1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2008 IBM Corporation 4 * Author: Mimi Zohar <zohar@us.ibm.com> 5 * 6 * ima_policy.c 7 * - initialize default measure policy rules 8 */ 9 10 #include <linux/init.h> 11 #include <linux/list.h> 12 #include <linux/kernel_read_file.h> 13 #include <linux/fs.h> 14 #include <linux/security.h> 15 #include <linux/magic.h> 16 #include <linux/parser.h> 17 #include <linux/slab.h> 18 #include <linux/rculist.h> 19 #include <linux/genhd.h> 20 #include <linux/seq_file.h> 21 #include <linux/ima.h> 22 23 #include "ima.h" 24 25 /* flags definitions */ 26 #define IMA_FUNC 0x0001 27 #define IMA_MASK 0x0002 28 #define IMA_FSMAGIC 0x0004 29 #define IMA_UID 0x0008 30 #define IMA_FOWNER 0x0010 31 #define IMA_FSUUID 0x0020 32 #define IMA_INMASK 0x0040 33 #define IMA_EUID 0x0080 34 #define IMA_PCR 0x0100 35 #define IMA_FSNAME 0x0200 36 #define IMA_KEYRINGS 0x0400 37 #define IMA_LABEL 0x0800 38 39 #define UNKNOWN 0 40 #define MEASURE 0x0001 /* same as IMA_MEASURE */ 41 #define DONT_MEASURE 0x0002 42 #define APPRAISE 0x0004 /* same as IMA_APPRAISE */ 43 #define DONT_APPRAISE 0x0008 44 #define AUDIT 0x0040 45 #define HASH 0x0100 46 #define DONT_HASH 0x0200 47 48 #define INVALID_PCR(a) (((a) < 0) || \ 49 (a) >= (sizeof_field(struct integrity_iint_cache, measured_pcrs) * 8)) 50 51 int ima_policy_flag; 52 static int temp_ima_appraise; 53 static int build_ima_appraise __ro_after_init; 54 55 #define MAX_LSM_RULES 6 56 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, 57 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE 58 }; 59 60 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB }; 61 62 enum policy_rule_list { IMA_DEFAULT_POLICY = 1, IMA_CUSTOM_POLICY }; 63 64 struct ima_rule_opt_list { 65 size_t count; 66 char *items[]; 67 }; 68 69 struct ima_rule_entry { 70 struct list_head list; 71 int action; 72 unsigned int flags; 73 enum ima_hooks func; 74 int mask; 75 unsigned long fsmagic; 76 uuid_t fsuuid; 77 kuid_t uid; 78 kuid_t fowner; 79 bool (*uid_op)(kuid_t, kuid_t); /* Handlers for operators */ 80 bool (*fowner_op)(kuid_t, kuid_t); /* uid_eq(), uid_gt(), uid_lt() */ 81 int pcr; 82 struct { 83 void *rule; /* LSM file metadata specific */ 84 char *args_p; /* audit value */ 85 int type; /* audit type */ 86 } lsm[MAX_LSM_RULES]; 87 char *fsname; 88 struct ima_rule_opt_list *keyrings; /* Measure keys added to these keyrings */ 89 struct ima_rule_opt_list *label; /* Measure data grouped under this label */ 90 struct ima_template_desc *template; 91 }; 92 93 /* 94 * Without LSM specific knowledge, the default policy can only be 95 * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner 96 */ 97 98 /* 99 * The minimum rule set to allow for full TCB coverage. Measures all files 100 * opened or mmap for exec and everything read by root. Dangerous because 101 * normal users can easily run the machine out of memory simply building 102 * and running executables. 103 */ 104 static struct ima_rule_entry dont_measure_rules[] __ro_after_init = { 105 {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 106 {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, 107 {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, 108 {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, 109 {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 110 {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, 111 {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, 112 {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, 113 {.action = DONT_MEASURE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC}, 114 {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC, 115 .flags = IMA_FSMAGIC}, 116 {.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC, 117 .flags = IMA_FSMAGIC}, 118 {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, 119 {.action = DONT_MEASURE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC} 120 }; 121 122 static struct ima_rule_entry original_measurement_rules[] __ro_after_init = { 123 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, 124 .flags = IMA_FUNC | IMA_MASK}, 125 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, 126 .flags = IMA_FUNC | IMA_MASK}, 127 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 128 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq, 129 .flags = IMA_FUNC | IMA_MASK | IMA_UID}, 130 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, 131 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, 132 }; 133 134 static struct ima_rule_entry default_measurement_rules[] __ro_after_init = { 135 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, 136 .flags = IMA_FUNC | IMA_MASK}, 137 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, 138 .flags = IMA_FUNC | IMA_MASK}, 139 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 140 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq, 141 .flags = IMA_FUNC | IMA_INMASK | IMA_EUID}, 142 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 143 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq, 144 .flags = IMA_FUNC | IMA_INMASK | IMA_UID}, 145 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, 146 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, 147 {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC}, 148 }; 149 150 static struct ima_rule_entry default_appraise_rules[] __ro_after_init = { 151 {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 152 {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, 153 {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, 154 {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, 155 {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC}, 156 {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 157 {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, 158 {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, 159 {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, 160 {.action = DONT_APPRAISE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC}, 161 {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, 162 {.action = DONT_APPRAISE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC}, 163 {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 164 {.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 165 #ifdef CONFIG_IMA_WRITE_POLICY 166 {.action = APPRAISE, .func = POLICY_CHECK, 167 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 168 #endif 169 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT 170 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq, 171 .flags = IMA_FOWNER}, 172 #else 173 /* force signature */ 174 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq, 175 .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED}, 176 #endif 177 }; 178 179 static struct ima_rule_entry build_appraise_rules[] __ro_after_init = { 180 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS 181 {.action = APPRAISE, .func = MODULE_CHECK, 182 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 183 #endif 184 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS 185 {.action = APPRAISE, .func = FIRMWARE_CHECK, 186 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 187 #endif 188 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS 189 {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK, 190 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 191 #endif 192 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS 193 {.action = APPRAISE, .func = POLICY_CHECK, 194 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 195 #endif 196 }; 197 198 static struct ima_rule_entry secure_boot_rules[] __ro_after_init = { 199 {.action = APPRAISE, .func = MODULE_CHECK, 200 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 201 {.action = APPRAISE, .func = FIRMWARE_CHECK, 202 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 203 {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK, 204 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 205 {.action = APPRAISE, .func = POLICY_CHECK, 206 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, 207 }; 208 209 static struct ima_rule_entry critical_data_rules[] __ro_after_init = { 210 {.action = MEASURE, .func = CRITICAL_DATA, .flags = IMA_FUNC}, 211 }; 212 213 /* An array of architecture specific rules */ 214 static struct ima_rule_entry *arch_policy_entry __ro_after_init; 215 216 static LIST_HEAD(ima_default_rules); 217 static LIST_HEAD(ima_policy_rules); 218 static LIST_HEAD(ima_temp_rules); 219 static struct list_head *ima_rules = &ima_default_rules; 220 221 static int ima_policy __initdata; 222 223 static int __init default_measure_policy_setup(char *str) 224 { 225 if (ima_policy) 226 return 1; 227 228 ima_policy = ORIGINAL_TCB; 229 return 1; 230 } 231 __setup("ima_tcb", default_measure_policy_setup); 232 233 static bool ima_use_appraise_tcb __initdata; 234 static bool ima_use_secure_boot __initdata; 235 static bool ima_use_critical_data __initdata; 236 static bool ima_fail_unverifiable_sigs __ro_after_init; 237 static int __init policy_setup(char *str) 238 { 239 char *p; 240 241 while ((p = strsep(&str, " |\n")) != NULL) { 242 if (*p == ' ') 243 continue; 244 if ((strcmp(p, "tcb") == 0) && !ima_policy) 245 ima_policy = DEFAULT_TCB; 246 else if (strcmp(p, "appraise_tcb") == 0) 247 ima_use_appraise_tcb = true; 248 else if (strcmp(p, "secure_boot") == 0) 249 ima_use_secure_boot = true; 250 else if (strcmp(p, "critical_data") == 0) 251 ima_use_critical_data = true; 252 else if (strcmp(p, "fail_securely") == 0) 253 ima_fail_unverifiable_sigs = true; 254 else 255 pr_err("policy \"%s\" not found", p); 256 } 257 258 return 1; 259 } 260 __setup("ima_policy=", policy_setup); 261 262 static int __init default_appraise_policy_setup(char *str) 263 { 264 ima_use_appraise_tcb = true; 265 return 1; 266 } 267 __setup("ima_appraise_tcb", default_appraise_policy_setup); 268 269 static struct ima_rule_opt_list *ima_alloc_rule_opt_list(const substring_t *src) 270 { 271 struct ima_rule_opt_list *opt_list; 272 size_t count = 0; 273 char *src_copy; 274 char *cur, *next; 275 size_t i; 276 277 src_copy = match_strdup(src); 278 if (!src_copy) 279 return ERR_PTR(-ENOMEM); 280 281 next = src_copy; 282 while ((cur = strsep(&next, "|"))) { 283 /* Don't accept an empty list item */ 284 if (!(*cur)) { 285 kfree(src_copy); 286 return ERR_PTR(-EINVAL); 287 } 288 count++; 289 } 290 291 /* Don't accept an empty list */ 292 if (!count) { 293 kfree(src_copy); 294 return ERR_PTR(-EINVAL); 295 } 296 297 opt_list = kzalloc(struct_size(opt_list, items, count), GFP_KERNEL); 298 if (!opt_list) { 299 kfree(src_copy); 300 return ERR_PTR(-ENOMEM); 301 } 302 303 /* 304 * strsep() has already replaced all instances of '|' with '\0', 305 * leaving a byte sequence of NUL-terminated strings. Reference each 306 * string with the array of items. 307 * 308 * IMPORTANT: Ownership of the allocated buffer is transferred from 309 * src_copy to the first element in the items array. To free the 310 * buffer, kfree() must only be called on the first element of the 311 * array. 312 */ 313 for (i = 0, cur = src_copy; i < count; i++) { 314 opt_list->items[i] = cur; 315 cur = strchr(cur, '\0') + 1; 316 } 317 opt_list->count = count; 318 319 return opt_list; 320 } 321 322 static void ima_free_rule_opt_list(struct ima_rule_opt_list *opt_list) 323 { 324 if (!opt_list) 325 return; 326 327 if (opt_list->count) { 328 kfree(opt_list->items[0]); 329 opt_list->count = 0; 330 } 331 332 kfree(opt_list); 333 } 334 335 static void ima_lsm_free_rule(struct ima_rule_entry *entry) 336 { 337 int i; 338 339 for (i = 0; i < MAX_LSM_RULES; i++) { 340 ima_filter_rule_free(entry->lsm[i].rule); 341 kfree(entry->lsm[i].args_p); 342 } 343 } 344 345 static void ima_free_rule(struct ima_rule_entry *entry) 346 { 347 if (!entry) 348 return; 349 350 /* 351 * entry->template->fields may be allocated in ima_parse_rule() but that 352 * reference is owned by the corresponding ima_template_desc element in 353 * the defined_templates list and cannot be freed here 354 */ 355 kfree(entry->fsname); 356 ima_free_rule_opt_list(entry->keyrings); 357 ima_lsm_free_rule(entry); 358 kfree(entry); 359 } 360 361 static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry) 362 { 363 struct ima_rule_entry *nentry; 364 int i; 365 366 /* 367 * Immutable elements are copied over as pointers and data; only 368 * lsm rules can change 369 */ 370 nentry = kmemdup(entry, sizeof(*nentry), GFP_KERNEL); 371 if (!nentry) 372 return NULL; 373 374 memset(nentry->lsm, 0, sizeof_field(struct ima_rule_entry, lsm)); 375 376 for (i = 0; i < MAX_LSM_RULES; i++) { 377 if (!entry->lsm[i].args_p) 378 continue; 379 380 nentry->lsm[i].type = entry->lsm[i].type; 381 nentry->lsm[i].args_p = entry->lsm[i].args_p; 382 /* 383 * Remove the reference from entry so that the associated 384 * memory will not be freed during a later call to 385 * ima_lsm_free_rule(entry). 386 */ 387 entry->lsm[i].args_p = NULL; 388 389 ima_filter_rule_init(nentry->lsm[i].type, Audit_equal, 390 nentry->lsm[i].args_p, 391 &nentry->lsm[i].rule); 392 if (!nentry->lsm[i].rule) 393 pr_warn("rule for LSM \'%s\' is undefined\n", 394 nentry->lsm[i].args_p); 395 } 396 return nentry; 397 } 398 399 static int ima_lsm_update_rule(struct ima_rule_entry *entry) 400 { 401 struct ima_rule_entry *nentry; 402 403 nentry = ima_lsm_copy_rule(entry); 404 if (!nentry) 405 return -ENOMEM; 406 407 list_replace_rcu(&entry->list, &nentry->list); 408 synchronize_rcu(); 409 /* 410 * ima_lsm_copy_rule() shallow copied all references, except for the 411 * LSM references, from entry to nentry so we only want to free the LSM 412 * references and the entry itself. All other memory refrences will now 413 * be owned by nentry. 414 */ 415 ima_lsm_free_rule(entry); 416 kfree(entry); 417 418 return 0; 419 } 420 421 static bool ima_rule_contains_lsm_cond(struct ima_rule_entry *entry) 422 { 423 int i; 424 425 for (i = 0; i < MAX_LSM_RULES; i++) 426 if (entry->lsm[i].args_p) 427 return true; 428 429 return false; 430 } 431 432 /* 433 * The LSM policy can be reloaded, leaving the IMA LSM based rules referring 434 * to the old, stale LSM policy. Update the IMA LSM based rules to reflect 435 * the reloaded LSM policy. 436 */ 437 static void ima_lsm_update_rules(void) 438 { 439 struct ima_rule_entry *entry, *e; 440 int result; 441 442 list_for_each_entry_safe(entry, e, &ima_policy_rules, list) { 443 if (!ima_rule_contains_lsm_cond(entry)) 444 continue; 445 446 result = ima_lsm_update_rule(entry); 447 if (result) { 448 pr_err("lsm rule update error %d\n", result); 449 return; 450 } 451 } 452 } 453 454 int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event, 455 void *lsm_data) 456 { 457 if (event != LSM_POLICY_CHANGE) 458 return NOTIFY_DONE; 459 460 ima_lsm_update_rules(); 461 return NOTIFY_OK; 462 } 463 464 /** 465 * ima_match_rule_data - determine whether func_data matches the policy rule 466 * @rule: a pointer to a rule 467 * @func_data: data to match against the measure rule data 468 * @cred: a pointer to a credentials structure for user validation 469 * 470 * Returns true if func_data matches one in the rule, false otherwise. 471 */ 472 static bool ima_match_rule_data(struct ima_rule_entry *rule, 473 const char *func_data, 474 const struct cred *cred) 475 { 476 const struct ima_rule_opt_list *opt_list = NULL; 477 bool matched = false; 478 size_t i; 479 480 if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid)) 481 return false; 482 483 switch (rule->func) { 484 case KEY_CHECK: 485 if (!rule->keyrings) 486 return true; 487 488 opt_list = rule->keyrings; 489 break; 490 case CRITICAL_DATA: 491 if (!rule->label) 492 return true; 493 494 opt_list = rule->label; 495 break; 496 default: 497 return false; 498 } 499 500 if (!func_data) 501 return false; 502 503 for (i = 0; i < opt_list->count; i++) { 504 if (!strcmp(opt_list->items[i], func_data)) { 505 matched = true; 506 break; 507 } 508 } 509 510 return matched; 511 } 512 513 /** 514 * ima_match_rules - determine whether an inode matches the policy rule. 515 * @rule: a pointer to a rule 516 * @mnt_userns: user namespace of the mount the inode was found from 517 * @inode: a pointer to an inode 518 * @cred: a pointer to a credentials structure for user validation 519 * @secid: the secid of the task to be validated 520 * @func: LIM hook identifier 521 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 522 * @func_data: func specific data, may be NULL 523 * 524 * Returns true on rule match, false on failure. 525 */ 526 static bool ima_match_rules(struct ima_rule_entry *rule, 527 struct user_namespace *mnt_userns, 528 struct inode *inode, const struct cred *cred, 529 u32 secid, enum ima_hooks func, int mask, 530 const char *func_data) 531 { 532 int i; 533 534 if ((rule->flags & IMA_FUNC) && 535 (rule->func != func && func != POST_SETATTR)) 536 return false; 537 538 switch (func) { 539 case KEY_CHECK: 540 case CRITICAL_DATA: 541 return ((rule->func == func) && 542 ima_match_rule_data(rule, func_data, cred)); 543 default: 544 break; 545 } 546 547 if ((rule->flags & IMA_MASK) && 548 (rule->mask != mask && func != POST_SETATTR)) 549 return false; 550 if ((rule->flags & IMA_INMASK) && 551 (!(rule->mask & mask) && func != POST_SETATTR)) 552 return false; 553 if ((rule->flags & IMA_FSMAGIC) 554 && rule->fsmagic != inode->i_sb->s_magic) 555 return false; 556 if ((rule->flags & IMA_FSNAME) 557 && strcmp(rule->fsname, inode->i_sb->s_type->name)) 558 return false; 559 if ((rule->flags & IMA_FSUUID) && 560 !uuid_equal(&rule->fsuuid, &inode->i_sb->s_uuid)) 561 return false; 562 if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid)) 563 return false; 564 if (rule->flags & IMA_EUID) { 565 if (has_capability_noaudit(current, CAP_SETUID)) { 566 if (!rule->uid_op(cred->euid, rule->uid) 567 && !rule->uid_op(cred->suid, rule->uid) 568 && !rule->uid_op(cred->uid, rule->uid)) 569 return false; 570 } else if (!rule->uid_op(cred->euid, rule->uid)) 571 return false; 572 } 573 574 if ((rule->flags & IMA_FOWNER) && 575 !rule->fowner_op(i_uid_into_mnt(mnt_userns, inode), rule->fowner)) 576 return false; 577 for (i = 0; i < MAX_LSM_RULES; i++) { 578 int rc = 0; 579 u32 osid; 580 581 if (!rule->lsm[i].rule) { 582 if (!rule->lsm[i].args_p) 583 continue; 584 else 585 return false; 586 } 587 switch (i) { 588 case LSM_OBJ_USER: 589 case LSM_OBJ_ROLE: 590 case LSM_OBJ_TYPE: 591 security_inode_getsecid(inode, &osid); 592 rc = ima_filter_rule_match(osid, rule->lsm[i].type, 593 Audit_equal, 594 rule->lsm[i].rule); 595 break; 596 case LSM_SUBJ_USER: 597 case LSM_SUBJ_ROLE: 598 case LSM_SUBJ_TYPE: 599 rc = ima_filter_rule_match(secid, rule->lsm[i].type, 600 Audit_equal, 601 rule->lsm[i].rule); 602 default: 603 break; 604 } 605 if (!rc) 606 return false; 607 } 608 return true; 609 } 610 611 /* 612 * In addition to knowing that we need to appraise the file in general, 613 * we need to differentiate between calling hooks, for hook specific rules. 614 */ 615 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) 616 { 617 if (!(rule->flags & IMA_FUNC)) 618 return IMA_FILE_APPRAISE; 619 620 switch (func) { 621 case MMAP_CHECK: 622 return IMA_MMAP_APPRAISE; 623 case BPRM_CHECK: 624 return IMA_BPRM_APPRAISE; 625 case CREDS_CHECK: 626 return IMA_CREDS_APPRAISE; 627 case FILE_CHECK: 628 case POST_SETATTR: 629 return IMA_FILE_APPRAISE; 630 case MODULE_CHECK ... MAX_CHECK - 1: 631 default: 632 return IMA_READ_APPRAISE; 633 } 634 } 635 636 /** 637 * ima_match_policy - decision based on LSM and other conditions 638 * @mnt_userns: user namespace of the mount the inode was found from 639 * @inode: pointer to an inode for which the policy decision is being made 640 * @cred: pointer to a credentials structure for which the policy decision is 641 * being made 642 * @secid: LSM secid of the task to be validated 643 * @func: IMA hook identifier 644 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 645 * @pcr: set the pcr to extend 646 * @template_desc: the template that should be used for this rule 647 * @func_data: func specific data, may be NULL 648 * 649 * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type) 650 * conditions. 651 * 652 * Since the IMA policy may be updated multiple times we need to lock the 653 * list when walking it. Reads are many orders of magnitude more numerous 654 * than writes so ima_match_policy() is classical RCU candidate. 655 */ 656 int ima_match_policy(struct user_namespace *mnt_userns, struct inode *inode, 657 const struct cred *cred, u32 secid, enum ima_hooks func, 658 int mask, int flags, int *pcr, 659 struct ima_template_desc **template_desc, 660 const char *func_data) 661 { 662 struct ima_rule_entry *entry; 663 int action = 0, actmask = flags | (flags << 1); 664 665 if (template_desc && !*template_desc) 666 *template_desc = ima_template_desc_current(); 667 668 rcu_read_lock(); 669 list_for_each_entry_rcu(entry, ima_rules, list) { 670 671 if (!(entry->action & actmask)) 672 continue; 673 674 if (!ima_match_rules(entry, mnt_userns, inode, cred, secid, 675 func, mask, func_data)) 676 continue; 677 678 action |= entry->flags & IMA_ACTION_FLAGS; 679 680 action |= entry->action & IMA_DO_MASK; 681 if (entry->action & IMA_APPRAISE) { 682 action |= get_subaction(entry, func); 683 action &= ~IMA_HASH; 684 if (ima_fail_unverifiable_sigs) 685 action |= IMA_FAIL_UNVERIFIABLE_SIGS; 686 } 687 688 689 if (entry->action & IMA_DO_MASK) 690 actmask &= ~(entry->action | entry->action << 1); 691 else 692 actmask &= ~(entry->action | entry->action >> 1); 693 694 if ((pcr) && (entry->flags & IMA_PCR)) 695 *pcr = entry->pcr; 696 697 if (template_desc && entry->template) 698 *template_desc = entry->template; 699 700 if (!actmask) 701 break; 702 } 703 rcu_read_unlock(); 704 705 return action; 706 } 707 708 /* 709 * Initialize the ima_policy_flag variable based on the currently 710 * loaded policy. Based on this flag, the decision to short circuit 711 * out of a function or not call the function in the first place 712 * can be made earlier. 713 */ 714 void ima_update_policy_flag(void) 715 { 716 struct ima_rule_entry *entry; 717 718 list_for_each_entry(entry, ima_rules, list) { 719 if (entry->action & IMA_DO_MASK) 720 ima_policy_flag |= entry->action; 721 } 722 723 ima_appraise |= (build_ima_appraise | temp_ima_appraise); 724 if (!ima_appraise) 725 ima_policy_flag &= ~IMA_APPRAISE; 726 } 727 728 static int ima_appraise_flag(enum ima_hooks func) 729 { 730 if (func == MODULE_CHECK) 731 return IMA_APPRAISE_MODULES; 732 else if (func == FIRMWARE_CHECK) 733 return IMA_APPRAISE_FIRMWARE; 734 else if (func == POLICY_CHECK) 735 return IMA_APPRAISE_POLICY; 736 else if (func == KEXEC_KERNEL_CHECK) 737 return IMA_APPRAISE_KEXEC; 738 return 0; 739 } 740 741 static void add_rules(struct ima_rule_entry *entries, int count, 742 enum policy_rule_list policy_rule) 743 { 744 int i = 0; 745 746 for (i = 0; i < count; i++) { 747 struct ima_rule_entry *entry; 748 749 if (policy_rule & IMA_DEFAULT_POLICY) 750 list_add_tail(&entries[i].list, &ima_default_rules); 751 752 if (policy_rule & IMA_CUSTOM_POLICY) { 753 entry = kmemdup(&entries[i], sizeof(*entry), 754 GFP_KERNEL); 755 if (!entry) 756 continue; 757 758 list_add_tail(&entry->list, &ima_policy_rules); 759 } 760 if (entries[i].action == APPRAISE) { 761 if (entries != build_appraise_rules) 762 temp_ima_appraise |= 763 ima_appraise_flag(entries[i].func); 764 else 765 build_ima_appraise |= 766 ima_appraise_flag(entries[i].func); 767 } 768 } 769 } 770 771 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry); 772 773 static int __init ima_init_arch_policy(void) 774 { 775 const char * const *arch_rules; 776 const char * const *rules; 777 int arch_entries = 0; 778 int i = 0; 779 780 arch_rules = arch_get_ima_policy(); 781 if (!arch_rules) 782 return arch_entries; 783 784 /* Get number of rules */ 785 for (rules = arch_rules; *rules != NULL; rules++) 786 arch_entries++; 787 788 arch_policy_entry = kcalloc(arch_entries + 1, 789 sizeof(*arch_policy_entry), GFP_KERNEL); 790 if (!arch_policy_entry) 791 return 0; 792 793 /* Convert each policy string rules to struct ima_rule_entry format */ 794 for (rules = arch_rules, i = 0; *rules != NULL; rules++) { 795 char rule[255]; 796 int result; 797 798 result = strlcpy(rule, *rules, sizeof(rule)); 799 800 INIT_LIST_HEAD(&arch_policy_entry[i].list); 801 result = ima_parse_rule(rule, &arch_policy_entry[i]); 802 if (result) { 803 pr_warn("Skipping unknown architecture policy rule: %s\n", 804 rule); 805 memset(&arch_policy_entry[i], 0, 806 sizeof(*arch_policy_entry)); 807 continue; 808 } 809 i++; 810 } 811 return i; 812 } 813 814 /** 815 * ima_init_policy - initialize the default measure rules. 816 * 817 * ima_rules points to either the ima_default_rules or the 818 * the new ima_policy_rules. 819 */ 820 void __init ima_init_policy(void) 821 { 822 int build_appraise_entries, arch_entries; 823 824 /* if !ima_policy, we load NO default rules */ 825 if (ima_policy) 826 add_rules(dont_measure_rules, ARRAY_SIZE(dont_measure_rules), 827 IMA_DEFAULT_POLICY); 828 829 switch (ima_policy) { 830 case ORIGINAL_TCB: 831 add_rules(original_measurement_rules, 832 ARRAY_SIZE(original_measurement_rules), 833 IMA_DEFAULT_POLICY); 834 break; 835 case DEFAULT_TCB: 836 add_rules(default_measurement_rules, 837 ARRAY_SIZE(default_measurement_rules), 838 IMA_DEFAULT_POLICY); 839 default: 840 break; 841 } 842 843 /* 844 * Based on runtime secure boot flags, insert arch specific measurement 845 * and appraise rules requiring file signatures for both the initial 846 * and custom policies, prior to other appraise rules. 847 * (Highest priority) 848 */ 849 arch_entries = ima_init_arch_policy(); 850 if (!arch_entries) 851 pr_info("No architecture policies found\n"); 852 else 853 add_rules(arch_policy_entry, arch_entries, 854 IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY); 855 856 /* 857 * Insert the builtin "secure_boot" policy rules requiring file 858 * signatures, prior to other appraise rules. 859 */ 860 if (ima_use_secure_boot) 861 add_rules(secure_boot_rules, ARRAY_SIZE(secure_boot_rules), 862 IMA_DEFAULT_POLICY); 863 864 /* 865 * Insert the build time appraise rules requiring file signatures 866 * for both the initial and custom policies, prior to other appraise 867 * rules. As the secure boot rules includes all of the build time 868 * rules, include either one or the other set of rules, but not both. 869 */ 870 build_appraise_entries = ARRAY_SIZE(build_appraise_rules); 871 if (build_appraise_entries) { 872 if (ima_use_secure_boot) 873 add_rules(build_appraise_rules, build_appraise_entries, 874 IMA_CUSTOM_POLICY); 875 else 876 add_rules(build_appraise_rules, build_appraise_entries, 877 IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY); 878 } 879 880 if (ima_use_appraise_tcb) 881 add_rules(default_appraise_rules, 882 ARRAY_SIZE(default_appraise_rules), 883 IMA_DEFAULT_POLICY); 884 885 if (ima_use_critical_data) 886 add_rules(critical_data_rules, 887 ARRAY_SIZE(critical_data_rules), 888 IMA_DEFAULT_POLICY); 889 890 ima_update_policy_flag(); 891 } 892 893 /* Make sure we have a valid policy, at least containing some rules. */ 894 int ima_check_policy(void) 895 { 896 if (list_empty(&ima_temp_rules)) 897 return -EINVAL; 898 return 0; 899 } 900 901 /** 902 * ima_update_policy - update default_rules with new measure rules 903 * 904 * Called on file .release to update the default rules with a complete new 905 * policy. What we do here is to splice ima_policy_rules and ima_temp_rules so 906 * they make a queue. The policy may be updated multiple times and this is the 907 * RCU updater. 908 * 909 * Policy rules are never deleted so ima_policy_flag gets zeroed only once when 910 * we switch from the default policy to user defined. 911 */ 912 void ima_update_policy(void) 913 { 914 struct list_head *policy = &ima_policy_rules; 915 916 list_splice_tail_init_rcu(&ima_temp_rules, policy, synchronize_rcu); 917 918 if (ima_rules != policy) { 919 ima_policy_flag = 0; 920 ima_rules = policy; 921 922 /* 923 * IMA architecture specific policy rules are specified 924 * as strings and converted to an array of ima_entry_rules 925 * on boot. After loading a custom policy, free the 926 * architecture specific rules stored as an array. 927 */ 928 kfree(arch_policy_entry); 929 } 930 ima_update_policy_flag(); 931 932 /* Custom IMA policy has been loaded */ 933 ima_process_queued_keys(); 934 } 935 936 /* Keep the enumeration in sync with the policy_tokens! */ 937 enum { 938 Opt_measure, Opt_dont_measure, 939 Opt_appraise, Opt_dont_appraise, 940 Opt_audit, Opt_hash, Opt_dont_hash, 941 Opt_obj_user, Opt_obj_role, Opt_obj_type, 942 Opt_subj_user, Opt_subj_role, Opt_subj_type, 943 Opt_func, Opt_mask, Opt_fsmagic, Opt_fsname, 944 Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq, 945 Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt, 946 Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt, 947 Opt_appraise_type, Opt_appraise_flag, 948 Opt_permit_directio, Opt_pcr, Opt_template, Opt_keyrings, 949 Opt_label, Opt_err 950 }; 951 952 static const match_table_t policy_tokens = { 953 {Opt_measure, "measure"}, 954 {Opt_dont_measure, "dont_measure"}, 955 {Opt_appraise, "appraise"}, 956 {Opt_dont_appraise, "dont_appraise"}, 957 {Opt_audit, "audit"}, 958 {Opt_hash, "hash"}, 959 {Opt_dont_hash, "dont_hash"}, 960 {Opt_obj_user, "obj_user=%s"}, 961 {Opt_obj_role, "obj_role=%s"}, 962 {Opt_obj_type, "obj_type=%s"}, 963 {Opt_subj_user, "subj_user=%s"}, 964 {Opt_subj_role, "subj_role=%s"}, 965 {Opt_subj_type, "subj_type=%s"}, 966 {Opt_func, "func=%s"}, 967 {Opt_mask, "mask=%s"}, 968 {Opt_fsmagic, "fsmagic=%s"}, 969 {Opt_fsname, "fsname=%s"}, 970 {Opt_fsuuid, "fsuuid=%s"}, 971 {Opt_uid_eq, "uid=%s"}, 972 {Opt_euid_eq, "euid=%s"}, 973 {Opt_fowner_eq, "fowner=%s"}, 974 {Opt_uid_gt, "uid>%s"}, 975 {Opt_euid_gt, "euid>%s"}, 976 {Opt_fowner_gt, "fowner>%s"}, 977 {Opt_uid_lt, "uid<%s"}, 978 {Opt_euid_lt, "euid<%s"}, 979 {Opt_fowner_lt, "fowner<%s"}, 980 {Opt_appraise_type, "appraise_type=%s"}, 981 {Opt_appraise_flag, "appraise_flag=%s"}, 982 {Opt_permit_directio, "permit_directio"}, 983 {Opt_pcr, "pcr=%s"}, 984 {Opt_template, "template=%s"}, 985 {Opt_keyrings, "keyrings=%s"}, 986 {Opt_label, "label=%s"}, 987 {Opt_err, NULL} 988 }; 989 990 static int ima_lsm_rule_init(struct ima_rule_entry *entry, 991 substring_t *args, int lsm_rule, int audit_type) 992 { 993 int result; 994 995 if (entry->lsm[lsm_rule].rule) 996 return -EINVAL; 997 998 entry->lsm[lsm_rule].args_p = match_strdup(args); 999 if (!entry->lsm[lsm_rule].args_p) 1000 return -ENOMEM; 1001 1002 entry->lsm[lsm_rule].type = audit_type; 1003 result = ima_filter_rule_init(entry->lsm[lsm_rule].type, Audit_equal, 1004 entry->lsm[lsm_rule].args_p, 1005 &entry->lsm[lsm_rule].rule); 1006 if (!entry->lsm[lsm_rule].rule) { 1007 pr_warn("rule for LSM \'%s\' is undefined\n", 1008 entry->lsm[lsm_rule].args_p); 1009 1010 if (ima_rules == &ima_default_rules) { 1011 kfree(entry->lsm[lsm_rule].args_p); 1012 entry->lsm[lsm_rule].args_p = NULL; 1013 result = -EINVAL; 1014 } else 1015 result = 0; 1016 } 1017 1018 return result; 1019 } 1020 1021 static void ima_log_string_op(struct audit_buffer *ab, char *key, char *value, 1022 bool (*rule_operator)(kuid_t, kuid_t)) 1023 { 1024 if (!ab) 1025 return; 1026 1027 if (rule_operator == &uid_gt) 1028 audit_log_format(ab, "%s>", key); 1029 else if (rule_operator == &uid_lt) 1030 audit_log_format(ab, "%s<", key); 1031 else 1032 audit_log_format(ab, "%s=", key); 1033 audit_log_format(ab, "%s ", value); 1034 } 1035 static void ima_log_string(struct audit_buffer *ab, char *key, char *value) 1036 { 1037 ima_log_string_op(ab, key, value, NULL); 1038 } 1039 1040 /* 1041 * Validating the appended signature included in the measurement list requires 1042 * the file hash calculated without the appended signature (i.e., the 'd-modsig' 1043 * field). Therefore, notify the user if they have the 'modsig' field but not 1044 * the 'd-modsig' field in the template. 1045 */ 1046 static void check_template_modsig(const struct ima_template_desc *template) 1047 { 1048 #define MSG "template with 'modsig' field also needs 'd-modsig' field\n" 1049 bool has_modsig, has_dmodsig; 1050 static bool checked; 1051 int i; 1052 1053 /* We only need to notify the user once. */ 1054 if (checked) 1055 return; 1056 1057 has_modsig = has_dmodsig = false; 1058 for (i = 0; i < template->num_fields; i++) { 1059 if (!strcmp(template->fields[i]->field_id, "modsig")) 1060 has_modsig = true; 1061 else if (!strcmp(template->fields[i]->field_id, "d-modsig")) 1062 has_dmodsig = true; 1063 } 1064 1065 if (has_modsig && !has_dmodsig) 1066 pr_notice(MSG); 1067 1068 checked = true; 1069 #undef MSG 1070 } 1071 1072 static bool ima_validate_rule(struct ima_rule_entry *entry) 1073 { 1074 /* Ensure that the action is set and is compatible with the flags */ 1075 if (entry->action == UNKNOWN) 1076 return false; 1077 1078 if (entry->action != MEASURE && entry->flags & IMA_PCR) 1079 return false; 1080 1081 if (entry->action != APPRAISE && 1082 entry->flags & (IMA_DIGSIG_REQUIRED | IMA_MODSIG_ALLOWED | IMA_CHECK_BLACKLIST)) 1083 return false; 1084 1085 /* 1086 * The IMA_FUNC bit must be set if and only if there's a valid hook 1087 * function specified, and vice versa. Enforcing this property allows 1088 * for the NONE case below to validate a rule without an explicit hook 1089 * function. 1090 */ 1091 if (((entry->flags & IMA_FUNC) && entry->func == NONE) || 1092 (!(entry->flags & IMA_FUNC) && entry->func != NONE)) 1093 return false; 1094 1095 /* 1096 * Ensure that the hook function is compatible with the other 1097 * components of the rule 1098 */ 1099 switch (entry->func) { 1100 case NONE: 1101 case FILE_CHECK: 1102 case MMAP_CHECK: 1103 case BPRM_CHECK: 1104 case CREDS_CHECK: 1105 case POST_SETATTR: 1106 case FIRMWARE_CHECK: 1107 case POLICY_CHECK: 1108 if (entry->flags & ~(IMA_FUNC | IMA_MASK | IMA_FSMAGIC | 1109 IMA_UID | IMA_FOWNER | IMA_FSUUID | 1110 IMA_INMASK | IMA_EUID | IMA_PCR | 1111 IMA_FSNAME | IMA_DIGSIG_REQUIRED | 1112 IMA_PERMIT_DIRECTIO)) 1113 return false; 1114 1115 break; 1116 case MODULE_CHECK: 1117 case KEXEC_KERNEL_CHECK: 1118 case KEXEC_INITRAMFS_CHECK: 1119 if (entry->flags & ~(IMA_FUNC | IMA_MASK | IMA_FSMAGIC | 1120 IMA_UID | IMA_FOWNER | IMA_FSUUID | 1121 IMA_INMASK | IMA_EUID | IMA_PCR | 1122 IMA_FSNAME | IMA_DIGSIG_REQUIRED | 1123 IMA_PERMIT_DIRECTIO | IMA_MODSIG_ALLOWED | 1124 IMA_CHECK_BLACKLIST)) 1125 return false; 1126 1127 break; 1128 case KEXEC_CMDLINE: 1129 if (entry->action & ~(MEASURE | DONT_MEASURE)) 1130 return false; 1131 1132 if (entry->flags & ~(IMA_FUNC | IMA_FSMAGIC | IMA_UID | 1133 IMA_FOWNER | IMA_FSUUID | IMA_EUID | 1134 IMA_PCR | IMA_FSNAME)) 1135 return false; 1136 1137 break; 1138 case KEY_CHECK: 1139 if (entry->action & ~(MEASURE | DONT_MEASURE)) 1140 return false; 1141 1142 if (entry->flags & ~(IMA_FUNC | IMA_UID | IMA_PCR | 1143 IMA_KEYRINGS)) 1144 return false; 1145 1146 if (ima_rule_contains_lsm_cond(entry)) 1147 return false; 1148 1149 break; 1150 case CRITICAL_DATA: 1151 if (entry->action & ~(MEASURE | DONT_MEASURE)) 1152 return false; 1153 1154 if (entry->flags & ~(IMA_FUNC | IMA_UID | IMA_PCR | 1155 IMA_LABEL)) 1156 return false; 1157 1158 if (ima_rule_contains_lsm_cond(entry)) 1159 return false; 1160 1161 break; 1162 default: 1163 return false; 1164 } 1165 1166 /* Ensure that combinations of flags are compatible with each other */ 1167 if (entry->flags & IMA_CHECK_BLACKLIST && 1168 !(entry->flags & IMA_MODSIG_ALLOWED)) 1169 return false; 1170 1171 return true; 1172 } 1173 1174 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) 1175 { 1176 struct audit_buffer *ab; 1177 char *from; 1178 char *p; 1179 bool uid_token; 1180 struct ima_template_desc *template_desc; 1181 int result = 0; 1182 1183 ab = integrity_audit_log_start(audit_context(), GFP_KERNEL, 1184 AUDIT_INTEGRITY_POLICY_RULE); 1185 1186 entry->uid = INVALID_UID; 1187 entry->fowner = INVALID_UID; 1188 entry->uid_op = &uid_eq; 1189 entry->fowner_op = &uid_eq; 1190 entry->action = UNKNOWN; 1191 while ((p = strsep(&rule, " \t")) != NULL) { 1192 substring_t args[MAX_OPT_ARGS]; 1193 int token; 1194 unsigned long lnum; 1195 1196 if (result < 0) 1197 break; 1198 if ((*p == '\0') || (*p == ' ') || (*p == '\t')) 1199 continue; 1200 token = match_token(p, policy_tokens, args); 1201 switch (token) { 1202 case Opt_measure: 1203 ima_log_string(ab, "action", "measure"); 1204 1205 if (entry->action != UNKNOWN) 1206 result = -EINVAL; 1207 1208 entry->action = MEASURE; 1209 break; 1210 case Opt_dont_measure: 1211 ima_log_string(ab, "action", "dont_measure"); 1212 1213 if (entry->action != UNKNOWN) 1214 result = -EINVAL; 1215 1216 entry->action = DONT_MEASURE; 1217 break; 1218 case Opt_appraise: 1219 ima_log_string(ab, "action", "appraise"); 1220 1221 if (entry->action != UNKNOWN) 1222 result = -EINVAL; 1223 1224 entry->action = APPRAISE; 1225 break; 1226 case Opt_dont_appraise: 1227 ima_log_string(ab, "action", "dont_appraise"); 1228 1229 if (entry->action != UNKNOWN) 1230 result = -EINVAL; 1231 1232 entry->action = DONT_APPRAISE; 1233 break; 1234 case Opt_audit: 1235 ima_log_string(ab, "action", "audit"); 1236 1237 if (entry->action != UNKNOWN) 1238 result = -EINVAL; 1239 1240 entry->action = AUDIT; 1241 break; 1242 case Opt_hash: 1243 ima_log_string(ab, "action", "hash"); 1244 1245 if (entry->action != UNKNOWN) 1246 result = -EINVAL; 1247 1248 entry->action = HASH; 1249 break; 1250 case Opt_dont_hash: 1251 ima_log_string(ab, "action", "dont_hash"); 1252 1253 if (entry->action != UNKNOWN) 1254 result = -EINVAL; 1255 1256 entry->action = DONT_HASH; 1257 break; 1258 case Opt_func: 1259 ima_log_string(ab, "func", args[0].from); 1260 1261 if (entry->func) 1262 result = -EINVAL; 1263 1264 if (strcmp(args[0].from, "FILE_CHECK") == 0) 1265 entry->func = FILE_CHECK; 1266 /* PATH_CHECK is for backwards compat */ 1267 else if (strcmp(args[0].from, "PATH_CHECK") == 0) 1268 entry->func = FILE_CHECK; 1269 else if (strcmp(args[0].from, "MODULE_CHECK") == 0) 1270 entry->func = MODULE_CHECK; 1271 else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0) 1272 entry->func = FIRMWARE_CHECK; 1273 else if ((strcmp(args[0].from, "FILE_MMAP") == 0) 1274 || (strcmp(args[0].from, "MMAP_CHECK") == 0)) 1275 entry->func = MMAP_CHECK; 1276 else if (strcmp(args[0].from, "BPRM_CHECK") == 0) 1277 entry->func = BPRM_CHECK; 1278 else if (strcmp(args[0].from, "CREDS_CHECK") == 0) 1279 entry->func = CREDS_CHECK; 1280 else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") == 1281 0) 1282 entry->func = KEXEC_KERNEL_CHECK; 1283 else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK") 1284 == 0) 1285 entry->func = KEXEC_INITRAMFS_CHECK; 1286 else if (strcmp(args[0].from, "POLICY_CHECK") == 0) 1287 entry->func = POLICY_CHECK; 1288 else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0) 1289 entry->func = KEXEC_CMDLINE; 1290 else if (IS_ENABLED(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) && 1291 strcmp(args[0].from, "KEY_CHECK") == 0) 1292 entry->func = KEY_CHECK; 1293 else if (strcmp(args[0].from, "CRITICAL_DATA") == 0) 1294 entry->func = CRITICAL_DATA; 1295 else 1296 result = -EINVAL; 1297 if (!result) 1298 entry->flags |= IMA_FUNC; 1299 break; 1300 case Opt_mask: 1301 ima_log_string(ab, "mask", args[0].from); 1302 1303 if (entry->mask) 1304 result = -EINVAL; 1305 1306 from = args[0].from; 1307 if (*from == '^') 1308 from++; 1309 1310 if ((strcmp(from, "MAY_EXEC")) == 0) 1311 entry->mask = MAY_EXEC; 1312 else if (strcmp(from, "MAY_WRITE") == 0) 1313 entry->mask = MAY_WRITE; 1314 else if (strcmp(from, "MAY_READ") == 0) 1315 entry->mask = MAY_READ; 1316 else if (strcmp(from, "MAY_APPEND") == 0) 1317 entry->mask = MAY_APPEND; 1318 else 1319 result = -EINVAL; 1320 if (!result) 1321 entry->flags |= (*args[0].from == '^') 1322 ? IMA_INMASK : IMA_MASK; 1323 break; 1324 case Opt_fsmagic: 1325 ima_log_string(ab, "fsmagic", args[0].from); 1326 1327 if (entry->fsmagic) { 1328 result = -EINVAL; 1329 break; 1330 } 1331 1332 result = kstrtoul(args[0].from, 16, &entry->fsmagic); 1333 if (!result) 1334 entry->flags |= IMA_FSMAGIC; 1335 break; 1336 case Opt_fsname: 1337 ima_log_string(ab, "fsname", args[0].from); 1338 1339 entry->fsname = kstrdup(args[0].from, GFP_KERNEL); 1340 if (!entry->fsname) { 1341 result = -ENOMEM; 1342 break; 1343 } 1344 result = 0; 1345 entry->flags |= IMA_FSNAME; 1346 break; 1347 case Opt_keyrings: 1348 ima_log_string(ab, "keyrings", args[0].from); 1349 1350 if (!IS_ENABLED(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) || 1351 entry->keyrings) { 1352 result = -EINVAL; 1353 break; 1354 } 1355 1356 entry->keyrings = ima_alloc_rule_opt_list(args); 1357 if (IS_ERR(entry->keyrings)) { 1358 result = PTR_ERR(entry->keyrings); 1359 entry->keyrings = NULL; 1360 break; 1361 } 1362 1363 entry->flags |= IMA_KEYRINGS; 1364 break; 1365 case Opt_label: 1366 ima_log_string(ab, "label", args[0].from); 1367 1368 if (entry->label) { 1369 result = -EINVAL; 1370 break; 1371 } 1372 1373 entry->label = ima_alloc_rule_opt_list(args); 1374 if (IS_ERR(entry->label)) { 1375 result = PTR_ERR(entry->label); 1376 entry->label = NULL; 1377 break; 1378 } 1379 1380 entry->flags |= IMA_LABEL; 1381 break; 1382 case Opt_fsuuid: 1383 ima_log_string(ab, "fsuuid", args[0].from); 1384 1385 if (!uuid_is_null(&entry->fsuuid)) { 1386 result = -EINVAL; 1387 break; 1388 } 1389 1390 result = uuid_parse(args[0].from, &entry->fsuuid); 1391 if (!result) 1392 entry->flags |= IMA_FSUUID; 1393 break; 1394 case Opt_uid_gt: 1395 case Opt_euid_gt: 1396 entry->uid_op = &uid_gt; 1397 fallthrough; 1398 case Opt_uid_lt: 1399 case Opt_euid_lt: 1400 if ((token == Opt_uid_lt) || (token == Opt_euid_lt)) 1401 entry->uid_op = &uid_lt; 1402 fallthrough; 1403 case Opt_uid_eq: 1404 case Opt_euid_eq: 1405 uid_token = (token == Opt_uid_eq) || 1406 (token == Opt_uid_gt) || 1407 (token == Opt_uid_lt); 1408 1409 ima_log_string_op(ab, uid_token ? "uid" : "euid", 1410 args[0].from, entry->uid_op); 1411 1412 if (uid_valid(entry->uid)) { 1413 result = -EINVAL; 1414 break; 1415 } 1416 1417 result = kstrtoul(args[0].from, 10, &lnum); 1418 if (!result) { 1419 entry->uid = make_kuid(current_user_ns(), 1420 (uid_t) lnum); 1421 if (!uid_valid(entry->uid) || 1422 (uid_t)lnum != lnum) 1423 result = -EINVAL; 1424 else 1425 entry->flags |= uid_token 1426 ? IMA_UID : IMA_EUID; 1427 } 1428 break; 1429 case Opt_fowner_gt: 1430 entry->fowner_op = &uid_gt; 1431 fallthrough; 1432 case Opt_fowner_lt: 1433 if (token == Opt_fowner_lt) 1434 entry->fowner_op = &uid_lt; 1435 fallthrough; 1436 case Opt_fowner_eq: 1437 ima_log_string_op(ab, "fowner", args[0].from, 1438 entry->fowner_op); 1439 1440 if (uid_valid(entry->fowner)) { 1441 result = -EINVAL; 1442 break; 1443 } 1444 1445 result = kstrtoul(args[0].from, 10, &lnum); 1446 if (!result) { 1447 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum); 1448 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum)) 1449 result = -EINVAL; 1450 else 1451 entry->flags |= IMA_FOWNER; 1452 } 1453 break; 1454 case Opt_obj_user: 1455 ima_log_string(ab, "obj_user", args[0].from); 1456 result = ima_lsm_rule_init(entry, args, 1457 LSM_OBJ_USER, 1458 AUDIT_OBJ_USER); 1459 break; 1460 case Opt_obj_role: 1461 ima_log_string(ab, "obj_role", args[0].from); 1462 result = ima_lsm_rule_init(entry, args, 1463 LSM_OBJ_ROLE, 1464 AUDIT_OBJ_ROLE); 1465 break; 1466 case Opt_obj_type: 1467 ima_log_string(ab, "obj_type", args[0].from); 1468 result = ima_lsm_rule_init(entry, args, 1469 LSM_OBJ_TYPE, 1470 AUDIT_OBJ_TYPE); 1471 break; 1472 case Opt_subj_user: 1473 ima_log_string(ab, "subj_user", args[0].from); 1474 result = ima_lsm_rule_init(entry, args, 1475 LSM_SUBJ_USER, 1476 AUDIT_SUBJ_USER); 1477 break; 1478 case Opt_subj_role: 1479 ima_log_string(ab, "subj_role", args[0].from); 1480 result = ima_lsm_rule_init(entry, args, 1481 LSM_SUBJ_ROLE, 1482 AUDIT_SUBJ_ROLE); 1483 break; 1484 case Opt_subj_type: 1485 ima_log_string(ab, "subj_type", args[0].from); 1486 result = ima_lsm_rule_init(entry, args, 1487 LSM_SUBJ_TYPE, 1488 AUDIT_SUBJ_TYPE); 1489 break; 1490 case Opt_appraise_type: 1491 ima_log_string(ab, "appraise_type", args[0].from); 1492 if ((strcmp(args[0].from, "imasig")) == 0) 1493 entry->flags |= IMA_DIGSIG_REQUIRED; 1494 else if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) && 1495 strcmp(args[0].from, "imasig|modsig") == 0) 1496 entry->flags |= IMA_DIGSIG_REQUIRED | 1497 IMA_MODSIG_ALLOWED; 1498 else 1499 result = -EINVAL; 1500 break; 1501 case Opt_appraise_flag: 1502 ima_log_string(ab, "appraise_flag", args[0].from); 1503 if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) && 1504 strstr(args[0].from, "blacklist")) 1505 entry->flags |= IMA_CHECK_BLACKLIST; 1506 else 1507 result = -EINVAL; 1508 break; 1509 case Opt_permit_directio: 1510 entry->flags |= IMA_PERMIT_DIRECTIO; 1511 break; 1512 case Opt_pcr: 1513 ima_log_string(ab, "pcr", args[0].from); 1514 1515 result = kstrtoint(args[0].from, 10, &entry->pcr); 1516 if (result || INVALID_PCR(entry->pcr)) 1517 result = -EINVAL; 1518 else 1519 entry->flags |= IMA_PCR; 1520 1521 break; 1522 case Opt_template: 1523 ima_log_string(ab, "template", args[0].from); 1524 if (entry->action != MEASURE) { 1525 result = -EINVAL; 1526 break; 1527 } 1528 template_desc = lookup_template_desc(args[0].from); 1529 if (!template_desc || entry->template) { 1530 result = -EINVAL; 1531 break; 1532 } 1533 1534 /* 1535 * template_desc_init_fields() does nothing if 1536 * the template is already initialised, so 1537 * it's safe to do this unconditionally 1538 */ 1539 template_desc_init_fields(template_desc->fmt, 1540 &(template_desc->fields), 1541 &(template_desc->num_fields)); 1542 entry->template = template_desc; 1543 break; 1544 case Opt_err: 1545 ima_log_string(ab, "UNKNOWN", p); 1546 result = -EINVAL; 1547 break; 1548 } 1549 } 1550 if (!result && !ima_validate_rule(entry)) 1551 result = -EINVAL; 1552 else if (entry->action == APPRAISE) 1553 temp_ima_appraise |= ima_appraise_flag(entry->func); 1554 1555 if (!result && entry->flags & IMA_MODSIG_ALLOWED) { 1556 template_desc = entry->template ? entry->template : 1557 ima_template_desc_current(); 1558 check_template_modsig(template_desc); 1559 } 1560 1561 audit_log_format(ab, "res=%d", !result); 1562 audit_log_end(ab); 1563 return result; 1564 } 1565 1566 /** 1567 * ima_parse_add_rule - add a rule to ima_policy_rules 1568 * @rule - ima measurement policy rule 1569 * 1570 * Avoid locking by allowing just one writer at a time in ima_write_policy() 1571 * Returns the length of the rule parsed, an error code on failure 1572 */ 1573 ssize_t ima_parse_add_rule(char *rule) 1574 { 1575 static const char op[] = "update_policy"; 1576 char *p; 1577 struct ima_rule_entry *entry; 1578 ssize_t result, len; 1579 int audit_info = 0; 1580 1581 p = strsep(&rule, "\n"); 1582 len = strlen(p) + 1; 1583 p += strspn(p, " \t"); 1584 1585 if (*p == '#' || *p == '\0') 1586 return len; 1587 1588 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 1589 if (!entry) { 1590 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 1591 NULL, op, "-ENOMEM", -ENOMEM, audit_info); 1592 return -ENOMEM; 1593 } 1594 1595 INIT_LIST_HEAD(&entry->list); 1596 1597 result = ima_parse_rule(p, entry); 1598 if (result) { 1599 ima_free_rule(entry); 1600 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 1601 NULL, op, "invalid-policy", result, 1602 audit_info); 1603 return result; 1604 } 1605 1606 list_add_tail(&entry->list, &ima_temp_rules); 1607 1608 return len; 1609 } 1610 1611 /** 1612 * ima_delete_rules() called to cleanup invalid in-flight policy. 1613 * We don't need locking as we operate on the temp list, which is 1614 * different from the active one. There is also only one user of 1615 * ima_delete_rules() at a time. 1616 */ 1617 void ima_delete_rules(void) 1618 { 1619 struct ima_rule_entry *entry, *tmp; 1620 1621 temp_ima_appraise = 0; 1622 list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) { 1623 list_del(&entry->list); 1624 ima_free_rule(entry); 1625 } 1626 } 1627 1628 #define __ima_hook_stringify(func, str) (#func), 1629 1630 const char *const func_tokens[] = { 1631 __ima_hooks(__ima_hook_stringify) 1632 }; 1633 1634 #ifdef CONFIG_IMA_READ_POLICY 1635 enum { 1636 mask_exec = 0, mask_write, mask_read, mask_append 1637 }; 1638 1639 static const char *const mask_tokens[] = { 1640 "^MAY_EXEC", 1641 "^MAY_WRITE", 1642 "^MAY_READ", 1643 "^MAY_APPEND" 1644 }; 1645 1646 void *ima_policy_start(struct seq_file *m, loff_t *pos) 1647 { 1648 loff_t l = *pos; 1649 struct ima_rule_entry *entry; 1650 1651 rcu_read_lock(); 1652 list_for_each_entry_rcu(entry, ima_rules, list) { 1653 if (!l--) { 1654 rcu_read_unlock(); 1655 return entry; 1656 } 1657 } 1658 rcu_read_unlock(); 1659 return NULL; 1660 } 1661 1662 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos) 1663 { 1664 struct ima_rule_entry *entry = v; 1665 1666 rcu_read_lock(); 1667 entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list); 1668 rcu_read_unlock(); 1669 (*pos)++; 1670 1671 return (&entry->list == ima_rules) ? NULL : entry; 1672 } 1673 1674 void ima_policy_stop(struct seq_file *m, void *v) 1675 { 1676 } 1677 1678 #define pt(token) policy_tokens[token].pattern 1679 #define mt(token) mask_tokens[token] 1680 1681 /* 1682 * policy_func_show - display the ima_hooks policy rule 1683 */ 1684 static void policy_func_show(struct seq_file *m, enum ima_hooks func) 1685 { 1686 if (func > 0 && func < MAX_CHECK) 1687 seq_printf(m, "func=%s ", func_tokens[func]); 1688 else 1689 seq_printf(m, "func=%d ", func); 1690 } 1691 1692 static void ima_show_rule_opt_list(struct seq_file *m, 1693 const struct ima_rule_opt_list *opt_list) 1694 { 1695 size_t i; 1696 1697 for (i = 0; i < opt_list->count; i++) 1698 seq_printf(m, "%s%s", i ? "|" : "", opt_list->items[i]); 1699 } 1700 1701 int ima_policy_show(struct seq_file *m, void *v) 1702 { 1703 struct ima_rule_entry *entry = v; 1704 int i; 1705 char tbuf[64] = {0,}; 1706 int offset = 0; 1707 1708 rcu_read_lock(); 1709 1710 if (entry->action & MEASURE) 1711 seq_puts(m, pt(Opt_measure)); 1712 if (entry->action & DONT_MEASURE) 1713 seq_puts(m, pt(Opt_dont_measure)); 1714 if (entry->action & APPRAISE) 1715 seq_puts(m, pt(Opt_appraise)); 1716 if (entry->action & DONT_APPRAISE) 1717 seq_puts(m, pt(Opt_dont_appraise)); 1718 if (entry->action & AUDIT) 1719 seq_puts(m, pt(Opt_audit)); 1720 if (entry->action & HASH) 1721 seq_puts(m, pt(Opt_hash)); 1722 if (entry->action & DONT_HASH) 1723 seq_puts(m, pt(Opt_dont_hash)); 1724 1725 seq_puts(m, " "); 1726 1727 if (entry->flags & IMA_FUNC) 1728 policy_func_show(m, entry->func); 1729 1730 if ((entry->flags & IMA_MASK) || (entry->flags & IMA_INMASK)) { 1731 if (entry->flags & IMA_MASK) 1732 offset = 1; 1733 if (entry->mask & MAY_EXEC) 1734 seq_printf(m, pt(Opt_mask), mt(mask_exec) + offset); 1735 if (entry->mask & MAY_WRITE) 1736 seq_printf(m, pt(Opt_mask), mt(mask_write) + offset); 1737 if (entry->mask & MAY_READ) 1738 seq_printf(m, pt(Opt_mask), mt(mask_read) + offset); 1739 if (entry->mask & MAY_APPEND) 1740 seq_printf(m, pt(Opt_mask), mt(mask_append) + offset); 1741 seq_puts(m, " "); 1742 } 1743 1744 if (entry->flags & IMA_FSMAGIC) { 1745 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic); 1746 seq_printf(m, pt(Opt_fsmagic), tbuf); 1747 seq_puts(m, " "); 1748 } 1749 1750 if (entry->flags & IMA_FSNAME) { 1751 snprintf(tbuf, sizeof(tbuf), "%s", entry->fsname); 1752 seq_printf(m, pt(Opt_fsname), tbuf); 1753 seq_puts(m, " "); 1754 } 1755 1756 if (entry->flags & IMA_KEYRINGS) { 1757 seq_puts(m, "keyrings="); 1758 ima_show_rule_opt_list(m, entry->keyrings); 1759 seq_puts(m, " "); 1760 } 1761 1762 if (entry->flags & IMA_LABEL) { 1763 seq_puts(m, "label="); 1764 ima_show_rule_opt_list(m, entry->label); 1765 seq_puts(m, " "); 1766 } 1767 1768 if (entry->flags & IMA_PCR) { 1769 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr); 1770 seq_printf(m, pt(Opt_pcr), tbuf); 1771 seq_puts(m, " "); 1772 } 1773 1774 if (entry->flags & IMA_FSUUID) { 1775 seq_printf(m, "fsuuid=%pU", &entry->fsuuid); 1776 seq_puts(m, " "); 1777 } 1778 1779 if (entry->flags & IMA_UID) { 1780 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid)); 1781 if (entry->uid_op == &uid_gt) 1782 seq_printf(m, pt(Opt_uid_gt), tbuf); 1783 else if (entry->uid_op == &uid_lt) 1784 seq_printf(m, pt(Opt_uid_lt), tbuf); 1785 else 1786 seq_printf(m, pt(Opt_uid_eq), tbuf); 1787 seq_puts(m, " "); 1788 } 1789 1790 if (entry->flags & IMA_EUID) { 1791 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid)); 1792 if (entry->uid_op == &uid_gt) 1793 seq_printf(m, pt(Opt_euid_gt), tbuf); 1794 else if (entry->uid_op == &uid_lt) 1795 seq_printf(m, pt(Opt_euid_lt), tbuf); 1796 else 1797 seq_printf(m, pt(Opt_euid_eq), tbuf); 1798 seq_puts(m, " "); 1799 } 1800 1801 if (entry->flags & IMA_FOWNER) { 1802 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner)); 1803 if (entry->fowner_op == &uid_gt) 1804 seq_printf(m, pt(Opt_fowner_gt), tbuf); 1805 else if (entry->fowner_op == &uid_lt) 1806 seq_printf(m, pt(Opt_fowner_lt), tbuf); 1807 else 1808 seq_printf(m, pt(Opt_fowner_eq), tbuf); 1809 seq_puts(m, " "); 1810 } 1811 1812 for (i = 0; i < MAX_LSM_RULES; i++) { 1813 if (entry->lsm[i].rule) { 1814 switch (i) { 1815 case LSM_OBJ_USER: 1816 seq_printf(m, pt(Opt_obj_user), 1817 entry->lsm[i].args_p); 1818 break; 1819 case LSM_OBJ_ROLE: 1820 seq_printf(m, pt(Opt_obj_role), 1821 entry->lsm[i].args_p); 1822 break; 1823 case LSM_OBJ_TYPE: 1824 seq_printf(m, pt(Opt_obj_type), 1825 entry->lsm[i].args_p); 1826 break; 1827 case LSM_SUBJ_USER: 1828 seq_printf(m, pt(Opt_subj_user), 1829 entry->lsm[i].args_p); 1830 break; 1831 case LSM_SUBJ_ROLE: 1832 seq_printf(m, pt(Opt_subj_role), 1833 entry->lsm[i].args_p); 1834 break; 1835 case LSM_SUBJ_TYPE: 1836 seq_printf(m, pt(Opt_subj_type), 1837 entry->lsm[i].args_p); 1838 break; 1839 } 1840 seq_puts(m, " "); 1841 } 1842 } 1843 if (entry->template) 1844 seq_printf(m, "template=%s ", entry->template->name); 1845 if (entry->flags & IMA_DIGSIG_REQUIRED) { 1846 if (entry->flags & IMA_MODSIG_ALLOWED) 1847 seq_puts(m, "appraise_type=imasig|modsig "); 1848 else 1849 seq_puts(m, "appraise_type=imasig "); 1850 } 1851 if (entry->flags & IMA_CHECK_BLACKLIST) 1852 seq_puts(m, "appraise_flag=check_blacklist "); 1853 if (entry->flags & IMA_PERMIT_DIRECTIO) 1854 seq_puts(m, "permit_directio "); 1855 rcu_read_unlock(); 1856 seq_puts(m, "\n"); 1857 return 0; 1858 } 1859 #endif /* CONFIG_IMA_READ_POLICY */ 1860 1861 #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING) 1862 /* 1863 * ima_appraise_signature: whether IMA will appraise a given function using 1864 * an IMA digital signature. This is restricted to cases where the kernel 1865 * has a set of built-in trusted keys in order to avoid an attacker simply 1866 * loading additional keys. 1867 */ 1868 bool ima_appraise_signature(enum kernel_read_file_id id) 1869 { 1870 struct ima_rule_entry *entry; 1871 bool found = false; 1872 enum ima_hooks func; 1873 1874 if (id >= READING_MAX_ID) 1875 return false; 1876 1877 func = read_idmap[id] ?: FILE_CHECK; 1878 1879 rcu_read_lock(); 1880 list_for_each_entry_rcu(entry, ima_rules, list) { 1881 if (entry->action != APPRAISE) 1882 continue; 1883 1884 /* 1885 * A generic entry will match, but otherwise require that it 1886 * match the func we're looking for 1887 */ 1888 if (entry->func && entry->func != func) 1889 continue; 1890 1891 /* 1892 * We require this to be a digital signature, not a raw IMA 1893 * hash. 1894 */ 1895 if (entry->flags & IMA_DIGSIG_REQUIRED) 1896 found = true; 1897 1898 /* 1899 * We've found a rule that matches, so break now even if it 1900 * didn't require a digital signature - a later rule that does 1901 * won't override it, so would be a false positive. 1902 */ 1903 break; 1904 } 1905 1906 rcu_read_unlock(); 1907 return found; 1908 } 1909 #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */ 1910