1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
4 */
5
6 #include <linux/fs.h>
7 #include <linux/fs_struct.h>
8 #include <linux/types.h>
9 #include <linux/binfmts.h>
10 #include <linux/mman.h>
11 #include <linux/blk_types.h>
12
13 #include "ipe.h"
14 #include "hooks.h"
15 #include "eval.h"
16 #include "digest.h"
17
18 /**
19 * ipe_bprm_check_security() - ipe security hook function for bprm check.
20 * @bprm: Supplies a pointer to a linux_binprm structure to source the file
21 * being evaluated.
22 *
23 * This LSM hook is called when a binary is loaded through the exec
24 * family of system calls.
25 *
26 * Return:
27 * * %0 - Success
28 * * %-EACCES - Did not pass IPE policy
29 */
30 int ipe_bprm_check_security(struct linux_binprm *bprm)
31 {
32 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
33
34 ipe_build_eval_ctx(&ctx, bprm->file, IPE_OP_EXEC, IPE_HOOK_BPRM_CHECK);
35 return ipe_evaluate_event(&ctx);
36 }
37
38 /**
39 * ipe_mmap_file() - ipe security hook function for mmap check.
40 * @f: File being mmap'd. Can be NULL in the case of anonymous memory.
41 * @reqprot: The requested protection on the mmap, passed from usermode.
42 * @prot: The effective protection on the mmap, resolved from reqprot and
43 * system configuration.
44 * @flags: Unused.
45 *
46 * This hook is called when a file is loaded through the mmap
47 * family of system calls.
48 *
49 * Return:
50 * * %0 - Success
51 * * %-EACCES - Did not pass IPE policy
52 */
53 int ipe_mmap_file(struct file *f, unsigned long reqprot __always_unused,
54 unsigned long prot, unsigned long flags)
55 {
56 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
57
58 if (prot & PROT_EXEC) {
59 ipe_build_eval_ctx(&ctx, f, IPE_OP_EXEC, IPE_HOOK_MMAP);
60 return ipe_evaluate_event(&ctx);
61 }
62
63 return 0;
64 }
65
66 /**
67 * ipe_file_mprotect() - ipe security hook function for mprotect check.
68 * @vma: Existing virtual memory area created by mmap or similar.
69 * @reqprot: The requested protection on the mmap, passed from usermode.
70 * @prot: The effective protection on the mmap, resolved from reqprot and
71 * system configuration.
72 *
73 * This LSM hook is called when a mmap'd region of memory is changing
74 * its protections via mprotect.
75 *
76 * Return:
77 * * %0 - Success
78 * * %-EACCES - Did not pass IPE policy
79 */
80 int ipe_file_mprotect(struct vm_area_struct *vma,
81 unsigned long reqprot __always_unused,
82 unsigned long prot)
83 {
84 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
85
86 /* Already Executable */
87 if (vma->vm_flags & VM_EXEC)
88 return 0;
89
90 if (prot & PROT_EXEC) {
91 ipe_build_eval_ctx(&ctx, vma->vm_file, IPE_OP_EXEC, IPE_HOOK_MPROTECT);
92 return ipe_evaluate_event(&ctx);
93 }
94
95 return 0;
96 }
97
98 /**
99 * ipe_kernel_read_file() - ipe security hook function for kernel read.
100 * @file: Supplies a pointer to the file structure being read in from disk.
101 * @id: Supplies the enumeration identifying the purpose of the read.
102 * @contents: Unused.
103 *
104 * This LSM hook is called when a file is read from disk in the kernel.
105 *
106 * Return:
107 * * %0 - Success
108 * * %-EACCES - Did not pass IPE policy
109 */
110 int ipe_kernel_read_file(struct file *file, enum kernel_read_file_id id,
111 bool contents)
112 {
113 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
114 enum ipe_op_type op;
115
116 switch (id) {
117 case READING_FIRMWARE:
118 op = IPE_OP_FIRMWARE;
119 break;
120 case READING_MODULE:
121 op = IPE_OP_KERNEL_MODULE;
122 break;
123 case READING_KEXEC_INITRAMFS:
124 op = IPE_OP_KEXEC_INITRAMFS;
125 break;
126 case READING_KEXEC_IMAGE:
127 op = IPE_OP_KEXEC_IMAGE;
128 break;
129 case READING_POLICY:
130 op = IPE_OP_POLICY;
131 break;
132 case READING_X509_CERTIFICATE:
133 op = IPE_OP_X509;
134 break;
135 default:
136 op = IPE_OP_INVALID;
137 WARN(1, "no rule setup for kernel_read_file enum %d", id);
138 }
139
140 ipe_build_eval_ctx(&ctx, file, op, IPE_HOOK_KERNEL_READ);
141 return ipe_evaluate_event(&ctx);
142 }
143
144 /**
145 * ipe_kernel_load_data() - ipe security hook function for kernel load data.
146 * @id: Supplies the enumeration identifying the purpose of the load.
147 * @contents: Unused.
148 *
149 * This LSM hook is called when a data buffer provided by userspace is loading
150 * into the kernel.
151 *
152 * Return:
153 * * %0 - Success
154 * * %-EACCES - Did not pass IPE policy
155 */
156 int ipe_kernel_load_data(enum kernel_load_data_id id, bool contents)
157 {
158 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
159 enum ipe_op_type op;
160
161 switch (id) {
162 case LOADING_FIRMWARE:
163 op = IPE_OP_FIRMWARE;
164 break;
165 case LOADING_MODULE:
166 op = IPE_OP_KERNEL_MODULE;
167 break;
168 case LOADING_KEXEC_INITRAMFS:
169 op = IPE_OP_KEXEC_INITRAMFS;
170 break;
171 case LOADING_KEXEC_IMAGE:
172 op = IPE_OP_KEXEC_IMAGE;
173 break;
174 case LOADING_POLICY:
175 op = IPE_OP_POLICY;
176 break;
177 case LOADING_X509_CERTIFICATE:
178 op = IPE_OP_X509;
179 break;
180 default:
181 op = IPE_OP_INVALID;
182 WARN(1, "no rule setup for kernel_load_data enum %d", id);
183 }
184
185 ipe_build_eval_ctx(&ctx, NULL, op, IPE_HOOK_KERNEL_LOAD);
186 return ipe_evaluate_event(&ctx);
187 }
188
189 /**
190 * ipe_unpack_initramfs() - Mark the current rootfs as initramfs.
191 */
192 void ipe_unpack_initramfs(void)
193 {
194 ipe_sb(current->fs->root.mnt->mnt_sb)->initramfs = true;
195 }
196
197 #ifdef CONFIG_IPE_PROP_DM_VERITY
198 /**
199 * ipe_bdev_free_security() - Free IPE's LSM blob of block_devices.
200 * @bdev: Supplies a pointer to a block_device that contains the structure
201 * to free.
202 */
203 void ipe_bdev_free_security(struct block_device *bdev)
204 {
205 struct ipe_bdev *blob = ipe_bdev(bdev);
206
207 ipe_digest_free(blob->root_hash);
208 }
209
210 #ifdef CONFIG_IPE_PROP_DM_VERITY_SIGNATURE
211 static void ipe_set_dmverity_signature(struct ipe_bdev *blob,
212 const void *value,
213 size_t size)
214 {
215 blob->dm_verity_signed = size > 0 && value;
216 }
217 #else
218 static inline void ipe_set_dmverity_signature(struct ipe_bdev *blob,
219 const void *value,
220 size_t size)
221 {
222 }
223 #endif /* CONFIG_IPE_PROP_DM_VERITY_SIGNATURE */
224
225 /**
226 * ipe_bdev_setintegrity() - Save integrity data from a bdev to IPE's LSM blob.
227 * @bdev: Supplies a pointer to a block_device that contains the LSM blob.
228 * @type: Supplies the integrity type.
229 * @value: Supplies the value to store.
230 * @size: The size of @value.
231 *
232 * This hook is currently used to save dm-verity's root hash or the existence
233 * of a validated signed dm-verity root hash into LSM blob.
234 *
235 * Return: %0 on success. If an error occurs, the function will return the
236 * -errno.
237 */
238 int ipe_bdev_setintegrity(struct block_device *bdev, enum lsm_integrity_type type,
239 const void *value, size_t size)
240 {
241 const struct dm_verity_digest *digest = NULL;
242 struct ipe_bdev *blob = ipe_bdev(bdev);
243 struct digest_info *info = NULL;
244
245 if (type == LSM_INT_DMVERITY_SIG_VALID) {
246 ipe_set_dmverity_signature(blob, value, size);
247
248 return 0;
249 }
250
251 if (type != LSM_INT_DMVERITY_ROOTHASH)
252 return -EINVAL;
253
254 if (!value) {
255 ipe_digest_free(blob->root_hash);
256 blob->root_hash = NULL;
257
258 return 0;
259 }
260 digest = value;
261
262 info = kzalloc(sizeof(*info), GFP_KERNEL);
263 if (!info)
264 return -ENOMEM;
265
266 info->digest = kmemdup(digest->digest, digest->digest_len, GFP_KERNEL);
267 if (!info->digest)
268 goto err;
269
270 info->alg = kstrdup(digest->alg, GFP_KERNEL);
271 if (!info->alg)
272 goto err;
273
274 info->digest_len = digest->digest_len;
275
276 ipe_digest_free(blob->root_hash);
277 blob->root_hash = info;
278
279 return 0;
280 err:
281 ipe_digest_free(info);
282
283 return -ENOMEM;
284 }
285 #endif /* CONFIG_IPE_PROP_DM_VERITY */
286
287 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
288 /**
289 * ipe_inode_setintegrity() - save integrity data from a inode to IPE's LSM blob.
290 * @inode: The inode to source the security blob from.
291 * @type: Supplies the integrity type.
292 * @value: The value to be stored.
293 * @size: The size of @value.
294 *
295 * This hook is currently used to save the existence of a validated fs-verity
296 * builtin signature into LSM blob.
297 *
298 * Return: %0 on success. If an error occurs, the function will return the
299 * -errno.
300 */
301 int ipe_inode_setintegrity(const struct inode *inode,
302 enum lsm_integrity_type type,
303 const void *value, size_t size)
304 {
305 struct ipe_inode *inode_sec = ipe_inode(inode);
306
307 if (type == LSM_INT_FSVERITY_BUILTINSIG_VALID) {
308 inode_sec->fs_verity_signed = size > 0 && value;
309 return 0;
310 }
311
312 return -EINVAL;
313 }
314 #endif /* CONFIG_CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
315
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.