry->uid)) {
794 result = -EINVAL;
795 break;
796 }
797
798 result = kstrtoul(args[0].from, 10, &lnum);
799 if (!result) {
800 entry->uid = make_kuid(current_user_ns(),
801 (uid_t) lnum);
802 if (!uid_valid(entry->uid) ||
803 (uid_t)lnum != lnum)
804 result = -EINVAL;
805 else
806 entry->flags |= uid_token
807 ? IMA_UID : IMA_EUID;
808 }
809 break;
810 case Opt_fowner_gt:
811 entry->fowner_op = &uid_gt;
812 case Opt_fowner_lt:
813 if (token == Opt_fowner_lt)
814 entry->fowner_op = &uid_lt;
815 case Opt_fowner_eq:
816 ima_log_string_op(ab, "fowner", args[0].from,
817 entry->fowner_op);
818
819 if (uid_valid(entry->fowner)) {
820 result = -EINVAL;
821 break;
822 }
823
824 result = kstrtoul(args[0].from, 10, &lnum);
825 if (!result) {
826 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
827 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
828 result = -EINVAL;
829 else
830 entry->flags |= IMA_FOWNER;
831 }
832 break;
833 case Opt_obj_user:
834 ima_log_string(ab, "obj_user", args[0].from);
835 result = ima_lsm_rule_init(entry, args,
836 LSM_OBJ_USER,
837 AUDIT_OBJ_USER);
838 break;
839 case Opt_obj_role:
840 ima_log_string(ab, "obj_role", args[0].from);
841 result = ima_lsm_rule_init(entry, args,
842 LSM_OBJ_ROLE,
843 AUDIT_OBJ_ROLE);
844 break;
845 case Opt_obj_type:
846 ima_log_string(ab, "obj_type", args[0].from);
847 result = ima_lsm_rule_init(entry, args,
848 LSM_OBJ_TYPE,
849 AUDIT_OBJ_TYPE);
850 break;
851 case Opt_subj_user:
852 ima_log_string(ab, "subj_user", args[0].from);
853 result = ima_lsm_rule_init(entry, args,
854 LSM_SUBJ_USER,
855 AUDIT_SUBJ_USER);
856 break;
857 case Opt_subj_role:
858 ima_log_string(ab, "subj_role", args[0].from);
859 result = ima_lsm_rule_init(entry, args,
860 LSM_SUBJ_ROLE,
861 AUDIT_SUBJ_ROLE);
862 break;
863 case Opt_subj_type:
864 ima_log_string(ab, "subj_type", args[0].from);
865 result = ima_lsm_rule_init(entry, args,
866 LSM_SUBJ_TYPE,
867 AUDIT_SUBJ_TYPE);
868 break;
869 case Opt_appraise_type:
870 if (entry->action != APPRAISE) {
871 result = -EINVAL;
872 break;
873 }
874
875 ima_log_string(ab, "appraise_type", args[0].from);
876 if ((strcmp(args[0].from, "imasig")) == 0)
877 entry->flags |= IMA_DIGSIG_REQUIRED;
878 else
879 result = -EINVAL;
880 break;
881 case Opt_permit_directio:
882 entry->flags |= IMA_PERMIT_DIRECTIO;
883 break;
884 case Opt_pcr:
885 if (entry->action != MEASURE) {
886 result = -EINVAL;
887 break;
888 }
889 ima_log_string(ab, "pcr", args[0].from);
890
891 result = kstrtoint(args[0].from, 10, &entry->pcr);
892 if (result || INVALID_PCR(entry->pcr))
893 result = -EINVAL;
894 else
895 entry->flags |= IMA_PCR;
896
897 break;
898 case Opt_err:
899 ima_log_string(ab, "UNKNOWN", p);
900 result = -EINVAL;
901 break;
902 }
903 }
904 if (!result && (entry->action == UNKNOWN))
905 result = -EINVAL;
906 else if (entry->func == MODULE_CHECK)
907 temp_ima_appraise |= IMA_APPRAISE_MODULES;
908 else if (entry->func == FIRMWARE_CHECK)
909 temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
910 else if (entry->func == POLICY_CHECK)
911 temp_ima_appraise |= IMA_APPRAISE_POLICY;
912 audit_log_format(ab, "res=%d", !result);
913 audit_log_end(ab);
914 return result;
915}
916
917
918
919
920
921
922
923
924ssize_t ima_parse_add_rule(char *rule)
925{
926 static const char op[] = "update_policy";
927 char *p;
928 struct ima_rule_entry *entry;
929 ssize_t result, len;
930 int audit_info = 0;
931
932 p = strsep(&rule, "\n");
933 len = strlen(p) + 1;
934 p += strspn(p, " \t");
935
936 if (*p == '#' || *p == '\0')
937 return len;
938
939 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
940 if (!entry) {
941 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
942 NULL, op, "-ENOMEM", -ENOMEM, audit_info);
943 return -ENOMEM;
944 }
945
946 INIT_LIST_HEAD(&entry->list);
947
948 result = ima_parse_rule(p, entry);
949 if (result) {
950 kfree(entry);
951 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
952 NULL, op, "invalid-policy", result,
953 audit_info);
954 return result;
955 }
956
957 list_add_tail(&entry->list, &ima_temp_rules);
958
959 return len;
960}
961
962
963
964
965
966
967
968void ima_delete_rules(void)
969{
970 struct ima_rule_entry *entry, *tmp;
971 int i;
972
973 temp_ima_appraise = 0;
974 list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
975 for (i = 0; i < MAX_LSM_RULES; i++)
976 kfree(entry->lsm[i].args_p);
977
978 list_del(&entry->list);
979 kfree(entry);
980 }
981}
982
983#ifdef CONFIG_IMA_READ_POLICY
984enum {
985 mask_exec = 0, mask_write, mask_read, mask_append
986};
987
988static const char *const mask_tokens[] = {
989 "MAY_EXEC",
990 "MAY_WRITE",
991 "MAY_READ",
992 "MAY_APPEND"
993};
994
995#define __ima_hook_stringify(str) (#str),
996
997static const char *const func_tokens[] = {
998 __ima_hooks(__ima_hook_stringify)
999};
1000
1001void *ima_policy_start(struct seq_file *m, loff_t *pos)
1002{
1003 loff_t l = *pos;
1004 struct ima_rule_entry *entry;
1005
1006 rcu_read_lock();
1007 list_for_each_entry_rcu(entry, ima_rules, list) {
1008 if (!l--) {
1009 rcu_read_unlock();
1010 return entry;
1011 }
1012 }
1013 rcu_read_unlock();
1014 return NULL;
1015}
1016
1017void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
1018{
1019 struct ima_rule_entry *entry = v;
1020
1021 rcu_read_lock();
1022 entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
1023 rcu_read_unlock();
1024 (*pos)++;
1025
1026 return (&entry->list == ima_rules) ? NULL : entry;
1027}
1028
1029void ima_policy_stop(struct seq_file *m, void *v)
1030{
1031}
1032
1033#define pt(token) policy_tokens[token + Opt_err].pattern
1034#define mt(token) mask_tokens[token]
1035
1036
1037
1038
1039static void policy_func_show(struct seq_file *m, enum ima_hooks func)
1040{
1041 if (func > 0 && func < MAX_CHECK)
1042 seq_printf(m, "func=%s ", func_tokens[func]);
1043 else
1044 seq_printf(m, "func=%d ", func);
1045}
1046
1047int ima_policy_show(struct seq_file *m, void *v)
1048{
1049 struct ima_rule_entry *entry = v;
1050 int i;
1051 char tbuf[64] = {0,};
1052
1053 rcu_read_lock();
1054
1055 if (entry->action & MEASURE)
1056 seq_puts(m, pt(Opt_measure));
1057 if (entry->action & DONT_MEASURE)
1058 seq_puts(m, pt(Opt_dont_measure));
1059 if (entry->action & APPRAISE)
1060 seq_puts(m, pt(Opt_appraise));
1061 if (entry->action & DONT_APPRAISE)
1062 seq_puts(m, pt(Opt_dont_appraise));
1063 if (entry->action & AUDIT)
1064 seq_puts(m, pt(Opt_audit));
1065 if (entry->action & HASH)
1066 seq_puts(m, pt(Opt_hash));
1067 if (entry->action & DONT_HASH)
1068 seq_puts(m, pt(Opt_dont_hash));
1069
1070 seq_puts(m, " ");
1071
1072 if (entry->flags & IMA_FUNC)
1073 policy_func_show(m, entry->func);
1074
1075 if (entry->flags & IMA_MASK) {
1076 if (entry->mask & MAY_EXEC)
1077 seq_printf(m, pt(Opt_mask), mt(mask_exec));
1078 if (entry->mask & MAY_WRITE)
1079 seq_printf(m, pt(Opt_mask), mt(mask_write));
1080 if (entry->mask & MAY_READ)
1081 seq_printf(m, pt(Opt_mask), mt(mask_read));
1082 if (entry->mask & MAY_APPEND)
1083 seq_printf(m, pt(Opt_mask), mt(mask_append));
1084 seq_puts(m, " ");
1085 }
1086
1087 if (entry->flags & IMA_FSMAGIC) {
1088 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1089 seq_printf(m, pt(Opt_fsmagic), tbuf);
1090 seq_puts(m, " ");
1091 }
1092
1093 if (entry->flags & IMA_PCR) {
1094 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
1095 seq_printf(m, pt(Opt_pcr), tbuf);
1096 seq_puts(m, " ");
1097 }
1098
1099 if (entry->flags & IMA_FSUUID) {
1100 seq_printf(m, "fsuuid=%pU", &entry->fsuuid);
1101 seq_puts(m, " ");
1102 }
1103
1104 if (entry->flags & IMA_UID) {
1105 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1106 if (entry->uid_op == &uid_gt)
1107 seq_printf(m, pt(Opt_uid_gt), tbuf);
1108 else if (entry->uid_op == &uid_lt)
1109 seq_printf(m, pt(Opt_uid_lt), tbuf);
1110 else
1111 seq_printf(m, pt(Opt_uid_eq), tbuf);
1112 seq_puts(m, " ");
1113 }
1114
1115 if (entry->flags & IMA_EUID) {
1116 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1117 if (entry->uid_op == &uid_gt)
1118 seq_printf(m, pt(Opt_euid_gt), tbuf);
1119 else if (entry->uid_op == &uid_lt)
1120 seq_printf(m, pt(Opt_euid_lt), tbuf);
1121 else
1122 seq_printf(m, pt(Opt_euid_eq), tbuf);
1123 seq_puts(m, " ");
1124 }
1125
1126 if (entry->flags & IMA_FOWNER) {
1127 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1128 if (entry->fowner_op == &uid_gt)
1129 seq_printf(m, pt(Opt_fowner_gt), tbuf);
1130 else if (entry->fowner_op == &uid_lt)
1131 seq_printf(m, pt(Opt_fowner_lt), tbuf);
1132 else
1133 seq_printf(m, pt(Opt_fowner_eq), tbuf);
1134 seq_puts(m, " ");
1135 }
1136
1137 for (i = 0; i < MAX_LSM_RULES; i++) {
1138 if (entry->lsm[i].rule) {
1139 switch (i) {
1140 case LSM_OBJ_USER:
1141 seq_printf(m, pt(Opt_obj_user),
1142 (char *)entry->lsm[i].args_p);
1143 break;
1144 case LSM_OBJ_ROLE:
1145 seq_printf(m, pt(Opt_obj_role),
1146 (char *)entry->lsm[i].args_p);
1147 break;
1148 case LSM_OBJ_TYPE:
1149 seq_printf(m, pt(Opt_obj_type),
1150 (char *)entry->lsm[i].args_p);
1151 break;
1152 case LSM_SUBJ_USER:
1153 seq_printf(m, pt(Opt_subj_user),
1154 (char *)entry->lsm[i].args_p);
1155 break;
1156 case LSM_SUBJ_ROLE:
1157 seq_printf(m, pt(Opt_subj_role),
1158 (char *)entry->lsm[i].args_p);
1159 break;
1160 case LSM_SUBJ_TYPE:
1161 seq_printf(m, pt(Opt_subj_type),
1162 (char *)entry->lsm[i].args_p);
1163 break;
1164 }
1165 }
1166 }
1167 if (entry->flags & IMA_DIGSIG_REQUIRED)
1168 seq_puts(m, "appraise_type=imasig ");
1169 if (entry->flags & IMA_PERMIT_DIRECTIO)
1170 seq_puts(m, "permit_directio ");
1171 rcu_read_unlock();
1172 seq_puts(m, "\n");
1173 return 0;
1174}
1175#endif
1176
