1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2008 IBM Corporation 4 * Author: Mimi Zohar <zohar@us.ibm.com> 5 * 6 * ima_policy.c 7 * - initialize default measure policy rules 8 */ 9 #include <linux/init.h> 10 #include <linux/list.h> 11 #include <linux/fs.h> 12 #include <linux/security.h> 13 #include <linux/magic.h> 14 #include <linux/parser.h> 15 #include <linux/slab.h> 16 #include <linux/rculist.h> 17 #include <linux/genhd.h> 18 #include <linux/seq_file.h> 19 #include <linux/ima.h> 20 21 #include "ima.h" 22 23 /* flags definitions */ 24 #define IMA_FUNC 0x0001 25 #define IMA_MASK 0x0002 26 #define IMA_FSMAGIC 0x0004 27 #define IMA_UID 0x0008 28 #define IMA_FOWNER 0x0010 29 #define IMA_FSUUID 0x0020 30 #define IMA_INMASK 0x0040 31 #define IMA_EUID 0x0080 32 #define IMA_PCR 0x0100 33 #define IMA_FSNAME 0x0200 34 35 #define UNKNOWN 0 36 #define MEASURE 0x0001 /* same as IMA_MEASURE */ 37 #define DONT_MEASURE 0x0002 38 #define APPRAISE 0x0004 /* same as IMA_APPRAISE */ 39 #define DONT_APPRAISE 0x0008 40 #define AUDIT 0x0040 41 #define HASH 0x0100 42 #define DONT_HASH 0x0200 43 44 #define INVALID_PCR(a) (((a) < 0) || \ 45 (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8)) 46 47 int ima_policy_flag; 48 static int temp_ima_appraise; 49 static int build_ima_appraise __ro_after_init; 50 51 #define MAX_LSM_RULES 6 52 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, 53 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE 54 }; 55 56 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB }; 57 58 enum policy_rule_list { IMA_DEFAULT_POLICY = 1, IMA_CUSTOM_POLICY }; 59 60 struct ima_rule_entry { 61 struct list_head list; 62 int action; 63 unsigned int flags; 64 enum ima_hooks func; 65 int mask; 66 unsigned long fsmagic; 67 uuid_t fsuuid; 68 kuid_t uid; 69 kuid_t fowner; 70 bool (*uid_op)(kuid_t, kuid_t); /* Handlers for operators */ 71 bool (*fowner_op)(kuid_t, kuid_t); /* uid_eq(), uid_gt(), uid_lt() */ 72 int pcr; 73 struct { 74 void *rule; /* LSM file metadata specific */ 75 void *args_p; /* audit value */ 76 int type; /* audit type */ 77 } lsm[MAX_LSM_RULES]; 78 char *fsname; 79 struct ima_template_desc *template; 80 }; 81 82 /* 83 * Without LSM specific knowledge, the default policy can only be 84 * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner 85 */ 86 87 /* 88 * The minimum rule set to allow for full TCB coverage. Measures all files 89 * opened or mmap for exec and everything read by root. Dangerous because 90 * normal users can easily run the machine out of memory simply building 91 * and running executables. 92 */ 93 static struct ima_rule_entry dont_measure_rules[] __ro_after_init = { 94 {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 95 {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, 96 {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, 97 {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, 98 {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 99 {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, 100 {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, 101 {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, 102 {.action = DONT_MEASURE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC}, 103 {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC, 104 .flags = IMA_FSMAGIC}, 105 {.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC, 106 .flags = IMA_FSMAGIC}, 107 {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, 108 {.action = DONT_MEASURE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC} 109 }; 110 111 static struct ima_rule_entry original_measurement_rules[] __ro_after_init = { 112 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, 113 .flags = IMA_FUNC | IMA_MASK}, 114 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, 115 .flags = IMA_FUNC | IMA_MASK}, 116 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 117 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq, 118 .flags = IMA_FUNC | IMA_MASK | IMA_UID}, 119 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, 120 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, 121 }; 122 123 static struct ima_rule_entry default_measurement_rules[] __ro_after_init = { 124 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, 125 .flags = IMA_FUNC | IMA_MASK}, 126 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, 127 .flags = IMA_FUNC | IMA_MASK}, 128 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 129 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq, 130 .flags = IMA_FUNC | IMA_INMASK | IMA_EUID}, 131 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 132 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq, 133 .flags = IMA_FUNC | IMA_INMASK | IMA_UID}, 134 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, 135 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, 136 {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC}, 137 }; 138 139 static struct ima_rule_entry default_appraise_rules[] __ro_after_init = { 140 {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 141 {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, 142 {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, 143 {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, 144 {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC}, 145 {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 146 {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, 147 {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, 148 {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, 149 {.action = DONT_APPRAISE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC}, 150 {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, 151 {.action = DONT_APPRAISE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC}, 152 {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 153 {.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 154 #ifdef CONFIG_IMA_WRITE_POLICY 155 {.action = APPRAISE, .func = POLICY_CHECK, 156 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 157 #endif 158 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT 159 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq, 160 .flags = IMA_FOWNER}, 161 #else 162 /* force signature */ 163 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq, 164 .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED}, 165 #endif 166 }; 167 168 static struct ima_rule_entry build_appraise_rules[] __ro_after_init = { 169 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS 170 {.action = APPRAISE, .func = MODULE_CHECK, 171 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 172 #endif 173 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS 174 {.action = APPRAISE, .func = FIRMWARE_CHECK, 175 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 176 #endif 177 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS 178 {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK, 179 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 180 #endif 181 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS 182 {.action = APPRAISE, .func = POLICY_CHECK, 183 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 184 #endif 185 }; 186 187 static struct ima_rule_entry secure_boot_rules[] __ro_after_init = { 188 {.action = APPRAISE, .func = MODULE_CHECK, 189 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 190 {.action = APPRAISE, .func = FIRMWARE_CHECK, 191 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 192 {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK, 193 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 194 {.action = APPRAISE, .func = POLICY_CHECK, 195 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 196 }; 197 198 /* An array of architecture specific rules */ 199 static struct ima_rule_entry *arch_policy_entry __ro_after_init; 200 201 static LIST_HEAD(ima_default_rules); 202 static LIST_HEAD(ima_policy_rules); 203 static LIST_HEAD(ima_temp_rules); 204 static struct list_head *ima_rules; 205 206 static int ima_policy __initdata; 207 208 static int __init default_measure_policy_setup(char *str) 209 { 210 if (ima_policy) 211 return 1; 212 213 ima_policy = ORIGINAL_TCB; 214 return 1; 215 } 216 __setup("ima_tcb", default_measure_policy_setup); 217 218 static bool ima_use_appraise_tcb __initdata; 219 static bool ima_use_secure_boot __initdata; 220 static bool ima_fail_unverifiable_sigs __ro_after_init; 221 static int __init policy_setup(char *str) 222 { 223 char *p; 224 225 while ((p = strsep(&str, " |\n")) != NULL) { 226 if (*p == ' ') 227 continue; 228 if ((strcmp(p, "tcb") == 0) && !ima_policy) 229 ima_policy = DEFAULT_TCB; 230 else if (strcmp(p, "appraise_tcb") == 0) 231 ima_use_appraise_tcb = true; 232 else if (strcmp(p, "secure_boot") == 0) 233 ima_use_secure_boot = true; 234 else if (strcmp(p, "fail_securely") == 0) 235 ima_fail_unverifiable_sigs = true; 236 } 237 238 return 1; 239 } 240 __setup("ima_policy=", policy_setup); 241 242 static int __init default_appraise_policy_setup(char *str) 243 { 244 ima_use_appraise_tcb = true; 245 return 1; 246 } 247 __setup("ima_appraise_tcb", default_appraise_policy_setup); 248 249 static void ima_lsm_free_rule(struct ima_rule_entry *entry) 250 { 251 int i; 252 253 for (i = 0; i < MAX_LSM_RULES; i++) { 254 kfree(entry->lsm[i].rule); 255 kfree(entry->lsm[i].args_p); 256 } 257 kfree(entry); 258 } 259 260 static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry) 261 { 262 struct ima_rule_entry *nentry; 263 int i, result; 264 265 nentry = kmalloc(sizeof(*nentry), GFP_KERNEL); 266 if (!nentry) 267 return NULL; 268 269 /* 270 * Immutable elements are copied over as pointers and data; only 271 * lsm rules can change 272 */ 273 memcpy(nentry, entry, sizeof(*nentry)); 274 memset(nentry->lsm, 0, FIELD_SIZEOF(struct ima_rule_entry, lsm)); 275 276 for (i = 0; i < MAX_LSM_RULES; i++) { 277 if (!entry->lsm[i].rule) 278 continue; 279 280 nentry->lsm[i].type = entry->lsm[i].type; 281 nentry->lsm[i].args_p = kstrdup(entry->lsm[i].args_p, 282 GFP_KERNEL); 283 if (!nentry->lsm[i].args_p) 284 goto out_err; 285 286 result = security_filter_rule_init(nentry->lsm[i].type, 287 Audit_equal, 288 nentry->lsm[i].args_p, 289 &nentry->lsm[i].rule); 290 if (result == -EINVAL) 291 pr_warn("ima: rule for LSM \'%d\' is undefined\n", 292 entry->lsm[i].type); 293 } 294 return nentry; 295 296 out_err: 297 ima_lsm_free_rule(nentry); 298 return NULL; 299 } 300 301 static int ima_lsm_update_rule(struct ima_rule_entry *entry) 302 { 303 struct ima_rule_entry *nentry; 304 305 nentry = ima_lsm_copy_rule(entry); 306 if (!nentry) 307 return -ENOMEM; 308 309 list_replace_rcu(&entry->list, &nentry->list); 310 synchronize_rcu(); 311 ima_lsm_free_rule(entry); 312 313 return 0; 314 } 315 316 /* 317 * The LSM policy can be reloaded, leaving the IMA LSM based rules referring 318 * to the old, stale LSM policy. Update the IMA LSM based rules to reflect 319 * the reloaded LSM policy. 320 */ 321 static void ima_lsm_update_rules(void) 322 { 323 struct ima_rule_entry *entry, *e; 324 int i, result, needs_update; 325 326 list_for_each_entry_safe(entry, e, &ima_policy_rules, list) { 327 needs_update = 0; 328 for (i = 0; i < MAX_LSM_RULES; i++) { 329 if (entry->lsm[i].rule) { 330 needs_update = 1; 331 break; 332 } 333 } 334 if (!needs_update) 335 continue; 336 337 result = ima_lsm_update_rule(entry); 338 if (result) { 339 pr_err("ima: lsm rule update error %d\n", 340 result); 341 return; 342 } 343 } 344 } 345 346 int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event, 347 void *lsm_data) 348 { 349 if (event != LSM_POLICY_CHANGE) 350 return NOTIFY_DONE; 351 352 ima_lsm_update_rules(); 353 return NOTIFY_OK; 354 } 355 356 /** 357 * ima_match_rules - determine whether an inode matches the measure rule. 358 * @rule: a pointer to a rule 359 * @inode: a pointer to an inode 360 * @cred: a pointer to a credentials structure for user validation 361 * @secid: the secid of the task to be validated 362 * @func: LIM hook identifier 363 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 364 * 365 * Returns true on rule match, false on failure. 366 */ 367 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, 368 const struct cred *cred, u32 secid, 369 enum ima_hooks func, int mask) 370 { 371 int i; 372 373 if (func == KEXEC_CMDLINE) { 374 if ((rule->flags & IMA_FUNC) && (rule->func == func)) 375 return true; 376 return false; 377 } 378 if ((rule->flags & IMA_FUNC) && 379 (rule->func != func && func != POST_SETATTR)) 380 return false; 381 if ((rule->flags & IMA_MASK) && 382 (rule->mask != mask && func != POST_SETATTR)) 383 return false; 384 if ((rule->flags & IMA_INMASK) && 385 (!(rule->mask & mask) && func != POST_SETATTR)) 386 return false; 387 if ((rule->flags & IMA_FSMAGIC) 388 && rule->fsmagic != inode->i_sb->s_magic) 389 return false; 390 if ((rule->flags & IMA_FSNAME) 391 && strcmp(rule->fsname, inode->i_sb->s_type->name)) 392 return false; 393 if ((rule->flags & IMA_FSUUID) && 394 !uuid_equal(&rule->fsuuid, &inode->i_sb->s_uuid)) 395 return false; 396 if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid)) 397 return false; 398 if (rule->flags & IMA_EUID) { 399 if (has_capability_noaudit(current, CAP_SETUID)) { 400 if (!rule->uid_op(cred->euid, rule->uid) 401 && !rule->uid_op(cred->suid, rule->uid) 402 && !rule->uid_op(cred->uid, rule->uid)) 403 return false; 404 } else if (!rule->uid_op(cred->euid, rule->uid)) 405 return false; 406 } 407 408 if ((rule->flags & IMA_FOWNER) && 409 !rule->fowner_op(inode->i_uid, rule->fowner)) 410 return false; 411 for (i = 0; i < MAX_LSM_RULES; i++) { 412 int rc = 0; 413 u32 osid; 414 415 if (!rule->lsm[i].rule) 416 continue; 417 418 switch (i) { 419 case LSM_OBJ_USER: 420 case LSM_OBJ_ROLE: 421 case LSM_OBJ_TYPE: 422 security_inode_getsecid(inode, &osid); 423 rc = security_filter_rule_match(osid, 424 rule->lsm[i].type, 425 Audit_equal, 426 rule->lsm[i].rule); 427 break; 428 case LSM_SUBJ_USER: 429 case LSM_SUBJ_ROLE: 430 case LSM_SUBJ_TYPE: 431 rc = security_filter_rule_match(secid, 432 rule->lsm[i].type, 433 Audit_equal, 434 rule->lsm[i].rule); 435 default: 436 break; 437 } 438 if (!rc) 439 return false; 440 } 441 return true; 442 } 443 444 /* 445 * In addition to knowing that we need to appraise the file in general, 446 * we need to differentiate between calling hooks, for hook specific rules. 447 */ 448 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) 449 { 450 if (!(rule->flags & IMA_FUNC)) 451 return IMA_FILE_APPRAISE; 452 453 switch (func) { 454 case MMAP_CHECK: 455 return IMA_MMAP_APPRAISE; 456 case BPRM_CHECK: 457 return IMA_BPRM_APPRAISE; 458 case CREDS_CHECK: 459 return IMA_CREDS_APPRAISE; 460 case FILE_CHECK: 461 case POST_SETATTR: 462 return IMA_FILE_APPRAISE; 463 case MODULE_CHECK ... MAX_CHECK - 1: 464 default: 465 return IMA_READ_APPRAISE; 466 } 467 } 468 469 /** 470 * ima_match_policy - decision based on LSM and other conditions 471 * @inode: pointer to an inode for which the policy decision is being made 472 * @cred: pointer to a credentials structure for which the policy decision is 473 * being made 474 * @secid: LSM secid of the task to be validated 475 * @func: IMA hook identifier 476 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 477 * @pcr: set the pcr to extend 478 * @template_desc: the template that should be used for this rule 479 * 480 * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type) 481 * conditions. 482 * 483 * Since the IMA policy may be updated multiple times we need to lock the 484 * list when walking it. Reads are many orders of magnitude more numerous 485 * than writes so ima_match_policy() is classical RCU candidate. 486 */ 487 int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, 488 enum ima_hooks func, int mask, int flags, int *pcr, 489 struct ima_template_desc **template_desc) 490 { 491 struct ima_rule_entry *entry; 492 int action = 0, actmask = flags | (flags << 1); 493 494 rcu_read_lock(); 495 list_for_each_entry_rcu(entry, ima_rules, list) { 496 497 if (!(entry->action & actmask)) 498 continue; 499 500 if (!ima_match_rules(entry, inode, cred, secid, func, mask)) 501 continue; 502 503 action |= entry->flags & IMA_ACTION_FLAGS; 504 505 action |= entry->action & IMA_DO_MASK; 506 if (entry->action & IMA_APPRAISE) { 507 action |= get_subaction(entry, func); 508 action &= ~IMA_HASH; 509 if (ima_fail_unverifiable_sigs) 510 action |= IMA_FAIL_UNVERIFIABLE_SIGS; 511 } 512 513 if (entry->action & IMA_DO_MASK) 514 actmask &= ~(entry->action | entry->action << 1); 515 else 516 actmask &= ~(entry->action | entry->action >> 1); 517 518 if ((pcr) && (entry->flags & IMA_PCR)) 519 *pcr = entry->pcr; 520 521 if (template_desc && entry->template) 522 *template_desc = entry->template; 523 else if (template_desc) 524 *template_desc = ima_template_desc_current(); 525 526 if (!actmask) 527 break; 528 } 529 rcu_read_unlock(); 530 531 return action; 532 } 533 534 /* 535 * Initialize the ima_policy_flag variable based on the currently 536 * loaded policy. Based on this flag, the decision to short circuit 537 * out of a function or not call the function in the first place 538 * can be made earlier. 539 */ 540 void ima_update_policy_flag(void) 541 { 542 struct ima_rule_entry *entry; 543 544 list_for_each_entry(entry, ima_rules, list) { 545 if (entry->action & IMA_DO_MASK) 546 ima_policy_flag |= entry->action; 547 } 548 549 ima_appraise |= (build_ima_appraise | temp_ima_appraise); 550 if (!ima_appraise) 551 ima_policy_flag &= ~IMA_APPRAISE; 552 } 553 554 static int ima_appraise_flag(enum ima_hooks func) 555 { 556 if (func == MODULE_CHECK) 557 return IMA_APPRAISE_MODULES; 558 else if (func == FIRMWARE_CHECK) 559 return IMA_APPRAISE_FIRMWARE; 560 else if (func == POLICY_CHECK) 561 return IMA_APPRAISE_POLICY; 562 else if (func == KEXEC_KERNEL_CHECK) 563 return IMA_APPRAISE_KEXEC; 564 return 0; 565 } 566 567 static void add_rules(struct ima_rule_entry *entries, int count, 568 enum policy_rule_list policy_rule) 569 { 570 int i = 0; 571 572 for (i = 0; i < count; i++) { 573 struct ima_rule_entry *entry; 574 575 if (policy_rule & IMA_DEFAULT_POLICY) 576 list_add_tail(&entries[i].list, &ima_default_rules); 577 578 if (policy_rule & IMA_CUSTOM_POLICY) { 579 entry = kmemdup(&entries[i], sizeof(*entry), 580 GFP_KERNEL); 581 if (!entry) 582 continue; 583 584 list_add_tail(&entry->list, &ima_policy_rules); 585 } 586 if (entries[i].action == APPRAISE) { 587 temp_ima_appraise |= ima_appraise_flag(entries[i].func); 588 if (entries[i].func == POLICY_CHECK) 589 temp_ima_appraise |= IMA_APPRAISE_POLICY; 590 } 591 } 592 } 593 594 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry); 595 596 static int __init ima_init_arch_policy(void) 597 { 598 const char * const *arch_rules; 599 const char * const *rules; 600 int arch_entries = 0; 601 int i = 0; 602 603 arch_rules = arch_get_ima_policy(); 604 if (!arch_rules) 605 return arch_entries; 606 607 /* Get number of rules */ 608 for (rules = arch_rules; *rules != NULL; rules++) 609 arch_entries++; 610 611 arch_policy_entry = kcalloc(arch_entries + 1, 612 sizeof(*arch_policy_entry), GFP_KERNEL); 613 if (!arch_policy_entry) 614 return 0; 615 616 /* Convert each policy string rules to struct ima_rule_entry format */ 617 for (rules = arch_rules, i = 0; *rules != NULL; rules++) { 618 char rule[255]; 619 int result; 620 621 result = strlcpy(rule, *rules, sizeof(rule)); 622 623 INIT_LIST_HEAD(&arch_policy_entry[i].list); 624 result = ima_parse_rule(rule, &arch_policy_entry[i]); 625 if (result) { 626 pr_warn("Skipping unknown architecture policy rule: %s\n", 627 rule); 628 memset(&arch_policy_entry[i], 0, 629 sizeof(*arch_policy_entry)); 630 continue; 631 } 632 i++; 633 } 634 return i; 635 } 636 637 /** 638 * ima_init_policy - initialize the default measure rules. 639 * 640 * ima_rules points to either the ima_default_rules or the 641 * the new ima_policy_rules. 642 */ 643 void __init ima_init_policy(void) 644 { 645 int build_appraise_entries, arch_entries; 646 647 /* if !ima_policy, we load NO default rules */ 648 if (ima_policy) 649 add_rules(dont_measure_rules, ARRAY_SIZE(dont_measure_rules), 650 IMA_DEFAULT_POLICY); 651 652 switch (ima_policy) { 653 case ORIGINAL_TCB: 654 add_rules(original_measurement_rules, 655 ARRAY_SIZE(original_measurement_rules), 656 IMA_DEFAULT_POLICY); 657 break; 658 case DEFAULT_TCB: 659 add_rules(default_measurement_rules, 660 ARRAY_SIZE(default_measurement_rules), 661 IMA_DEFAULT_POLICY); 662 default: 663 break; 664 } 665 666 /* 667 * Based on runtime secure boot flags, insert arch specific measurement 668 * and appraise rules requiring file signatures for both the initial 669 * and custom policies, prior to other appraise rules. 670 * (Highest priority) 671 */ 672 arch_entries = ima_init_arch_policy(); 673 if (!arch_entries) 674 pr_info("No architecture policies found\n"); 675 else 676 add_rules(arch_policy_entry, arch_entries, 677 IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY); 678 679 /* 680 * Insert the builtin "secure_boot" policy rules requiring file 681 * signatures, prior to other appraise rules. 682 */ 683 if (ima_use_secure_boot) 684 add_rules(secure_boot_rules, ARRAY_SIZE(secure_boot_rules), 685 IMA_DEFAULT_POLICY); 686 687 /* 688 * Insert the build time appraise rules requiring file signatures 689 * for both the initial and custom policies, prior to other appraise 690 * rules. As the secure boot rules includes all of the build time 691 * rules, include either one or the other set of rules, but not both. 692 */ 693 build_appraise_entries = ARRAY_SIZE(build_appraise_rules); 694 if (build_appraise_entries) { 695 if (ima_use_secure_boot) 696 add_rules(build_appraise_rules, build_appraise_entries, 697 IMA_CUSTOM_POLICY); 698 else 699 add_rules(build_appraise_rules, build_appraise_entries, 700 IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY); 701 } 702 703 if (ima_use_appraise_tcb) 704 add_rules(default_appraise_rules, 705 ARRAY_SIZE(default_appraise_rules), 706 IMA_DEFAULT_POLICY); 707 708 ima_rules = &ima_default_rules; 709 ima_update_policy_flag(); 710 } 711 712 /* Make sure we have a valid policy, at least containing some rules. */ 713 int ima_check_policy(void) 714 { 715 if (list_empty(&ima_temp_rules)) 716 return -EINVAL; 717 return 0; 718 } 719 720 /** 721 * ima_update_policy - update default_rules with new measure rules 722 * 723 * Called on file .release to update the default rules with a complete new 724 * policy. What we do here is to splice ima_policy_rules and ima_temp_rules so 725 * they make a queue. The policy may be updated multiple times and this is the 726 * RCU updater. 727 * 728 * Policy rules are never deleted so ima_policy_flag gets zeroed only once when 729 * we switch from the default policy to user defined. 730 */ 731 void ima_update_policy(void) 732 { 733 struct list_head *policy = &ima_policy_rules; 734 735 list_splice_tail_init_rcu(&ima_temp_rules, policy, synchronize_rcu); 736 737 if (ima_rules != policy) { 738 ima_policy_flag = 0; 739 ima_rules = policy; 740 741 /* 742 * IMA architecture specific policy rules are specified 743 * as strings and converted to an array of ima_entry_rules 744 * on boot. After loading a custom policy, free the 745 * architecture specific rules stored as an array. 746 */ 747 kfree(arch_policy_entry); 748 } 749 ima_update_policy_flag(); 750 } 751 752 /* Keep the enumeration in sync with the policy_tokens! */ 753 enum { 754 Opt_measure, Opt_dont_measure, 755 Opt_appraise, Opt_dont_appraise, 756 Opt_audit, Opt_hash, Opt_dont_hash, 757 Opt_obj_user, Opt_obj_role, Opt_obj_type, 758 Opt_subj_user, Opt_subj_role, Opt_subj_type, 759 Opt_func, Opt_mask, Opt_fsmagic, Opt_fsname, 760 Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq, 761 Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt, 762 Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt, 763 Opt_appraise_type, Opt_permit_directio, 764 Opt_pcr, Opt_template, Opt_err 765 }; 766 767 static const match_table_t policy_tokens = { 768 {Opt_measure, "measure"}, 769 {Opt_dont_measure, "dont_measure"}, 770 {Opt_appraise, "appraise"}, 771 {Opt_dont_appraise, "dont_appraise"}, 772 {Opt_audit, "audit"}, 773 {Opt_hash, "hash"}, 774 {Opt_dont_hash, "dont_hash"}, 775 {Opt_obj_user, "obj_user=%s"}, 776 {Opt_obj_role, "obj_role=%s"}, 777 {Opt_obj_type, "obj_type=%s"}, 778 {Opt_subj_user, "subj_user=%s"}, 779 {Opt_subj_role, "subj_role=%s"}, 780 {Opt_subj_type, "subj_type=%s"}, 781 {Opt_func, "func=%s"}, 782 {Opt_mask, "mask=%s"}, 783 {Opt_fsmagic, "fsmagic=%s"}, 784 {Opt_fsname, "fsname=%s"}, 785 {Opt_fsuuid, "fsuuid=%s"}, 786 {Opt_uid_eq, "uid=%s"}, 787 {Opt_euid_eq, "euid=%s"}, 788 {Opt_fowner_eq, "fowner=%s"}, 789 {Opt_uid_gt, "uid>%s"}, 790 {Opt_euid_gt, "euid>%s"}, 791 {Opt_fowner_gt, "fowner>%s"}, 792 {Opt_uid_lt, "uid<%s"}, 793 {Opt_euid_lt, "euid<%s"}, 794 {Opt_fowner_lt, "fowner<%s"}, 795 {Opt_appraise_type, "appraise_type=%s"}, 796 {Opt_permit_directio, "permit_directio"}, 797 {Opt_pcr, "pcr=%s"}, 798 {Opt_template, "template=%s"}, 799 {Opt_err, NULL} 800 }; 801 802 static int ima_lsm_rule_init(struct ima_rule_entry *entry, 803 substring_t *args, int lsm_rule, int audit_type) 804 { 805 int result; 806 807 if (entry->lsm[lsm_rule].rule) 808 return -EINVAL; 809 810 entry->lsm[lsm_rule].args_p = match_strdup(args); 811 if (!entry->lsm[lsm_rule].args_p) 812 return -ENOMEM; 813 814 entry->lsm[lsm_rule].type = audit_type; 815 result = security_filter_rule_init(entry->lsm[lsm_rule].type, 816 Audit_equal, 817 entry->lsm[lsm_rule].args_p, 818 &entry->lsm[lsm_rule].rule); 819 if (!entry->lsm[lsm_rule].rule) { 820 kfree(entry->lsm[lsm_rule].args_p); 821 return -EINVAL; 822 } 823 824 return result; 825 } 826 827 static void ima_log_string_op(struct audit_buffer *ab, char *key, char *value, 828 bool (*rule_operator)(kuid_t, kuid_t)) 829 { 830 if (!ab) 831 return; 832 833 if (rule_operator == &uid_gt) 834 audit_log_format(ab, "%s>", key); 835 else if (rule_operator == &uid_lt) 836 audit_log_format(ab, "%s<", key); 837 else 838 audit_log_format(ab, "%s=", key); 839 audit_log_format(ab, "%s ", value); 840 } 841 static void ima_log_string(struct audit_buffer *ab, char *key, char *value) 842 { 843 ima_log_string_op(ab, key, value, NULL); 844 } 845 846 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) 847 { 848 struct audit_buffer *ab; 849 char *from; 850 char *p; 851 bool uid_token; 852 struct ima_template_desc *template_desc; 853 int result = 0; 854 855 ab = integrity_audit_log_start(audit_context(), GFP_KERNEL, 856 AUDIT_INTEGRITY_POLICY_RULE); 857 858 entry->uid = INVALID_UID; 859 entry->fowner = INVALID_UID; 860 entry->uid_op = &uid_eq; 861 entry->fowner_op = &uid_eq; 862 entry->action = UNKNOWN; 863 while ((p = strsep(&rule, " \t")) != NULL) { 864 substring_t args[MAX_OPT_ARGS]; 865 int token; 866 unsigned long lnum; 867 868 if (result < 0) 869 break; 870 if ((*p == '\0') || (*p == ' ') || (*p == '\t')) 871 continue; 872 token = match_token(p, policy_tokens, args); 873 switch (token) { 874 case Opt_measure: 875 ima_log_string(ab, "action", "measure"); 876 877 if (entry->action != UNKNOWN) 878 result = -EINVAL; 879 880 entry->action = MEASURE; 881 break; 882 case Opt_dont_measure: 883 ima_log_string(ab, "action", "dont_measure"); 884 885 if (entry->action != UNKNOWN) 886 result = -EINVAL; 887 888 entry->action = DONT_MEASURE; 889 break; 890 case Opt_appraise: 891 ima_log_string(ab, "action", "appraise"); 892 893 if (entry->action != UNKNOWN) 894 result = -EINVAL; 895 896 entry->action = APPRAISE; 897 break; 898 case Opt_dont_appraise: 899 ima_log_string(ab, "action", "dont_appraise"); 900 901 if (entry->action != UNKNOWN) 902 result = -EINVAL; 903 904 entry->action = DONT_APPRAISE; 905 break; 906 case Opt_audit: 907 ima_log_string(ab, "action", "audit"); 908 909 if (entry->action != UNKNOWN) 910 result = -EINVAL; 911 912 entry->action = AUDIT; 913 break; 914 case Opt_hash: 915 ima_log_string(ab, "action", "hash"); 916 917 if (entry->action != UNKNOWN) 918 result = -EINVAL; 919 920 entry->action = HASH; 921 break; 922 case Opt_dont_hash: 923 ima_log_string(ab, "action", "dont_hash"); 924 925 if (entry->action != UNKNOWN) 926 result = -EINVAL; 927 928 entry->action = DONT_HASH; 929 break; 930 case Opt_func: 931 ima_log_string(ab, "func", args[0].from); 932 933 if (entry->func) 934 result = -EINVAL; 935 936 if (strcmp(args[0].from, "FILE_CHECK") == 0) 937 entry->func = FILE_CHECK; 938 /* PATH_CHECK is for backwards compat */ 939 else if (strcmp(args[0].from, "PATH_CHECK") == 0) 940 entry->func = FILE_CHECK; 941 else if (strcmp(args[0].from, "MODULE_CHECK") == 0) 942 entry->func = MODULE_CHECK; 943 else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0) 944 entry->func = FIRMWARE_CHECK; 945 else if ((strcmp(args[0].from, "FILE_MMAP") == 0) 946 || (strcmp(args[0].from, "MMAP_CHECK") == 0)) 947 entry->func = MMAP_CHECK; 948 else if (strcmp(args[0].from, "BPRM_CHECK") == 0) 949 entry->func = BPRM_CHECK; 950 else if (strcmp(args[0].from, "CREDS_CHECK") == 0) 951 entry->func = CREDS_CHECK; 952 else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") == 953 0) 954 entry->func = KEXEC_KERNEL_CHECK; 955 else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK") 956 == 0) 957 entry->func = KEXEC_INITRAMFS_CHECK; 958 else if (strcmp(args[0].from, "POLICY_CHECK") == 0) 959 entry->func = POLICY_CHECK; 960 else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0) 961 entry->func = KEXEC_CMDLINE; 962 else 963 result = -EINVAL; 964 if (!result) 965 entry->flags |= IMA_FUNC; 966 break; 967 case Opt_mask: 968 ima_log_string(ab, "mask", args[0].from); 969 970 if (entry->mask) 971 result = -EINVAL; 972 973 from = args[0].from; 974 if (*from == '^') 975 from++; 976 977 if ((strcmp(from, "MAY_EXEC")) == 0) 978 entry->mask = MAY_EXEC; 979 else if (strcmp(from, "MAY_WRITE") == 0) 980 entry->mask = MAY_WRITE; 981 else if (strcmp(from, "MAY_READ") == 0) 982 entry->mask = MAY_READ; 983 else if (strcmp(from, "MAY_APPEND") == 0) 984 entry->mask = MAY_APPEND; 985 else 986 result = -EINVAL; 987 if (!result) 988 entry->flags |= (*args[0].from == '^') 989 ? IMA_INMASK : IMA_MASK; 990 break; 991 case Opt_fsmagic: 992 ima_log_string(ab, "fsmagic", args[0].from); 993 994 if (entry->fsmagic) { 995 result = -EINVAL; 996 break; 997 } 998 999 result = kstrtoul(args[0].from, 16, &entry->fsmagic); 1000 if (!result) 1001 entry->flags |= IMA_FSMAGIC; 1002 break; 1003 case Opt_fsname: 1004 ima_log_string(ab, "fsname", args[0].from); 1005 1006 entry->fsname = kstrdup(args[0].from, GFP_KERNEL); 1007 if (!entry->fsname) { 1008 result = -ENOMEM; 1009 break; 1010 } 1011 result = 0; 1012 entry->flags |= IMA_FSNAME; 1013 break; 1014 case Opt_fsuuid: 1015 ima_log_string(ab, "fsuuid", args[0].from); 1016 1017 if (!uuid_is_null(&entry->fsuuid)) { 1018 result = -EINVAL; 1019 break; 1020 } 1021 1022 result = uuid_parse(args[0].from, &entry->fsuuid); 1023 if (!result) 1024 entry->flags |= IMA_FSUUID; 1025 break; 1026 case Opt_uid_gt: 1027 case Opt_euid_gt: 1028 entry->uid_op = &uid_gt; 1029 /* fall through */ 1030 case Opt_uid_lt: 1031 case Opt_euid_lt: 1032 if ((token == Opt_uid_lt) || (token == Opt_euid_lt)) 1033 entry->uid_op = &uid_lt; 1034 /* fall through */ 1035 case Opt_uid_eq: 1036 case Opt_euid_eq: 1037 uid_token = (token == Opt_uid_eq) || 1038 (token == Opt_uid_gt) || 1039 (token == Opt_uid_lt); 1040 1041 ima_log_string_op(ab, uid_token ? "uid" : "euid", 1042 args[0].from, entry->uid_op); 1043 1044 if (uid_valid(entry->uid)) { 1045 result = -EINVAL; 1046 break; 1047 } 1048 1049 result = kstrtoul(args[0].from, 10, &lnum); 1050 if (!result) { 1051 entry->uid = make_kuid(current_user_ns(), 1052 (uid_t) lnum); 1053 if (!uid_valid(entry->uid) || 1054 (uid_t)lnum != lnum) 1055 result = -EINVAL; 1056 else 1057 entry->flags |= uid_token 1058 ? IMA_UID : IMA_EUID; 1059 } 1060 break; 1061 case Opt_fowner_gt: 1062 entry->fowner_op = &uid_gt; 1063 /* fall through */ 1064 case Opt_fowner_lt: 1065 if (token == Opt_fowner_lt) 1066 entry->fowner_op = &uid_lt; 1067 /* fall through */ 1068 case Opt_fowner_eq: 1069 ima_log_string_op(ab, "fowner", args[0].from, 1070 entry->fowner_op); 1071 1072 if (uid_valid(entry->fowner)) { 1073 result = -EINVAL; 1074 break; 1075 } 1076 1077 result = kstrtoul(args[0].from, 10, &lnum); 1078 if (!result) { 1079 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum); 1080 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum)) 1081 result = -EINVAL; 1082 else 1083 entry->flags |= IMA_FOWNER; 1084 } 1085 break; 1086 case Opt_obj_user: 1087 ima_log_string(ab, "obj_user", args[0].from); 1088 result = ima_lsm_rule_init(entry, args, 1089 LSM_OBJ_USER, 1090 AUDIT_OBJ_USER); 1091 break; 1092 case Opt_obj_role: 1093 ima_log_string(ab, "obj_role", args[0].from); 1094 result = ima_lsm_rule_init(entry, args, 1095 LSM_OBJ_ROLE, 1096 AUDIT_OBJ_ROLE); 1097 break; 1098 case Opt_obj_type: 1099 ima_log_string(ab, "obj_type", args[0].from); 1100 result = ima_lsm_rule_init(entry, args, 1101 LSM_OBJ_TYPE, 1102 AUDIT_OBJ_TYPE); 1103 break; 1104 case Opt_subj_user: 1105 ima_log_string(ab, "subj_user", args[0].from); 1106 result = ima_lsm_rule_init(entry, args, 1107 LSM_SUBJ_USER, 1108 AUDIT_SUBJ_USER); 1109 break; 1110 case Opt_subj_role: 1111 ima_log_string(ab, "subj_role", args[0].from); 1112 result = ima_lsm_rule_init(entry, args, 1113 LSM_SUBJ_ROLE, 1114 AUDIT_SUBJ_ROLE); 1115 break; 1116 case Opt_subj_type: 1117 ima_log_string(ab, "subj_type", args[0].from); 1118 result = ima_lsm_rule_init(entry, args, 1119 LSM_SUBJ_TYPE, 1120 AUDIT_SUBJ_TYPE); 1121 break; 1122 case Opt_appraise_type: 1123 if (entry->action != APPRAISE) { 1124 result = -EINVAL; 1125 break; 1126 } 1127 1128 ima_log_string(ab, "appraise_type", args[0].from); 1129 if ((strcmp(args[0].from, "imasig")) == 0) 1130 entry->flags |= IMA_DIGSIG_REQUIRED; 1131 else 1132 result = -EINVAL; 1133 break; 1134 case Opt_permit_directio: 1135 entry->flags |= IMA_PERMIT_DIRECTIO; 1136 break; 1137 case Opt_pcr: 1138 if (entry->action != MEASURE) { 1139 result = -EINVAL; 1140 break; 1141 } 1142 ima_log_string(ab, "pcr", args[0].from); 1143 1144 result = kstrtoint(args[0].from, 10, &entry->pcr); 1145 if (result || INVALID_PCR(entry->pcr)) 1146 result = -EINVAL; 1147 else 1148 entry->flags |= IMA_PCR; 1149 1150 break; 1151 case Opt_template: 1152 ima_log_string(ab, "template", args[0].from); 1153 if (entry->action != MEASURE) { 1154 result = -EINVAL; 1155 break; 1156 } 1157 template_desc = lookup_template_desc(args[0].from); 1158 if (!template_desc || entry->template) { 1159 result = -EINVAL; 1160 break; 1161 } 1162 1163 /* 1164 * template_desc_init_fields() does nothing if 1165 * the template is already initialised, so 1166 * it's safe to do this unconditionally 1167 */ 1168 template_desc_init_fields(template_desc->fmt, 1169 &(template_desc->fields), 1170 &(template_desc->num_fields)); 1171 entry->template = template_desc; 1172 break; 1173 case Opt_err: 1174 ima_log_string(ab, "UNKNOWN", p); 1175 result = -EINVAL; 1176 break; 1177 } 1178 } 1179 if (!result && (entry->action == UNKNOWN)) 1180 result = -EINVAL; 1181 else if (entry->action == APPRAISE) 1182 temp_ima_appraise |= ima_appraise_flag(entry->func); 1183 1184 audit_log_format(ab, "res=%d", !result); 1185 audit_log_end(ab); 1186 return result; 1187 } 1188 1189 /** 1190 * ima_parse_add_rule - add a rule to ima_policy_rules 1191 * @rule - ima measurement policy rule 1192 * 1193 * Avoid locking by allowing just one writer at a time in ima_write_policy() 1194 * Returns the length of the rule parsed, an error code on failure 1195 */ 1196 ssize_t ima_parse_add_rule(char *rule) 1197 { 1198 static const char op[] = "update_policy"; 1199 char *p; 1200 struct ima_rule_entry *entry; 1201 ssize_t result, len; 1202 int audit_info = 0; 1203 1204 p = strsep(&rule, "\n"); 1205 len = strlen(p) + 1; 1206 p += strspn(p, " \t"); 1207 1208 if (*p == '#' || *p == '\0') 1209 return len; 1210 1211 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 1212 if (!entry) { 1213 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 1214 NULL, op, "-ENOMEM", -ENOMEM, audit_info); 1215 return -ENOMEM; 1216 } 1217 1218 INIT_LIST_HEAD(&entry->list); 1219 1220 result = ima_parse_rule(p, entry); 1221 if (result) { 1222 kfree(entry); 1223 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 1224 NULL, op, "invalid-policy", result, 1225 audit_info); 1226 return result; 1227 } 1228 1229 list_add_tail(&entry->list, &ima_temp_rules); 1230 1231 return len; 1232 } 1233 1234 /** 1235 * ima_delete_rules() called to cleanup invalid in-flight policy. 1236 * We don't need locking as we operate on the temp list, which is 1237 * different from the active one. There is also only one user of 1238 * ima_delete_rules() at a time. 1239 */ 1240 void ima_delete_rules(void) 1241 { 1242 struct ima_rule_entry *entry, *tmp; 1243 int i; 1244 1245 temp_ima_appraise = 0; 1246 list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) { 1247 for (i = 0; i < MAX_LSM_RULES; i++) 1248 kfree(entry->lsm[i].args_p); 1249 1250 list_del(&entry->list); 1251 kfree(entry); 1252 } 1253 } 1254 1255 #ifdef CONFIG_IMA_READ_POLICY 1256 enum { 1257 mask_exec = 0, mask_write, mask_read, mask_append 1258 }; 1259 1260 static const char *const mask_tokens[] = { 1261 "^MAY_EXEC", 1262 "^MAY_WRITE", 1263 "^MAY_READ", 1264 "^MAY_APPEND" 1265 }; 1266 1267 #define __ima_hook_stringify(str) (#str), 1268 1269 static const char *const func_tokens[] = { 1270 __ima_hooks(__ima_hook_stringify) 1271 }; 1272 1273 void *ima_policy_start(struct seq_file *m, loff_t *pos) 1274 { 1275 loff_t l = *pos; 1276 struct ima_rule_entry *entry; 1277 1278 rcu_read_lock(); 1279 list_for_each_entry_rcu(entry, ima_rules, list) { 1280 if (!l--) { 1281 rcu_read_unlock(); 1282 return entry; 1283 } 1284 } 1285 rcu_read_unlock(); 1286 return NULL; 1287 } 1288 1289 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos) 1290 { 1291 struct ima_rule_entry *entry = v; 1292 1293 rcu_read_lock(); 1294 entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list); 1295 rcu_read_unlock(); 1296 (*pos)++; 1297 1298 return (&entry->list == ima_rules) ? NULL : entry; 1299 } 1300 1301 void ima_policy_stop(struct seq_file *m, void *v) 1302 { 1303 } 1304 1305 #define pt(token) policy_tokens[token].pattern 1306 #define mt(token) mask_tokens[token] 1307 1308 /* 1309 * policy_func_show - display the ima_hooks policy rule 1310 */ 1311 static void policy_func_show(struct seq_file *m, enum ima_hooks func) 1312 { 1313 if (func > 0 && func < MAX_CHECK) 1314 seq_printf(m, "func=%s ", func_tokens[func]); 1315 else 1316 seq_printf(m, "func=%d ", func); 1317 } 1318 1319 int ima_policy_show(struct seq_file *m, void *v) 1320 { 1321 struct ima_rule_entry *entry = v; 1322 int i; 1323 char tbuf[64] = {0,}; 1324 int offset = 0; 1325 1326 rcu_read_lock(); 1327 1328 if (entry->action & MEASURE) 1329 seq_puts(m, pt(Opt_measure)); 1330 if (entry->action & DONT_MEASURE) 1331 seq_puts(m, pt(Opt_dont_measure)); 1332 if (entry->action & APPRAISE) 1333 seq_puts(m, pt(Opt_appraise)); 1334 if (entry->action & DONT_APPRAISE) 1335 seq_puts(m, pt(Opt_dont_appraise)); 1336 if (entry->action & AUDIT) 1337 seq_puts(m, pt(Opt_audit)); 1338 if (entry->action & HASH) 1339 seq_puts(m, pt(Opt_hash)); 1340 if (entry->action & DONT_HASH) 1341 seq_puts(m, pt(Opt_dont_hash)); 1342 1343 seq_puts(m, " "); 1344 1345 if (entry->flags & IMA_FUNC) 1346 policy_func_show(m, entry->func); 1347 1348 if ((entry->flags & IMA_MASK) || (entry->flags & IMA_INMASK)) { 1349 if (entry->flags & IMA_MASK) 1350 offset = 1; 1351 if (entry->mask & MAY_EXEC) 1352 seq_printf(m, pt(Opt_mask), mt(mask_exec) + offset); 1353 if (entry->mask & MAY_WRITE) 1354 seq_printf(m, pt(Opt_mask), mt(mask_write) + offset); 1355 if (entry->mask & MAY_READ) 1356 seq_printf(m, pt(Opt_mask), mt(mask_read) + offset); 1357 if (entry->mask & MAY_APPEND) 1358 seq_printf(m, pt(Opt_mask), mt(mask_append) + offset); 1359 seq_puts(m, " "); 1360 } 1361 1362 if (entry->flags & IMA_FSMAGIC) { 1363 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic); 1364 seq_printf(m, pt(Opt_fsmagic), tbuf); 1365 seq_puts(m, " "); 1366 } 1367 1368 if (entry->flags & IMA_FSNAME) { 1369 snprintf(tbuf, sizeof(tbuf), "%s", entry->fsname); 1370 seq_printf(m, pt(Opt_fsname), tbuf); 1371 seq_puts(m, " "); 1372 } 1373 1374 if (entry->flags & IMA_PCR) { 1375 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr); 1376 seq_printf(m, pt(Opt_pcr), tbuf); 1377 seq_puts(m, " "); 1378 } 1379 1380 if (entry->flags & IMA_FSUUID) { 1381 seq_printf(m, "fsuuid=%pU", &entry->fsuuid); 1382 seq_puts(m, " "); 1383 } 1384 1385 if (entry->flags & IMA_UID) { 1386 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid)); 1387 if (entry->uid_op == &uid_gt) 1388 seq_printf(m, pt(Opt_uid_gt), tbuf); 1389 else if (entry->uid_op == &uid_lt) 1390 seq_printf(m, pt(Opt_uid_lt), tbuf); 1391 else 1392 seq_printf(m, pt(Opt_uid_eq), tbuf); 1393 seq_puts(m, " "); 1394 } 1395 1396 if (entry->flags & IMA_EUID) { 1397 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid)); 1398 if (entry->uid_op == &uid_gt) 1399 seq_printf(m, pt(Opt_euid_gt), tbuf); 1400 else if (entry->uid_op == &uid_lt) 1401 seq_printf(m, pt(Opt_euid_lt), tbuf); 1402 else 1403 seq_printf(m, pt(Opt_euid_eq), tbuf); 1404 seq_puts(m, " "); 1405 } 1406 1407 if (entry->flags & IMA_FOWNER) { 1408 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner)); 1409 if (entry->fowner_op == &uid_gt) 1410 seq_printf(m, pt(Opt_fowner_gt), tbuf); 1411 else if (entry->fowner_op == &uid_lt) 1412 seq_printf(m, pt(Opt_fowner_lt), tbuf); 1413 else 1414 seq_printf(m, pt(Opt_fowner_eq), tbuf); 1415 seq_puts(m, " "); 1416 } 1417 1418 for (i = 0; i < MAX_LSM_RULES; i++) { 1419 if (entry->lsm[i].rule) { 1420 switch (i) { 1421 case LSM_OBJ_USER: 1422 seq_printf(m, pt(Opt_obj_user), 1423 (char *)entry->lsm[i].args_p); 1424 break; 1425 case LSM_OBJ_ROLE: 1426 seq_printf(m, pt(Opt_obj_role), 1427 (char *)entry->lsm[i].args_p); 1428 break; 1429 case LSM_OBJ_TYPE: 1430 seq_printf(m, pt(Opt_obj_type), 1431 (char *)entry->lsm[i].args_p); 1432 break; 1433 case LSM_SUBJ_USER: 1434 seq_printf(m, pt(Opt_subj_user), 1435 (char *)entry->lsm[i].args_p); 1436 break; 1437 case LSM_SUBJ_ROLE: 1438 seq_printf(m, pt(Opt_subj_role), 1439 (char *)entry->lsm[i].args_p); 1440 break; 1441 case LSM_SUBJ_TYPE: 1442 seq_printf(m, pt(Opt_subj_type), 1443 (char *)entry->lsm[i].args_p); 1444 break; 1445 } 1446 } 1447 } 1448 if (entry->template) 1449 seq_printf(m, "template=%s ", entry->template->name); 1450 if (entry->flags & IMA_DIGSIG_REQUIRED) 1451 seq_puts(m, "appraise_type=imasig "); 1452 if (entry->flags & IMA_PERMIT_DIRECTIO) 1453 seq_puts(m, "permit_directio "); 1454 rcu_read_unlock(); 1455 seq_puts(m, "\n"); 1456 return 0; 1457 } 1458 #endif /* CONFIG_IMA_READ_POLICY */ 1459