1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2005,2006,2007,2008 IBM Corporation 4 * 5 * Authors: 6 * Kylene Hall <kjhall@us.ibm.com> 7 * Reiner Sailer <sailer@us.ibm.com> 8 * Mimi Zohar <zohar@us.ibm.com> 9 * 10 * File: ima_fs.c 11 * implemenents security file system for reporting 12 * current measurement list and IMA statistics 13 */ 14 15 #include <linux/fcntl.h> 16 #include <linux/slab.h> 17 #include <linux/init.h> 18 #include <linux/seq_file.h> 19 #include <linux/rculist.h> 20 #include <linux/rcupdate.h> 21 #include <linux/parser.h> 22 #include <linux/vmalloc.h> 23 24 #include "ima.h" 25 26 static DEFINE_MUTEX(ima_write_mutex); 27 28 bool ima_canonical_fmt; 29 static int __init default_canonical_fmt_setup(char *str) 30 { 31 #ifdef __BIG_ENDIAN 32 ima_canonical_fmt = true; 33 #endif 34 return 1; 35 } 36 __setup("ima_canonical_fmt", default_canonical_fmt_setup); 37 38 static int valid_policy = 1; 39 40 static ssize_t ima_show_htable_value(char __user *buf, size_t count, 41 loff_t *ppos, atomic_long_t *val) 42 { 43 char tmpbuf[32]; /* greater than largest 'long' string value */ 44 ssize_t len; 45 46 len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val)); 47 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len); 48 } 49 50 static ssize_t ima_show_htable_violations(struct file *filp, 51 char __user *buf, 52 size_t count, loff_t *ppos) 53 { 54 return ima_show_htable_value(buf, count, ppos, &ima_htable.violations); 55 } 56 57 static const struct file_operations ima_htable_violations_ops = { 58 .read = ima_show_htable_violations, 59 .llseek = generic_file_llseek, 60 }; 61 62 static ssize_t ima_show_measurements_count(struct file *filp, 63 char __user *buf, 64 size_t count, loff_t *ppos) 65 { 66 return ima_show_htable_value(buf, count, ppos, &ima_htable.len); 67 68 } 69 70 static const struct file_operations ima_measurements_count_ops = { 71 .read = ima_show_measurements_count, 72 .llseek = generic_file_llseek, 73 }; 74 75 /* returns pointer to hlist_node */ 76 static void *ima_measurements_start(struct seq_file *m, loff_t *pos) 77 { 78 loff_t l = *pos; 79 struct ima_queue_entry *qe; 80 81 /* we need a lock since pos could point beyond last element */ 82 rcu_read_lock(); 83 list_for_each_entry_rcu(qe, &ima_measurements, later) { 84 if (!l--) { 85 rcu_read_unlock(); 86 return qe; 87 } 88 } 89 rcu_read_unlock(); 90 return NULL; 91 } 92 93 static void *ima_measurements_next(struct seq_file *m, void *v, loff_t *pos) 94 { 95 struct ima_queue_entry *qe = v; 96 97 /* lock protects when reading beyond last element 98 * against concurrent list-extension 99 */ 100 rcu_read_lock(); 101 qe = list_entry_rcu(qe->later.next, struct ima_queue_entry, later); 102 rcu_read_unlock(); 103 (*pos)++; 104 105 return (&qe->later == &ima_measurements) ? NULL : qe; 106 } 107 108 static void ima_measurements_stop(struct seq_file *m, void *v) 109 { 110 } 111 112 void ima_putc(struct seq_file *m, void *data, int datalen) 113 { 114 while (datalen--) 115 seq_putc(m, *(char *)data++); 116 } 117 118 /* print format: 119 * 32bit-le=pcr# 120 * char[20]=template digest 121 * 32bit-le=template name size 122 * char[n]=template name 123 * [eventdata length] 124 * eventdata[n]=template specific data 125 */ 126 int ima_measurements_show(struct seq_file *m, void *v) 127 { 128 /* the list never shrinks, so we don't need a lock here */ 129 struct ima_queue_entry *qe = v; 130 struct ima_template_entry *e; 131 char *template_name; 132 u32 pcr, namelen, template_data_len; /* temporary fields */ 133 bool is_ima_template = false; 134 int i; 135 136 /* get entry */ 137 e = qe->entry; 138 if (e == NULL) 139 return -1; 140 141 template_name = (e->template_desc->name[0] != '\0') ? 142 e->template_desc->name : e->template_desc->fmt; 143 144 /* 145 * 1st: PCRIndex 146 * PCR used defaults to the same (config option) in 147 * little-endian format, unless set in policy 148 */ 149 pcr = !ima_canonical_fmt ? e->pcr : cpu_to_le32(e->pcr); 150 ima_putc(m, &pcr, sizeof(e->pcr)); 151 152 /* 2nd: template digest */ 153 ima_putc(m, e->digests[ima_sha1_idx].digest, TPM_DIGEST_SIZE); 154 155 /* 3rd: template name size */ 156 namelen = !ima_canonical_fmt ? strlen(template_name) : 157 cpu_to_le32(strlen(template_name)); 158 ima_putc(m, &namelen, sizeof(namelen)); 159 160 /* 4th: template name */ 161 ima_putc(m, template_name, strlen(template_name)); 162 163 /* 5th: template length (except for 'ima' template) */ 164 if (strcmp(template_name, IMA_TEMPLATE_IMA_NAME) == 0) 165 is_ima_template = true; 166 167 if (!is_ima_template) { 168 template_data_len = !ima_canonical_fmt ? e->template_data_len : 169 cpu_to_le32(e->template_data_len); 170 ima_putc(m, &template_data_len, sizeof(e->template_data_len)); 171 } 172 173 /* 6th: template specific data */ 174 for (i = 0; i < e->template_desc->num_fields; i++) { 175 enum ima_show_type show = IMA_SHOW_BINARY; 176 const struct ima_template_field *field = 177 e->template_desc->fields[i]; 178 179 if (is_ima_template && strcmp(field->field_id, "d") == 0) 180 show = IMA_SHOW_BINARY_NO_FIELD_LEN; 181 if (is_ima_template && strcmp(field->field_id, "n") == 0) 182 show = IMA_SHOW_BINARY_OLD_STRING_FMT; 183 field->field_show(m, show, &e->template_data[i]); 184 } 185 return 0; 186 } 187 188 static const struct seq_operations ima_measurments_seqops = { 189 .start = ima_measurements_start, 190 .next = ima_measurements_next, 191 .stop = ima_measurements_stop, 192 .show = ima_measurements_show 193 }; 194 195 static int ima_measurements_open(struct inode *inode, struct file *file) 196 { 197 return seq_open(file, &ima_measurments_seqops); 198 } 199 200 static const struct file_operations ima_measurements_ops = { 201 .open = ima_measurements_open, 202 .read = seq_read, 203 .llseek = seq_lseek, 204 .release = seq_release, 205 }; 206 207 void ima_print_digest(struct seq_file *m, u8 *digest, u32 size) 208 { 209 u32 i; 210 211 for (i = 0; i < size; i++) 212 seq_printf(m, "%02x", *(digest + i)); 213 } 214 215 /* print in ascii */ 216 static int ima_ascii_measurements_show(struct seq_file *m, void *v) 217 { 218 /* the list never shrinks, so we don't need a lock here */ 219 struct ima_queue_entry *qe = v; 220 struct ima_template_entry *e; 221 char *template_name; 222 int i; 223 224 /* get entry */ 225 e = qe->entry; 226 if (e == NULL) 227 return -1; 228 229 template_name = (e->template_desc->name[0] != '\0') ? 230 e->template_desc->name : e->template_desc->fmt; 231 232 /* 1st: PCR used (config option) */ 233 seq_printf(m, "%2d ", e->pcr); 234 235 /* 2nd: SHA1 template hash */ 236 ima_print_digest(m, e->digests[ima_sha1_idx].digest, TPM_DIGEST_SIZE); 237 238 /* 3th: template name */ 239 seq_printf(m, " %s", template_name); 240 241 /* 4th: template specific data */ 242 for (i = 0; i < e->template_desc->num_fields; i++) { 243 seq_puts(m, " "); 244 if (e->template_data[i].len == 0) 245 continue; 246 247 e->template_desc->fields[i]->field_show(m, IMA_SHOW_ASCII, 248 &e->template_data[i]); 249 } 250 seq_puts(m, "\n"); 251 return 0; 252 } 253 254 static const struct seq_operations ima_ascii_measurements_seqops = { 255 .start = ima_measurements_start, 256 .next = ima_measurements_next, 257 .stop = ima_measurements_stop, 258 .show = ima_ascii_measurements_show 259 }; 260 261 static int ima_ascii_measurements_open(struct inode *inode, struct file *file) 262 { 263 return seq_open(file, &ima_ascii_measurements_seqops); 264 } 265 266 static const struct file_operations ima_ascii_measurements_ops = { 267 .open = ima_ascii_measurements_open, 268 .read = seq_read, 269 .llseek = seq_lseek, 270 .release = seq_release, 271 }; 272 273 static ssize_t ima_read_policy(char *path) 274 { 275 void *data; 276 char *datap; 277 loff_t size; 278 int rc, pathlen = strlen(path); 279 280 char *p; 281 282 /* remove \n */ 283 datap = path; 284 strsep(&datap, "\n"); 285 286 rc = kernel_read_file_from_path(path, &data, &size, 0, READING_POLICY); 287 if (rc < 0) { 288 pr_err("Unable to open file: %s (%d)", path, rc); 289 return rc; 290 } 291 292 datap = data; 293 while (size > 0 && (p = strsep(&datap, "\n"))) { 294 pr_debug("rule: %s\n", p); 295 rc = ima_parse_add_rule(p); 296 if (rc < 0) 297 break; 298 size -= rc; 299 } 300 301 vfree(data); 302 if (rc < 0) 303 return rc; 304 else if (size) 305 return -EINVAL; 306 else 307 return pathlen; 308 } 309 310 static ssize_t ima_write_policy(struct file *file, const char __user *buf, 311 size_t datalen, loff_t *ppos) 312 { 313 char *data; 314 ssize_t result; 315 316 if (datalen >= PAGE_SIZE) 317 datalen = PAGE_SIZE - 1; 318 319 /* No partial writes. */ 320 result = -EINVAL; 321 if (*ppos != 0) 322 goto out; 323 324 data = memdup_user_nul(buf, datalen); 325 if (IS_ERR(data)) { 326 result = PTR_ERR(data); 327 goto out; 328 } 329 330 result = mutex_lock_interruptible(&ima_write_mutex); 331 if (result < 0) 332 goto out_free; 333 334 if (data[0] == '/') { 335 result = ima_read_policy(data); 336 } else if (ima_appraise & IMA_APPRAISE_POLICY) { 337 pr_err("signed policy file (specified as an absolute pathname) required\n"); 338 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, 339 "policy_update", "signed policy required", 340 1, 0); 341 result = -EACCES; 342 } else { 343 result = ima_parse_add_rule(data); 344 } 345 mutex_unlock(&ima_write_mutex); 346 out_free: 347 kfree(data); 348 out: 349 if (result < 0) 350 valid_policy = 0; 351 352 return result; 353 } 354 355 static struct dentry *ima_dir; 356 static struct dentry *ima_symlink; 357 static struct dentry *binary_runtime_measurements; 358 static struct dentry *ascii_runtime_measurements; 359 static struct dentry *runtime_measurements_count; 360 static struct dentry *violations; 361 static struct dentry *ima_policy; 362 363 enum ima_fs_flags { 364 IMA_FS_BUSY, 365 }; 366 367 static unsigned long ima_fs_flags; 368 369 #ifdef CONFIG_IMA_READ_POLICY 370 static const struct seq_operations ima_policy_seqops = { 371 .start = ima_policy_start, 372 .next = ima_policy_next, 373 .stop = ima_policy_stop, 374 .show = ima_policy_show, 375 }; 376 #endif 377 378 /* 379 * ima_open_policy: sequentialize access to the policy file 380 */ 381 static int ima_open_policy(struct inode *inode, struct file *filp) 382 { 383 if (!(filp->f_flags & O_WRONLY)) { 384 #ifndef CONFIG_IMA_READ_POLICY 385 return -EACCES; 386 #else 387 if ((filp->f_flags & O_ACCMODE) != O_RDONLY) 388 return -EACCES; 389 if (!capable(CAP_SYS_ADMIN)) 390 return -EPERM; 391 return seq_open(filp, &ima_policy_seqops); 392 #endif 393 } 394 if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags)) 395 return -EBUSY; 396 return 0; 397 } 398 399 /* 400 * ima_release_policy - start using the new measure policy rules. 401 * 402 * Initially, ima_measure points to the default policy rules, now 403 * point to the new policy rules, and remove the securityfs policy file, 404 * assuming a valid policy. 405 */ 406 static int ima_release_policy(struct inode *inode, struct file *file) 407 { 408 const char *cause = valid_policy ? "completed" : "failed"; 409 410 if ((file->f_flags & O_ACCMODE) == O_RDONLY) 411 return seq_release(inode, file); 412 413 if (valid_policy && ima_check_policy() < 0) { 414 cause = "failed"; 415 valid_policy = 0; 416 } 417 418 pr_info("policy update %s\n", cause); 419 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, 420 "policy_update", cause, !valid_policy, 0); 421 422 if (!valid_policy) { 423 ima_delete_rules(); 424 valid_policy = 1; 425 clear_bit(IMA_FS_BUSY, &ima_fs_flags); 426 return 0; 427 } 428 429 ima_update_policy(); 430 #if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY) 431 securityfs_remove(ima_policy); 432 ima_policy = NULL; 433 #elif defined(CONFIG_IMA_WRITE_POLICY) 434 clear_bit(IMA_FS_BUSY, &ima_fs_flags); 435 #elif defined(CONFIG_IMA_READ_POLICY) 436 inode->i_mode &= ~S_IWUSR; 437 #endif 438 return 0; 439 } 440 441 static const struct file_operations ima_measure_policy_ops = { 442 .open = ima_open_policy, 443 .write = ima_write_policy, 444 .read = seq_read, 445 .release = ima_release_policy, 446 .llseek = generic_file_llseek, 447 }; 448 449 int __init ima_fs_init(void) 450 { 451 ima_dir = securityfs_create_dir("ima", integrity_dir); 452 if (IS_ERR(ima_dir)) 453 return -1; 454 455 ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima", 456 NULL); 457 if (IS_ERR(ima_symlink)) 458 goto out; 459 460 binary_runtime_measurements = 461 securityfs_create_file("binary_runtime_measurements", 462 S_IRUSR | S_IRGRP, ima_dir, NULL, 463 &ima_measurements_ops); 464 if (IS_ERR(binary_runtime_measurements)) 465 goto out; 466 467 ascii_runtime_measurements = 468 securityfs_create_file("ascii_runtime_measurements", 469 S_IRUSR | S_IRGRP, ima_dir, NULL, 470 &ima_ascii_measurements_ops); 471 if (IS_ERR(ascii_runtime_measurements)) 472 goto out; 473 474 runtime_measurements_count = 475 securityfs_create_file("runtime_measurements_count", 476 S_IRUSR | S_IRGRP, ima_dir, NULL, 477 &ima_measurements_count_ops); 478 if (IS_ERR(runtime_measurements_count)) 479 goto out; 480 481 violations = 482 securityfs_create_file("violations", S_IRUSR | S_IRGRP, 483 ima_dir, NULL, &ima_htable_violations_ops); 484 if (IS_ERR(violations)) 485 goto out; 486 487 ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS, 488 ima_dir, NULL, 489 &ima_measure_policy_ops); 490 if (IS_ERR(ima_policy)) 491 goto out; 492 493 return 0; 494 out: 495 securityfs_remove(violations); 496 securityfs_remove(runtime_measurements_count); 497 securityfs_remove(ascii_runtime_measurements); 498 securityfs_remove(binary_runtime_measurements); 499 securityfs_remove(ima_symlink); 500 securityfs_remove(ima_dir); 501 securityfs_remove(ima_policy); 502 return -1; 503 } 504