1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2008 IBM Corporation 4 * 5 * Authors: 6 * Mimi Zohar <zohar@us.ibm.com> 7 * 8 * File: integrity_iint.c 9 * - implements the integrity hooks: integrity_inode_alloc, 10 * integrity_inode_free 11 * - cache integrity information associated with an inode 12 * using a rbtree tree. 13 */ 14 #include <linux/slab.h> 15 #include <linux/init.h> 16 #include <linux/spinlock.h> 17 #include <linux/rbtree.h> 18 #include <linux/file.h> 19 #include <linux/uaccess.h> 20 #include <linux/security.h> 21 #include <linux/lsm_hooks.h> 22 #include "integrity.h" 23 24 static struct rb_root integrity_iint_tree = RB_ROOT; 25 static DEFINE_RWLOCK(integrity_iint_lock); 26 static struct kmem_cache *iint_cache __read_mostly; 27 28 struct dentry *integrity_dir; 29 30 /* 31 * __integrity_iint_find - return the iint associated with an inode 32 */ 33 static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) 34 { 35 struct integrity_iint_cache *iint; 36 struct rb_node *n = integrity_iint_tree.rb_node; 37 38 while (n) { 39 iint = rb_entry(n, struct integrity_iint_cache, rb_node); 40 41 if (inode < iint->inode) 42 n = n->rb_left; 43 else if (inode > iint->inode) 44 n = n->rb_right; 45 else 46 return iint; 47 } 48 49 return NULL; 50 } 51 52 /* 53 * integrity_iint_find - return the iint associated with an inode 54 */ 55 struct integrity_iint_cache *integrity_iint_find(struct inode *inode) 56 { 57 struct integrity_iint_cache *iint; 58 59 if (!IS_IMA(inode)) 60 return NULL; 61 62 read_lock(&integrity_iint_lock); 63 iint = __integrity_iint_find(inode); 64 read_unlock(&integrity_iint_lock); 65 66 return iint; 67 } 68 69 static void iint_free(struct integrity_iint_cache *iint) 70 { 71 kfree(iint->ima_hash); 72 iint->ima_hash = NULL; 73 iint->version = 0; 74 iint->flags = 0UL; 75 iint->atomic_flags = 0UL; 76 iint->ima_file_status = INTEGRITY_UNKNOWN; 77 iint->ima_mmap_status = INTEGRITY_UNKNOWN; 78 iint->ima_bprm_status = INTEGRITY_UNKNOWN; 79 iint->ima_read_status = INTEGRITY_UNKNOWN; 80 iint->ima_creds_status = INTEGRITY_UNKNOWN; 81 iint->evm_status = INTEGRITY_UNKNOWN; 82 iint->measured_pcrs = 0; 83 kmem_cache_free(iint_cache, iint); 84 } 85 86 /** 87 * integrity_inode_get - find or allocate an iint associated with an inode 88 * @inode: pointer to the inode 89 * @return: allocated iint 90 * 91 * Caller must lock i_mutex 92 */ 93 struct integrity_iint_cache *integrity_inode_get(struct inode *inode) 94 { 95 struct rb_node **p; 96 struct rb_node *node, *parent = NULL; 97 struct integrity_iint_cache *iint, *test_iint; 98 99 iint = integrity_iint_find(inode); 100 if (iint) 101 return iint; 102 103 iint = kmem_cache_alloc(iint_cache, GFP_NOFS); 104 if (!iint) 105 return NULL; 106 107 write_lock(&integrity_iint_lock); 108 109 p = &integrity_iint_tree.rb_node; 110 while (*p) { 111 parent = *p; 112 test_iint = rb_entry(parent, struct integrity_iint_cache, 113 rb_node); 114 if (inode < test_iint->inode) { 115 p = &(*p)->rb_left; 116 } else if (inode > test_iint->inode) { 117 p = &(*p)->rb_right; 118 } else { 119 write_unlock(&integrity_iint_lock); 120 kmem_cache_free(iint_cache, iint); 121 return test_iint; 122 } 123 } 124 125 iint->inode = inode; 126 node = &iint->rb_node; 127 inode->i_flags |= S_IMA; 128 rb_link_node(node, parent, p); 129 rb_insert_color(node, &integrity_iint_tree); 130 131 write_unlock(&integrity_iint_lock); 132 return iint; 133 } 134 135 /** 136 * integrity_inode_free - called on security_inode_free 137 * @inode: pointer to the inode 138 * 139 * Free the integrity information(iint) associated with an inode. 140 */ 141 void integrity_inode_free(struct inode *inode) 142 { 143 struct integrity_iint_cache *iint; 144 145 if (!IS_IMA(inode)) 146 return; 147 148 write_lock(&integrity_iint_lock); 149 iint = __integrity_iint_find(inode); 150 rb_erase(&iint->rb_node, &integrity_iint_tree); 151 write_unlock(&integrity_iint_lock); 152 153 iint_free(iint); 154 } 155 156 static void init_once(void *foo) 157 { 158 struct integrity_iint_cache *iint = (struct integrity_iint_cache *) foo; 159 160 memset(iint, 0, sizeof(*iint)); 161 iint->ima_file_status = INTEGRITY_UNKNOWN; 162 iint->ima_mmap_status = INTEGRITY_UNKNOWN; 163 iint->ima_bprm_status = INTEGRITY_UNKNOWN; 164 iint->ima_read_status = INTEGRITY_UNKNOWN; 165 iint->ima_creds_status = INTEGRITY_UNKNOWN; 166 iint->evm_status = INTEGRITY_UNKNOWN; 167 mutex_init(&iint->mutex); 168 } 169 170 static int __init integrity_iintcache_init(void) 171 { 172 iint_cache = 173 kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache), 174 0, SLAB_PANIC, init_once); 175 return 0; 176 } 177 DEFINE_LSM(integrity) = { 178 .name = "integrity", 179 .init = integrity_iintcache_init, 180 .order = LSM_ORDER_LAST, 181 }; 182 183 184 /* 185 * integrity_kernel_read - read data from the file 186 * 187 * This is a function for reading file content instead of kernel_read(). 188 * It does not perform locking checks to ensure it cannot be blocked. 189 * It does not perform security checks because it is irrelevant for IMA. 190 * 191 */ 192 int integrity_kernel_read(struct file *file, loff_t offset, 193 void *addr, unsigned long count) 194 { 195 return __kernel_read(file, addr, count, &offset); 196 } 197 198 /* 199 * integrity_load_keys - load integrity keys hook 200 * 201 * Hooks is called from init/main.c:kernel_init_freeable() 202 * when rootfs is ready 203 */ 204 void __init integrity_load_keys(void) 205 { 206 ima_load_x509(); 207 208 if (!IS_ENABLED(CONFIG_IMA_LOAD_X509)) 209 evm_load_x509(); 210 } 211 212 static int __init integrity_fs_init(void) 213 { 214 integrity_dir = securityfs_create_dir("integrity", NULL); 215 if (IS_ERR(integrity_dir)) { 216 int ret = PTR_ERR(integrity_dir); 217 218 if (ret != -ENODEV) 219 pr_err("Unable to create integrity sysfs dir: %d\n", 220 ret); 221 integrity_dir = NULL; 222 return ret; 223 } 224 225 return 0; 226 } 227 228 late_initcall(integrity_fs_init) 229