1b886d83cSThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
2f381c272SMimi Zohar /*
3f381c272SMimi Zohar * Copyright (C) 2008 IBM Corporation
4f381c272SMimi Zohar *
5f381c272SMimi Zohar * Authors:
6f381c272SMimi Zohar * Mimi Zohar <zohar@us.ibm.com>
7f381c272SMimi Zohar *
8f381c272SMimi Zohar * File: integrity_iint.c
9f381c272SMimi Zohar * - implements the integrity hooks: integrity_inode_alloc,
10f381c272SMimi Zohar * integrity_inode_free
11f381c272SMimi Zohar * - cache integrity information associated with an inode
12f381c272SMimi Zohar * using a rbtree tree.
13f381c272SMimi Zohar */
14f381c272SMimi Zohar #include <linux/slab.h>
15876979c9SPaul Gortmaker #include <linux/init.h>
16f381c272SMimi Zohar #include <linux/spinlock.h>
17f381c272SMimi Zohar #include <linux/rbtree.h>
18e3c4abbfSDmitry Kasatkin #include <linux/file.h>
19e3c4abbfSDmitry Kasatkin #include <linux/uaccess.h>
200c343af8SMatthew Garrett #include <linux/security.h>
215b89c1bdSKees Cook #include <linux/lsm_hooks.h>
22f381c272SMimi Zohar #include "integrity.h"
23f381c272SMimi Zohar
24f381c272SMimi Zohar static struct rb_root integrity_iint_tree = RB_ROOT;
25a10bf26bSDmitry Kasatkin static DEFINE_RWLOCK(integrity_iint_lock);
26f381c272SMimi Zohar static struct kmem_cache *iint_cache __read_mostly;
27f381c272SMimi Zohar
280c343af8SMatthew Garrett struct dentry *integrity_dir;
290c343af8SMatthew Garrett
30f381c272SMimi Zohar /*
31f381c272SMimi Zohar * __integrity_iint_find - return the iint associated with an inode
32f381c272SMimi Zohar */
__integrity_iint_find(struct inode * inode)33f381c272SMimi Zohar static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode)
34f381c272SMimi Zohar {
35f381c272SMimi Zohar struct integrity_iint_cache *iint;
36f381c272SMimi Zohar struct rb_node *n = integrity_iint_tree.rb_node;
37f381c272SMimi Zohar
38f381c272SMimi Zohar while (n) {
39f381c272SMimi Zohar iint = rb_entry(n, struct integrity_iint_cache, rb_node);
40f381c272SMimi Zohar
41f381c272SMimi Zohar if (inode < iint->inode)
42f381c272SMimi Zohar n = n->rb_left;
43f381c272SMimi Zohar else if (inode > iint->inode)
44f381c272SMimi Zohar n = n->rb_right;
45f381c272SMimi Zohar else
46f381c272SMimi Zohar return iint;
47f381c272SMimi Zohar }
48f381c272SMimi Zohar
499df6a487STianjia Zhang return NULL;
509df6a487STianjia Zhang }
519df6a487STianjia Zhang
52f381c272SMimi Zohar /*
53f381c272SMimi Zohar * integrity_iint_find - return the iint associated with an inode
54f381c272SMimi Zohar */
integrity_iint_find(struct inode * inode)55f381c272SMimi Zohar struct integrity_iint_cache *integrity_iint_find(struct inode *inode)
56f381c272SMimi Zohar {
57f381c272SMimi Zohar struct integrity_iint_cache *iint;
58f381c272SMimi Zohar
59f381c272SMimi Zohar if (!IS_IMA(inode))
60f381c272SMimi Zohar return NULL;
61f381c272SMimi Zohar
62a10bf26bSDmitry Kasatkin read_lock(&integrity_iint_lock);
63f381c272SMimi Zohar iint = __integrity_iint_find(inode);
64a10bf26bSDmitry Kasatkin read_unlock(&integrity_iint_lock);
65f381c272SMimi Zohar
66f381c272SMimi Zohar return iint;
67f381c272SMimi Zohar }
68f381c272SMimi Zohar
69*1eb840f1SAmir Goldstein #define IMA_MAX_NESTING (FILESYSTEM_MAX_STACK_DEPTH+1)
70*1eb840f1SAmir Goldstein
71*1eb840f1SAmir Goldstein /*
72*1eb840f1SAmir Goldstein * It is not clear that IMA should be nested at all, but as long is it measures
73*1eb840f1SAmir Goldstein * files both on overlayfs and on underlying fs, we need to annotate the iint
74*1eb840f1SAmir Goldstein * mutex to avoid lockdep false positives related to IMA + overlayfs.
75*1eb840f1SAmir Goldstein * See ovl_lockdep_annotate_inode_mutex_key() for more details.
76*1eb840f1SAmir Goldstein */
iint_lockdep_annotate(struct integrity_iint_cache * iint,struct inode * inode)77*1eb840f1SAmir Goldstein static inline void iint_lockdep_annotate(struct integrity_iint_cache *iint,
78*1eb840f1SAmir Goldstein struct inode *inode)
79f381c272SMimi Zohar {
80*1eb840f1SAmir Goldstein #ifdef CONFIG_LOCKDEP
81*1eb840f1SAmir Goldstein static struct lock_class_key iint_mutex_key[IMA_MAX_NESTING];
82*1eb840f1SAmir Goldstein
83*1eb840f1SAmir Goldstein int depth = inode->i_sb->s_stack_depth;
84*1eb840f1SAmir Goldstein
85*1eb840f1SAmir Goldstein if (WARN_ON_ONCE(depth < 0 || depth >= IMA_MAX_NESTING))
86*1eb840f1SAmir Goldstein depth = 0;
87*1eb840f1SAmir Goldstein
88*1eb840f1SAmir Goldstein lockdep_set_class(&iint->mutex, &iint_mutex_key[depth]);
89*1eb840f1SAmir Goldstein #endif
90*1eb840f1SAmir Goldstein }
91*1eb840f1SAmir Goldstein
iint_init_always(struct integrity_iint_cache * iint,struct inode * inode)92*1eb840f1SAmir Goldstein static void iint_init_always(struct integrity_iint_cache *iint,
93*1eb840f1SAmir Goldstein struct inode *inode)
94*1eb840f1SAmir Goldstein {
95a35c3fb6SDmitry Kasatkin iint->ima_hash = NULL;
96f381c272SMimi Zohar iint->version = 0;
97f381c272SMimi Zohar iint->flags = 0UL;
98e2598077SMimi Zohar iint->atomic_flags = 0UL;
99d79d72e0SMimi Zohar iint->ima_file_status = INTEGRITY_UNKNOWN;
100d79d72e0SMimi Zohar iint->ima_mmap_status = INTEGRITY_UNKNOWN;
101d79d72e0SMimi Zohar iint->ima_bprm_status = INTEGRITY_UNKNOWN;
102c6af8efeSMimi Zohar iint->ima_read_status = INTEGRITY_UNKNOWN;
103d906c10dSMatthew Garrett iint->ima_creds_status = INTEGRITY_UNKNOWN;
104fb788d8bSDmitry Kasatkin iint->evm_status = INTEGRITY_UNKNOWN;
10596d450bbSEric Richter iint->measured_pcrs = 0;
106*1eb840f1SAmir Goldstein mutex_init(&iint->mutex);
107*1eb840f1SAmir Goldstein iint_lockdep_annotate(iint, inode);
108*1eb840f1SAmir Goldstein }
109*1eb840f1SAmir Goldstein
iint_free(struct integrity_iint_cache * iint)110*1eb840f1SAmir Goldstein static void iint_free(struct integrity_iint_cache *iint)
111*1eb840f1SAmir Goldstein {
112*1eb840f1SAmir Goldstein kfree(iint->ima_hash);
113*1eb840f1SAmir Goldstein mutex_destroy(&iint->mutex);
114f381c272SMimi Zohar kmem_cache_free(iint_cache, iint);
115f381c272SMimi Zohar }
116f381c272SMimi Zohar
117f381c272SMimi Zohar /**
118bf2276d1SDmitry Kasatkin * integrity_inode_get - find or allocate an iint associated with an inode
119f381c272SMimi Zohar * @inode: pointer to the inode
120bf2276d1SDmitry Kasatkin * @return: allocated iint
121bf2276d1SDmitry Kasatkin *
122bf2276d1SDmitry Kasatkin * Caller must lock i_mutex
123f381c272SMimi Zohar */
integrity_inode_get(struct inode * inode)124bf2276d1SDmitry Kasatkin struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
125f381c272SMimi Zohar {
126f381c272SMimi Zohar struct rb_node **p;
127bf2276d1SDmitry Kasatkin struct rb_node *node, *parent = NULL;
128bf2276d1SDmitry Kasatkin struct integrity_iint_cache *iint, *test_iint;
129f381c272SMimi Zohar
130bf2276d1SDmitry Kasatkin iint = integrity_iint_find(inode);
131bf2276d1SDmitry Kasatkin if (iint)
132bf2276d1SDmitry Kasatkin return iint;
133f381c272SMimi Zohar
134bf2276d1SDmitry Kasatkin iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
135bf2276d1SDmitry Kasatkin if (!iint)
136bf2276d1SDmitry Kasatkin return NULL;
137f381c272SMimi Zohar
138*1eb840f1SAmir Goldstein iint_init_always(iint, inode);
139*1eb840f1SAmir Goldstein
140a10bf26bSDmitry Kasatkin write_lock(&integrity_iint_lock);
141f381c272SMimi Zohar
142f381c272SMimi Zohar p = &integrity_iint_tree.rb_node;
143f381c272SMimi Zohar while (*p) {
144f381c272SMimi Zohar parent = *p;
145f381c272SMimi Zohar test_iint = rb_entry(parent, struct integrity_iint_cache,
146f381c272SMimi Zohar rb_node);
1479df6a487STianjia Zhang if (inode < test_iint->inode) {
148f381c272SMimi Zohar p = &(*p)->rb_left;
1499df6a487STianjia Zhang } else if (inode > test_iint->inode) {
150bf2276d1SDmitry Kasatkin p = &(*p)->rb_right;
1519df6a487STianjia Zhang } else {
1529df6a487STianjia Zhang write_unlock(&integrity_iint_lock);
1539df6a487STianjia Zhang kmem_cache_free(iint_cache, iint);
1549df6a487STianjia Zhang return test_iint;
1559df6a487STianjia Zhang }
156f381c272SMimi Zohar }
157f381c272SMimi Zohar
158bf2276d1SDmitry Kasatkin iint->inode = inode;
159bf2276d1SDmitry Kasatkin node = &iint->rb_node;
160f381c272SMimi Zohar inode->i_flags |= S_IMA;
161bf2276d1SDmitry Kasatkin rb_link_node(node, parent, p);
162bf2276d1SDmitry Kasatkin rb_insert_color(node, &integrity_iint_tree);
163f381c272SMimi Zohar
164a10bf26bSDmitry Kasatkin write_unlock(&integrity_iint_lock);
165bf2276d1SDmitry Kasatkin return iint;
166f381c272SMimi Zohar }
167f381c272SMimi Zohar
168f381c272SMimi Zohar /**
169f381c272SMimi Zohar * integrity_inode_free - called on security_inode_free
170f381c272SMimi Zohar * @inode: pointer to the inode
171f381c272SMimi Zohar *
172f381c272SMimi Zohar * Free the integrity information(iint) associated with an inode.
173f381c272SMimi Zohar */
integrity_inode_free(struct inode * inode)174f381c272SMimi Zohar void integrity_inode_free(struct inode *inode)
175f381c272SMimi Zohar {
176f381c272SMimi Zohar struct integrity_iint_cache *iint;
177f381c272SMimi Zohar
178f381c272SMimi Zohar if (!IS_IMA(inode))
179f381c272SMimi Zohar return;
180f381c272SMimi Zohar
181a10bf26bSDmitry Kasatkin write_lock(&integrity_iint_lock);
182f381c272SMimi Zohar iint = __integrity_iint_find(inode);
183f381c272SMimi Zohar rb_erase(&iint->rb_node, &integrity_iint_tree);
184a10bf26bSDmitry Kasatkin write_unlock(&integrity_iint_lock);
185f381c272SMimi Zohar
186f381c272SMimi Zohar iint_free(iint);
187f381c272SMimi Zohar }
188f381c272SMimi Zohar
iint_init_once(void * foo)189*1eb840f1SAmir Goldstein static void iint_init_once(void *foo)
190f381c272SMimi Zohar {
191282c0a4dSJiele Zhao struct integrity_iint_cache *iint = (struct integrity_iint_cache *) foo;
192f381c272SMimi Zohar
1932bb930abSDmitry Kasatkin memset(iint, 0, sizeof(*iint));
194f381c272SMimi Zohar }
195f381c272SMimi Zohar
integrity_iintcache_init(void)196f381c272SMimi Zohar static int __init integrity_iintcache_init(void)
197f381c272SMimi Zohar {
198f381c272SMimi Zohar iint_cache =
199f381c272SMimi Zohar kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache),
200*1eb840f1SAmir Goldstein 0, SLAB_PANIC, iint_init_once);
201f381c272SMimi Zohar return 0;
202f381c272SMimi Zohar }
2033d6e5f6dSKees Cook DEFINE_LSM(integrity) = {
20407aed2f2SKees Cook .name = "integrity",
2053d6e5f6dSKees Cook .init = integrity_iintcache_init,
20642994ee3SRoberto Sassu .order = LSM_ORDER_LAST,
2073d6e5f6dSKees Cook };
208e3c4abbfSDmitry Kasatkin
209e3c4abbfSDmitry Kasatkin
210e3c4abbfSDmitry Kasatkin /*
211e3c4abbfSDmitry Kasatkin * integrity_kernel_read - read data from the file
212e3c4abbfSDmitry Kasatkin *
213e3c4abbfSDmitry Kasatkin * This is a function for reading file content instead of kernel_read().
214e3c4abbfSDmitry Kasatkin * It does not perform locking checks to ensure it cannot be blocked.
215e3c4abbfSDmitry Kasatkin * It does not perform security checks because it is irrelevant for IMA.
216e3c4abbfSDmitry Kasatkin *
217e3c4abbfSDmitry Kasatkin */
integrity_kernel_read(struct file * file,loff_t offset,void * addr,unsigned long count)218e3c4abbfSDmitry Kasatkin int integrity_kernel_read(struct file *file, loff_t offset,
219bb543e39SThiago Jung Bauermann void *addr, unsigned long count)
220e3c4abbfSDmitry Kasatkin {
221a1f9b1c0SChristoph Hellwig return __kernel_read(file, addr, count, &offset);
222e3c4abbfSDmitry Kasatkin }
223e3c4abbfSDmitry Kasatkin
224e3c4abbfSDmitry Kasatkin /*
225c9cd2ce2SDmitry Kasatkin * integrity_load_keys - load integrity keys hook
226c9cd2ce2SDmitry Kasatkin *
227c9cd2ce2SDmitry Kasatkin * Hooks is called from init/main.c:kernel_init_freeable()
228c9cd2ce2SDmitry Kasatkin * when rootfs is ready
229c9cd2ce2SDmitry Kasatkin */
integrity_load_keys(void)230c9cd2ce2SDmitry Kasatkin void __init integrity_load_keys(void)
231c9cd2ce2SDmitry Kasatkin {
232c9cd2ce2SDmitry Kasatkin ima_load_x509();
233aa2ead71SRoberto Sassu
234aa2ead71SRoberto Sassu if (!IS_ENABLED(CONFIG_IMA_LOAD_X509))
2352ce523ebSDmitry Kasatkin evm_load_x509();
236c9cd2ce2SDmitry Kasatkin }
2370c343af8SMatthew Garrett
integrity_fs_init(void)2380c343af8SMatthew Garrett static int __init integrity_fs_init(void)
2390c343af8SMatthew Garrett {
2400c343af8SMatthew Garrett integrity_dir = securityfs_create_dir("integrity", NULL);
2410c343af8SMatthew Garrett if (IS_ERR(integrity_dir)) {
242ac2409a5SSudeep Holla int ret = PTR_ERR(integrity_dir);
243ac2409a5SSudeep Holla
244ac2409a5SSudeep Holla if (ret != -ENODEV)
245ac2409a5SSudeep Holla pr_err("Unable to create integrity sysfs dir: %d\n",
246ac2409a5SSudeep Holla ret);
2470c343af8SMatthew Garrett integrity_dir = NULL;
248ac2409a5SSudeep Holla return ret;
2490c343af8SMatthew Garrett }
2500c343af8SMatthew Garrett
2510c343af8SMatthew Garrett return 0;
2520c343af8SMatthew Garrett }
2530c343af8SMatthew Garrett
2540c343af8SMatthew Garrett late_initcall(integrity_fs_init)
255