1 /* 2 * Copyright (C) 2008 IBM Corporation 3 * Author: Mimi Zohar <zohar@us.ibm.com> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation, version 2 of the License. 8 * 9 * ima_policy.c 10 * - initialize default measure policy rules 11 * 12 */ 13 #include <linux/module.h> 14 #include <linux/list.h> 15 #include <linux/security.h> 16 #include <linux/magic.h> 17 #include <linux/parser.h> 18 #include <linux/slab.h> 19 #include <linux/rculist.h> 20 #include <linux/genhd.h> 21 #include <linux/seq_file.h> 22 23 #include "ima.h" 24 25 /* flags definitions */ 26 #define IMA_FUNC 0x0001 27 #define IMA_MASK 0x0002 28 #define IMA_FSMAGIC 0x0004 29 #define IMA_UID 0x0008 30 #define IMA_FOWNER 0x0010 31 #define IMA_FSUUID 0x0020 32 #define IMA_INMASK 0x0040 33 #define IMA_EUID 0x0080 34 35 #define UNKNOWN 0 36 #define MEASURE 0x0001 /* same as IMA_MEASURE */ 37 #define DONT_MEASURE 0x0002 38 #define APPRAISE 0x0004 /* same as IMA_APPRAISE */ 39 #define DONT_APPRAISE 0x0008 40 #define AUDIT 0x0040 41 42 int ima_policy_flag; 43 static int temp_ima_appraise; 44 45 #define MAX_LSM_RULES 6 46 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, 47 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE 48 }; 49 50 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB }; 51 52 struct ima_rule_entry { 53 struct list_head list; 54 int action; 55 unsigned int flags; 56 enum ima_hooks func; 57 int mask; 58 unsigned long fsmagic; 59 u8 fsuuid[16]; 60 kuid_t uid; 61 kuid_t fowner; 62 struct { 63 void *rule; /* LSM file metadata specific */ 64 void *args_p; /* audit value */ 65 int type; /* audit type */ 66 } lsm[MAX_LSM_RULES]; 67 }; 68 69 /* 70 * Without LSM specific knowledge, the default policy can only be 71 * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner 72 */ 73 74 /* 75 * The minimum rule set to allow for full TCB coverage. Measures all files 76 * opened or mmap for exec and everything read by root. Dangerous because 77 * normal users can easily run the machine out of memory simply building 78 * and running executables. 79 */ 80 static struct ima_rule_entry dont_measure_rules[] = { 81 {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 82 {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, 83 {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, 84 {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, 85 {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 86 {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, 87 {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, 88 {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, 89 {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC, 90 .flags = IMA_FSMAGIC}, 91 {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC} 92 }; 93 94 static struct ima_rule_entry original_measurement_rules[] = { 95 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, 96 .flags = IMA_FUNC | IMA_MASK}, 97 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, 98 .flags = IMA_FUNC | IMA_MASK}, 99 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 100 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID}, 101 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, 102 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, 103 }; 104 105 static struct ima_rule_entry default_measurement_rules[] = { 106 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, 107 .flags = IMA_FUNC | IMA_MASK}, 108 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, 109 .flags = IMA_FUNC | IMA_MASK}, 110 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 111 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID}, 112 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 113 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID}, 114 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, 115 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, 116 }; 117 118 static struct ima_rule_entry default_appraise_rules[] = { 119 {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 120 {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, 121 {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, 122 {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, 123 {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC}, 124 {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 125 {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, 126 {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, 127 {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, 128 {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, 129 {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 130 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT 131 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER}, 132 #else 133 /* force signature */ 134 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, 135 .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED}, 136 #endif 137 }; 138 139 static LIST_HEAD(ima_default_rules); 140 static LIST_HEAD(ima_policy_rules); 141 static LIST_HEAD(ima_temp_rules); 142 static struct list_head *ima_rules; 143 144 static int ima_policy __initdata; 145 146 static int __init default_measure_policy_setup(char *str) 147 { 148 if (ima_policy) 149 return 1; 150 151 ima_policy = ORIGINAL_TCB; 152 return 1; 153 } 154 __setup("ima_tcb", default_measure_policy_setup); 155 156 static int __init policy_setup(char *str) 157 { 158 if (ima_policy) 159 return 1; 160 161 if (strcmp(str, "tcb") == 0) 162 ima_policy = DEFAULT_TCB; 163 164 return 1; 165 } 166 __setup("ima_policy=", policy_setup); 167 168 static bool ima_use_appraise_tcb __initdata; 169 static int __init default_appraise_policy_setup(char *str) 170 { 171 ima_use_appraise_tcb = 1; 172 return 1; 173 } 174 __setup("ima_appraise_tcb", default_appraise_policy_setup); 175 176 /* 177 * The LSM policy can be reloaded, leaving the IMA LSM based rules referring 178 * to the old, stale LSM policy. Update the IMA LSM based rules to reflect 179 * the reloaded LSM policy. We assume the rules still exist; and BUG_ON() if 180 * they don't. 181 */ 182 static void ima_lsm_update_rules(void) 183 { 184 struct ima_rule_entry *entry; 185 int result; 186 int i; 187 188 list_for_each_entry(entry, &ima_policy_rules, list) { 189 for (i = 0; i < MAX_LSM_RULES; i++) { 190 if (!entry->lsm[i].rule) 191 continue; 192 result = security_filter_rule_init(entry->lsm[i].type, 193 Audit_equal, 194 entry->lsm[i].args_p, 195 &entry->lsm[i].rule); 196 BUG_ON(!entry->lsm[i].rule); 197 } 198 } 199 } 200 201 /** 202 * ima_match_rules - determine whether an inode matches the measure rule. 203 * @rule: a pointer to a rule 204 * @inode: a pointer to an inode 205 * @func: LIM hook identifier 206 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 207 * 208 * Returns true on rule match, false on failure. 209 */ 210 static bool ima_match_rules(struct ima_rule_entry *rule, 211 struct inode *inode, enum ima_hooks func, int mask) 212 { 213 struct task_struct *tsk = current; 214 const struct cred *cred = current_cred(); 215 int i; 216 217 if ((rule->flags & IMA_FUNC) && 218 (rule->func != func && func != POST_SETATTR)) 219 return false; 220 if ((rule->flags & IMA_MASK) && 221 (rule->mask != mask && func != POST_SETATTR)) 222 return false; 223 if ((rule->flags & IMA_INMASK) && 224 (!(rule->mask & mask) && func != POST_SETATTR)) 225 return false; 226 if ((rule->flags & IMA_FSMAGIC) 227 && rule->fsmagic != inode->i_sb->s_magic) 228 return false; 229 if ((rule->flags & IMA_FSUUID) && 230 memcmp(rule->fsuuid, inode->i_sb->s_uuid, sizeof(rule->fsuuid))) 231 return false; 232 if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid)) 233 return false; 234 if (rule->flags & IMA_EUID) { 235 if (has_capability_noaudit(current, CAP_SETUID)) { 236 if (!uid_eq(rule->uid, cred->euid) 237 && !uid_eq(rule->uid, cred->suid) 238 && !uid_eq(rule->uid, cred->uid)) 239 return false; 240 } else if (!uid_eq(rule->uid, cred->euid)) 241 return false; 242 } 243 244 if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid)) 245 return false; 246 for (i = 0; i < MAX_LSM_RULES; i++) { 247 int rc = 0; 248 u32 osid, sid; 249 int retried = 0; 250 251 if (!rule->lsm[i].rule) 252 continue; 253 retry: 254 switch (i) { 255 case LSM_OBJ_USER: 256 case LSM_OBJ_ROLE: 257 case LSM_OBJ_TYPE: 258 security_inode_getsecid(inode, &osid); 259 rc = security_filter_rule_match(osid, 260 rule->lsm[i].type, 261 Audit_equal, 262 rule->lsm[i].rule, 263 NULL); 264 break; 265 case LSM_SUBJ_USER: 266 case LSM_SUBJ_ROLE: 267 case LSM_SUBJ_TYPE: 268 security_task_getsecid(tsk, &sid); 269 rc = security_filter_rule_match(sid, 270 rule->lsm[i].type, 271 Audit_equal, 272 rule->lsm[i].rule, 273 NULL); 274 default: 275 break; 276 } 277 if ((rc < 0) && (!retried)) { 278 retried = 1; 279 ima_lsm_update_rules(); 280 goto retry; 281 } 282 if (!rc) 283 return false; 284 } 285 return true; 286 } 287 288 /* 289 * In addition to knowing that we need to appraise the file in general, 290 * we need to differentiate between calling hooks, for hook specific rules. 291 */ 292 static int get_subaction(struct ima_rule_entry *rule, int func) 293 { 294 if (!(rule->flags & IMA_FUNC)) 295 return IMA_FILE_APPRAISE; 296 297 switch (func) { 298 case MMAP_CHECK: 299 return IMA_MMAP_APPRAISE; 300 case BPRM_CHECK: 301 return IMA_BPRM_APPRAISE; 302 case MODULE_CHECK: 303 return IMA_MODULE_APPRAISE; 304 case FIRMWARE_CHECK: 305 return IMA_FIRMWARE_APPRAISE; 306 case FILE_CHECK: 307 default: 308 return IMA_FILE_APPRAISE; 309 } 310 } 311 312 /** 313 * ima_match_policy - decision based on LSM and other conditions 314 * @inode: pointer to an inode for which the policy decision is being made 315 * @func: IMA hook identifier 316 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 317 * 318 * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type) 319 * conditions. 320 * 321 * Since the IMA policy may be updated multiple times we need to lock the 322 * list when walking it. Reads are many orders of magnitude more numerous 323 * than writes so ima_match_policy() is classical RCU candidate. 324 */ 325 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, 326 int flags) 327 { 328 struct ima_rule_entry *entry; 329 int action = 0, actmask = flags | (flags << 1); 330 331 rcu_read_lock(); 332 list_for_each_entry_rcu(entry, ima_rules, list) { 333 334 if (!(entry->action & actmask)) 335 continue; 336 337 if (!ima_match_rules(entry, inode, func, mask)) 338 continue; 339 340 action |= entry->flags & IMA_ACTION_FLAGS; 341 342 action |= entry->action & IMA_DO_MASK; 343 if (entry->action & IMA_APPRAISE) 344 action |= get_subaction(entry, func); 345 346 if (entry->action & IMA_DO_MASK) 347 actmask &= ~(entry->action | entry->action << 1); 348 else 349 actmask &= ~(entry->action | entry->action >> 1); 350 351 if (!actmask) 352 break; 353 } 354 rcu_read_unlock(); 355 356 return action; 357 } 358 359 /* 360 * Initialize the ima_policy_flag variable based on the currently 361 * loaded policy. Based on this flag, the decision to short circuit 362 * out of a function or not call the function in the first place 363 * can be made earlier. 364 */ 365 void ima_update_policy_flag(void) 366 { 367 struct ima_rule_entry *entry; 368 369 list_for_each_entry(entry, ima_rules, list) { 370 if (entry->action & IMA_DO_MASK) 371 ima_policy_flag |= entry->action; 372 } 373 374 ima_appraise |= temp_ima_appraise; 375 if (!ima_appraise) 376 ima_policy_flag &= ~IMA_APPRAISE; 377 } 378 379 /** 380 * ima_init_policy - initialize the default measure rules. 381 * 382 * ima_rules points to either the ima_default_rules or the 383 * the new ima_policy_rules. 384 */ 385 void __init ima_init_policy(void) 386 { 387 int i, measure_entries, appraise_entries; 388 389 /* if !ima_policy set entries = 0 so we load NO default rules */ 390 measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0; 391 appraise_entries = ima_use_appraise_tcb ? 392 ARRAY_SIZE(default_appraise_rules) : 0; 393 394 for (i = 0; i < measure_entries; i++) 395 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules); 396 397 switch (ima_policy) { 398 case ORIGINAL_TCB: 399 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++) 400 list_add_tail(&original_measurement_rules[i].list, 401 &ima_default_rules); 402 break; 403 case DEFAULT_TCB: 404 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++) 405 list_add_tail(&default_measurement_rules[i].list, 406 &ima_default_rules); 407 default: 408 break; 409 } 410 411 for (i = 0; i < appraise_entries; i++) { 412 list_add_tail(&default_appraise_rules[i].list, 413 &ima_default_rules); 414 } 415 416 ima_rules = &ima_default_rules; 417 } 418 419 /* Make sure we have a valid policy, at least containing some rules. */ 420 int ima_check_policy() 421 { 422 if (list_empty(&ima_temp_rules)) 423 return -EINVAL; 424 return 0; 425 } 426 427 /** 428 * ima_update_policy - update default_rules with new measure rules 429 * 430 * Called on file .release to update the default rules with a complete new 431 * policy. What we do here is to splice ima_policy_rules and ima_temp_rules so 432 * they make a queue. The policy may be updated multiple times and this is the 433 * RCU updater. 434 * 435 * Policy rules are never deleted so ima_policy_flag gets zeroed only once when 436 * we switch from the default policy to user defined. 437 */ 438 void ima_update_policy(void) 439 { 440 struct list_head *first, *last, *policy; 441 442 /* append current policy with the new rules */ 443 first = (&ima_temp_rules)->next; 444 last = (&ima_temp_rules)->prev; 445 policy = &ima_policy_rules; 446 447 synchronize_rcu(); 448 449 last->next = policy; 450 rcu_assign_pointer(list_next_rcu(policy->prev), first); 451 first->prev = policy->prev; 452 policy->prev = last; 453 454 /* prepare for the next policy rules addition */ 455 INIT_LIST_HEAD(&ima_temp_rules); 456 457 if (ima_rules != policy) { 458 ima_policy_flag = 0; 459 ima_rules = policy; 460 } 461 ima_update_policy_flag(); 462 } 463 464 enum { 465 Opt_err = -1, 466 Opt_measure = 1, Opt_dont_measure, 467 Opt_appraise, Opt_dont_appraise, 468 Opt_audit, 469 Opt_obj_user, Opt_obj_role, Opt_obj_type, 470 Opt_subj_user, Opt_subj_role, Opt_subj_type, 471 Opt_func, Opt_mask, Opt_fsmagic, 472 Opt_fsuuid, Opt_uid, Opt_euid, Opt_fowner, 473 Opt_appraise_type, Opt_permit_directio 474 }; 475 476 static match_table_t policy_tokens = { 477 {Opt_measure, "measure"}, 478 {Opt_dont_measure, "dont_measure"}, 479 {Opt_appraise, "appraise"}, 480 {Opt_dont_appraise, "dont_appraise"}, 481 {Opt_audit, "audit"}, 482 {Opt_obj_user, "obj_user=%s"}, 483 {Opt_obj_role, "obj_role=%s"}, 484 {Opt_obj_type, "obj_type=%s"}, 485 {Opt_subj_user, "subj_user=%s"}, 486 {Opt_subj_role, "subj_role=%s"}, 487 {Opt_subj_type, "subj_type=%s"}, 488 {Opt_func, "func=%s"}, 489 {Opt_mask, "mask=%s"}, 490 {Opt_fsmagic, "fsmagic=%s"}, 491 {Opt_fsuuid, "fsuuid=%s"}, 492 {Opt_uid, "uid=%s"}, 493 {Opt_euid, "euid=%s"}, 494 {Opt_fowner, "fowner=%s"}, 495 {Opt_appraise_type, "appraise_type=%s"}, 496 {Opt_permit_directio, "permit_directio"}, 497 {Opt_err, NULL} 498 }; 499 500 static int ima_lsm_rule_init(struct ima_rule_entry *entry, 501 substring_t *args, int lsm_rule, int audit_type) 502 { 503 int result; 504 505 if (entry->lsm[lsm_rule].rule) 506 return -EINVAL; 507 508 entry->lsm[lsm_rule].args_p = match_strdup(args); 509 if (!entry->lsm[lsm_rule].args_p) 510 return -ENOMEM; 511 512 entry->lsm[lsm_rule].type = audit_type; 513 result = security_filter_rule_init(entry->lsm[lsm_rule].type, 514 Audit_equal, 515 entry->lsm[lsm_rule].args_p, 516 &entry->lsm[lsm_rule].rule); 517 if (!entry->lsm[lsm_rule].rule) { 518 kfree(entry->lsm[lsm_rule].args_p); 519 return -EINVAL; 520 } 521 522 return result; 523 } 524 525 static void ima_log_string(struct audit_buffer *ab, char *key, char *value) 526 { 527 audit_log_format(ab, "%s=", key); 528 audit_log_untrustedstring(ab, value); 529 audit_log_format(ab, " "); 530 } 531 532 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) 533 { 534 struct audit_buffer *ab; 535 char *from; 536 char *p; 537 int result = 0; 538 539 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE); 540 541 entry->uid = INVALID_UID; 542 entry->fowner = INVALID_UID; 543 entry->action = UNKNOWN; 544 while ((p = strsep(&rule, " \t")) != NULL) { 545 substring_t args[MAX_OPT_ARGS]; 546 int token; 547 unsigned long lnum; 548 549 if (result < 0) 550 break; 551 if ((*p == '\0') || (*p == ' ') || (*p == '\t')) 552 continue; 553 token = match_token(p, policy_tokens, args); 554 switch (token) { 555 case Opt_measure: 556 ima_log_string(ab, "action", "measure"); 557 558 if (entry->action != UNKNOWN) 559 result = -EINVAL; 560 561 entry->action = MEASURE; 562 break; 563 case Opt_dont_measure: 564 ima_log_string(ab, "action", "dont_measure"); 565 566 if (entry->action != UNKNOWN) 567 result = -EINVAL; 568 569 entry->action = DONT_MEASURE; 570 break; 571 case Opt_appraise: 572 ima_log_string(ab, "action", "appraise"); 573 574 if (entry->action != UNKNOWN) 575 result = -EINVAL; 576 577 entry->action = APPRAISE; 578 break; 579 case Opt_dont_appraise: 580 ima_log_string(ab, "action", "dont_appraise"); 581 582 if (entry->action != UNKNOWN) 583 result = -EINVAL; 584 585 entry->action = DONT_APPRAISE; 586 break; 587 case Opt_audit: 588 ima_log_string(ab, "action", "audit"); 589 590 if (entry->action != UNKNOWN) 591 result = -EINVAL; 592 593 entry->action = AUDIT; 594 break; 595 case Opt_func: 596 ima_log_string(ab, "func", args[0].from); 597 598 if (entry->func) 599 result = -EINVAL; 600 601 if (strcmp(args[0].from, "FILE_CHECK") == 0) 602 entry->func = FILE_CHECK; 603 /* PATH_CHECK is for backwards compat */ 604 else if (strcmp(args[0].from, "PATH_CHECK") == 0) 605 entry->func = FILE_CHECK; 606 else if (strcmp(args[0].from, "MODULE_CHECK") == 0) 607 entry->func = MODULE_CHECK; 608 else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0) 609 entry->func = FIRMWARE_CHECK; 610 else if ((strcmp(args[0].from, "FILE_MMAP") == 0) 611 || (strcmp(args[0].from, "MMAP_CHECK") == 0)) 612 entry->func = MMAP_CHECK; 613 else if (strcmp(args[0].from, "BPRM_CHECK") == 0) 614 entry->func = BPRM_CHECK; 615 else 616 result = -EINVAL; 617 if (!result) 618 entry->flags |= IMA_FUNC; 619 break; 620 case Opt_mask: 621 ima_log_string(ab, "mask", args[0].from); 622 623 if (entry->mask) 624 result = -EINVAL; 625 626 from = args[0].from; 627 if (*from == '^') 628 from++; 629 630 if ((strcmp(from, "MAY_EXEC")) == 0) 631 entry->mask = MAY_EXEC; 632 else if (strcmp(from, "MAY_WRITE") == 0) 633 entry->mask = MAY_WRITE; 634 else if (strcmp(from, "MAY_READ") == 0) 635 entry->mask = MAY_READ; 636 else if (strcmp(from, "MAY_APPEND") == 0) 637 entry->mask = MAY_APPEND; 638 else 639 result = -EINVAL; 640 if (!result) 641 entry->flags |= (*args[0].from == '^') 642 ? IMA_INMASK : IMA_MASK; 643 break; 644 case Opt_fsmagic: 645 ima_log_string(ab, "fsmagic", args[0].from); 646 647 if (entry->fsmagic) { 648 result = -EINVAL; 649 break; 650 } 651 652 result = kstrtoul(args[0].from, 16, &entry->fsmagic); 653 if (!result) 654 entry->flags |= IMA_FSMAGIC; 655 break; 656 case Opt_fsuuid: 657 ima_log_string(ab, "fsuuid", args[0].from); 658 659 if (memchr_inv(entry->fsuuid, 0x00, 660 sizeof(entry->fsuuid))) { 661 result = -EINVAL; 662 break; 663 } 664 665 result = blk_part_pack_uuid(args[0].from, 666 entry->fsuuid); 667 if (!result) 668 entry->flags |= IMA_FSUUID; 669 break; 670 case Opt_uid: 671 ima_log_string(ab, "uid", args[0].from); 672 case Opt_euid: 673 if (token == Opt_euid) 674 ima_log_string(ab, "euid", args[0].from); 675 676 if (uid_valid(entry->uid)) { 677 result = -EINVAL; 678 break; 679 } 680 681 result = kstrtoul(args[0].from, 10, &lnum); 682 if (!result) { 683 entry->uid = make_kuid(current_user_ns(), 684 (uid_t) lnum); 685 if (!uid_valid(entry->uid) || 686 (uid_t)lnum != lnum) 687 result = -EINVAL; 688 else 689 entry->flags |= (token == Opt_uid) 690 ? IMA_UID : IMA_EUID; 691 } 692 break; 693 case Opt_fowner: 694 ima_log_string(ab, "fowner", args[0].from); 695 696 if (uid_valid(entry->fowner)) { 697 result = -EINVAL; 698 break; 699 } 700 701 result = kstrtoul(args[0].from, 10, &lnum); 702 if (!result) { 703 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum); 704 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum)) 705 result = -EINVAL; 706 else 707 entry->flags |= IMA_FOWNER; 708 } 709 break; 710 case Opt_obj_user: 711 ima_log_string(ab, "obj_user", args[0].from); 712 result = ima_lsm_rule_init(entry, args, 713 LSM_OBJ_USER, 714 AUDIT_OBJ_USER); 715 break; 716 case Opt_obj_role: 717 ima_log_string(ab, "obj_role", args[0].from); 718 result = ima_lsm_rule_init(entry, args, 719 LSM_OBJ_ROLE, 720 AUDIT_OBJ_ROLE); 721 break; 722 case Opt_obj_type: 723 ima_log_string(ab, "obj_type", args[0].from); 724 result = ima_lsm_rule_init(entry, args, 725 LSM_OBJ_TYPE, 726 AUDIT_OBJ_TYPE); 727 break; 728 case Opt_subj_user: 729 ima_log_string(ab, "subj_user", args[0].from); 730 result = ima_lsm_rule_init(entry, args, 731 LSM_SUBJ_USER, 732 AUDIT_SUBJ_USER); 733 break; 734 case Opt_subj_role: 735 ima_log_string(ab, "subj_role", args[0].from); 736 result = ima_lsm_rule_init(entry, args, 737 LSM_SUBJ_ROLE, 738 AUDIT_SUBJ_ROLE); 739 break; 740 case Opt_subj_type: 741 ima_log_string(ab, "subj_type", args[0].from); 742 result = ima_lsm_rule_init(entry, args, 743 LSM_SUBJ_TYPE, 744 AUDIT_SUBJ_TYPE); 745 break; 746 case Opt_appraise_type: 747 if (entry->action != APPRAISE) { 748 result = -EINVAL; 749 break; 750 } 751 752 ima_log_string(ab, "appraise_type", args[0].from); 753 if ((strcmp(args[0].from, "imasig")) == 0) 754 entry->flags |= IMA_DIGSIG_REQUIRED; 755 else 756 result = -EINVAL; 757 break; 758 case Opt_permit_directio: 759 entry->flags |= IMA_PERMIT_DIRECTIO; 760 break; 761 case Opt_err: 762 ima_log_string(ab, "UNKNOWN", p); 763 result = -EINVAL; 764 break; 765 } 766 } 767 if (!result && (entry->action == UNKNOWN)) 768 result = -EINVAL; 769 else if (entry->func == MODULE_CHECK) 770 temp_ima_appraise |= IMA_APPRAISE_MODULES; 771 else if (entry->func == FIRMWARE_CHECK) 772 temp_ima_appraise |= IMA_APPRAISE_FIRMWARE; 773 audit_log_format(ab, "res=%d", !result); 774 audit_log_end(ab); 775 return result; 776 } 777 778 /** 779 * ima_parse_add_rule - add a rule to ima_policy_rules 780 * @rule - ima measurement policy rule 781 * 782 * Avoid locking by allowing just one writer at a time in ima_write_policy() 783 * Returns the length of the rule parsed, an error code on failure 784 */ 785 ssize_t ima_parse_add_rule(char *rule) 786 { 787 static const char op[] = "update_policy"; 788 char *p; 789 struct ima_rule_entry *entry; 790 ssize_t result, len; 791 int audit_info = 0; 792 793 p = strsep(&rule, "\n"); 794 len = strlen(p) + 1; 795 p += strspn(p, " \t"); 796 797 if (*p == '#' || *p == '\0') 798 return len; 799 800 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 801 if (!entry) { 802 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 803 NULL, op, "-ENOMEM", -ENOMEM, audit_info); 804 return -ENOMEM; 805 } 806 807 INIT_LIST_HEAD(&entry->list); 808 809 result = ima_parse_rule(p, entry); 810 if (result) { 811 kfree(entry); 812 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 813 NULL, op, "invalid-policy", result, 814 audit_info); 815 return result; 816 } 817 818 list_add_tail(&entry->list, &ima_temp_rules); 819 820 return len; 821 } 822 823 /** 824 * ima_delete_rules() called to cleanup invalid in-flight policy. 825 * We don't need locking as we operate on the temp list, which is 826 * different from the active one. There is also only one user of 827 * ima_delete_rules() at a time. 828 */ 829 void ima_delete_rules(void) 830 { 831 struct ima_rule_entry *entry, *tmp; 832 int i; 833 834 temp_ima_appraise = 0; 835 list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) { 836 for (i = 0; i < MAX_LSM_RULES; i++) 837 kfree(entry->lsm[i].args_p); 838 839 list_del(&entry->list); 840 kfree(entry); 841 } 842 } 843 844 #ifdef CONFIG_IMA_READ_POLICY 845 enum { 846 mask_exec = 0, mask_write, mask_read, mask_append 847 }; 848 849 static char *mask_tokens[] = { 850 "MAY_EXEC", 851 "MAY_WRITE", 852 "MAY_READ", 853 "MAY_APPEND" 854 }; 855 856 enum { 857 func_file = 0, func_mmap, func_bprm, 858 func_module, func_firmware, func_post 859 }; 860 861 static char *func_tokens[] = { 862 "FILE_CHECK", 863 "MMAP_CHECK", 864 "BPRM_CHECK", 865 "MODULE_CHECK", 866 "FIRMWARE_CHECK", 867 "POST_SETATTR" 868 }; 869 870 void *ima_policy_start(struct seq_file *m, loff_t *pos) 871 { 872 loff_t l = *pos; 873 struct ima_rule_entry *entry; 874 875 rcu_read_lock(); 876 list_for_each_entry_rcu(entry, ima_rules, list) { 877 if (!l--) { 878 rcu_read_unlock(); 879 return entry; 880 } 881 } 882 rcu_read_unlock(); 883 return NULL; 884 } 885 886 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos) 887 { 888 struct ima_rule_entry *entry = v; 889 890 rcu_read_lock(); 891 entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list); 892 rcu_read_unlock(); 893 (*pos)++; 894 895 return (&entry->list == ima_rules) ? NULL : entry; 896 } 897 898 void ima_policy_stop(struct seq_file *m, void *v) 899 { 900 } 901 902 #define pt(token) policy_tokens[token + Opt_err].pattern 903 #define mt(token) mask_tokens[token] 904 #define ft(token) func_tokens[token] 905 906 int ima_policy_show(struct seq_file *m, void *v) 907 { 908 struct ima_rule_entry *entry = v; 909 int i = 0; 910 char tbuf[64] = {0,}; 911 912 rcu_read_lock(); 913 914 if (entry->action & MEASURE) 915 seq_puts(m, pt(Opt_measure)); 916 if (entry->action & DONT_MEASURE) 917 seq_puts(m, pt(Opt_dont_measure)); 918 if (entry->action & APPRAISE) 919 seq_puts(m, pt(Opt_appraise)); 920 if (entry->action & DONT_APPRAISE) 921 seq_puts(m, pt(Opt_dont_appraise)); 922 if (entry->action & AUDIT) 923 seq_puts(m, pt(Opt_audit)); 924 925 seq_puts(m, " "); 926 927 if (entry->flags & IMA_FUNC) { 928 switch (entry->func) { 929 case FILE_CHECK: 930 seq_printf(m, pt(Opt_func), ft(func_file)); 931 break; 932 case MMAP_CHECK: 933 seq_printf(m, pt(Opt_func), ft(func_mmap)); 934 break; 935 case BPRM_CHECK: 936 seq_printf(m, pt(Opt_func), ft(func_bprm)); 937 break; 938 case MODULE_CHECK: 939 seq_printf(m, pt(Opt_func), ft(func_module)); 940 break; 941 case FIRMWARE_CHECK: 942 seq_printf(m, pt(Opt_func), ft(func_firmware)); 943 break; 944 case POST_SETATTR: 945 seq_printf(m, pt(Opt_func), ft(func_post)); 946 break; 947 default: 948 snprintf(tbuf, sizeof(tbuf), "%d", entry->func); 949 seq_printf(m, pt(Opt_func), tbuf); 950 break; 951 } 952 seq_puts(m, " "); 953 } 954 955 if (entry->flags & IMA_MASK) { 956 if (entry->mask & MAY_EXEC) 957 seq_printf(m, pt(Opt_mask), mt(mask_exec)); 958 if (entry->mask & MAY_WRITE) 959 seq_printf(m, pt(Opt_mask), mt(mask_write)); 960 if (entry->mask & MAY_READ) 961 seq_printf(m, pt(Opt_mask), mt(mask_read)); 962 if (entry->mask & MAY_APPEND) 963 seq_printf(m, pt(Opt_mask), mt(mask_append)); 964 seq_puts(m, " "); 965 } 966 967 if (entry->flags & IMA_FSMAGIC) { 968 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic); 969 seq_printf(m, pt(Opt_fsmagic), tbuf); 970 seq_puts(m, " "); 971 } 972 973 if (entry->flags & IMA_FSUUID) { 974 seq_puts(m, "fsuuid="); 975 for (i = 0; i < ARRAY_SIZE(entry->fsuuid); ++i) { 976 switch (i) { 977 case 4: 978 case 6: 979 case 8: 980 case 10: 981 seq_puts(m, "-"); 982 } 983 seq_printf(m, "%x", entry->fsuuid[i]); 984 } 985 seq_puts(m, " "); 986 } 987 988 if (entry->flags & IMA_UID) { 989 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid)); 990 seq_printf(m, pt(Opt_uid), tbuf); 991 seq_puts(m, " "); 992 } 993 994 if (entry->flags & IMA_EUID) { 995 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid)); 996 seq_printf(m, pt(Opt_euid), tbuf); 997 seq_puts(m, " "); 998 } 999 1000 if (entry->flags & IMA_FOWNER) { 1001 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner)); 1002 seq_printf(m, pt(Opt_fowner), tbuf); 1003 seq_puts(m, " "); 1004 } 1005 1006 for (i = 0; i < MAX_LSM_RULES; i++) { 1007 if (entry->lsm[i].rule) { 1008 switch (i) { 1009 case LSM_OBJ_USER: 1010 seq_printf(m, pt(Opt_obj_user), 1011 (char *)entry->lsm[i].args_p); 1012 break; 1013 case LSM_OBJ_ROLE: 1014 seq_printf(m, pt(Opt_obj_role), 1015 (char *)entry->lsm[i].args_p); 1016 break; 1017 case LSM_OBJ_TYPE: 1018 seq_printf(m, pt(Opt_obj_type), 1019 (char *)entry->lsm[i].args_p); 1020 break; 1021 case LSM_SUBJ_USER: 1022 seq_printf(m, pt(Opt_subj_user), 1023 (char *)entry->lsm[i].args_p); 1024 break; 1025 case LSM_SUBJ_ROLE: 1026 seq_printf(m, pt(Opt_subj_role), 1027 (char *)entry->lsm[i].args_p); 1028 break; 1029 case LSM_SUBJ_TYPE: 1030 seq_printf(m, pt(Opt_subj_type), 1031 (char *)entry->lsm[i].args_p); 1032 break; 1033 } 1034 } 1035 } 1036 if (entry->flags & IMA_DIGSIG_REQUIRED) 1037 seq_puts(m, "appraise_type=imasig "); 1038 if (entry->flags & IMA_PERMIT_DIRECTIO) 1039 seq_puts(m, "permit_directio "); 1040 rcu_read_unlock(); 1041 seq_puts(m, "\n"); 1042 return 0; 1043 } 1044 #endif /* CONFIG_IMA_READ_POLICY */ 1045