1 /*
2  * Copyright (C) 2005,2006,2007,2008 IBM Corporation
3  *
4  * Authors:
5  * Reiner Sailer <sailer@watson.ibm.com>
6  * Serge Hallyn <serue@us.ibm.com>
7  * Kylene Hall <kylene@us.ibm.com>
8  * Mimi Zohar <zohar@us.ibm.com>
9  *
10  * This program is free software; you can redistribute it and/or
11  * modify it under the terms of the GNU General Public License as
12  * published by the Free Software Foundation, version 2 of the
13  * License.
14  *
15  * File: ima_main.c
16  *	implements the IMA hooks: ima_bprm_check, ima_file_mmap,
17  *	and ima_file_check.
18  */
19 #include <linux/module.h>
20 #include <linux/file.h>
21 #include <linux/binfmts.h>
22 #include <linux/mount.h>
23 #include <linux/mman.h>
24 #include <linux/slab.h>
25 
26 #include "ima.h"
27 
28 int ima_initialized;
29 
30 char *ima_hash = "sha1";
31 static int __init hash_setup(char *str)
32 {
33 	if (strncmp(str, "md5", 3) == 0)
34 		ima_hash = "md5";
35 	return 1;
36 }
37 __setup("ima_hash=", hash_setup);
38 
39 /*
40  * ima_rdwr_violation_check
41  *
42  * Only invalidate the PCR for measured files:
43  * 	- Opening a file for write when already open for read,
44  *	  results in a time of measure, time of use (ToMToU) error.
45  *	- Opening a file for read when already open for write,
46  * 	  could result in a file measurement error.
47  *
48  */
49 static void ima_rdwr_violation_check(struct file *file)
50 {
51 	struct dentry *dentry = file->f_path.dentry;
52 	struct inode *inode = dentry->d_inode;
53 	fmode_t mode = file->f_mode;
54 	int rc;
55 	bool send_tomtou = false, send_writers = false;
56 
57 	if (!S_ISREG(inode->i_mode) || !ima_initialized)
58 		return;
59 
60 	mutex_lock(&inode->i_mutex);	/* file metadata: permissions, xattr */
61 
62 	if (mode & FMODE_WRITE) {
63 		if (atomic_read(&inode->i_readcount) && IS_IMA(inode))
64 			send_tomtou = true;
65 		goto out;
66 	}
67 
68 	rc = ima_must_measure(inode, MAY_READ, FILE_CHECK);
69 	if (rc < 0)
70 		goto out;
71 
72 	if (atomic_read(&inode->i_writecount) > 0)
73 		send_writers = true;
74 out:
75 	mutex_unlock(&inode->i_mutex);
76 
77 	if (send_tomtou)
78 		ima_add_violation(inode, dentry->d_name.name, "invalid_pcr",
79 				  "ToMToU");
80 	if (send_writers)
81 		ima_add_violation(inode, dentry->d_name.name, "invalid_pcr",
82 				  "open_writers");
83 }
84 
85 static void ima_check_last_writer(struct ima_iint_cache *iint,
86 				  struct inode *inode,
87 				  struct file *file)
88 {
89 	mode_t mode = file->f_mode;
90 
91 	mutex_lock(&iint->mutex);
92 	if (mode & FMODE_WRITE &&
93 	    atomic_read(&inode->i_writecount) == 1 &&
94 	    iint->version != inode->i_version)
95 		iint->flags &= ~IMA_MEASURED;
96 	mutex_unlock(&iint->mutex);
97 }
98 
99 /**
100  * ima_file_free - called on __fput()
101  * @file: pointer to file structure being freed
102  *
103  * Flag files that changed, based on i_version
104  */
105 void ima_file_free(struct file *file)
106 {
107 	struct inode *inode = file->f_dentry->d_inode;
108 	struct ima_iint_cache *iint;
109 
110 	if (!iint_initialized || !S_ISREG(inode->i_mode))
111 		return;
112 
113 	iint = ima_iint_find(inode);
114 	if (!iint)
115 		return;
116 
117 	ima_check_last_writer(iint, inode, file);
118 }
119 
120 static int process_measurement(struct file *file, const unsigned char *filename,
121 			       int mask, int function)
122 {
123 	struct inode *inode = file->f_dentry->d_inode;
124 	struct ima_iint_cache *iint;
125 	int rc = 0;
126 
127 	if (!ima_initialized || !S_ISREG(inode->i_mode))
128 		return 0;
129 
130 	rc = ima_must_measure(inode, mask, function);
131 	if (rc != 0)
132 		return rc;
133 retry:
134 	iint = ima_iint_find(inode);
135 	if (!iint) {
136 		rc = ima_inode_alloc(inode);
137 		if (!rc || rc == -EEXIST)
138 			goto retry;
139 		return rc;
140 	}
141 
142 	mutex_lock(&iint->mutex);
143 
144 	rc = iint->flags & IMA_MEASURED ? 1 : 0;
145 	if (rc != 0)
146 		goto out;
147 
148 	rc = ima_collect_measurement(iint, file);
149 	if (!rc)
150 		ima_store_measurement(iint, file, filename);
151 out:
152 	mutex_unlock(&iint->mutex);
153 	return rc;
154 }
155 
156 /**
157  * ima_file_mmap - based on policy, collect/store measurement.
158  * @file: pointer to the file to be measured (May be NULL)
159  * @prot: contains the protection that will be applied by the kernel.
160  *
161  * Measure files being mmapped executable based on the ima_must_measure()
162  * policy decision.
163  *
164  * Return 0 on success, an error code on failure.
165  * (Based on the results of appraise_measurement().)
166  */
167 int ima_file_mmap(struct file *file, unsigned long prot)
168 {
169 	int rc;
170 
171 	if (!file)
172 		return 0;
173 	if (prot & PROT_EXEC)
174 		rc = process_measurement(file, file->f_dentry->d_name.name,
175 					 MAY_EXEC, FILE_MMAP);
176 	return 0;
177 }
178 
179 /**
180  * ima_bprm_check - based on policy, collect/store measurement.
181  * @bprm: contains the linux_binprm structure
182  *
183  * The OS protects against an executable file, already open for write,
184  * from being executed in deny_write_access() and an executable file,
185  * already open for execute, from being modified in get_write_access().
186  * So we can be certain that what we verify and measure here is actually
187  * what is being executed.
188  *
189  * Return 0 on success, an error code on failure.
190  * (Based on the results of appraise_measurement().)
191  */
192 int ima_bprm_check(struct linux_binprm *bprm)
193 {
194 	int rc;
195 
196 	rc = process_measurement(bprm->file, bprm->filename,
197 				 MAY_EXEC, BPRM_CHECK);
198 	return 0;
199 }
200 
201 /**
202  * ima_path_check - based on policy, collect/store measurement.
203  * @file: pointer to the file to be measured
204  * @mask: contains MAY_READ, MAY_WRITE or MAY_EXECUTE
205  *
206  * Measure files based on the ima_must_measure() policy decision.
207  *
208  * Always return 0 and audit dentry_open failures.
209  * (Return code will be based upon measurement appraisal.)
210  */
211 int ima_file_check(struct file *file, int mask)
212 {
213 	int rc;
214 
215 	ima_rdwr_violation_check(file);
216 	rc = process_measurement(file, file->f_dentry->d_name.name,
217 				 mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
218 				 FILE_CHECK);
219 	return 0;
220 }
221 EXPORT_SYMBOL_GPL(ima_file_check);
222 
223 static int __init init_ima(void)
224 {
225 	int error;
226 
227 	error = ima_init();
228 	ima_initialized = 1;
229 	return error;
230 }
231 
232 static void __exit cleanup_ima(void)
233 {
234 	ima_cleanup();
235 }
236 
237 late_initcall(init_ima);	/* Start IMA after the TPM is available */
238 
239 MODULE_DESCRIPTION("Integrity Measurement Architecture");
240 MODULE_LICENSE("GPL");
241