1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Integrity Measurement Architecture
4  *
5  * Copyright (C) 2005,2006,2007,2008 IBM Corporation
6  *
7  * Authors:
8  * Reiner Sailer <sailer@watson.ibm.com>
9  * Serge Hallyn <serue@us.ibm.com>
10  * Kylene Hall <kylene@us.ibm.com>
11  * Mimi Zohar <zohar@us.ibm.com>
12  *
13  * File: ima_main.c
14  *	implements the IMA hooks: ima_bprm_check, ima_file_mmap,
15  *	and ima_file_check.
16  */
17 
18 #include <linux/module.h>
19 #include <linux/file.h>
20 #include <linux/binfmts.h>
21 #include <linux/mount.h>
22 #include <linux/mman.h>
23 #include <linux/slab.h>
24 #include <linux/xattr.h>
25 #include <linux/ima.h>
26 #include <linux/iversion.h>
27 #include <linux/fs.h>
28 
29 #include "ima.h"
30 
31 #ifdef CONFIG_IMA_APPRAISE
32 int ima_appraise = IMA_APPRAISE_ENFORCE;
33 #else
34 int ima_appraise;
35 #endif
36 
37 int ima_hash_algo = HASH_ALGO_SHA1;
38 static int hash_setup_done;
39 
40 static struct notifier_block ima_lsm_policy_notifier = {
41 	.notifier_call = ima_lsm_policy_change,
42 };
43 
44 static int __init hash_setup(char *str)
45 {
46 	struct ima_template_desc *template_desc = ima_template_desc_current();
47 	int i;
48 
49 	if (hash_setup_done)
50 		return 1;
51 
52 	if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) {
53 		if (strncmp(str, "sha1", 4) == 0)
54 			ima_hash_algo = HASH_ALGO_SHA1;
55 		else if (strncmp(str, "md5", 3) == 0)
56 			ima_hash_algo = HASH_ALGO_MD5;
57 		else
58 			return 1;
59 		goto out;
60 	}
61 
62 	i = match_string(hash_algo_name, HASH_ALGO__LAST, str);
63 	if (i < 0)
64 		return 1;
65 
66 	ima_hash_algo = i;
67 out:
68 	hash_setup_done = 1;
69 	return 1;
70 }
71 __setup("ima_hash=", hash_setup);
72 
73 /* Prevent mmap'ing a file execute that is already mmap'ed write */
74 static int mmap_violation_check(enum ima_hooks func, struct file *file,
75 				char **pathbuf, const char **pathname,
76 				char *filename)
77 {
78 	struct inode *inode;
79 	int rc = 0;
80 
81 	if ((func == MMAP_CHECK) && mapping_writably_mapped(file->f_mapping)) {
82 		rc = -ETXTBSY;
83 		inode = file_inode(file);
84 
85 		if (!*pathbuf)	/* ima_rdwr_violation possibly pre-fetched */
86 			*pathname = ima_d_path(&file->f_path, pathbuf,
87 					       filename);
88 		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, *pathname,
89 				    "mmap_file", "mmapped_writers", rc, 0);
90 	}
91 	return rc;
92 }
93 
94 /*
95  * ima_rdwr_violation_check
96  *
97  * Only invalidate the PCR for measured files:
98  *	- Opening a file for write when already open for read,
99  *	  results in a time of measure, time of use (ToMToU) error.
100  *	- Opening a file for read when already open for write,
101  *	  could result in a file measurement error.
102  *
103  */
104 static void ima_rdwr_violation_check(struct file *file,
105 				     struct integrity_iint_cache *iint,
106 				     int must_measure,
107 				     char **pathbuf,
108 				     const char **pathname,
109 				     char *filename)
110 {
111 	struct inode *inode = file_inode(file);
112 	fmode_t mode = file->f_mode;
113 	bool send_tomtou = false, send_writers = false;
114 
115 	if (mode & FMODE_WRITE) {
116 		if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) {
117 			if (!iint)
118 				iint = integrity_iint_find(inode);
119 			/* IMA_MEASURE is set from reader side */
120 			if (iint && test_bit(IMA_MUST_MEASURE,
121 						&iint->atomic_flags))
122 				send_tomtou = true;
123 		}
124 	} else {
125 		if (must_measure)
126 			set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);
127 		if (inode_is_open_for_write(inode) && must_measure)
128 			send_writers = true;
129 	}
130 
131 	if (!send_tomtou && !send_writers)
132 		return;
133 
134 	*pathname = ima_d_path(&file->f_path, pathbuf, filename);
135 
136 	if (send_tomtou)
137 		ima_add_violation(file, *pathname, iint,
138 				  "invalid_pcr", "ToMToU");
139 	if (send_writers)
140 		ima_add_violation(file, *pathname, iint,
141 				  "invalid_pcr", "open_writers");
142 }
143 
144 static void ima_check_last_writer(struct integrity_iint_cache *iint,
145 				  struct inode *inode, struct file *file)
146 {
147 	fmode_t mode = file->f_mode;
148 	bool update;
149 
150 	if (!(mode & FMODE_WRITE))
151 		return;
152 
153 	mutex_lock(&iint->mutex);
154 	if (atomic_read(&inode->i_writecount) == 1) {
155 		update = test_and_clear_bit(IMA_UPDATE_XATTR,
156 					    &iint->atomic_flags);
157 		if (!IS_I_VERSION(inode) ||
158 		    !inode_eq_iversion(inode, iint->version) ||
159 		    (iint->flags & IMA_NEW_FILE)) {
160 			iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
161 			iint->measured_pcrs = 0;
162 			if (update)
163 				ima_update_xattr(iint, file);
164 		}
165 	}
166 	mutex_unlock(&iint->mutex);
167 }
168 
169 /**
170  * ima_file_free - called on __fput()
171  * @file: pointer to file structure being freed
172  *
173  * Flag files that changed, based on i_version
174  */
175 void ima_file_free(struct file *file)
176 {
177 	struct inode *inode = file_inode(file);
178 	struct integrity_iint_cache *iint;
179 
180 	if (!ima_policy_flag || !S_ISREG(inode->i_mode))
181 		return;
182 
183 	iint = integrity_iint_find(inode);
184 	if (!iint)
185 		return;
186 
187 	ima_check_last_writer(iint, inode, file);
188 }
189 
190 static int process_measurement(struct file *file, const struct cred *cred,
191 			       u32 secid, char *buf, loff_t size, int mask,
192 			       enum ima_hooks func)
193 {
194 	struct inode *inode = file_inode(file);
195 	struct integrity_iint_cache *iint = NULL;
196 	struct ima_template_desc *template_desc = NULL;
197 	char *pathbuf = NULL;
198 	char filename[NAME_MAX];
199 	const char *pathname = NULL;
200 	int rc = 0, action, must_appraise = 0;
201 	int pcr = CONFIG_IMA_MEASURE_PCR_IDX;
202 	struct evm_ima_xattr_data *xattr_value = NULL;
203 	struct modsig *modsig = NULL;
204 	int xattr_len = 0;
205 	bool violation_check;
206 	enum hash_algo hash_algo;
207 
208 	if (!ima_policy_flag || !S_ISREG(inode->i_mode))
209 		return 0;
210 
211 	/* Return an IMA_MEASURE, IMA_APPRAISE, IMA_AUDIT action
212 	 * bitmask based on the appraise/audit/measurement policy.
213 	 * Included is the appraise submask.
214 	 */
215 	action = ima_get_action(inode, cred, secid, mask, func, &pcr,
216 				&template_desc, NULL);
217 	violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) &&
218 			   (ima_policy_flag & IMA_MEASURE));
219 	if (!action && !violation_check)
220 		return 0;
221 
222 	must_appraise = action & IMA_APPRAISE;
223 
224 	/*  Is the appraise rule hook specific?  */
225 	if (action & IMA_FILE_APPRAISE)
226 		func = FILE_CHECK;
227 
228 	inode_lock(inode);
229 
230 	if (action) {
231 		iint = integrity_inode_get(inode);
232 		if (!iint)
233 			rc = -ENOMEM;
234 	}
235 
236 	if (!rc && violation_check)
237 		ima_rdwr_violation_check(file, iint, action & IMA_MEASURE,
238 					 &pathbuf, &pathname, filename);
239 
240 	inode_unlock(inode);
241 
242 	if (rc)
243 		goto out;
244 	if (!action)
245 		goto out;
246 
247 	mutex_lock(&iint->mutex);
248 
249 	if (test_and_clear_bit(IMA_CHANGE_ATTR, &iint->atomic_flags))
250 		/* reset appraisal flags if ima_inode_post_setattr was called */
251 		iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED |
252 				 IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
253 				 IMA_ACTION_FLAGS);
254 
255 	/*
256 	 * Re-evaulate the file if either the xattr has changed or the
257 	 * kernel has no way of detecting file change on the filesystem.
258 	 * (Limited to privileged mounted filesystems.)
259 	 */
260 	if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags) ||
261 	    ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) &&
262 	     !(inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER) &&
263 	     !(action & IMA_FAIL_UNVERIFIABLE_SIGS))) {
264 		iint->flags &= ~IMA_DONE_MASK;
265 		iint->measured_pcrs = 0;
266 	}
267 
268 	/* Determine if already appraised/measured based on bitmask
269 	 * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,
270 	 *  IMA_AUDIT, IMA_AUDITED)
271 	 */
272 	iint->flags |= action;
273 	action &= IMA_DO_MASK;
274 	action &= ~((iint->flags & (IMA_DONE_MASK ^ IMA_MEASURED)) >> 1);
275 
276 	/* If target pcr is already measured, unset IMA_MEASURE action */
277 	if ((action & IMA_MEASURE) && (iint->measured_pcrs & (0x1 << pcr)))
278 		action ^= IMA_MEASURE;
279 
280 	/* HASH sets the digital signature and update flags, nothing else */
281 	if ((action & IMA_HASH) &&
282 	    !(test_bit(IMA_DIGSIG, &iint->atomic_flags))) {
283 		xattr_len = ima_read_xattr(file_dentry(file), &xattr_value);
284 		if ((xattr_value && xattr_len > 2) &&
285 		    (xattr_value->type == EVM_IMA_XATTR_DIGSIG))
286 			set_bit(IMA_DIGSIG, &iint->atomic_flags);
287 		iint->flags |= IMA_HASHED;
288 		action ^= IMA_HASH;
289 		set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
290 	}
291 
292 	/* Nothing to do, just return existing appraised status */
293 	if (!action) {
294 		if (must_appraise) {
295 			rc = mmap_violation_check(func, file, &pathbuf,
296 						  &pathname, filename);
297 			if (!rc)
298 				rc = ima_get_cache_status(iint, func);
299 		}
300 		goto out_locked;
301 	}
302 
303 	if ((action & IMA_APPRAISE_SUBMASK) ||
304 	    strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) != 0) {
305 		/* read 'security.ima' */
306 		xattr_len = ima_read_xattr(file_dentry(file), &xattr_value);
307 
308 		/*
309 		 * Read the appended modsig if allowed by the policy, and allow
310 		 * an additional measurement list entry, if needed, based on the
311 		 * template format and whether the file was already measured.
312 		 */
313 		if (iint->flags & IMA_MODSIG_ALLOWED) {
314 			rc = ima_read_modsig(func, buf, size, &modsig);
315 
316 			if (!rc && ima_template_has_modsig(template_desc) &&
317 			    iint->flags & IMA_MEASURED)
318 				action |= IMA_MEASURE;
319 		}
320 	}
321 
322 	hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
323 
324 	rc = ima_collect_measurement(iint, file, buf, size, hash_algo, modsig);
325 	if (rc != 0 && rc != -EBADF && rc != -EINVAL)
326 		goto out_locked;
327 
328 	if (!pathbuf)	/* ima_rdwr_violation possibly pre-fetched */
329 		pathname = ima_d_path(&file->f_path, &pathbuf, filename);
330 
331 	if (action & IMA_MEASURE)
332 		ima_store_measurement(iint, file, pathname,
333 				      xattr_value, xattr_len, modsig, pcr,
334 				      template_desc);
335 	if (rc == 0 && (action & IMA_APPRAISE_SUBMASK)) {
336 		rc = ima_check_blacklist(iint, modsig, pcr);
337 		if (rc != -EPERM) {
338 			inode_lock(inode);
339 			rc = ima_appraise_measurement(func, iint, file,
340 						      pathname, xattr_value,
341 						      xattr_len, modsig);
342 			inode_unlock(inode);
343 		}
344 		if (!rc)
345 			rc = mmap_violation_check(func, file, &pathbuf,
346 						  &pathname, filename);
347 	}
348 	if (action & IMA_AUDIT)
349 		ima_audit_measurement(iint, pathname);
350 
351 	if ((file->f_flags & O_DIRECT) && (iint->flags & IMA_PERMIT_DIRECTIO))
352 		rc = 0;
353 out_locked:
354 	if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) &&
355 	     !(iint->flags & IMA_NEW_FILE))
356 		rc = -EACCES;
357 	mutex_unlock(&iint->mutex);
358 	kfree(xattr_value);
359 	ima_free_modsig(modsig);
360 out:
361 	if (pathbuf)
362 		__putname(pathbuf);
363 	if (must_appraise) {
364 		if (rc && (ima_appraise & IMA_APPRAISE_ENFORCE))
365 			return -EACCES;
366 		if (file->f_mode & FMODE_WRITE)
367 			set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
368 	}
369 	return 0;
370 }
371 
372 /**
373  * ima_file_mmap - based on policy, collect/store measurement.
374  * @file: pointer to the file to be measured (May be NULL)
375  * @prot: contains the protection that will be applied by the kernel.
376  *
377  * Measure files being mmapped executable based on the ima_must_measure()
378  * policy decision.
379  *
380  * On success return 0.  On integrity appraisal error, assuming the file
381  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
382  */
383 int ima_file_mmap(struct file *file, unsigned long prot)
384 {
385 	u32 secid;
386 
387 	if (file && (prot & PROT_EXEC)) {
388 		security_task_getsecid(current, &secid);
389 		return process_measurement(file, current_cred(), secid, NULL,
390 					   0, MAY_EXEC, MMAP_CHECK);
391 	}
392 
393 	return 0;
394 }
395 
396 /**
397  * ima_file_mprotect - based on policy, limit mprotect change
398  * @prot: contains the protection that will be applied by the kernel.
399  *
400  * Files can be mmap'ed read/write and later changed to execute to circumvent
401  * IMA's mmap appraisal policy rules.  Due to locking issues (mmap semaphore
402  * would be taken before i_mutex), files can not be measured or appraised at
403  * this point.  Eliminate this integrity gap by denying the mprotect
404  * PROT_EXECUTE change, if an mmap appraise policy rule exists.
405  *
406  * On mprotect change success, return 0.  On failure, return -EACESS.
407  */
408 int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
409 {
410 	struct ima_template_desc *template;
411 	struct file *file = vma->vm_file;
412 	char filename[NAME_MAX];
413 	char *pathbuf = NULL;
414 	const char *pathname = NULL;
415 	struct inode *inode;
416 	int result = 0;
417 	int action;
418 	u32 secid;
419 	int pcr;
420 
421 	/* Is mprotect making an mmap'ed file executable? */
422 	if (!(ima_policy_flag & IMA_APPRAISE) || !vma->vm_file ||
423 	    !(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC))
424 		return 0;
425 
426 	security_task_getsecid(current, &secid);
427 	inode = file_inode(vma->vm_file);
428 	action = ima_get_action(inode, current_cred(), secid, MAY_EXEC,
429 				MMAP_CHECK, &pcr, &template, 0);
430 
431 	/* Is the mmap'ed file in policy? */
432 	if (!(action & (IMA_MEASURE | IMA_APPRAISE_SUBMASK)))
433 		return 0;
434 
435 	if (action & IMA_APPRAISE_SUBMASK)
436 		result = -EPERM;
437 
438 	file = vma->vm_file;
439 	pathname = ima_d_path(&file->f_path, &pathbuf, filename);
440 	integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, pathname,
441 			    "collect_data", "failed-mprotect", result, 0);
442 	if (pathbuf)
443 		__putname(pathbuf);
444 
445 	return result;
446 }
447 
448 /**
449  * ima_bprm_check - based on policy, collect/store measurement.
450  * @bprm: contains the linux_binprm structure
451  *
452  * The OS protects against an executable file, already open for write,
453  * from being executed in deny_write_access() and an executable file,
454  * already open for execute, from being modified in get_write_access().
455  * So we can be certain that what we verify and measure here is actually
456  * what is being executed.
457  *
458  * On success return 0.  On integrity appraisal error, assuming the file
459  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
460  */
461 int ima_bprm_check(struct linux_binprm *bprm)
462 {
463 	int ret;
464 	u32 secid;
465 
466 	security_task_getsecid(current, &secid);
467 	ret = process_measurement(bprm->file, current_cred(), secid, NULL, 0,
468 				  MAY_EXEC, BPRM_CHECK);
469 	if (ret)
470 		return ret;
471 
472 	security_cred_getsecid(bprm->cred, &secid);
473 	return process_measurement(bprm->file, bprm->cred, secid, NULL, 0,
474 				   MAY_EXEC, CREDS_CHECK);
475 }
476 
477 /**
478  * ima_path_check - based on policy, collect/store measurement.
479  * @file: pointer to the file to be measured
480  * @mask: contains MAY_READ, MAY_WRITE, MAY_EXEC or MAY_APPEND
481  *
482  * Measure files based on the ima_must_measure() policy decision.
483  *
484  * On success return 0.  On integrity appraisal error, assuming the file
485  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
486  */
487 int ima_file_check(struct file *file, int mask)
488 {
489 	u32 secid;
490 
491 	security_task_getsecid(current, &secid);
492 	return process_measurement(file, current_cred(), secid, NULL, 0,
493 				   mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
494 					   MAY_APPEND), FILE_CHECK);
495 }
496 EXPORT_SYMBOL_GPL(ima_file_check);
497 
498 /**
499  * ima_file_hash - return the stored measurement if a file has been hashed and
500  * is in the iint cache.
501  * @file: pointer to the file
502  * @buf: buffer in which to store the hash
503  * @buf_size: length of the buffer
504  *
505  * On success, return the hash algorithm (as defined in the enum hash_algo).
506  * If buf is not NULL, this function also outputs the hash into buf.
507  * If the hash is larger than buf_size, then only buf_size bytes will be copied.
508  * It generally just makes sense to pass a buffer capable of holding the largest
509  * possible hash: IMA_MAX_DIGEST_SIZE.
510  * The file hash returned is based on the entire file, including the appended
511  * signature.
512  *
513  * If IMA is disabled or if no measurement is available, return -EOPNOTSUPP.
514  * If the parameters are incorrect, return -EINVAL.
515  */
516 int ima_file_hash(struct file *file, char *buf, size_t buf_size)
517 {
518 	struct inode *inode;
519 	struct integrity_iint_cache *iint;
520 	int hash_algo;
521 
522 	if (!file)
523 		return -EINVAL;
524 
525 	if (!ima_policy_flag)
526 		return -EOPNOTSUPP;
527 
528 	inode = file_inode(file);
529 	iint = integrity_iint_find(inode);
530 	if (!iint)
531 		return -EOPNOTSUPP;
532 
533 	mutex_lock(&iint->mutex);
534 	if (buf) {
535 		size_t copied_size;
536 
537 		copied_size = min_t(size_t, iint->ima_hash->length, buf_size);
538 		memcpy(buf, iint->ima_hash->digest, copied_size);
539 	}
540 	hash_algo = iint->ima_hash->algo;
541 	mutex_unlock(&iint->mutex);
542 
543 	return hash_algo;
544 }
545 EXPORT_SYMBOL_GPL(ima_file_hash);
546 
547 /**
548  * ima_post_create_tmpfile - mark newly created tmpfile as new
549  * @file : newly created tmpfile
550  *
551  * No measuring, appraising or auditing of newly created tmpfiles is needed.
552  * Skip calling process_measurement(), but indicate which newly, created
553  * tmpfiles are in policy.
554  */
555 void ima_post_create_tmpfile(struct inode *inode)
556 {
557 	struct integrity_iint_cache *iint;
558 	int must_appraise;
559 
560 	must_appraise = ima_must_appraise(inode, MAY_ACCESS, FILE_CHECK);
561 	if (!must_appraise)
562 		return;
563 
564 	/* Nothing to do if we can't allocate memory */
565 	iint = integrity_inode_get(inode);
566 	if (!iint)
567 		return;
568 
569 	/* needed for writing the security xattrs */
570 	set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
571 	iint->ima_file_status = INTEGRITY_PASS;
572 }
573 
574 /**
575  * ima_post_path_mknod - mark as a new inode
576  * @dentry: newly created dentry
577  *
578  * Mark files created via the mknodat syscall as new, so that the
579  * file data can be written later.
580  */
581 void ima_post_path_mknod(struct dentry *dentry)
582 {
583 	struct integrity_iint_cache *iint;
584 	struct inode *inode = dentry->d_inode;
585 	int must_appraise;
586 
587 	must_appraise = ima_must_appraise(inode, MAY_ACCESS, FILE_CHECK);
588 	if (!must_appraise)
589 		return;
590 
591 	/* Nothing to do if we can't allocate memory */
592 	iint = integrity_inode_get(inode);
593 	if (!iint)
594 		return;
595 
596 	/* needed for re-opening empty files */
597 	iint->flags |= IMA_NEW_FILE;
598 }
599 
600 /**
601  * ima_read_file - pre-measure/appraise hook decision based on policy
602  * @file: pointer to the file to be measured/appraised/audit
603  * @read_id: caller identifier
604  *
605  * Permit reading a file based on policy. The policy rules are written
606  * in terms of the policy identifier.  Appraising the integrity of
607  * a file requires a file descriptor.
608  *
609  * For permission return 0, otherwise return -EACCES.
610  */
611 int ima_read_file(struct file *file, enum kernel_read_file_id read_id)
612 {
613 	/*
614 	 * READING_FIRMWARE_PREALLOC_BUFFER
615 	 *
616 	 * Do devices using pre-allocated memory run the risk of the
617 	 * firmware being accessible to the device prior to the completion
618 	 * of IMA's signature verification any more than when using two
619 	 * buffers?
620 	 */
621 	return 0;
622 }
623 
624 const int read_idmap[READING_MAX_ID] = {
625 	[READING_FIRMWARE] = FIRMWARE_CHECK,
626 	[READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK,
627 	[READING_MODULE] = MODULE_CHECK,
628 	[READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,
629 	[READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,
630 	[READING_POLICY] = POLICY_CHECK
631 };
632 
633 /**
634  * ima_post_read_file - in memory collect/appraise/audit measurement
635  * @file: pointer to the file to be measured/appraised/audit
636  * @buf: pointer to in memory file contents
637  * @size: size of in memory file contents
638  * @read_id: caller identifier
639  *
640  * Measure/appraise/audit in memory file based on policy.  Policy rules
641  * are written in terms of a policy identifier.
642  *
643  * On success return 0.  On integrity appraisal error, assuming the file
644  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
645  */
646 int ima_post_read_file(struct file *file, void *buf, loff_t size,
647 		       enum kernel_read_file_id read_id)
648 {
649 	enum ima_hooks func;
650 	u32 secid;
651 
652 	if (!file && read_id == READING_FIRMWARE) {
653 		if ((ima_appraise & IMA_APPRAISE_FIRMWARE) &&
654 		    (ima_appraise & IMA_APPRAISE_ENFORCE)) {
655 			pr_err("Prevent firmware loading_store.\n");
656 			return -EACCES;	/* INTEGRITY_UNKNOWN */
657 		}
658 		return 0;
659 	}
660 
661 	/* permit signed certs */
662 	if (!file && read_id == READING_X509_CERTIFICATE)
663 		return 0;
664 
665 	if (!file || !buf || size == 0) { /* should never happen */
666 		if (ima_appraise & IMA_APPRAISE_ENFORCE)
667 			return -EACCES;
668 		return 0;
669 	}
670 
671 	func = read_idmap[read_id] ?: FILE_CHECK;
672 	security_task_getsecid(current, &secid);
673 	return process_measurement(file, current_cred(), secid, buf, size,
674 				   MAY_READ, func);
675 }
676 
677 /**
678  * ima_load_data - appraise decision based on policy
679  * @id: kernel load data caller identifier
680  *
681  * Callers of this LSM hook can not measure, appraise, or audit the
682  * data provided by userspace.  Enforce policy rules requring a file
683  * signature (eg. kexec'ed kernel image).
684  *
685  * For permission return 0, otherwise return -EACCES.
686  */
687 int ima_load_data(enum kernel_load_data_id id)
688 {
689 	bool ima_enforce, sig_enforce;
690 
691 	ima_enforce =
692 		(ima_appraise & IMA_APPRAISE_ENFORCE) == IMA_APPRAISE_ENFORCE;
693 
694 	switch (id) {
695 	case LOADING_KEXEC_IMAGE:
696 		if (IS_ENABLED(CONFIG_KEXEC_SIG)
697 		    && arch_ima_get_secureboot()) {
698 			pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
699 			return -EACCES;
700 		}
701 
702 		if (ima_enforce && (ima_appraise & IMA_APPRAISE_KEXEC)) {
703 			pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
704 			return -EACCES;	/* INTEGRITY_UNKNOWN */
705 		}
706 		break;
707 	case LOADING_FIRMWARE:
708 		if (ima_enforce && (ima_appraise & IMA_APPRAISE_FIRMWARE)) {
709 			pr_err("Prevent firmware sysfs fallback loading.\n");
710 			return -EACCES;	/* INTEGRITY_UNKNOWN */
711 		}
712 		break;
713 	case LOADING_MODULE:
714 		sig_enforce = is_module_sig_enforced();
715 
716 		if (ima_enforce && (!sig_enforce
717 				    && (ima_appraise & IMA_APPRAISE_MODULES))) {
718 			pr_err("impossible to appraise a module without a file descriptor. sig_enforce kernel parameter might help\n");
719 			return -EACCES;	/* INTEGRITY_UNKNOWN */
720 		}
721 	default:
722 		break;
723 	}
724 	return 0;
725 }
726 
727 /*
728  * process_buffer_measurement - Measure the buffer to ima log.
729  * @inode: inode associated with the object being measured (NULL for KEY_CHECK)
730  * @buf: pointer to the buffer that needs to be added to the log.
731  * @size: size of buffer(in bytes).
732  * @eventname: event name to be used for the buffer entry.
733  * @func: IMA hook
734  * @pcr: pcr to extend the measurement
735  * @keyring: keyring name to determine the action to be performed
736  *
737  * Based on policy, the buffer is measured into the ima log.
738  */
739 void process_buffer_measurement(struct inode *inode, const void *buf, int size,
740 				const char *eventname, enum ima_hooks func,
741 				int pcr, const char *keyring)
742 {
743 	int ret = 0;
744 	const char *audit_cause = "ENOMEM";
745 	struct ima_template_entry *entry = NULL;
746 	struct integrity_iint_cache iint = {};
747 	struct ima_event_data event_data = {.iint = &iint,
748 					    .filename = eventname,
749 					    .buf = buf,
750 					    .buf_len = size};
751 	struct ima_template_desc *template = NULL;
752 	struct {
753 		struct ima_digest_data hdr;
754 		char digest[IMA_MAX_DIGEST_SIZE];
755 	} hash = {};
756 	int violation = 0;
757 	int action = 0;
758 	u32 secid;
759 
760 	if (!ima_policy_flag)
761 		return;
762 
763 	/*
764 	 * Both LSM hooks and auxilary based buffer measurements are
765 	 * based on policy.  To avoid code duplication, differentiate
766 	 * between the LSM hooks and auxilary buffer measurements,
767 	 * retrieving the policy rule information only for the LSM hook
768 	 * buffer measurements.
769 	 */
770 	if (func) {
771 		security_task_getsecid(current, &secid);
772 		action = ima_get_action(inode, current_cred(), secid, 0, func,
773 					&pcr, &template, keyring);
774 		if (!(action & IMA_MEASURE))
775 			return;
776 	}
777 
778 	if (!pcr)
779 		pcr = CONFIG_IMA_MEASURE_PCR_IDX;
780 
781 	if (!template) {
782 		template = lookup_template_desc("ima-buf");
783 		ret = template_desc_init_fields(template->fmt,
784 						&(template->fields),
785 						&(template->num_fields));
786 		if (ret < 0) {
787 			pr_err("template %s init failed, result: %d\n",
788 			       (strlen(template->name) ?
789 				template->name : template->fmt), ret);
790 			return;
791 		}
792 	}
793 
794 	iint.ima_hash = &hash.hdr;
795 	iint.ima_hash->algo = ima_hash_algo;
796 	iint.ima_hash->length = hash_digest_size[ima_hash_algo];
797 
798 	ret = ima_calc_buffer_hash(buf, size, iint.ima_hash);
799 	if (ret < 0) {
800 		audit_cause = "hashing_error";
801 		goto out;
802 	}
803 
804 	ret = ima_alloc_init_template(&event_data, &entry, template);
805 	if (ret < 0) {
806 		audit_cause = "alloc_entry";
807 		goto out;
808 	}
809 
810 	ret = ima_store_template(entry, violation, NULL, buf, pcr);
811 	if (ret < 0) {
812 		audit_cause = "store_entry";
813 		ima_free_template_entry(entry);
814 	}
815 
816 out:
817 	if (ret < 0)
818 		integrity_audit_message(AUDIT_INTEGRITY_PCR, NULL, eventname,
819 					func_measure_str(func),
820 					audit_cause, ret, 0, ret);
821 
822 	return;
823 }
824 
825 /**
826  * ima_kexec_cmdline - measure kexec cmdline boot args
827  * @kernel_fd: file descriptor of the kexec kernel being loaded
828  * @buf: pointer to buffer
829  * @size: size of buffer
830  *
831  * Buffers can only be measured, not appraised.
832  */
833 void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
834 {
835 	struct fd f;
836 
837 	if (!buf || !size)
838 		return;
839 
840 	f = fdget(kernel_fd);
841 	if (!f.file)
842 		return;
843 
844 	process_buffer_measurement(file_inode(f.file), buf, size,
845 				   "kexec-cmdline", KEXEC_CMDLINE, 0, NULL);
846 	fdput(f);
847 }
848 
849 static int __init init_ima(void)
850 {
851 	int error;
852 
853 	ima_init_template_list();
854 	hash_setup(CONFIG_IMA_DEFAULT_HASH);
855 	error = ima_init();
856 
857 	if (error && strcmp(hash_algo_name[ima_hash_algo],
858 			    CONFIG_IMA_DEFAULT_HASH) != 0) {
859 		pr_info("Allocating %s failed, going to use default hash algorithm %s\n",
860 			hash_algo_name[ima_hash_algo], CONFIG_IMA_DEFAULT_HASH);
861 		hash_setup_done = 0;
862 		hash_setup(CONFIG_IMA_DEFAULT_HASH);
863 		error = ima_init();
864 	}
865 
866 	if (error)
867 		return error;
868 
869 	error = register_blocking_lsm_notifier(&ima_lsm_policy_notifier);
870 	if (error)
871 		pr_warn("Couldn't register LSM notifier, error %d\n", error);
872 
873 	if (!error)
874 		ima_update_policy_flag();
875 
876 	return error;
877 }
878 
879 late_initcall(init_ima);	/* Start IMA after the TPM is available */
880