1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Copyright (C) 2008 IBM Corporation 4 * Author: Mimi Zohar <zohar@us.ibm.com> 5 */ 6 7 #ifndef _LINUX_IMA_H 8 #define _LINUX_IMA_H 9 10 #include <linux/kernel_read_file.h> 11 #include <linux/fs.h> 12 #include <linux/security.h> 13 #include <linux/kexec.h> 14 #include <crypto/hash_info.h> 15 struct linux_binprm; 16 17 #ifdef CONFIG_IMA 18 extern enum hash_algo ima_get_current_hash_algo(void); 19 extern int ima_bprm_check(struct linux_binprm *bprm); 20 extern int ima_file_check(struct file *file, int mask); 21 extern void ima_post_create_tmpfile(struct user_namespace *mnt_userns, 22 struct inode *inode); 23 extern void ima_file_free(struct file *file); 24 extern int ima_file_mmap(struct file *file, unsigned long prot); 25 extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); 26 extern int ima_load_data(enum kernel_load_data_id id, bool contents); 27 extern int ima_post_load_data(char *buf, loff_t size, 28 enum kernel_load_data_id id, char *description); 29 extern int ima_read_file(struct file *file, enum kernel_read_file_id id, 30 bool contents); 31 extern int ima_post_read_file(struct file *file, void *buf, loff_t size, 32 enum kernel_read_file_id id); 33 extern void ima_post_path_mknod(struct user_namespace *mnt_userns, 34 struct dentry *dentry); 35 extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); 36 extern int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size); 37 extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); 38 extern int ima_measure_critical_data(const char *event_label, 39 const char *event_name, 40 const void *buf, size_t buf_len, 41 bool hash, u8 *digest, size_t digest_len); 42 43 #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM 44 extern void ima_appraise_parse_cmdline(void); 45 #else 46 static inline void ima_appraise_parse_cmdline(void) {} 47 #endif 48 49 #ifdef CONFIG_IMA_KEXEC 50 extern void ima_add_kexec_buffer(struct kimage *image); 51 #endif 52 53 #else 54 static inline enum hash_algo ima_get_current_hash_algo(void) 55 { 56 return HASH_ALGO__LAST; 57 } 58 59 static inline int ima_bprm_check(struct linux_binprm *bprm) 60 { 61 return 0; 62 } 63 64 static inline int ima_file_check(struct file *file, int mask) 65 { 66 return 0; 67 } 68 69 static inline void ima_post_create_tmpfile(struct user_namespace *mnt_userns, 70 struct inode *inode) 71 { 72 } 73 74 static inline void ima_file_free(struct file *file) 75 { 76 return; 77 } 78 79 static inline int ima_file_mmap(struct file *file, unsigned long prot) 80 { 81 return 0; 82 } 83 84 static inline int ima_file_mprotect(struct vm_area_struct *vma, 85 unsigned long prot) 86 { 87 return 0; 88 } 89 90 static inline int ima_load_data(enum kernel_load_data_id id, bool contents) 91 { 92 return 0; 93 } 94 95 static inline int ima_post_load_data(char *buf, loff_t size, 96 enum kernel_load_data_id id, 97 char *description) 98 { 99 return 0; 100 } 101 102 static inline int ima_read_file(struct file *file, enum kernel_read_file_id id, 103 bool contents) 104 { 105 return 0; 106 } 107 108 static inline int ima_post_read_file(struct file *file, void *buf, loff_t size, 109 enum kernel_read_file_id id) 110 { 111 return 0; 112 } 113 114 static inline void ima_post_path_mknod(struct user_namespace *mnt_userns, 115 struct dentry *dentry) 116 { 117 return; 118 } 119 120 static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) 121 { 122 return -EOPNOTSUPP; 123 } 124 125 static inline int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size) 126 { 127 return -EOPNOTSUPP; 128 } 129 130 static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} 131 132 static inline int ima_measure_critical_data(const char *event_label, 133 const char *event_name, 134 const void *buf, size_t buf_len, 135 bool hash, u8 *digest, 136 size_t digest_len) 137 { 138 return -ENOENT; 139 } 140 141 #endif /* CONFIG_IMA */ 142 143 #ifdef CONFIG_HAVE_IMA_KEXEC 144 int __init ima_free_kexec_buffer(void); 145 int __init ima_get_kexec_buffer(void **addr, size_t *size); 146 #endif 147 148 #ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT 149 extern bool arch_ima_get_secureboot(void); 150 extern const char * const *arch_get_ima_policy(void); 151 #else 152 static inline bool arch_ima_get_secureboot(void) 153 { 154 return false; 155 } 156 157 static inline const char * const *arch_get_ima_policy(void) 158 { 159 return NULL; 160 } 161 #endif 162 163 #ifndef CONFIG_IMA_KEXEC 164 struct kimage; 165 166 static inline void ima_add_kexec_buffer(struct kimage *image) 167 {} 168 #endif 169 170 #ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS 171 extern void ima_post_key_create_or_update(struct key *keyring, 172 struct key *key, 173 const void *payload, size_t plen, 174 unsigned long flags, bool create); 175 #else 176 static inline void ima_post_key_create_or_update(struct key *keyring, 177 struct key *key, 178 const void *payload, 179 size_t plen, 180 unsigned long flags, 181 bool create) {} 182 #endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */ 183 184 #ifdef CONFIG_IMA_APPRAISE 185 extern bool is_ima_appraise_enabled(void); 186 extern void ima_inode_post_setattr(struct user_namespace *mnt_userns, 187 struct dentry *dentry); 188 extern int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, 189 const void *xattr_value, size_t xattr_value_len); 190 extern int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name); 191 #else 192 static inline bool is_ima_appraise_enabled(void) 193 { 194 return 0; 195 } 196 197 static inline void ima_inode_post_setattr(struct user_namespace *mnt_userns, 198 struct dentry *dentry) 199 { 200 return; 201 } 202 203 static inline int ima_inode_setxattr(struct dentry *dentry, 204 const char *xattr_name, 205 const void *xattr_value, 206 size_t xattr_value_len) 207 { 208 return 0; 209 } 210 211 static inline int ima_inode_removexattr(struct dentry *dentry, 212 const char *xattr_name) 213 { 214 return 0; 215 } 216 #endif /* CONFIG_IMA_APPRAISE */ 217 218 #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING) 219 extern bool ima_appraise_signature(enum kernel_read_file_id func); 220 #else 221 static inline bool ima_appraise_signature(enum kernel_read_file_id func) 222 { 223 return false; 224 } 225 #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */ 226 #endif /* _LINUX_IMA_H */ 227