1 /* 2 * Copyright (C) 2008 IBM Corporation 3 * Author: Mimi Zohar <zohar@us.ibm.com> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation, version 2 of the License. 8 * 9 * ima_policy.c 10 * - initialize default measure policy rules 11 * 12 */ 13 #include <linux/module.h> 14 #include <linux/list.h> 15 #include <linux/security.h> 16 #include <linux/magic.h> 17 #include <linux/parser.h> 18 #include <linux/slab.h> 19 #include <linux/genhd.h> 20 21 #include "ima.h" 22 23 /* flags definitions */ 24 #define IMA_FUNC 0x0001 25 #define IMA_MASK 0x0002 26 #define IMA_FSMAGIC 0x0004 27 #define IMA_UID 0x0008 28 #define IMA_FOWNER 0x0010 29 #define IMA_FSUUID 0x0020 30 #define IMA_INMASK 0x0040 31 #define IMA_EUID 0x0080 32 33 #define UNKNOWN 0 34 #define MEASURE 0x0001 /* same as IMA_MEASURE */ 35 #define DONT_MEASURE 0x0002 36 #define APPRAISE 0x0004 /* same as IMA_APPRAISE */ 37 #define DONT_APPRAISE 0x0008 38 #define AUDIT 0x0040 39 40 int ima_policy_flag; 41 42 #define MAX_LSM_RULES 6 43 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, 44 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE 45 }; 46 47 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB }; 48 49 struct ima_rule_entry { 50 struct list_head list; 51 int action; 52 unsigned int flags; 53 enum ima_hooks func; 54 int mask; 55 unsigned long fsmagic; 56 u8 fsuuid[16]; 57 kuid_t uid; 58 kuid_t fowner; 59 struct { 60 void *rule; /* LSM file metadata specific */ 61 void *args_p; /* audit value */ 62 int type; /* audit type */ 63 } lsm[MAX_LSM_RULES]; 64 }; 65 66 /* 67 * Without LSM specific knowledge, the default policy can only be 68 * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner 69 */ 70 71 /* 72 * The minimum rule set to allow for full TCB coverage. Measures all files 73 * opened or mmap for exec and everything read by root. Dangerous because 74 * normal users can easily run the machine out of memory simply building 75 * and running executables. 76 */ 77 static struct ima_rule_entry dont_measure_rules[] = { 78 {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 79 {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, 80 {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, 81 {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, 82 {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 83 {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, 84 {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, 85 {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, 86 {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC, 87 .flags = IMA_FSMAGIC}, 88 {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC} 89 }; 90 91 static struct ima_rule_entry original_measurement_rules[] = { 92 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, 93 .flags = IMA_FUNC | IMA_MASK}, 94 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, 95 .flags = IMA_FUNC | IMA_MASK}, 96 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 97 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID}, 98 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, 99 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, 100 }; 101 102 static struct ima_rule_entry default_measurement_rules[] = { 103 {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC, 104 .flags = IMA_FUNC | IMA_MASK}, 105 {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC, 106 .flags = IMA_FUNC | IMA_MASK}, 107 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 108 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID}, 109 {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, 110 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID}, 111 {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC}, 112 {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC}, 113 }; 114 115 static struct ima_rule_entry default_appraise_rules[] = { 116 {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 117 {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC}, 118 {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC}, 119 {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, 120 {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC}, 121 {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 122 {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC}, 123 {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC}, 124 {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, 125 {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, 126 {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC}, 127 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT 128 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER}, 129 #else 130 /* force signature */ 131 {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, 132 .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED}, 133 #endif 134 }; 135 136 static LIST_HEAD(ima_default_rules); 137 static LIST_HEAD(ima_policy_rules); 138 static struct list_head *ima_rules; 139 140 static DEFINE_MUTEX(ima_rules_mutex); 141 142 static int ima_policy __initdata; 143 static int __init default_measure_policy_setup(char *str) 144 { 145 if (ima_policy) 146 return 1; 147 148 ima_policy = ORIGINAL_TCB; 149 return 1; 150 } 151 __setup("ima_tcb", default_measure_policy_setup); 152 153 static int __init policy_setup(char *str) 154 { 155 if (ima_policy) 156 return 1; 157 158 if (strcmp(str, "tcb") == 0) 159 ima_policy = DEFAULT_TCB; 160 161 return 1; 162 } 163 __setup("ima_policy=", policy_setup); 164 165 static bool ima_use_appraise_tcb __initdata; 166 static int __init default_appraise_policy_setup(char *str) 167 { 168 ima_use_appraise_tcb = 1; 169 return 1; 170 } 171 __setup("ima_appraise_tcb", default_appraise_policy_setup); 172 173 /* 174 * Although the IMA policy does not change, the LSM policy can be 175 * reloaded, leaving the IMA LSM based rules referring to the old, 176 * stale LSM policy. 177 * 178 * Update the IMA LSM based rules to reflect the reloaded LSM policy. 179 * We assume the rules still exist; and BUG_ON() if they don't. 180 */ 181 static void ima_lsm_update_rules(void) 182 { 183 struct ima_rule_entry *entry, *tmp; 184 int result; 185 int i; 186 187 mutex_lock(&ima_rules_mutex); 188 list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) { 189 for (i = 0; i < MAX_LSM_RULES; i++) { 190 if (!entry->lsm[i].rule) 191 continue; 192 result = security_filter_rule_init(entry->lsm[i].type, 193 Audit_equal, 194 entry->lsm[i].args_p, 195 &entry->lsm[i].rule); 196 BUG_ON(!entry->lsm[i].rule); 197 } 198 } 199 mutex_unlock(&ima_rules_mutex); 200 } 201 202 /** 203 * ima_match_rules - determine whether an inode matches the measure rule. 204 * @rule: a pointer to a rule 205 * @inode: a pointer to an inode 206 * @func: LIM hook identifier 207 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 208 * 209 * Returns true on rule match, false on failure. 210 */ 211 static bool ima_match_rules(struct ima_rule_entry *rule, 212 struct inode *inode, enum ima_hooks func, int mask) 213 { 214 struct task_struct *tsk = current; 215 const struct cred *cred = current_cred(); 216 int i; 217 218 if ((rule->flags & IMA_FUNC) && 219 (rule->func != func && func != POST_SETATTR)) 220 return false; 221 if ((rule->flags & IMA_MASK) && 222 (rule->mask != mask && func != POST_SETATTR)) 223 return false; 224 if ((rule->flags & IMA_INMASK) && 225 (!(rule->mask & mask) && func != POST_SETATTR)) 226 return false; 227 if ((rule->flags & IMA_FSMAGIC) 228 && rule->fsmagic != inode->i_sb->s_magic) 229 return false; 230 if ((rule->flags & IMA_FSUUID) && 231 memcmp(rule->fsuuid, inode->i_sb->s_uuid, sizeof(rule->fsuuid))) 232 return false; 233 if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid)) 234 return false; 235 if (rule->flags & IMA_EUID) { 236 if (has_capability_noaudit(current, CAP_SETUID)) { 237 if (!uid_eq(rule->uid, cred->euid) 238 && !uid_eq(rule->uid, cred->suid) 239 && !uid_eq(rule->uid, cred->uid)) 240 return false; 241 } else if (!uid_eq(rule->uid, cred->euid)) 242 return false; 243 } 244 245 if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid)) 246 return false; 247 for (i = 0; i < MAX_LSM_RULES; i++) { 248 int rc = 0; 249 u32 osid, sid; 250 int retried = 0; 251 252 if (!rule->lsm[i].rule) 253 continue; 254 retry: 255 switch (i) { 256 case LSM_OBJ_USER: 257 case LSM_OBJ_ROLE: 258 case LSM_OBJ_TYPE: 259 security_inode_getsecid(inode, &osid); 260 rc = security_filter_rule_match(osid, 261 rule->lsm[i].type, 262 Audit_equal, 263 rule->lsm[i].rule, 264 NULL); 265 break; 266 case LSM_SUBJ_USER: 267 case LSM_SUBJ_ROLE: 268 case LSM_SUBJ_TYPE: 269 security_task_getsecid(tsk, &sid); 270 rc = security_filter_rule_match(sid, 271 rule->lsm[i].type, 272 Audit_equal, 273 rule->lsm[i].rule, 274 NULL); 275 default: 276 break; 277 } 278 if ((rc < 0) && (!retried)) { 279 retried = 1; 280 ima_lsm_update_rules(); 281 goto retry; 282 } 283 if (!rc) 284 return false; 285 } 286 return true; 287 } 288 289 /* 290 * In addition to knowing that we need to appraise the file in general, 291 * we need to differentiate between calling hooks, for hook specific rules. 292 */ 293 static int get_subaction(struct ima_rule_entry *rule, int func) 294 { 295 if (!(rule->flags & IMA_FUNC)) 296 return IMA_FILE_APPRAISE; 297 298 switch (func) { 299 case MMAP_CHECK: 300 return IMA_MMAP_APPRAISE; 301 case BPRM_CHECK: 302 return IMA_BPRM_APPRAISE; 303 case MODULE_CHECK: 304 return IMA_MODULE_APPRAISE; 305 case FIRMWARE_CHECK: 306 return IMA_FIRMWARE_APPRAISE; 307 case FILE_CHECK: 308 default: 309 return IMA_FILE_APPRAISE; 310 } 311 } 312 313 /** 314 * ima_match_policy - decision based on LSM and other conditions 315 * @inode: pointer to an inode for which the policy decision is being made 316 * @func: IMA hook identifier 317 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) 318 * 319 * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type) 320 * conditions. 321 * 322 * (There is no need for locking when walking the policy list, 323 * as elements in the list are never deleted, nor does the list 324 * change.) 325 */ 326 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, 327 int flags) 328 { 329 struct ima_rule_entry *entry; 330 int action = 0, actmask = flags | (flags << 1); 331 332 list_for_each_entry(entry, ima_rules, list) { 333 334 if (!(entry->action & actmask)) 335 continue; 336 337 if (!ima_match_rules(entry, inode, func, mask)) 338 continue; 339 340 action |= entry->flags & IMA_ACTION_FLAGS; 341 342 action |= entry->action & IMA_DO_MASK; 343 if (entry->action & IMA_APPRAISE) 344 action |= get_subaction(entry, func); 345 346 if (entry->action & IMA_DO_MASK) 347 actmask &= ~(entry->action | entry->action << 1); 348 else 349 actmask &= ~(entry->action | entry->action >> 1); 350 351 if (!actmask) 352 break; 353 } 354 355 return action; 356 } 357 358 /* 359 * Initialize the ima_policy_flag variable based on the currently 360 * loaded policy. Based on this flag, the decision to short circuit 361 * out of a function or not call the function in the first place 362 * can be made earlier. 363 */ 364 void ima_update_policy_flag(void) 365 { 366 struct ima_rule_entry *entry; 367 368 ima_policy_flag = 0; 369 list_for_each_entry(entry, ima_rules, list) { 370 if (entry->action & IMA_DO_MASK) 371 ima_policy_flag |= entry->action; 372 } 373 374 if (!ima_appraise) 375 ima_policy_flag &= ~IMA_APPRAISE; 376 } 377 378 /** 379 * ima_init_policy - initialize the default measure rules. 380 * 381 * ima_rules points to either the ima_default_rules or the 382 * the new ima_policy_rules. 383 */ 384 void __init ima_init_policy(void) 385 { 386 int i, measure_entries, appraise_entries; 387 388 /* if !ima_policy set entries = 0 so we load NO default rules */ 389 measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0; 390 appraise_entries = ima_use_appraise_tcb ? 391 ARRAY_SIZE(default_appraise_rules) : 0; 392 393 for (i = 0; i < measure_entries; i++) 394 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules); 395 396 switch (ima_policy) { 397 case ORIGINAL_TCB: 398 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++) 399 list_add_tail(&original_measurement_rules[i].list, 400 &ima_default_rules); 401 break; 402 case DEFAULT_TCB: 403 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++) 404 list_add_tail(&default_measurement_rules[i].list, 405 &ima_default_rules); 406 default: 407 break; 408 } 409 410 for (i = 0; i < appraise_entries; i++) { 411 list_add_tail(&default_appraise_rules[i].list, 412 &ima_default_rules); 413 } 414 415 ima_rules = &ima_default_rules; 416 } 417 418 /** 419 * ima_update_policy - update default_rules with new measure rules 420 * 421 * Called on file .release to update the default rules with a complete new 422 * policy. Once updated, the policy is locked, no additional rules can be 423 * added to the policy. 424 */ 425 void ima_update_policy(void) 426 { 427 ima_rules = &ima_policy_rules; 428 ima_update_policy_flag(); 429 } 430 431 enum { 432 Opt_err = -1, 433 Opt_measure = 1, Opt_dont_measure, 434 Opt_appraise, Opt_dont_appraise, 435 Opt_audit, 436 Opt_obj_user, Opt_obj_role, Opt_obj_type, 437 Opt_subj_user, Opt_subj_role, Opt_subj_type, 438 Opt_func, Opt_mask, Opt_fsmagic, 439 Opt_uid, Opt_euid, Opt_fowner, 440 Opt_appraise_type, Opt_fsuuid, Opt_permit_directio 441 }; 442 443 static match_table_t policy_tokens = { 444 {Opt_measure, "measure"}, 445 {Opt_dont_measure, "dont_measure"}, 446 {Opt_appraise, "appraise"}, 447 {Opt_dont_appraise, "dont_appraise"}, 448 {Opt_audit, "audit"}, 449 {Opt_obj_user, "obj_user=%s"}, 450 {Opt_obj_role, "obj_role=%s"}, 451 {Opt_obj_type, "obj_type=%s"}, 452 {Opt_subj_user, "subj_user=%s"}, 453 {Opt_subj_role, "subj_role=%s"}, 454 {Opt_subj_type, "subj_type=%s"}, 455 {Opt_func, "func=%s"}, 456 {Opt_mask, "mask=%s"}, 457 {Opt_fsmagic, "fsmagic=%s"}, 458 {Opt_fsuuid, "fsuuid=%s"}, 459 {Opt_uid, "uid=%s"}, 460 {Opt_euid, "euid=%s"}, 461 {Opt_fowner, "fowner=%s"}, 462 {Opt_appraise_type, "appraise_type=%s"}, 463 {Opt_permit_directio, "permit_directio"}, 464 {Opt_err, NULL} 465 }; 466 467 static int ima_lsm_rule_init(struct ima_rule_entry *entry, 468 substring_t *args, int lsm_rule, int audit_type) 469 { 470 int result; 471 472 if (entry->lsm[lsm_rule].rule) 473 return -EINVAL; 474 475 entry->lsm[lsm_rule].args_p = match_strdup(args); 476 if (!entry->lsm[lsm_rule].args_p) 477 return -ENOMEM; 478 479 entry->lsm[lsm_rule].type = audit_type; 480 result = security_filter_rule_init(entry->lsm[lsm_rule].type, 481 Audit_equal, 482 entry->lsm[lsm_rule].args_p, 483 &entry->lsm[lsm_rule].rule); 484 if (!entry->lsm[lsm_rule].rule) { 485 kfree(entry->lsm[lsm_rule].args_p); 486 return -EINVAL; 487 } 488 489 return result; 490 } 491 492 static void ima_log_string(struct audit_buffer *ab, char *key, char *value) 493 { 494 audit_log_format(ab, "%s=", key); 495 audit_log_untrustedstring(ab, value); 496 audit_log_format(ab, " "); 497 } 498 499 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) 500 { 501 struct audit_buffer *ab; 502 char *from; 503 char *p; 504 int result = 0; 505 506 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE); 507 508 entry->uid = INVALID_UID; 509 entry->fowner = INVALID_UID; 510 entry->action = UNKNOWN; 511 while ((p = strsep(&rule, " \t")) != NULL) { 512 substring_t args[MAX_OPT_ARGS]; 513 int token; 514 unsigned long lnum; 515 516 if (result < 0) 517 break; 518 if ((*p == '\0') || (*p == ' ') || (*p == '\t')) 519 continue; 520 token = match_token(p, policy_tokens, args); 521 switch (token) { 522 case Opt_measure: 523 ima_log_string(ab, "action", "measure"); 524 525 if (entry->action != UNKNOWN) 526 result = -EINVAL; 527 528 entry->action = MEASURE; 529 break; 530 case Opt_dont_measure: 531 ima_log_string(ab, "action", "dont_measure"); 532 533 if (entry->action != UNKNOWN) 534 result = -EINVAL; 535 536 entry->action = DONT_MEASURE; 537 break; 538 case Opt_appraise: 539 ima_log_string(ab, "action", "appraise"); 540 541 if (entry->action != UNKNOWN) 542 result = -EINVAL; 543 544 entry->action = APPRAISE; 545 break; 546 case Opt_dont_appraise: 547 ima_log_string(ab, "action", "dont_appraise"); 548 549 if (entry->action != UNKNOWN) 550 result = -EINVAL; 551 552 entry->action = DONT_APPRAISE; 553 break; 554 case Opt_audit: 555 ima_log_string(ab, "action", "audit"); 556 557 if (entry->action != UNKNOWN) 558 result = -EINVAL; 559 560 entry->action = AUDIT; 561 break; 562 case Opt_func: 563 ima_log_string(ab, "func", args[0].from); 564 565 if (entry->func) 566 result = -EINVAL; 567 568 if (strcmp(args[0].from, "FILE_CHECK") == 0) 569 entry->func = FILE_CHECK; 570 /* PATH_CHECK is for backwards compat */ 571 else if (strcmp(args[0].from, "PATH_CHECK") == 0) 572 entry->func = FILE_CHECK; 573 else if (strcmp(args[0].from, "MODULE_CHECK") == 0) 574 entry->func = MODULE_CHECK; 575 else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0) 576 entry->func = FIRMWARE_CHECK; 577 else if ((strcmp(args[0].from, "FILE_MMAP") == 0) 578 || (strcmp(args[0].from, "MMAP_CHECK") == 0)) 579 entry->func = MMAP_CHECK; 580 else if (strcmp(args[0].from, "BPRM_CHECK") == 0) 581 entry->func = BPRM_CHECK; 582 else 583 result = -EINVAL; 584 if (!result) 585 entry->flags |= IMA_FUNC; 586 break; 587 case Opt_mask: 588 ima_log_string(ab, "mask", args[0].from); 589 590 if (entry->mask) 591 result = -EINVAL; 592 593 from = args[0].from; 594 if (*from == '^') 595 from++; 596 597 if ((strcmp(from, "MAY_EXEC")) == 0) 598 entry->mask = MAY_EXEC; 599 else if (strcmp(from, "MAY_WRITE") == 0) 600 entry->mask = MAY_WRITE; 601 else if (strcmp(from, "MAY_READ") == 0) 602 entry->mask = MAY_READ; 603 else if (strcmp(from, "MAY_APPEND") == 0) 604 entry->mask = MAY_APPEND; 605 else 606 result = -EINVAL; 607 if (!result) 608 entry->flags |= (*args[0].from == '^') 609 ? IMA_INMASK : IMA_MASK; 610 break; 611 case Opt_fsmagic: 612 ima_log_string(ab, "fsmagic", args[0].from); 613 614 if (entry->fsmagic) { 615 result = -EINVAL; 616 break; 617 } 618 619 result = kstrtoul(args[0].from, 16, &entry->fsmagic); 620 if (!result) 621 entry->flags |= IMA_FSMAGIC; 622 break; 623 case Opt_fsuuid: 624 ima_log_string(ab, "fsuuid", args[0].from); 625 626 if (memchr_inv(entry->fsuuid, 0x00, 627 sizeof(entry->fsuuid))) { 628 result = -EINVAL; 629 break; 630 } 631 632 result = blk_part_pack_uuid(args[0].from, 633 entry->fsuuid); 634 if (!result) 635 entry->flags |= IMA_FSUUID; 636 break; 637 case Opt_uid: 638 ima_log_string(ab, "uid", args[0].from); 639 case Opt_euid: 640 if (token == Opt_euid) 641 ima_log_string(ab, "euid", args[0].from); 642 643 if (uid_valid(entry->uid)) { 644 result = -EINVAL; 645 break; 646 } 647 648 result = kstrtoul(args[0].from, 10, &lnum); 649 if (!result) { 650 entry->uid = make_kuid(current_user_ns(), 651 (uid_t) lnum); 652 if (!uid_valid(entry->uid) || 653 (uid_t)lnum != lnum) 654 result = -EINVAL; 655 else 656 entry->flags |= (token == Opt_uid) 657 ? IMA_UID : IMA_EUID; 658 } 659 break; 660 case Opt_fowner: 661 ima_log_string(ab, "fowner", args[0].from); 662 663 if (uid_valid(entry->fowner)) { 664 result = -EINVAL; 665 break; 666 } 667 668 result = kstrtoul(args[0].from, 10, &lnum); 669 if (!result) { 670 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum); 671 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum)) 672 result = -EINVAL; 673 else 674 entry->flags |= IMA_FOWNER; 675 } 676 break; 677 case Opt_obj_user: 678 ima_log_string(ab, "obj_user", args[0].from); 679 result = ima_lsm_rule_init(entry, args, 680 LSM_OBJ_USER, 681 AUDIT_OBJ_USER); 682 break; 683 case Opt_obj_role: 684 ima_log_string(ab, "obj_role", args[0].from); 685 result = ima_lsm_rule_init(entry, args, 686 LSM_OBJ_ROLE, 687 AUDIT_OBJ_ROLE); 688 break; 689 case Opt_obj_type: 690 ima_log_string(ab, "obj_type", args[0].from); 691 result = ima_lsm_rule_init(entry, args, 692 LSM_OBJ_TYPE, 693 AUDIT_OBJ_TYPE); 694 break; 695 case Opt_subj_user: 696 ima_log_string(ab, "subj_user", args[0].from); 697 result = ima_lsm_rule_init(entry, args, 698 LSM_SUBJ_USER, 699 AUDIT_SUBJ_USER); 700 break; 701 case Opt_subj_role: 702 ima_log_string(ab, "subj_role", args[0].from); 703 result = ima_lsm_rule_init(entry, args, 704 LSM_SUBJ_ROLE, 705 AUDIT_SUBJ_ROLE); 706 break; 707 case Opt_subj_type: 708 ima_log_string(ab, "subj_type", args[0].from); 709 result = ima_lsm_rule_init(entry, args, 710 LSM_SUBJ_TYPE, 711 AUDIT_SUBJ_TYPE); 712 break; 713 case Opt_appraise_type: 714 if (entry->action != APPRAISE) { 715 result = -EINVAL; 716 break; 717 } 718 719 ima_log_string(ab, "appraise_type", args[0].from); 720 if ((strcmp(args[0].from, "imasig")) == 0) 721 entry->flags |= IMA_DIGSIG_REQUIRED; 722 else 723 result = -EINVAL; 724 break; 725 case Opt_permit_directio: 726 entry->flags |= IMA_PERMIT_DIRECTIO; 727 break; 728 case Opt_err: 729 ima_log_string(ab, "UNKNOWN", p); 730 result = -EINVAL; 731 break; 732 } 733 } 734 if (!result && (entry->action == UNKNOWN)) 735 result = -EINVAL; 736 else if (entry->func == MODULE_CHECK) 737 ima_appraise |= IMA_APPRAISE_MODULES; 738 else if (entry->func == FIRMWARE_CHECK) 739 ima_appraise |= IMA_APPRAISE_FIRMWARE; 740 audit_log_format(ab, "res=%d", !result); 741 audit_log_end(ab); 742 return result; 743 } 744 745 /** 746 * ima_parse_add_rule - add a rule to ima_policy_rules 747 * @rule - ima measurement policy rule 748 * 749 * Uses a mutex to protect the policy list from multiple concurrent writers. 750 * Returns the length of the rule parsed, an error code on failure 751 */ 752 ssize_t ima_parse_add_rule(char *rule) 753 { 754 static const char op[] = "update_policy"; 755 char *p; 756 struct ima_rule_entry *entry; 757 ssize_t result, len; 758 int audit_info = 0; 759 760 p = strsep(&rule, "\n"); 761 len = strlen(p) + 1; 762 p += strspn(p, " \t"); 763 764 if (*p == '#' || *p == '\0') 765 return len; 766 767 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 768 if (!entry) { 769 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 770 NULL, op, "-ENOMEM", -ENOMEM, audit_info); 771 return -ENOMEM; 772 } 773 774 INIT_LIST_HEAD(&entry->list); 775 776 result = ima_parse_rule(p, entry); 777 if (result) { 778 kfree(entry); 779 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, 780 NULL, op, "invalid-policy", result, 781 audit_info); 782 return result; 783 } 784 785 mutex_lock(&ima_rules_mutex); 786 list_add_tail(&entry->list, &ima_policy_rules); 787 mutex_unlock(&ima_rules_mutex); 788 789 return len; 790 } 791 792 /* ima_delete_rules called to cleanup invalid policy */ 793 void ima_delete_rules(void) 794 { 795 struct ima_rule_entry *entry, *tmp; 796 int i; 797 798 mutex_lock(&ima_rules_mutex); 799 list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) { 800 for (i = 0; i < MAX_LSM_RULES; i++) 801 kfree(entry->lsm[i].args_p); 802 803 list_del(&entry->list); 804 kfree(entry); 805 } 806 mutex_unlock(&ima_rules_mutex); 807 } 808