1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19#include <linux/module.h>
20#include <linux/file.h>
21#include <linux/binfmts.h>
22#include <linux/mount.h>
23#include <linux/mman.h>
24#include <linux/slab.h>
25#include <linux/xattr.h>
26#include <linux/ima.h>
27
28#include "ima.h"
29
30int ima_initialized;
31
32#ifdef CONFIG_IMA_APPRAISE
33int ima_appraise = IMA_APPRAISE_ENFORCE;
34#else
35int ima_appraise;
36#endif
37
38int ima_hash_algo = HASH_ALGO_SHA1;
39static int hash_setup_done;
40
41static int __init hash_setup(char *str)
42{
43 struct ima_template_desc *template_desc = ima_template_desc_current();
44 int i;
45
46 if (hash_setup_done)
47 return 1;
48
49 if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) {
50 if (strncmp(str, "sha1", 4) == 0)
51 ima_hash_algo = HASH_ALGO_SHA1;
52 else if (strncmp(str, "md5", 3) == 0)
53 ima_hash_algo = HASH_ALGO_MD5;
54 goto out;
55 }
56
57 for (i = 0; i < HASH_ALGO__LAST; i++) {
58 if (strcmp(str, hash_algo_name[i]) == 0) {
59 ima_hash_algo = i;
60 break;
61 }
62 }
63out:
64 hash_setup_done = 1;
65 return 1;
66}
67__setup("ima_hash=", hash_setup);
68
69
70
71
72
73
74
75
76
77
78
79static void ima_rdwr_violation_check(struct file *file,
80 struct integrity_iint_cache *iint,
81 int must_measure,
82 char **pathbuf,
83 const char **pathname)
84{
85 struct inode *inode = file_inode(file);
86 fmode_t mode = file->f_mode;
87 bool send_tomtou = false, send_writers = false;
88
89 if (mode & FMODE_WRITE) {
90 if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) {
91 if (!iint)
92 iint = integrity_iint_find(inode);
93
94 if (iint && (iint->flags & IMA_MEASURE))
95 send_tomtou = true;
96 }
97 } else {
98 if ((atomic_read(&inode->i_writecount) > 0) && must_measure)
99 send_writers = true;
100 }
101
102 if (!send_tomtou && !send_writers)
103 return;
104
105 *pathname = ima_d_path(&file->f_path, pathbuf);
106
107 if (send_tomtou)
108 ima_add_violation(file, *pathname, iint,
109 "invalid_pcr", "ToMToU");
110 if (send_writers)
111 ima_add_violation(file, *pathname, iint,
112 "invalid_pcr", "open_writers");
113}
114
115static void ima_check_last_writer(struct integrity_iint_cache *iint,
116 struct inode *inode, struct file *file)
117{
118 fmode_t mode = file->f_mode;
119
120 if (!(mode & FMODE_WRITE))
121 return;
122
123 inode_lock(inode);
124 if (atomic_read(&inode->i_writecount) == 1) {
125 if ((iint->version != inode->i_version) ||
126 (iint->flags & IMA_NEW_FILE)) {
127 iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
128 if (iint->flags & IMA_APPRAISE)
129 ima_update_xattr(iint, file);
130 }
131 }
132 inode_unlock(inode);
133}
134
135
136
137
138
139
140
141void ima_file_free(struct file *file)
142{
143 struct inode *inode = file_inode(file);
144 struct integrity_iint_cache *iint;
145
146 if (!ima_policy_flag || !S_ISREG(inode->i_mode))
147 return;
148
149 iint = integrity_iint_find(inode);
150 if (!iint)
151 return;
152
153 ima_check_last_writer(iint, inode, file);
154}
155
156static int process_measurement(struct file *file, char *buf, loff_t size,
157 int mask, enum ima_hooks func, int opened)
158{
159 struct inode *inode = file_inode(file);
160 struct integrity_iint_cache *iint = NULL;
161 struct ima_template_desc *template_desc;
162 char *pathbuf = NULL;
163 const char *pathname = NULL;
164 int rc = -ENOMEM, action, must_appraise;
165 struct evm_ima_xattr_data *xattr_value = NULL;
166 int xattr_len = 0;
167 bool violation_check;
168 enum hash_algo hash_algo;
169
170 if (!ima_policy_flag || !S_ISREG(inode->i_mode))
171 return 0;
172
173
174
175
176
177 action = ima_get_action(inode, mask, func);
178 violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) &&
179 (ima_policy_flag & IMA_MEASURE));
180 if (!action && !violation_check)
181 return 0;
182
183 must_appraise = action & IMA_APPRAISE;
184
185
186 if (action & IMA_FILE_APPRAISE)
187 func = FILE_CHECK;
188
189 inode_lock(inode);
190
191 if (action) {
192 iint = integrity_inode_get(inode);
193 if (!iint)
194 goto out;
195 }
196
197 if (violation_check) {
198 ima_rdwr_violation_check(file, iint, action & IMA_MEASURE,
199 &pathbuf, &pathname);
200 if (!action) {
201 rc = 0;
202 goto out_free;
203 }
204 }
205
206
207
208
209
210 iint->flags |= action;
211 action &= IMA_DO_MASK;
212 action &= ~((iint->flags & IMA_DONE_MASK) >> 1);
213
214
215 if (!action) {
216 if (must_appraise)
217 rc = ima_get_cache_status(iint, func);
218 goto out_digsig;
219 }
220
221 template_desc = ima_template_desc_current();
222 if ((action & IMA_APPRAISE_SUBMASK) ||
223 strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) != 0)
224
225 xattr_len = ima_read_xattr(file->f_path.dentry, &xattr_value);
226
227 hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
228
229 rc = ima_collect_measurement(iint, file, buf, size, hash_algo);
230 if (rc != 0) {
231 if (file->f_flags & O_DIRECT)
232 rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES;
233 goto out_digsig;
234 }
235
236 if (!pathname)
237 pathname = ima_d_path(&file->f_path, &pathbuf);
238
239 if (action & IMA_MEASURE)
240 ima_store_measurement(iint, file, pathname,
241 xattr_value, xattr_len);
242 if (action & IMA_APPRAISE_SUBMASK)
243 rc = ima_appraise_measurement(func, iint, file, pathname,
244 xattr_value, xattr_len, opened);
245 if (action & IMA_AUDIT)
246 ima_audit_measurement(iint, pathname);
247
248out_digsig:
249 if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG))
250 rc = -EACCES;
251 kfree(xattr_value);
252out_free:
253 if (pathbuf)
254 __putname(pathbuf);
255out:
256 inode_unlock(inode);
257 if ((rc && must_appraise) && (ima_appraise & IMA_APPRAISE_ENFORCE))
258 return -EACCES;
259 return 0;
260}
261
262
263
264
265
266
267
268
269
270
271
272
273int ima_file_mmap(struct file *file, unsigned long prot)
274{
275 if (file && (prot & PROT_EXEC))
276 return process_measurement(file, NULL, 0, MAY_EXEC,
277 MMAP_CHECK, 0);
278 return 0;
279}
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294int ima_bprm_check(struct linux_binprm *bprm)
295{
296 return process_measurement(bprm->file, NULL, 0, MAY_EXEC,
297 BPRM_CHECK, 0);
298}
299
300
301
302
303
304
305
306
307
308
309
310int ima_file_check(struct file *file, int mask, int opened)
311{
312 return process_measurement(file, NULL, 0,
313 mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
314 FILE_CHECK, opened);
315}
316EXPORT_SYMBOL_GPL(ima_file_check);
317
318
319
320
321
322
323
324
325
326
327
328
329int ima_read_file(struct file *file, enum kernel_read_file_id read_id)
330{
331 if (!file && read_id == READING_MODULE) {
332#ifndef CONFIG_MODULE_SIG_FORCE
333 if ((ima_appraise & IMA_APPRAISE_MODULES) &&
334 (ima_appraise & IMA_APPRAISE_ENFORCE))
335 return -EACCES;
336#endif
337 return 0;
338 }
339 return 0;
340}
341
342static int read_idmap[READING_MAX_ID] = {
343 [READING_FIRMWARE] = FIRMWARE_CHECK,
344 [READING_MODULE] = MODULE_CHECK,
345 [READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,
346 [READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,
347 [READING_POLICY] = POLICY_CHECK
348};
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363int ima_post_read_file(struct file *file, void *buf, loff_t size,
364 enum kernel_read_file_id read_id)
365{
366 enum ima_hooks func;
367
368 if (!file && read_id == READING_FIRMWARE) {
369 if ((ima_appraise & IMA_APPRAISE_FIRMWARE) &&
370 (ima_appraise & IMA_APPRAISE_ENFORCE))
371 return -EACCES;
372 return 0;
373 }
374
375 if (!file && read_id == READING_MODULE)
376 return 0;
377
378 if (!file || !buf || size == 0) {
379 if (ima_appraise & IMA_APPRAISE_ENFORCE)
380 return -EACCES;
381 return 0;
382 }
383
384 func = read_idmap[read_id] ?: FILE_CHECK;
385 return process_measurement(file, buf, size, MAY_READ, func, 0);
386}
387
388static int __init init_ima(void)
389{
390 int error;
391
392 hash_setup(CONFIG_IMA_DEFAULT_HASH);
393 error = ima_init();
394 if (!error) {
395 ima_initialized = 1;
396 ima_update_policy_flag();
397 }
398 return error;
399}
400
401late_initcall(init_ima);
402
403MODULE_DESCRIPTION("Integrity Measurement Architecture");
404MODULE_LICENSE("GPL");
405