1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2008 IBM Corporation
4 *
5 * Author: Mimi Zohar <zohar@us.ibm.com>
6 *
7 * File: ima_api.c
8 * Implements must_appraise_or_measure, collect_measurement,
9 * appraise_measurement, store_measurement and store_template.
10 */
11 #include <linux/slab.h>
12 #include <linux/file.h>
13 #include <linux/fs.h>
14 #include <linux/xattr.h>
15 #include <linux/evm.h>
16 #include <linux/fsverity.h>
17
18 #include "ima.h"
19
20 /*
21 * ima_free_template_entry - free an existing template entry
22 */
23 void ima_free_template_entry(struct ima_template_entry *entry)
24 {
25 int i;
26
27 for (i = 0; i < entry->template_desc->num_fields; i++)
28 kfree(entry->template_data[i].data);
29
30 kfree(entry->digests);
31 kfree(entry);
32 }
33
34 /*
35 * ima_alloc_init_template - create and initialize a new template entry
36 */
37 int ima_alloc_init_template(struct ima_event_data *event_data,
38 struct ima_template_entry **entry,
39 struct ima_template_desc *desc)
40 {
41 struct ima_template_desc *template_desc;
42 struct tpm_digest *digests;
43 int i, result = 0;
44
45 if (desc)
46 template_desc = desc;
47 else
48 template_desc = ima_template_desc_current();
49
50 *entry = kzalloc(struct_size(*entry, template_data,
51 template_desc->num_fields), GFP_NOFS);
52 if (!*entry)
53 return -ENOMEM;
54
55 digests = kcalloc(NR_BANKS(ima_tpm_chip) + ima_extra_slots,
56 sizeof(*digests), GFP_NOFS);
57 if (!digests) {
58 kfree(*entry);
59 *entry = NULL;
60 return -ENOMEM;
61 }
62
63 (*entry)->digests = digests;
64 (*entry)->template_desc = template_desc;
65 for (i = 0; i < template_desc->num_fields; i++) {
66 const struct ima_template_field *field =
67 template_desc->fields[i];
68 u32 len;
69
70 result = field->field_init(event_data,
71 &((*entry)->template_data[i]));
72 if (result != 0)
73 goto out;
74
75 len = (*entry)->template_data[i].len;
76 (*entry)->template_data_len += sizeof(len);
77 (*entry)->template_data_len += len;
78 }
79 return 0;
80 out:
81 ima_free_template_entry(*entry);
82 *entry = NULL;
83 return result;
84 }
85
86 /*
87 * ima_store_template - store ima template measurements
88 *
89 * Calculate the hash of a template entry, add the template entry
90 * to an ordered list of measurement entries maintained inside the kernel,
91 * and also update the aggregate integrity value (maintained inside the
92 * configured TPM PCR) over the hashes of the current list of measurement
93 * entries.
94 *
95 * Applications retrieve the current kernel-held measurement list through
96 * the securityfs entries in /sys/kernel/security/ima. The signed aggregate
97 * TPM PCR (called quote) can be retrieved using a TPM user space library
98 * and is used to validate the measurement list.
99 *
100 * Returns 0 on success, error code otherwise
101 */
102 int ima_store_template(struct ima_template_entry *entry,
103 int violation, struct inode *inode,
104 const unsigned char *filename, int pcr)
105 {
106 static const char op[] = "add_template_measure";
107 static const char audit_cause[] = "hashing_error";
108 char *template_name = entry->template_desc->name;
109 int result;
110
111 if (!violation) {
112 result = ima_calc_field_array_hash(&entry->template_data[0],
113 entry);
114 if (result < 0) {
115 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
116 template_name, op,
117 audit_cause, result, 0);
118 return result;
119 }
120 }
121 entry->pcr = pcr;
122 result = ima_add_template_entry(entry, violation, op, inode, filename);
123 return result;
124 }
125
126 /*
127 * ima_add_violation - add violation to measurement list.
128 *
129 * Violations are flagged in the measurement list with zero hash values.
130 * By extending the PCR with 0xFF's instead of with zeroes, the PCR
131 * value is invalidated.
132 */
133 void ima_add_violation(struct file *file, const unsigned char *filename,
134 struct ima_iint_cache *iint, const char *op,
135 const char *cause)
136 {
137 struct ima_template_entry *entry;
138 struct inode *inode = file_inode(file);
139 struct ima_event_data event_data = { .iint = iint,
140 .file = file,
141 .filename = filename,
142 .violation = cause };
143 int violation = 1;
144 int result;
145
146 /* can overflow, only indicator */
147 atomic_long_inc(&ima_htable.violations);
148
149 result = ima_alloc_init_template(&event_data, &entry, NULL);
150 if (result < 0) {
151 result = -ENOMEM;
152 goto err_out;
153 }
154 result = ima_store_template(entry, violation, inode,
155 filename, CONFIG_IMA_MEASURE_PCR_IDX);
156 if (result < 0)
157 ima_free_template_entry(entry);
158 err_out:
159 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
160 op, cause, result, 0);
161 }
162
163 /**
164 * ima_get_action - appraise & measure decision based on policy.
165 * @idmap: idmap of the mount the inode was found from
166 * @inode: pointer to the inode associated with the object being validated
167 * @cred: pointer to credentials structure to validate
168 * @secid: secid of the task being validated
169 * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
170 * MAY_APPEND)
171 * @func: caller identifier
172 * @pcr: pointer filled in if matched measure policy sets pcr=
173 * @template_desc: pointer filled in if matched measure policy sets template=
174 * @func_data: func specific data, may be NULL
175 * @allowed_algos: allowlist of hash algorithms for the IMA xattr
176 *
177 * The policy is defined in terms of keypairs:
178 * subj=, obj=, type=, func=, mask=, fsmagic=
179 * subj,obj, and type: are LSM specific.
180 * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK
181 * | KEXEC_CMDLINE | KEY_CHECK | CRITICAL_DATA | SETXATTR_CHECK
182 * | MMAP_CHECK_REQPROT
183 * mask: contains the permission mask
184 * fsmagic: hex value
185 *
186 * Returns IMA_MEASURE, IMA_APPRAISE mask.
187 *
188 */
189 int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
190 const struct cred *cred, u32 secid, int mask,
191 enum ima_hooks func, int *pcr,
192 struct ima_template_desc **template_desc,
193 const char *func_data, unsigned int *allowed_algos)
194 {
195 int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
196
197 flags &= ima_policy_flag;
198
199 return ima_match_policy(idmap, inode, cred, secid, func, mask,
200 flags, pcr, template_desc, func_data,
201 allowed_algos);
202 }
203
204 static bool ima_get_verity_digest(struct ima_iint_cache *iint,
205 struct inode *inode,
206 struct ima_max_digest_data *hash)
207 {
208 enum hash_algo alg;
209 int digest_len;
210
211 /*
212 * On failure, 'measure' policy rules will result in a file data
213 * hash containing 0's.
214 */
215 digest_len = fsverity_get_digest(inode, hash->digest, NULL, &alg);
216 if (digest_len == 0)
217 return false;
218
219 /*
220 * Unlike in the case of actually calculating the file hash, in
221 * the fsverity case regardless of the hash algorithm, return
222 * the verity digest to be included in the measurement list. A
223 * mismatch between the verity algorithm and the xattr signature
224 * algorithm, if one exists, will be detected later.
225 */
226 hash->hdr.algo = alg;
227 hash->hdr.length = digest_len;
228 return true;
229 }
230
231 /*
232 * ima_collect_measurement - collect file measurement
233 *
234 * Calculate the file hash, if it doesn't already exist,
235 * storing the measurement and i_version in the iint.
236 *
237 * Must be called with iint->mutex held.
238 *
239 * Return 0 on success, error code otherwise
240 */
241 int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
242 void *buf, loff_t size, enum hash_algo algo,
243 struct modsig *modsig)
244 {
245 const char *audit_cause = "failed";
246 struct inode *inode = file_inode(file);
247 struct inode *real_inode = d_real_inode(file_dentry(file));
248 struct ima_max_digest_data hash;
249 struct ima_digest_data *hash_hdr = container_of(&hash.hdr,
250 struct ima_digest_data, hdr);
251 struct name_snapshot filename;
252 struct kstat stat;
253 int result = 0;
254 int length;
255 void *tmpbuf;
256 u64 i_version = 0;
257
258 /*
259 * Always collect the modsig, because IMA might have already collected
260 * the file digest without collecting the modsig in a previous
261 * measurement rule.
262 */
263 if (modsig)
264 ima_collect_modsig(modsig, buf, size);
265
266 if (iint->flags & IMA_COLLECTED)
267 goto out;
268
269 /*
270 * Detecting file change is based on i_version. On filesystems
271 * which do not support i_version, support was originally limited
272 * to an initial measurement/appraisal/audit, but was modified to
273 * assume the file changed.
274 */
275 result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE,
276 AT_STATX_SYNC_AS_STAT);
277 if (!result && (stat.result_mask & STATX_CHANGE_COOKIE))
278 i_version = stat.change_cookie;
279 hash.hdr.algo = algo;
280 hash.hdr.length = hash_digest_size[algo];
281
282 /* Initialize hash digest to 0's in case of failure */
283 memset(&hash.digest, 0, sizeof(hash.digest));
284
285 if (iint->flags & IMA_VERITY_REQUIRED) {
286 if (!ima_get_verity_digest(iint, inode, &hash)) {
287 audit_cause = "no-verity-digest";
288 result = -ENODATA;
289 }
290 } else if (buf) {
291 result = ima_calc_buffer_hash(buf, size, hash_hdr);
292 } else {
293 result = ima_calc_file_hash(file, hash_hdr);
294 }
295
296 if (result && result != -EBADF && result != -EINVAL)
297 goto out;
298
299 length = sizeof(hash.hdr) + hash.hdr.length;
300 tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS);
301 if (!tmpbuf) {
302 result = -ENOMEM;
303 goto out;
304 }
305
306 iint->ima_hash = tmpbuf;
307 memcpy(iint->ima_hash, &hash, length);
308 if (real_inode == inode)
309 iint->real_inode.version = i_version;
310 else
311 integrity_inode_attrs_store(&iint->real_inode, i_version,
312 real_inode);
313
314 /* Possibly temporary failure due to type of read (eg. O_DIRECT) */
315 if (!result)
316 iint->flags |= IMA_COLLECTED;
317 out:
318 if (result) {
319 if (file->f_flags & O_DIRECT)
320 audit_cause = "failed(directio)";
321
322 take_dentry_name_snapshot(&filename, file->f_path.dentry);
323
324 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
325 filename.name.name, "collect_data",
326 audit_cause, result, 0);
327
328 release_dentry_name_snapshot(&filename);
329 }
330 return result;
331 }
332
333 /*
334 * ima_store_measurement - store file measurement
335 *
336 * Create an "ima" template and then store the template by calling
337 * ima_store_template.
338 *
339 * We only get here if the inode has not already been measured,
340 * but the measurement could already exist:
341 * - multiple copies of the same file on either the same or
342 * different filesystems.
343 * - the inode was previously flushed as well as the iint info,
344 * containing the hashing info.
345 *
346 * Must be called with iint->mutex held.
347 */
348 void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
349 const unsigned char *filename,
350 struct evm_ima_xattr_data *xattr_value,
351 int xattr_len, const struct modsig *modsig, int pcr,
352 struct ima_template_desc *template_desc)
353 {
354 static const char op[] = "add_template_measure";
355 static const char audit_cause[] = "ENOMEM";
356 int result = -ENOMEM;
357 struct inode *inode = file_inode(file);
358 struct ima_template_entry *entry;
359 struct ima_event_data event_data = { .iint = iint,
360 .file = file,
361 .filename = filename,
362 .xattr_value = xattr_value,
363 .xattr_len = xattr_len,
364 .modsig = modsig };
365 int violation = 0;
366
367 /*
368 * We still need to store the measurement in the case of MODSIG because
369 * we only have its contents to put in the list at the time of
370 * appraisal, but a file measurement from earlier might already exist in
371 * the measurement list.
372 */
373 if (iint->measured_pcrs & (0x1 << pcr) && !modsig)
374 return;
375
376 result = ima_alloc_init_template(&event_data, &entry, template_desc);
377 if (result < 0) {
378 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
379 op, audit_cause, result, 0);
380 return;
381 }
382
383 result = ima_store_template(entry, violation, inode, filename, pcr);
384 if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {
385 iint->flags |= IMA_MEASURED;
386 iint->measured_pcrs |= (0x1 << pcr);
387 }
388 if (result < 0)
389 ima_free_template_entry(entry);
390 }
391
392 void ima_audit_measurement(struct ima_iint_cache *iint,
393 const unsigned char *filename)
394 {
395 struct audit_buffer *ab;
396 char *hash;
397 const char *algo_name = hash_algo_name[iint->ima_hash->algo];
398 int i;
399
400 if (iint->flags & IMA_AUDITED)
401 return;
402
403 hash = kzalloc((iint->ima_hash->length * 2) + 1, GFP_KERNEL);
404 if (!hash)
405 return;
406
407 for (i = 0; i < iint->ima_hash->length; i++)
408 hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
409 hash[i * 2] = '\0';
410
411 ab = audit_log_start(audit_context(), GFP_KERNEL,
412 AUDIT_INTEGRITY_RULE);
413 if (!ab)
414 goto out;
415
416 audit_log_format(ab, "file=");
417 audit_log_untrustedstring(ab, filename);
418 audit_log_format(ab, " hash=\"%s:%s\"", algo_name, hash);
419
420 audit_log_task_info(ab);
421 audit_log_end(ab);
422
423 iint->flags |= IMA_AUDITED;
424 out:
425 kfree(hash);
426 return;
427 }
428
429 /*
430 * ima_d_path - return a pointer to the full pathname
431 *
432 * Attempt to return a pointer to the full pathname for use in the
433 * IMA measurement list, IMA audit records, and auditing logs.
434 *
435 * On failure, return a pointer to a copy of the filename, not dname.
436 * Returning a pointer to dname, could result in using the pointer
437 * after the memory has been freed.
438 */
439 const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
440 {
441 struct name_snapshot filename;
442 char *pathname = NULL;
443
444 *pathbuf = __getname();
445 if (*pathbuf) {
446 pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
447 if (IS_ERR(pathname)) {
448 __putname(*pathbuf);
449 *pathbuf = NULL;
450 pathname = NULL;
451 }
452 }
453
454 if (!pathname) {
455 take_dentry_name_snapshot(&filename, path->dentry);
456 strscpy(namebuf, filename.name.name, NAME_MAX);
457 release_dentry_name_snapshot(&filename);
458
459 pathname = namebuf;
460 }
461
462 return pathname;
463 }
464
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.