1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#ifndef __LINUX_IMA_H
18#define __LINUX_IMA_H
19
20#include <linux/types.h>
21#include <linux/crypto.h>
22#include <linux/fs.h>
23#include <linux/security.h>
24#include <linux/hash.h>
25#include <linux/tpm.h>
26#include <linux/audit.h>
27#include <crypto/hash_info.h>
28
29#include "../integrity.h"
30
31enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
32 IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
33enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
34
35
36#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
37#define IMA_EVENT_NAME_LEN_MAX 255
38
39#define IMA_HASH_BITS 9
40#define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
41
42#define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16
43#define IMA_TEMPLATE_NUM_FIELDS_MAX 15
44
45#define IMA_TEMPLATE_IMA_NAME "ima"
46#define IMA_TEMPLATE_IMA_FMT "d|n"
47
48
49extern int ima_policy_flag;
50
51
52extern int ima_initialized;
53extern int ima_used_chip;
54extern int ima_hash_algo;
55extern int ima_appraise;
56
57
58struct ima_event_data {
59 struct integrity_iint_cache *iint;
60 struct file *file;
61 const unsigned char *filename;
62 struct evm_ima_xattr_data *xattr_value;
63 int xattr_len;
64 const char *violation;
65};
66
67
68struct ima_field_data {
69 u8 *data;
70 u32 len;
71};
72
73
74struct ima_template_field {
75 const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
76 int (*field_init)(struct ima_event_data *event_data,
77 struct ima_field_data *field_data);
78 void (*field_show)(struct seq_file *m, enum ima_show_type show,
79 struct ima_field_data *field_data);
80};
81
82
83struct ima_template_desc {
84 char *name;
85 char *fmt;
86 int num_fields;
87 struct ima_template_field **fields;
88};
89
90struct ima_template_entry {
91 u8 digest[TPM_DIGEST_SIZE];
92 struct ima_template_desc *template_desc;
93 u32 template_data_len;
94 struct ima_field_data template_data[0];
95};
96
97struct ima_queue_entry {
98 struct hlist_node hnext;
99 struct list_head later;
100 struct ima_template_entry *entry;
101};
102extern struct list_head ima_measurements;
103
104
105int ima_init(void);
106int ima_fs_init(void);
107int ima_add_template_entry(struct ima_template_entry *entry, int violation,
108 const char *op, struct inode *inode,
109 const unsigned char *filename);
110int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
111int ima_calc_buffer_hash(const void *buf, loff_t len,
112 struct ima_digest_data *hash);
113int ima_calc_field_array_hash(struct ima_field_data *field_data,
114 struct ima_template_desc *desc, int num_fields,
115 struct ima_digest_data *hash);
116int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
117void ima_add_violation(struct file *file, const unsigned char *filename,
118 struct integrity_iint_cache *iint,
119 const char *op, const char *cause);
120int ima_init_crypto(void);
121void ima_putc(struct seq_file *m, void *data, int datalen);
122void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
123struct ima_template_desc *ima_template_desc_current(void);
124int ima_init_template(void);
125
126
127
128
129extern spinlock_t ima_queue_lock;
130
131struct ima_h_table {
132 atomic_long_t len;
133 atomic_long_t violations;
134 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
135};
136extern struct ima_h_table ima_htable;
137
138static inline unsigned long ima_hash_key(u8 *digest)
139{
140 return hash_long(*digest, IMA_HASH_BITS);
141}
142
143enum ima_hooks {
144 FILE_CHECK = 1,
145 MMAP_CHECK,
146 BPRM_CHECK,
147 POST_SETATTR,
148 MODULE_CHECK,
149 FIRMWARE_CHECK,
150 KEXEC_KERNEL_CHECK,
151 KEXEC_INITRAMFS_CHECK,
152 POLICY_CHECK,
153 MAX_CHECK
154};
155
156
157int ima_get_action(struct inode *inode, int mask, enum ima_hooks func);
158int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
159int ima_collect_measurement(struct integrity_iint_cache *iint,
160 struct file *file, void *buf, loff_t size,
161 enum hash_algo algo);
162void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
163 const unsigned char *filename,
164 struct evm_ima_xattr_data *xattr_value,
165 int xattr_len);
166void ima_audit_measurement(struct integrity_iint_cache *iint,
167 const unsigned char *filename);
168int ima_alloc_init_template(struct ima_event_data *event_data,
169 struct ima_template_entry **entry);
170int ima_store_template(struct ima_template_entry *entry, int violation,
171 struct inode *inode, const unsigned char *filename);
172void ima_free_template_entry(struct ima_template_entry *entry);
173const char *ima_d_path(struct path *path, char **pathbuf);
174
175
176int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
177 int flags);
178void ima_init_policy(void);
179void ima_update_policy(void);
180void ima_update_policy_flag(void);
181ssize_t ima_parse_add_rule(char *);
182void ima_delete_rules(void);
183int ima_check_policy(void);
184void *ima_policy_start(struct seq_file *m, loff_t *pos);
185void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos);
186void ima_policy_stop(struct seq_file *m, void *v);
187int ima_policy_show(struct seq_file *m, void *v);
188
189
190#define IMA_APPRAISE_ENFORCE 0x01
191#define IMA_APPRAISE_FIX 0x02
192#define IMA_APPRAISE_LOG 0x04
193#define IMA_APPRAISE_MODULES 0x08
194#define IMA_APPRAISE_FIRMWARE 0x10
195#define IMA_APPRAISE_POLICY 0x20
196
197#ifdef CONFIG_IMA_APPRAISE
198int ima_appraise_measurement(enum ima_hooks func,
199 struct integrity_iint_cache *iint,
200 struct file *file, const unsigned char *filename,
201 struct evm_ima_xattr_data *xattr_value,
202 int xattr_len, int opened);
203int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
204void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
205enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
206 enum ima_hooks func);
207enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
208 int xattr_len);
209int ima_read_xattr(struct dentry *dentry,
210 struct evm_ima_xattr_data **xattr_value);
211
212#else
213static inline int ima_appraise_measurement(enum ima_hooks func,
214 struct integrity_iint_cache *iint,
215 struct file *file,
216 const unsigned char *filename,
217 struct evm_ima_xattr_data *xattr_value,
218 int xattr_len, int opened)
219{
220 return INTEGRITY_UNKNOWN;
221}
222
223static inline int ima_must_appraise(struct inode *inode, int mask,
224 enum ima_hooks func)
225{
226 return 0;
227}
228
229static inline void ima_update_xattr(struct integrity_iint_cache *iint,
230 struct file *file)
231{
232}
233
234static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache
235 *iint,
236 enum ima_hooks func)
237{
238 return INTEGRITY_UNKNOWN;
239}
240
241static inline enum hash_algo
242ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len)
243{
244 return ima_hash_algo;
245}
246
247static inline int ima_read_xattr(struct dentry *dentry,
248 struct evm_ima_xattr_data **xattr_value)
249{
250 return 0;
251}
252
253#endif
254
255
256#ifdef CONFIG_IMA_LSM_RULES
257
258#define security_filter_rule_init security_audit_rule_init
259#define security_filter_rule_match security_audit_rule_match
260
261#else
262
263static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,
264 void **lsmrule)
265{
266 return -EINVAL;
267}
268
269static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,
270 void *lsmrule,
271 struct audit_context *actx)
272{
273 return -EINVAL;
274}
275#endif
276
277#ifdef CONFIG_IMA_READ_POLICY
278#define POLICY_FILE_FLAGS (S_IWUSR | S_IRUSR)
279#else
280#define POLICY_FILE_FLAGS S_IWUSR
281#endif
282
283#endif
284