1
2
3
4
5
6
7
8
9
10
11
12
13#ifndef __LINUX_IMA_H
14#define __LINUX_IMA_H
15
16#include <linux/types.h>
17#include <linux/crypto.h>
18#include <linux/fs.h>
19#include <linux/security.h>
20#include <linux/hash.h>
21#include <linux/tpm.h>
22#include <linux/audit.h>
23#include <crypto/hash_info.h>
24
25#include "../integrity.h"
26
27#ifdef CONFIG_HAVE_IMA_KEXEC
28#include <asm/ima.h>
29#endif
30
31enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
32 IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
33enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
34
35
36#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
37#define IMA_EVENT_NAME_LEN_MAX 255
38
39#define IMA_HASH_BITS 9
40#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
41
42#define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16
43#define IMA_TEMPLATE_NUM_FIELDS_MAX 15
44
45#define IMA_TEMPLATE_IMA_NAME "ima"
46#define IMA_TEMPLATE_IMA_FMT "d|n"
47
48
49extern int ima_policy_flag;
50
51
52extern int ima_hash_algo;
53extern int ima_appraise;
54extern struct tpm_chip *ima_tpm_chip;
55
56
57struct ima_event_data {
58 struct integrity_iint_cache *iint;
59 struct file *file;
60 const unsigned char *filename;
61 struct evm_ima_xattr_data *xattr_value;
62 int xattr_len;
63 const char *violation;
64 const void *buf;
65 int buf_len;
66};
67
68
69struct ima_field_data {
70 u8 *data;
71 u32 len;
72};
73
74
75struct ima_template_field {
76 const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
77 int (*field_init)(struct ima_event_data *event_data,
78 struct ima_field_data *field_data);
79 void (*field_show)(struct seq_file *m, enum ima_show_type show,
80 struct ima_field_data *field_data);
81};
82
83
84struct ima_template_desc {
85 struct list_head list;
86 char *name;
87 char *fmt;
88 int num_fields;
89 const struct ima_template_field **fields;
90};
91
92struct ima_template_entry {
93 int pcr;
94 u8 digest[TPM_DIGEST_SIZE];
95 struct ima_template_desc *template_desc;
96 u32 template_data_len;
97 struct ima_field_data template_data[0];
98};
99
100struct ima_queue_entry {
101 struct hlist_node hnext;
102 struct list_head later;
103 struct ima_template_entry *entry;
104};
105extern struct list_head ima_measurements;
106
107
108struct ima_kexec_hdr {
109 u16 version;
110 u16 _reserved0;
111 u32 _reserved1;
112 u64 buffer_size;
113 u64 count;
114};
115
116#ifdef CONFIG_HAVE_IMA_KEXEC
117void ima_load_kexec_buffer(void);
118#else
119static inline void ima_load_kexec_buffer(void) {}
120#endif
121
122
123
124
125
126extern bool ima_canonical_fmt;
127
128
129int ima_init(void);
130int ima_fs_init(void);
131int ima_add_template_entry(struct ima_template_entry *entry, int violation,
132 const char *op, struct inode *inode,
133 const unsigned char *filename);
134int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
135int ima_calc_buffer_hash(const void *buf, loff_t len,
136 struct ima_digest_data *hash);
137int ima_calc_field_array_hash(struct ima_field_data *field_data,
138 struct ima_template_desc *desc, int num_fields,
139 struct ima_digest_data *hash);
140int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
141void ima_add_violation(struct file *file, const unsigned char *filename,
142 struct integrity_iint_cache *iint,
143 const char *op, const char *cause);
144int ima_init_crypto(void);
145void ima_putc(struct seq_file *m, void *data, int datalen);
146void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
147int template_desc_init_fields(const char *template_fmt,
148 const struct ima_template_field ***fields,
149 int *num_fields);
150struct ima_template_desc *ima_template_desc_current(void);
151struct ima_template_desc *lookup_template_desc(const char *name);
152int ima_restore_measurement_entry(struct ima_template_entry *entry);
153int ima_restore_measurement_list(loff_t bufsize, void *buf);
154int ima_measurements_show(struct seq_file *m, void *v);
155unsigned long ima_get_binary_runtime_size(void);
156int ima_init_template(void);
157void ima_init_template_list(void);
158int __init ima_init_digests(void);
159int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
160 void *lsm_data);
161
162
163
164
165extern spinlock_t ima_queue_lock;
166
167struct ima_h_table {
168 atomic_long_t len;
169 atomic_long_t violations;
170 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
171};
172extern struct ima_h_table ima_htable;
173
174static inline unsigned long ima_hash_key(u8 *digest)
175{
176 return hash_long(*digest, IMA_HASH_BITS);
177}
178
179#define __ima_hooks(hook) \
180 hook(NONE) \
181 hook(FILE_CHECK) \
182 hook(MMAP_CHECK) \
183 hook(BPRM_CHECK) \
184 hook(CREDS_CHECK) \
185 hook(POST_SETATTR) \
186 hook(MODULE_CHECK) \
187 hook(FIRMWARE_CHECK) \
188 hook(KEXEC_KERNEL_CHECK) \
189 hook(KEXEC_INITRAMFS_CHECK) \
190 hook(POLICY_CHECK) \
191 hook(KEXEC_CMDLINE) \
192 hook(MAX_CHECK)
193#define __ima_hook_enumify(ENUM) ENUM,
194
195enum ima_hooks {
196 __ima_hooks(__ima_hook_enumify)
197};
198
199
200int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
201 int mask, enum ima_hooks func, int *pcr,
202 struct ima_template_desc **template_desc);
203int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
204int ima_collect_measurement(struct integrity_iint_cache *iint,
205 struct file *file, void *buf, loff_t size,
206 enum hash_algo algo);
207void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
208 const unsigned char *filename,
209 struct evm_ima_xattr_data *xattr_value,
210 int xattr_len, int pcr,
211 struct ima_template_desc *template_desc);
212void ima_audit_measurement(struct integrity_iint_cache *iint,
213 const unsigned char *filename);
214int ima_alloc_init_template(struct ima_event_data *event_data,
215 struct ima_template_entry **entry,
216 struct ima_template_desc *template_desc);
217int ima_store_template(struct ima_template_entry *entry, int violation,
218 struct inode *inode,
219 const unsigned char *filename, int pcr);
220void ima_free_template_entry(struct ima_template_entry *entry);
221const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
222
223
224int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
225 enum ima_hooks func, int mask, int flags, int *pcr,
226 struct ima_template_desc **template_desc);
227void ima_init_policy(void);
228void ima_update_policy(void);
229void ima_update_policy_flag(void);
230ssize_t ima_parse_add_rule(char *);
231void ima_delete_rules(void);
232int ima_check_policy(void);
233void *ima_policy_start(struct seq_file *m, loff_t *pos);
234void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos);
235void ima_policy_stop(struct seq_file *m, void *v);
236int ima_policy_show(struct seq_file *m, void *v);
237
238
239#define IMA_APPRAISE_ENFORCE 0x01
240#define IMA_APPRAISE_FIX 0x02
241#define IMA_APPRAISE_LOG 0x04
242#define IMA_APPRAISE_MODULES 0x08
243#define IMA_APPRAISE_FIRMWARE 0x10
244#define IMA_APPRAISE_POLICY 0x20
245#define IMA_APPRAISE_KEXEC 0x40
246
247#ifdef CONFIG_IMA_APPRAISE
248int ima_appraise_measurement(enum ima_hooks func,
249 struct integrity_iint_cache *iint,
250 struct file *file, const unsigned char *filename,
251 struct evm_ima_xattr_data *xattr_value,
252 int xattr_len);
253int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
254void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
255enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
256 enum ima_hooks func);
257enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
258 int xattr_len);
259int ima_read_xattr(struct dentry *dentry,
260 struct evm_ima_xattr_data **xattr_value);
261
262#else
263static inline int ima_appraise_measurement(enum ima_hooks func,
264 struct integrity_iint_cache *iint,
265 struct file *file,
266 const unsigned char *filename,
267 struct evm_ima_xattr_data *xattr_value,
268 int xattr_len)
269{
270 return INTEGRITY_UNKNOWN;
271}
272
273static inline int ima_must_appraise(struct inode *inode, int mask,
274 enum ima_hooks func)
275{
276 return 0;
277}
278
279static inline void ima_update_xattr(struct integrity_iint_cache *iint,
280 struct file *file)
281{
282}
283
284static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache
285 *iint,
286 enum ima_hooks func)
287{
288 return INTEGRITY_UNKNOWN;
289}
290
291static inline enum hash_algo
292ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len)
293{
294 return ima_hash_algo;
295}
296
297static inline int ima_read_xattr(struct dentry *dentry,
298 struct evm_ima_xattr_data **xattr_value)
299{
300 return 0;
301}
302
303#endif
304
305
306#ifdef CONFIG_IMA_LSM_RULES
307
308#define security_filter_rule_init security_audit_rule_init
309#define security_filter_rule_match security_audit_rule_match
310
311#else
312
313static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,
314 void **lsmrule)
315{
316 return -EINVAL;
317}
318
319static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,
320 void *lsmrule)
321{
322 return -EINVAL;
323}
324#endif
325
326#ifdef CONFIG_IMA_READ_POLICY
327#define POLICY_FILE_FLAGS (S_IWUSR | S_IRUSR)
328#else
329#define POLICY_FILE_FLAGS S_IWUSR
330#endif
331
332#endif
333