1f381c272SMimi Zohar /* 2f381c272SMimi Zohar * Copyright (C) 2008 IBM Corporation 3f381c272SMimi Zohar * 4f381c272SMimi Zohar * Authors: 5f381c272SMimi Zohar * Mimi Zohar <zohar@us.ibm.com> 6f381c272SMimi Zohar * 7f381c272SMimi Zohar * This program is free software; you can redistribute it and/or 8f381c272SMimi Zohar * modify it under the terms of the GNU General Public License as 9f381c272SMimi Zohar * published by the Free Software Foundation, version 2 of the 10f381c272SMimi Zohar * License. 11f381c272SMimi Zohar * 12f381c272SMimi Zohar * File: integrity_iint.c 13f381c272SMimi Zohar * - implements the integrity hooks: integrity_inode_alloc, 14f381c272SMimi Zohar * integrity_inode_free 15f381c272SMimi Zohar * - cache integrity information associated with an inode 16f381c272SMimi Zohar * using a rbtree tree. 17f381c272SMimi Zohar */ 18f381c272SMimi Zohar #include <linux/slab.h> 19f381c272SMimi Zohar #include <linux/module.h> 20f381c272SMimi Zohar #include <linux/spinlock.h> 21f381c272SMimi Zohar #include <linux/rbtree.h> 22f381c272SMimi Zohar #include "integrity.h" 23f381c272SMimi Zohar 24f381c272SMimi Zohar static struct rb_root integrity_iint_tree = RB_ROOT; 25f381c272SMimi Zohar static DEFINE_SPINLOCK(integrity_iint_lock); 26f381c272SMimi Zohar static struct kmem_cache *iint_cache __read_mostly; 27f381c272SMimi Zohar 28f381c272SMimi Zohar int iint_initialized; 29f381c272SMimi Zohar 30f381c272SMimi Zohar /* 31f381c272SMimi Zohar * __integrity_iint_find - return the iint associated with an inode 32f381c272SMimi Zohar */ 33f381c272SMimi Zohar static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) 34f381c272SMimi Zohar { 35f381c272SMimi Zohar struct integrity_iint_cache *iint; 36f381c272SMimi Zohar struct rb_node *n = integrity_iint_tree.rb_node; 37f381c272SMimi Zohar 38f381c272SMimi Zohar assert_spin_locked(&integrity_iint_lock); 39f381c272SMimi Zohar 40f381c272SMimi Zohar while (n) { 41f381c272SMimi Zohar iint = rb_entry(n, struct integrity_iint_cache, rb_node); 42f381c272SMimi Zohar 43f381c272SMimi Zohar if (inode < iint->inode) 44f381c272SMimi Zohar n = n->rb_left; 45f381c272SMimi Zohar else if (inode > iint->inode) 46f381c272SMimi Zohar n = n->rb_right; 47f381c272SMimi Zohar else 48f381c272SMimi Zohar break; 49f381c272SMimi Zohar } 50f381c272SMimi Zohar if (!n) 51f381c272SMimi Zohar return NULL; 52f381c272SMimi Zohar 53f381c272SMimi Zohar return iint; 54f381c272SMimi Zohar } 55f381c272SMimi Zohar 56f381c272SMimi Zohar /* 57f381c272SMimi Zohar * integrity_iint_find - return the iint associated with an inode 58f381c272SMimi Zohar */ 59f381c272SMimi Zohar struct integrity_iint_cache *integrity_iint_find(struct inode *inode) 60f381c272SMimi Zohar { 61f381c272SMimi Zohar struct integrity_iint_cache *iint; 62f381c272SMimi Zohar 63f381c272SMimi Zohar if (!IS_IMA(inode)) 64f381c272SMimi Zohar return NULL; 65f381c272SMimi Zohar 66f381c272SMimi Zohar spin_lock(&integrity_iint_lock); 67f381c272SMimi Zohar iint = __integrity_iint_find(inode); 68f381c272SMimi Zohar spin_unlock(&integrity_iint_lock); 69f381c272SMimi Zohar 70f381c272SMimi Zohar return iint; 71f381c272SMimi Zohar } 72f381c272SMimi Zohar 73f381c272SMimi Zohar static void iint_free(struct integrity_iint_cache *iint) 74f381c272SMimi Zohar { 75f381c272SMimi Zohar iint->version = 0; 76f381c272SMimi Zohar iint->flags = 0UL; 77fb788d8bSDmitry Kasatkin iint->evm_status = INTEGRITY_UNKNOWN; 78f381c272SMimi Zohar kmem_cache_free(iint_cache, iint); 79f381c272SMimi Zohar } 80f381c272SMimi Zohar 81f381c272SMimi Zohar /** 82f381c272SMimi Zohar * integrity_inode_alloc - allocate an iint associated with an inode 83f381c272SMimi Zohar * @inode: pointer to the inode 84f381c272SMimi Zohar */ 85f381c272SMimi Zohar int integrity_inode_alloc(struct inode *inode) 86f381c272SMimi Zohar { 87f381c272SMimi Zohar struct rb_node **p; 88f381c272SMimi Zohar struct rb_node *new_node, *parent = NULL; 89f381c272SMimi Zohar struct integrity_iint_cache *new_iint, *test_iint; 90f381c272SMimi Zohar int rc; 91f381c272SMimi Zohar 92f381c272SMimi Zohar new_iint = kmem_cache_alloc(iint_cache, GFP_NOFS); 93f381c272SMimi Zohar if (!new_iint) 94f381c272SMimi Zohar return -ENOMEM; 95f381c272SMimi Zohar 96f381c272SMimi Zohar new_iint->inode = inode; 97f381c272SMimi Zohar new_node = &new_iint->rb_node; 98f381c272SMimi Zohar 99f381c272SMimi Zohar mutex_lock(&inode->i_mutex); /* i_flags */ 100f381c272SMimi Zohar spin_lock(&integrity_iint_lock); 101f381c272SMimi Zohar 102f381c272SMimi Zohar p = &integrity_iint_tree.rb_node; 103f381c272SMimi Zohar while (*p) { 104f381c272SMimi Zohar parent = *p; 105f381c272SMimi Zohar test_iint = rb_entry(parent, struct integrity_iint_cache, 106f381c272SMimi Zohar rb_node); 107f381c272SMimi Zohar rc = -EEXIST; 108f381c272SMimi Zohar if (inode < test_iint->inode) 109f381c272SMimi Zohar p = &(*p)->rb_left; 110f381c272SMimi Zohar else if (inode > test_iint->inode) 111f381c272SMimi Zohar p = &(*p)->rb_right; 112f381c272SMimi Zohar else 113f381c272SMimi Zohar goto out_err; 114f381c272SMimi Zohar } 115f381c272SMimi Zohar 116f381c272SMimi Zohar inode->i_flags |= S_IMA; 117f381c272SMimi Zohar rb_link_node(new_node, parent, p); 118f381c272SMimi Zohar rb_insert_color(new_node, &integrity_iint_tree); 119f381c272SMimi Zohar 120f381c272SMimi Zohar spin_unlock(&integrity_iint_lock); 121f381c272SMimi Zohar mutex_unlock(&inode->i_mutex); /* i_flags */ 122f381c272SMimi Zohar 123f381c272SMimi Zohar return 0; 124f381c272SMimi Zohar out_err: 125f381c272SMimi Zohar spin_unlock(&integrity_iint_lock); 126f381c272SMimi Zohar mutex_unlock(&inode->i_mutex); /* i_flags */ 127f381c272SMimi Zohar iint_free(new_iint); 128f381c272SMimi Zohar 129f381c272SMimi Zohar return rc; 130f381c272SMimi Zohar } 131f381c272SMimi Zohar 132f381c272SMimi Zohar /** 133f381c272SMimi Zohar * integrity_inode_free - called on security_inode_free 134f381c272SMimi Zohar * @inode: pointer to the inode 135f381c272SMimi Zohar * 136f381c272SMimi Zohar * Free the integrity information(iint) associated with an inode. 137f381c272SMimi Zohar */ 138f381c272SMimi Zohar void integrity_inode_free(struct inode *inode) 139f381c272SMimi Zohar { 140f381c272SMimi Zohar struct integrity_iint_cache *iint; 141f381c272SMimi Zohar 142f381c272SMimi Zohar if (!IS_IMA(inode)) 143f381c272SMimi Zohar return; 144f381c272SMimi Zohar 145f381c272SMimi Zohar spin_lock(&integrity_iint_lock); 146f381c272SMimi Zohar iint = __integrity_iint_find(inode); 147f381c272SMimi Zohar rb_erase(&iint->rb_node, &integrity_iint_tree); 148f381c272SMimi Zohar spin_unlock(&integrity_iint_lock); 149f381c272SMimi Zohar 150f381c272SMimi Zohar iint_free(iint); 151f381c272SMimi Zohar } 152f381c272SMimi Zohar 153f381c272SMimi Zohar static void init_once(void *foo) 154f381c272SMimi Zohar { 155f381c272SMimi Zohar struct integrity_iint_cache *iint = foo; 156f381c272SMimi Zohar 157f381c272SMimi Zohar memset(iint, 0, sizeof *iint); 158f381c272SMimi Zohar iint->version = 0; 159f381c272SMimi Zohar iint->flags = 0UL; 160f381c272SMimi Zohar mutex_init(&iint->mutex); 16124e0198eSDmitry Kasatkin iint->evm_status = INTEGRITY_UNKNOWN; 162f381c272SMimi Zohar } 163f381c272SMimi Zohar 164f381c272SMimi Zohar static int __init integrity_iintcache_init(void) 165f381c272SMimi Zohar { 166f381c272SMimi Zohar iint_cache = 167f381c272SMimi Zohar kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache), 168f381c272SMimi Zohar 0, SLAB_PANIC, init_once); 169f381c272SMimi Zohar iint_initialized = 1; 170f381c272SMimi Zohar return 0; 171f381c272SMimi Zohar } 172f381c272SMimi Zohar security_initcall(integrity_iintcache_init); 173