1
2
3
4
5
6
7
8
9
10
11#include <linux/module.h>
12#include <linux/file.h>
13#include <linux/fs.h>
14#include <linux/xattr.h>
15#include <linux/magic.h>
16#include <linux/ima.h>
17#include <linux/evm.h>
18
19#include "ima.h"
20
21static int __init default_appraise_setup(char *str)
22{
23#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
24 if (strncmp(str, "off", 3) == 0)
25 ima_appraise = 0;
26 else if (strncmp(str, "log", 3) == 0)
27 ima_appraise = IMA_APPRAISE_LOG;
28 else if (strncmp(str, "fix", 3) == 0)
29 ima_appraise = IMA_APPRAISE_FIX;
30#endif
31 return 1;
32}
33
34__setup("ima_appraise=", default_appraise_setup);
35
36
37
38
39
40
41bool is_ima_appraise_enabled(void)
42{
43 return (ima_appraise & IMA_APPRAISE_ENFORCE) ? 1 : 0;
44}
45
46
47
48
49
50
51int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
52{
53 if (!ima_appraise)
54 return 0;
55
56 return ima_match_policy(inode, func, mask, IMA_APPRAISE, NULL);
57}
58
59static int ima_fix_xattr(struct dentry *dentry,
60 struct integrity_iint_cache *iint)
61{
62 int rc, offset;
63 u8 algo = iint->ima_hash->algo;
64
65 if (algo <= HASH_ALGO_SHA1) {
66 offset = 1;
67 iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;
68 } else {
69 offset = 0;
70 iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG;
71 iint->ima_hash->xattr.ng.algo = algo;
72 }
73 rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA,
74 &iint->ima_hash->xattr.data[offset],
75 (sizeof(iint->ima_hash->xattr) - offset) +
76 iint->ima_hash->length, 0);
77 return rc;
78}
79
80
81enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
82 enum ima_hooks func)
83{
84 switch (func) {
85 case MMAP_CHECK:
86 return iint->ima_mmap_status;
87 case BPRM_CHECK:
88 return iint->ima_bprm_status;
89 case FILE_CHECK:
90 case POST_SETATTR:
91 return iint->ima_file_status;
92 case MODULE_CHECK ... MAX_CHECK - 1:
93 default:
94 return iint->ima_read_status;
95 }
96}
97
98static void ima_set_cache_status(struct integrity_iint_cache *iint,
99 enum ima_hooks func,
100 enum integrity_status status)
101{
102 switch (func) {
103 case MMAP_CHECK:
104 iint->ima_mmap_status = status;
105 break;
106 case BPRM_CHECK:
107 iint->ima_bprm_status = status;
108 break;
109 case FILE_CHECK:
110 case POST_SETATTR:
111 iint->ima_file_status = status;
112 break;
113 case MODULE_CHECK ... MAX_CHECK - 1:
114 default:
115 iint->ima_read_status = status;
116 break;
117 }
118}
119
120static void ima_cache_flags(struct integrity_iint_cache *iint,
121 enum ima_hooks func)
122{
123 switch (func) {
124 case MMAP_CHECK:
125 iint->flags |= (IMA_MMAP_APPRAISED | IMA_APPRAISED);
126 break;
127 case BPRM_CHECK:
128 iint->flags |= (IMA_BPRM_APPRAISED | IMA_APPRAISED);
129 break;
130 case FILE_CHECK:
131 case POST_SETATTR:
132 iint->flags |= (IMA_FILE_APPRAISED | IMA_APPRAISED);
133 break;
134 case MODULE_CHECK ... MAX_CHECK - 1:
135 default:
136 iint->flags |= (IMA_READ_APPRAISED | IMA_APPRAISED);
137 break;
138 }
139}
140
141enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
142 int xattr_len)
143{
144 struct signature_v2_hdr *sig;
145 enum hash_algo ret;
146
147 if (!xattr_value || xattr_len < 2)
148
149 return ima_hash_algo;
150
151 switch (xattr_value->type) {
152 case EVM_IMA_XATTR_DIGSIG:
153 sig = (typeof(sig))xattr_value;
154 if (sig->version != 2 || xattr_len <= sizeof(*sig))
155 return ima_hash_algo;
156 return sig->hash_algo;
157 break;
158 case IMA_XATTR_DIGEST_NG:
159 ret = xattr_value->digest[0];
160 if (ret < HASH_ALGO__LAST)
161 return ret;
162 break;
163 case IMA_XATTR_DIGEST:
164
165 if (xattr_len == 21) {
166 unsigned int zero = 0;
167 if (!memcmp(&xattr_value->digest[16], &zero, 4))
168 return HASH_ALGO_MD5;
169 else
170 return HASH_ALGO_SHA1;
171 } else if (xattr_len == 17)
172 return HASH_ALGO_MD5;
173 break;
174 }
175
176
177 return ima_hash_algo;
178}
179
180int ima_read_xattr(struct dentry *dentry,
181 struct evm_ima_xattr_data **xattr_value)
182{
183 ssize_t ret;
184
185 ret = vfs_getxattr_alloc(dentry, XATTR_NAME_IMA, (char **)xattr_value,
186 0, GFP_NOFS);
187 if (ret == -EOPNOTSUPP)
188 ret = 0;
189 return ret;
190}
191
192
193
194
195
196
197
198
199
200int ima_appraise_measurement(enum ima_hooks func,
201 struct integrity_iint_cache *iint,
202 struct file *file, const unsigned char *filename,
203 struct evm_ima_xattr_data *xattr_value,
204 int xattr_len, int opened)
205{
206 static const char op[] = "appraise_data";
207 char *cause = "unknown";
208 struct dentry *dentry = file_dentry(file);
209 struct inode *inode = d_backing_inode(dentry);
210 enum integrity_status status = INTEGRITY_UNKNOWN;
211 int rc = xattr_len, hash_start = 0;
212
213 if (!(inode->i_opflags & IOP_XATTR))
214 return INTEGRITY_UNKNOWN;
215
216 if (rc <= 0) {
217 if (rc && rc != -ENODATA)
218 goto out;
219
220 cause = iint->flags & IMA_DIGSIG_REQUIRED ?
221 "IMA-signature-required" : "missing-hash";
222 status = INTEGRITY_NOLABEL;
223 if (opened & FILE_CREATED)
224 iint->flags |= IMA_NEW_FILE;
225 if ((iint->flags & IMA_NEW_FILE) &&
226 !(iint->flags & IMA_DIGSIG_REQUIRED))
227 status = INTEGRITY_PASS;
228 goto out;
229 }
230
231 status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);
232 if ((status != INTEGRITY_PASS) && (status != INTEGRITY_UNKNOWN)) {
233 if ((status == INTEGRITY_NOLABEL)
234 || (status == INTEGRITY_NOXATTRS))
235 cause = "missing-HMAC";
236 else if (status == INTEGRITY_FAIL)
237 cause = "invalid-HMAC";
238 goto out;
239 }
240 switch (xattr_value->type) {
241 case IMA_XATTR_DIGEST_NG:
242
243 hash_start = 1;
244
245 case IMA_XATTR_DIGEST:
246 if (iint->flags & IMA_DIGSIG_REQUIRED) {
247 cause = "IMA-signature-required";
248 status = INTEGRITY_FAIL;
249 break;
250 }
251 if (xattr_len - sizeof(xattr_value->type) - hash_start >=
252 iint->ima_hash->length)
253
254
255
256 rc = memcmp(&xattr_value->digest[hash_start],
257 iint->ima_hash->digest,
258 iint->ima_hash->length);
259 else
260 rc = -EINVAL;
261 if (rc) {
262 cause = "invalid-hash";
263 status = INTEGRITY_FAIL;
264 break;
265 }
266 status = INTEGRITY_PASS;
267 break;
268 case EVM_IMA_XATTR_DIGSIG:
269 iint->flags |= IMA_DIGSIG;
270 rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
271 (const char *)xattr_value, rc,
272 iint->ima_hash->digest,
273 iint->ima_hash->length);
274 if (rc == -EOPNOTSUPP) {
275 status = INTEGRITY_UNKNOWN;
276 } else if (rc) {
277 cause = "invalid-signature";
278 status = INTEGRITY_FAIL;
279 } else {
280 status = INTEGRITY_PASS;
281 }
282 break;
283 default:
284 status = INTEGRITY_UNKNOWN;
285 cause = "unknown-ima-data";
286 break;
287 }
288
289out:
290 if (status != INTEGRITY_PASS) {
291 if ((ima_appraise & IMA_APPRAISE_FIX) &&
292 (!xattr_value ||
293 xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
294 if (!ima_fix_xattr(dentry, iint))
295 status = INTEGRITY_PASS;
296 } else if ((inode->i_size == 0) &&
297 (iint->flags & IMA_NEW_FILE) &&
298 (xattr_value &&
299 xattr_value->type == EVM_IMA_XATTR_DIGSIG)) {
300 status = INTEGRITY_PASS;
301 }
302 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
303 op, cause, rc, 0);
304 } else {
305 ima_cache_flags(iint, func);
306 }
307 ima_set_cache_status(iint, func, status);
308 return status;
309}
310
311
312
313
314void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
315{
316 struct dentry *dentry = file_dentry(file);
317 int rc = 0;
318
319
320 if (iint->flags & IMA_DIGSIG)
321 return;
322
323 rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo);
324 if (rc < 0)
325 return;
326
327 ima_fix_xattr(dentry, iint);
328}
329
330
331
332
333
334
335
336
337
338
339void ima_inode_post_setattr(struct dentry *dentry)
340{
341 struct inode *inode = d_backing_inode(dentry);
342 struct integrity_iint_cache *iint;
343 int must_appraise;
344
345 if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)
346 || !(inode->i_opflags & IOP_XATTR))
347 return;
348
349 must_appraise = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
350 iint = integrity_iint_find(inode);
351 if (iint) {
352 iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED |
353 IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
354 IMA_ACTION_RULE_FLAGS);
355 if (must_appraise)
356 iint->flags |= IMA_APPRAISE;
357 }
358 if (!must_appraise)
359 __vfs_removexattr(dentry, XATTR_NAME_IMA);
360}
361
362
363
364
365
366
367static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
368 const void *xattr_value, size_t xattr_value_len)
369{
370 if (strcmp(xattr_name, XATTR_NAME_IMA) == 0) {
371 if (!capable(CAP_SYS_ADMIN))
372 return -EPERM;
373 return 1;
374 }
375 return 0;
376}
377
378static void ima_reset_appraise_flags(struct inode *inode, int digsig)
379{
380 struct integrity_iint_cache *iint;
381
382 if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode))
383 return;
384
385 iint = integrity_iint_find(inode);
386 if (!iint)
387 return;
388
389 iint->flags &= ~IMA_DONE_MASK;
390 iint->measured_pcrs = 0;
391 if (digsig)
392 iint->flags |= IMA_DIGSIG;
393 return;
394}
395
396int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
397 const void *xattr_value, size_t xattr_value_len)
398{
399 const struct evm_ima_xattr_data *xvalue = xattr_value;
400 int result;
401
402 result = ima_protect_xattr(dentry, xattr_name, xattr_value,
403 xattr_value_len);
404 if (result == 1) {
405 if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
406 return -EINVAL;
407 ima_reset_appraise_flags(d_backing_inode(dentry),
408 (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
409 result = 0;
410 }
411 return result;
412}
413
414int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name)
415{
416 int result;
417
418 result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
419 if (result == 1) {
420 ima_reset_appraise_flags(d_backing_inode(dentry), 0);
421 result = 0;
422 }
423 return result;
424}
425
