1
2
3
4
5
6
7
8
9
10
11#include <linux/slab.h>
12#include <linux/file.h>
13#include <linux/fs.h>
14#include <linux/xattr.h>
15#include <linux/evm.h>
16#include <linux/iversion.h>
17
18#include "ima.h"
19
20
21
22
23void ima_free_template_entry(struct ima_template_entry *entry)
24{
25 int i;
26
27 for (i = 0; i < entry->template_desc->num_fields; i++)
28 kfree(entry->template_data[i].data);
29
30 kfree(entry->digests);
31 kfree(entry);
32}
33
34
35
36
37int ima_alloc_init_template(struct ima_event_data *event_data,
38 struct ima_template_entry **entry,
39 struct ima_template_desc *desc)
40{
41 struct ima_template_desc *template_desc;
42 struct tpm_digest *digests;
43 int i, result = 0;
44
45 if (desc)
46 template_desc = desc;
47 else
48 template_desc = ima_template_desc_current();
49
50 *entry = kzalloc(struct_size(*entry, template_data,
51 template_desc->num_fields), GFP_NOFS);
52 if (!*entry)
53 return -ENOMEM;
54
55 digests = kcalloc(NR_BANKS(ima_tpm_chip) + ima_extra_slots,
56 sizeof(*digests), GFP_NOFS);
57 if (!digests) {
58 kfree(*entry);
59 *entry = NULL;
60 return -ENOMEM;
61 }
62
63 (*entry)->digests = digests;
64 (*entry)->template_desc = template_desc;
65 for (i = 0; i < template_desc->num_fields; i++) {
66 const struct ima_template_field *field =
67 template_desc->fields[i];
68 u32 len;
69
70 result = field->field_init(event_data,
71 &((*entry)->template_data[i]));
72 if (result != 0)
73 goto out;
74
75 len = (*entry)->template_data[i].len;
76 (*entry)->template_data_len += sizeof(len);
77 (*entry)->template_data_len += len;
78 }
79 return 0;
80out:
81 ima_free_template_entry(*entry);
82 *entry = NULL;
83 return result;
84}
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102int ima_store_template(struct ima_template_entry *entry,
103 int violation, struct inode *inode,
104 const unsigned char *filename, int pcr)
105{
106 static const char op[] = "add_template_measure";
107 static const char audit_cause[] = "hashing_error";
108 char *template_name = entry->template_desc->name;
109 int result;
110
111 if (!violation) {
112 result = ima_calc_field_array_hash(&entry->template_data[0],
113 entry);
114 if (result < 0) {
115 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
116 template_name, op,
117 audit_cause, result, 0);
118 return result;
119 }
120 }
121 entry->pcr = pcr;
122 result = ima_add_template_entry(entry, violation, op, inode, filename);
123 return result;
124}
125
126
127
128
129
130
131
132
133void ima_add_violation(struct file *file, const unsigned char *filename,
134 struct integrity_iint_cache *iint,
135 const char *op, const char *cause)
136{
137 struct ima_template_entry *entry;
138 struct inode *inode = file_inode(file);
139 struct ima_event_data event_data = { .iint = iint,
140 .file = file,
141 .filename = filename,
142 .violation = cause };
143 int violation = 1;
144 int result;
145
146
147 atomic_long_inc(&ima_htable.violations);
148
149 result = ima_alloc_init_template(&event_data, &entry, NULL);
150 if (result < 0) {
151 result = -ENOMEM;
152 goto err_out;
153 }
154 result = ima_store_template(entry, violation, inode,
155 filename, CONFIG_IMA_MEASURE_PCR_IDX);
156 if (result < 0)
157 ima_free_template_entry(entry);
158err_out:
159 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
160 op, cause, result, 0);
161}
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
189 const struct cred *cred, u32 secid, int mask,
190 enum ima_hooks func, int *pcr,
191 struct ima_template_desc **template_desc,
192 const char *func_data, unsigned int *allowed_algos)
193{
194 int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
195
196 flags &= ima_policy_flag;
197
198 return ima_match_policy(mnt_userns, inode, cred, secid, func, mask,
199 flags, pcr, template_desc, func_data,
200 allowed_algos);
201}
202
203
204
205
206
207
208
209
210
211
212
213int ima_collect_measurement(struct integrity_iint_cache *iint,
214 struct file *file, void *buf, loff_t size,
215 enum hash_algo algo, struct modsig *modsig)
216{
217 const char *audit_cause = "failed";
218 struct inode *inode = file_inode(file);
219 const char *filename = file->f_path.dentry->d_name.name;
220 int result = 0;
221 int length;
222 void *tmpbuf;
223 u64 i_version;
224 struct {
225 struct ima_digest_data hdr;
226 char digest[IMA_MAX_DIGEST_SIZE];
227 } hash;
228
229
230
231
232
233
234 if (modsig)
235 ima_collect_modsig(modsig, buf, size);
236
237 if (iint->flags & IMA_COLLECTED)
238 goto out;
239
240
241
242
243
244
245 i_version = inode_query_iversion(inode);
246 hash.hdr.algo = algo;
247
248
249 memset(&hash.digest, 0, sizeof(hash.digest));
250
251 if (buf)
252 result = ima_calc_buffer_hash(buf, size, &hash.hdr);
253 else
254 result = ima_calc_file_hash(file, &hash.hdr);
255
256 if (result && result != -EBADF && result != -EINVAL)
257 goto out;
258
259 length = sizeof(hash.hdr) + hash.hdr.length;
260 tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS);
261 if (!tmpbuf) {
262 result = -ENOMEM;
263 goto out;
264 }
265
266 iint->ima_hash = tmpbuf;
267 memcpy(iint->ima_hash, &hash, length);
268 iint->version = i_version;
269
270
271 if (!result)
272 iint->flags |= IMA_COLLECTED;
273out:
274 if (result) {
275 if (file->f_flags & O_DIRECT)
276 audit_cause = "failed(directio)";
277
278 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
279 filename, "collect_data", audit_cause,
280 result, 0);
281 }
282 return result;
283}
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300void ima_store_measurement(struct integrity_iint_cache *iint,
301 struct file *file, const unsigned char *filename,
302 struct evm_ima_xattr_data *xattr_value,
303 int xattr_len, const struct modsig *modsig, int pcr,
304 struct ima_template_desc *template_desc)
305{
306 static const char op[] = "add_template_measure";
307 static const char audit_cause[] = "ENOMEM";
308 int result = -ENOMEM;
309 struct inode *inode = file_inode(file);
310 struct ima_template_entry *entry;
311 struct ima_event_data event_data = { .iint = iint,
312 .file = file,
313 .filename = filename,
314 .xattr_value = xattr_value,
315 .xattr_len = xattr_len,
316 .modsig = modsig };
317 int violation = 0;
318
319
320
321
322
323
324
325 if (iint->measured_pcrs & (0x1 << pcr) && !modsig)
326 return;
327
328 result = ima_alloc_init_template(&event_data, &entry, template_desc);
329 if (result < 0) {
330 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
331 op, audit_cause, result, 0);
332 return;
333 }
334
335 result = ima_store_template(entry, violation, inode, filename, pcr);
336 if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {
337 iint->flags |= IMA_MEASURED;
338 iint->measured_pcrs |= (0x1 << pcr);
339 }
340 if (result < 0)
341 ima_free_template_entry(entry);
342}
343
344void ima_audit_measurement(struct integrity_iint_cache *iint,
345 const unsigned char *filename)
346{
347 struct audit_buffer *ab;
348 char *hash;
349 const char *algo_name = hash_algo_name[iint->ima_hash->algo];
350 int i;
351
352 if (iint->flags & IMA_AUDITED)
353 return;
354
355 hash = kzalloc((iint->ima_hash->length * 2) + 1, GFP_KERNEL);
356 if (!hash)
357 return;
358
359 for (i = 0; i < iint->ima_hash->length; i++)
360 hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
361 hash[i * 2] = '\0';
362
363 ab = audit_log_start(audit_context(), GFP_KERNEL,
364 AUDIT_INTEGRITY_RULE);
365 if (!ab)
366 goto out;
367
368 audit_log_format(ab, "file=");
369 audit_log_untrustedstring(ab, filename);
370 audit_log_format(ab, " hash=\"%s:%s\"", algo_name, hash);
371
372 audit_log_task_info(ab);
373 audit_log_end(ab);
374
375 iint->flags |= IMA_AUDITED;
376out:
377 kfree(hash);
378 return;
379}
380
381
382
383
384
385
386
387
388
389
390
391const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
392{
393 char *pathname = NULL;
394
395 *pathbuf = __getname();
396 if (*pathbuf) {
397 pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
398 if (IS_ERR(pathname)) {
399 __putname(*pathbuf);
400 *pathbuf = NULL;
401 pathname = NULL;
402 }
403 }
404
405 if (!pathname) {
406 strlcpy(namebuf, path->dentry->d_name.name, NAME_MAX);
407 pathname = namebuf;
408 }
409
410 return pathname;
411}
412