1 /*
2  * Copyright (C) 2008 IBM Corporation
3  * Author: Mimi Zohar <zohar@us.ibm.com>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License as published by
7  * the Free Software Foundation, version 2 of the License.
8  *
9  * ima_policy.c
10  *	- initialize default measure policy rules
11  *
12  */
13 #include <linux/module.h>
14 #include <linux/list.h>
15 #include <linux/fs.h>
16 #include <linux/security.h>
17 #include <linux/magic.h>
18 #include <linux/parser.h>
19 #include <linux/slab.h>
20 #include <linux/rculist.h>
21 #include <linux/genhd.h>
22 #include <linux/seq_file.h>
23 
24 #include "ima.h"
25 
26 /* flags definitions */
27 #define IMA_FUNC	0x0001
28 #define IMA_MASK	0x0002
29 #define IMA_FSMAGIC	0x0004
30 #define IMA_UID		0x0008
31 #define IMA_FOWNER	0x0010
32 #define IMA_FSUUID	0x0020
33 #define IMA_INMASK	0x0040
34 #define IMA_EUID	0x0080
35 #define IMA_PCR		0x0100
36 
37 #define UNKNOWN		0
38 #define MEASURE		0x0001	/* same as IMA_MEASURE */
39 #define DONT_MEASURE	0x0002
40 #define APPRAISE	0x0004	/* same as IMA_APPRAISE */
41 #define DONT_APPRAISE	0x0008
42 #define AUDIT		0x0040
43 
44 #define INVALID_PCR(a) (((a) < 0) || \
45 	(a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
46 
47 int ima_policy_flag;
48 static int temp_ima_appraise;
49 
50 #define MAX_LSM_RULES 6
51 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
52 	LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
53 };
54 
55 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
56 
57 struct ima_rule_entry {
58 	struct list_head list;
59 	int action;
60 	unsigned int flags;
61 	enum ima_hooks func;
62 	int mask;
63 	unsigned long fsmagic;
64 	u8 fsuuid[16];
65 	kuid_t uid;
66 	kuid_t fowner;
67 	int pcr;
68 	struct {
69 		void *rule;	/* LSM file metadata specific */
70 		void *args_p;	/* audit value */
71 		int type;	/* audit type */
72 	} lsm[MAX_LSM_RULES];
73 };
74 
75 /*
76  * Without LSM specific knowledge, the default policy can only be
77  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
78  */
79 
80 /*
81  * The minimum rule set to allow for full TCB coverage.  Measures all files
82  * opened or mmap for exec and everything read by root.  Dangerous because
83  * normal users can easily run the machine out of memory simply building
84  * and running executables.
85  */
86 static struct ima_rule_entry dont_measure_rules[] = {
87 	{.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
88 	{.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
89 	{.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
90 	{.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
91 	{.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
92 	{.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
93 	{.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
94 	{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
95 	{.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
96 	 .flags = IMA_FSMAGIC},
97 	{.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
98 };
99 
100 static struct ima_rule_entry original_measurement_rules[] = {
101 	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
102 	 .flags = IMA_FUNC | IMA_MASK},
103 	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
104 	 .flags = IMA_FUNC | IMA_MASK},
105 	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
106 	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
107 	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
108 	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
109 };
110 
111 static struct ima_rule_entry default_measurement_rules[] = {
112 	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
113 	 .flags = IMA_FUNC | IMA_MASK},
114 	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
115 	 .flags = IMA_FUNC | IMA_MASK},
116 	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
117 	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
118 	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
119 	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
120 	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
121 	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
122 	{.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
123 };
124 
125 static struct ima_rule_entry default_appraise_rules[] = {
126 	{.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
127 	{.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
128 	{.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
129 	{.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
130 	{.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
131 	{.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
132 	{.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
133 	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
134 	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
135 	{.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
136 	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
137 #ifdef CONFIG_IMA_WRITE_POLICY
138 	{.action = APPRAISE, .func = POLICY_CHECK,
139 	.flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
140 #endif
141 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
142 	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
143 #else
144 	/* force signature */
145 	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID,
146 	 .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
147 #endif
148 };
149 
150 static LIST_HEAD(ima_default_rules);
151 static LIST_HEAD(ima_policy_rules);
152 static LIST_HEAD(ima_temp_rules);
153 static struct list_head *ima_rules;
154 
155 static int ima_policy __initdata;
156 
157 static int __init default_measure_policy_setup(char *str)
158 {
159 	if (ima_policy)
160 		return 1;
161 
162 	ima_policy = ORIGINAL_TCB;
163 	return 1;
164 }
165 __setup("ima_tcb", default_measure_policy_setup);
166 
167 static int __init policy_setup(char *str)
168 {
169 	if (ima_policy)
170 		return 1;
171 
172 	if (strcmp(str, "tcb") == 0)
173 		ima_policy = DEFAULT_TCB;
174 
175 	return 1;
176 }
177 __setup("ima_policy=", policy_setup);
178 
179 static bool ima_use_appraise_tcb __initdata;
180 static int __init default_appraise_policy_setup(char *str)
181 {
182 	ima_use_appraise_tcb = 1;
183 	return 1;
184 }
185 __setup("ima_appraise_tcb", default_appraise_policy_setup);
186 
187 /*
188  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
189  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
190  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
191  * they don't.
192  */
193 static void ima_lsm_update_rules(void)
194 {
195 	struct ima_rule_entry *entry;
196 	int result;
197 	int i;
198 
199 	list_for_each_entry(entry, &ima_policy_rules, list) {
200 		for (i = 0; i < MAX_LSM_RULES; i++) {
201 			if (!entry->lsm[i].rule)
202 				continue;
203 			result = security_filter_rule_init(entry->lsm[i].type,
204 							   Audit_equal,
205 							   entry->lsm[i].args_p,
206 							   &entry->lsm[i].rule);
207 			BUG_ON(!entry->lsm[i].rule);
208 		}
209 	}
210 }
211 
212 /**
213  * ima_match_rules - determine whether an inode matches the measure rule.
214  * @rule: a pointer to a rule
215  * @inode: a pointer to an inode
216  * @func: LIM hook identifier
217  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
218  *
219  * Returns true on rule match, false on failure.
220  */
221 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
222 			    enum ima_hooks func, int mask)
223 {
224 	struct task_struct *tsk = current;
225 	const struct cred *cred = current_cred();
226 	int i;
227 
228 	if ((rule->flags & IMA_FUNC) &&
229 	    (rule->func != func && func != POST_SETATTR))
230 		return false;
231 	if ((rule->flags & IMA_MASK) &&
232 	    (rule->mask != mask && func != POST_SETATTR))
233 		return false;
234 	if ((rule->flags & IMA_INMASK) &&
235 	    (!(rule->mask & mask) && func != POST_SETATTR))
236 		return false;
237 	if ((rule->flags & IMA_FSMAGIC)
238 	    && rule->fsmagic != inode->i_sb->s_magic)
239 		return false;
240 	if ((rule->flags & IMA_FSUUID) &&
241 	    memcmp(rule->fsuuid, inode->i_sb->s_uuid, sizeof(rule->fsuuid)))
242 		return false;
243 	if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
244 		return false;
245 	if (rule->flags & IMA_EUID) {
246 		if (has_capability_noaudit(current, CAP_SETUID)) {
247 			if (!uid_eq(rule->uid, cred->euid)
248 			    && !uid_eq(rule->uid, cred->suid)
249 			    && !uid_eq(rule->uid, cred->uid))
250 				return false;
251 		} else if (!uid_eq(rule->uid, cred->euid))
252 			return false;
253 	}
254 
255 	if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
256 		return false;
257 	for (i = 0; i < MAX_LSM_RULES; i++) {
258 		int rc = 0;
259 		u32 osid, sid;
260 		int retried = 0;
261 
262 		if (!rule->lsm[i].rule)
263 			continue;
264 retry:
265 		switch (i) {
266 		case LSM_OBJ_USER:
267 		case LSM_OBJ_ROLE:
268 		case LSM_OBJ_TYPE:
269 			security_inode_getsecid(inode, &osid);
270 			rc = security_filter_rule_match(osid,
271 							rule->lsm[i].type,
272 							Audit_equal,
273 							rule->lsm[i].rule,
274 							NULL);
275 			break;
276 		case LSM_SUBJ_USER:
277 		case LSM_SUBJ_ROLE:
278 		case LSM_SUBJ_TYPE:
279 			security_task_getsecid(tsk, &sid);
280 			rc = security_filter_rule_match(sid,
281 							rule->lsm[i].type,
282 							Audit_equal,
283 							rule->lsm[i].rule,
284 							NULL);
285 		default:
286 			break;
287 		}
288 		if ((rc < 0) && (!retried)) {
289 			retried = 1;
290 			ima_lsm_update_rules();
291 			goto retry;
292 		}
293 		if (!rc)
294 			return false;
295 	}
296 	return true;
297 }
298 
299 /*
300  * In addition to knowing that we need to appraise the file in general,
301  * we need to differentiate between calling hooks, for hook specific rules.
302  */
303 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
304 {
305 	if (!(rule->flags & IMA_FUNC))
306 		return IMA_FILE_APPRAISE;
307 
308 	switch (func) {
309 	case MMAP_CHECK:
310 		return IMA_MMAP_APPRAISE;
311 	case BPRM_CHECK:
312 		return IMA_BPRM_APPRAISE;
313 	case FILE_CHECK:
314 	case POST_SETATTR:
315 		return IMA_FILE_APPRAISE;
316 	case MODULE_CHECK ... MAX_CHECK - 1:
317 	default:
318 		return IMA_READ_APPRAISE;
319 	}
320 }
321 
322 /**
323  * ima_match_policy - decision based on LSM and other conditions
324  * @inode: pointer to an inode for which the policy decision is being made
325  * @func: IMA hook identifier
326  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
327  * @pcr: set the pcr to extend
328  *
329  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
330  * conditions.
331  *
332  * Since the IMA policy may be updated multiple times we need to lock the
333  * list when walking it.  Reads are many orders of magnitude more numerous
334  * than writes so ima_match_policy() is classical RCU candidate.
335  */
336 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
337 		     int flags, int *pcr)
338 {
339 	struct ima_rule_entry *entry;
340 	int action = 0, actmask = flags | (flags << 1);
341 
342 	rcu_read_lock();
343 	list_for_each_entry_rcu(entry, ima_rules, list) {
344 
345 		if (!(entry->action & actmask))
346 			continue;
347 
348 		if (!ima_match_rules(entry, inode, func, mask))
349 			continue;
350 
351 		action |= entry->flags & IMA_ACTION_FLAGS;
352 
353 		action |= entry->action & IMA_DO_MASK;
354 		if (entry->action & IMA_APPRAISE)
355 			action |= get_subaction(entry, func);
356 
357 		if (entry->action & IMA_DO_MASK)
358 			actmask &= ~(entry->action | entry->action << 1);
359 		else
360 			actmask &= ~(entry->action | entry->action >> 1);
361 
362 		if ((pcr) && (entry->flags & IMA_PCR))
363 			*pcr = entry->pcr;
364 
365 		if (!actmask)
366 			break;
367 	}
368 	rcu_read_unlock();
369 
370 	return action;
371 }
372 
373 /*
374  * Initialize the ima_policy_flag variable based on the currently
375  * loaded policy.  Based on this flag, the decision to short circuit
376  * out of a function or not call the function in the first place
377  * can be made earlier.
378  */
379 void ima_update_policy_flag(void)
380 {
381 	struct ima_rule_entry *entry;
382 
383 	list_for_each_entry(entry, ima_rules, list) {
384 		if (entry->action & IMA_DO_MASK)
385 			ima_policy_flag |= entry->action;
386 	}
387 
388 	ima_appraise |= temp_ima_appraise;
389 	if (!ima_appraise)
390 		ima_policy_flag &= ~IMA_APPRAISE;
391 }
392 
393 /**
394  * ima_init_policy - initialize the default measure rules.
395  *
396  * ima_rules points to either the ima_default_rules or the
397  * the new ima_policy_rules.
398  */
399 void __init ima_init_policy(void)
400 {
401 	int i, measure_entries, appraise_entries;
402 
403 	/* if !ima_policy set entries = 0 so we load NO default rules */
404 	measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
405 	appraise_entries = ima_use_appraise_tcb ?
406 			 ARRAY_SIZE(default_appraise_rules) : 0;
407 
408 	for (i = 0; i < measure_entries; i++)
409 		list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
410 
411 	switch (ima_policy) {
412 	case ORIGINAL_TCB:
413 		for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
414 			list_add_tail(&original_measurement_rules[i].list,
415 				      &ima_default_rules);
416 		break;
417 	case DEFAULT_TCB:
418 		for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
419 			list_add_tail(&default_measurement_rules[i].list,
420 				      &ima_default_rules);
421 	default:
422 		break;
423 	}
424 
425 	for (i = 0; i < appraise_entries; i++) {
426 		list_add_tail(&default_appraise_rules[i].list,
427 			      &ima_default_rules);
428 		if (default_appraise_rules[i].func == POLICY_CHECK)
429 			temp_ima_appraise |= IMA_APPRAISE_POLICY;
430 	}
431 
432 	ima_rules = &ima_default_rules;
433 	ima_update_policy_flag();
434 }
435 
436 /* Make sure we have a valid policy, at least containing some rules. */
437 int ima_check_policy(void)
438 {
439 	if (list_empty(&ima_temp_rules))
440 		return -EINVAL;
441 	return 0;
442 }
443 
444 /**
445  * ima_update_policy - update default_rules with new measure rules
446  *
447  * Called on file .release to update the default rules with a complete new
448  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
449  * they make a queue.  The policy may be updated multiple times and this is the
450  * RCU updater.
451  *
452  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
453  * we switch from the default policy to user defined.
454  */
455 void ima_update_policy(void)
456 {
457 	struct list_head *first, *last, *policy;
458 
459 	/* append current policy with the new rules */
460 	first = (&ima_temp_rules)->next;
461 	last = (&ima_temp_rules)->prev;
462 	policy = &ima_policy_rules;
463 
464 	synchronize_rcu();
465 
466 	last->next = policy;
467 	rcu_assign_pointer(list_next_rcu(policy->prev), first);
468 	first->prev = policy->prev;
469 	policy->prev = last;
470 
471 	/* prepare for the next policy rules addition */
472 	INIT_LIST_HEAD(&ima_temp_rules);
473 
474 	if (ima_rules != policy) {
475 		ima_policy_flag = 0;
476 		ima_rules = policy;
477 	}
478 	ima_update_policy_flag();
479 }
480 
481 enum {
482 	Opt_err = -1,
483 	Opt_measure = 1, Opt_dont_measure,
484 	Opt_appraise, Opt_dont_appraise,
485 	Opt_audit,
486 	Opt_obj_user, Opt_obj_role, Opt_obj_type,
487 	Opt_subj_user, Opt_subj_role, Opt_subj_type,
488 	Opt_func, Opt_mask, Opt_fsmagic,
489 	Opt_fsuuid, Opt_uid, Opt_euid, Opt_fowner,
490 	Opt_appraise_type, Opt_permit_directio,
491 	Opt_pcr
492 };
493 
494 static match_table_t policy_tokens = {
495 	{Opt_measure, "measure"},
496 	{Opt_dont_measure, "dont_measure"},
497 	{Opt_appraise, "appraise"},
498 	{Opt_dont_appraise, "dont_appraise"},
499 	{Opt_audit, "audit"},
500 	{Opt_obj_user, "obj_user=%s"},
501 	{Opt_obj_role, "obj_role=%s"},
502 	{Opt_obj_type, "obj_type=%s"},
503 	{Opt_subj_user, "subj_user=%s"},
504 	{Opt_subj_role, "subj_role=%s"},
505 	{Opt_subj_type, "subj_type=%s"},
506 	{Opt_func, "func=%s"},
507 	{Opt_mask, "mask=%s"},
508 	{Opt_fsmagic, "fsmagic=%s"},
509 	{Opt_fsuuid, "fsuuid=%s"},
510 	{Opt_uid, "uid=%s"},
511 	{Opt_euid, "euid=%s"},
512 	{Opt_fowner, "fowner=%s"},
513 	{Opt_appraise_type, "appraise_type=%s"},
514 	{Opt_permit_directio, "permit_directio"},
515 	{Opt_pcr, "pcr=%s"},
516 	{Opt_err, NULL}
517 };
518 
519 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
520 			     substring_t *args, int lsm_rule, int audit_type)
521 {
522 	int result;
523 
524 	if (entry->lsm[lsm_rule].rule)
525 		return -EINVAL;
526 
527 	entry->lsm[lsm_rule].args_p = match_strdup(args);
528 	if (!entry->lsm[lsm_rule].args_p)
529 		return -ENOMEM;
530 
531 	entry->lsm[lsm_rule].type = audit_type;
532 	result = security_filter_rule_init(entry->lsm[lsm_rule].type,
533 					   Audit_equal,
534 					   entry->lsm[lsm_rule].args_p,
535 					   &entry->lsm[lsm_rule].rule);
536 	if (!entry->lsm[lsm_rule].rule) {
537 		kfree(entry->lsm[lsm_rule].args_p);
538 		return -EINVAL;
539 	}
540 
541 	return result;
542 }
543 
544 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
545 {
546 	audit_log_format(ab, "%s=", key);
547 	audit_log_untrustedstring(ab, value);
548 	audit_log_format(ab, " ");
549 }
550 
551 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
552 {
553 	struct audit_buffer *ab;
554 	char *from;
555 	char *p;
556 	int result = 0;
557 
558 	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
559 
560 	entry->uid = INVALID_UID;
561 	entry->fowner = INVALID_UID;
562 	entry->action = UNKNOWN;
563 	while ((p = strsep(&rule, " \t")) != NULL) {
564 		substring_t args[MAX_OPT_ARGS];
565 		int token;
566 		unsigned long lnum;
567 
568 		if (result < 0)
569 			break;
570 		if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
571 			continue;
572 		token = match_token(p, policy_tokens, args);
573 		switch (token) {
574 		case Opt_measure:
575 			ima_log_string(ab, "action", "measure");
576 
577 			if (entry->action != UNKNOWN)
578 				result = -EINVAL;
579 
580 			entry->action = MEASURE;
581 			break;
582 		case Opt_dont_measure:
583 			ima_log_string(ab, "action", "dont_measure");
584 
585 			if (entry->action != UNKNOWN)
586 				result = -EINVAL;
587 
588 			entry->action = DONT_MEASURE;
589 			break;
590 		case Opt_appraise:
591 			ima_log_string(ab, "action", "appraise");
592 
593 			if (entry->action != UNKNOWN)
594 				result = -EINVAL;
595 
596 			entry->action = APPRAISE;
597 			break;
598 		case Opt_dont_appraise:
599 			ima_log_string(ab, "action", "dont_appraise");
600 
601 			if (entry->action != UNKNOWN)
602 				result = -EINVAL;
603 
604 			entry->action = DONT_APPRAISE;
605 			break;
606 		case Opt_audit:
607 			ima_log_string(ab, "action", "audit");
608 
609 			if (entry->action != UNKNOWN)
610 				result = -EINVAL;
611 
612 			entry->action = AUDIT;
613 			break;
614 		case Opt_func:
615 			ima_log_string(ab, "func", args[0].from);
616 
617 			if (entry->func)
618 				result = -EINVAL;
619 
620 			if (strcmp(args[0].from, "FILE_CHECK") == 0)
621 				entry->func = FILE_CHECK;
622 			/* PATH_CHECK is for backwards compat */
623 			else if (strcmp(args[0].from, "PATH_CHECK") == 0)
624 				entry->func = FILE_CHECK;
625 			else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
626 				entry->func = MODULE_CHECK;
627 			else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
628 				entry->func = FIRMWARE_CHECK;
629 			else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
630 				|| (strcmp(args[0].from, "MMAP_CHECK") == 0))
631 				entry->func = MMAP_CHECK;
632 			else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
633 				entry->func = BPRM_CHECK;
634 			else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
635 				 0)
636 				entry->func = KEXEC_KERNEL_CHECK;
637 			else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
638 				 == 0)
639 				entry->func = KEXEC_INITRAMFS_CHECK;
640 			else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
641 				entry->func = POLICY_CHECK;
642 			else
643 				result = -EINVAL;
644 			if (!result)
645 				entry->flags |= IMA_FUNC;
646 			break;
647 		case Opt_mask:
648 			ima_log_string(ab, "mask", args[0].from);
649 
650 			if (entry->mask)
651 				result = -EINVAL;
652 
653 			from = args[0].from;
654 			if (*from == '^')
655 				from++;
656 
657 			if ((strcmp(from, "MAY_EXEC")) == 0)
658 				entry->mask = MAY_EXEC;
659 			else if (strcmp(from, "MAY_WRITE") == 0)
660 				entry->mask = MAY_WRITE;
661 			else if (strcmp(from, "MAY_READ") == 0)
662 				entry->mask = MAY_READ;
663 			else if (strcmp(from, "MAY_APPEND") == 0)
664 				entry->mask = MAY_APPEND;
665 			else
666 				result = -EINVAL;
667 			if (!result)
668 				entry->flags |= (*args[0].from == '^')
669 				     ? IMA_INMASK : IMA_MASK;
670 			break;
671 		case Opt_fsmagic:
672 			ima_log_string(ab, "fsmagic", args[0].from);
673 
674 			if (entry->fsmagic) {
675 				result = -EINVAL;
676 				break;
677 			}
678 
679 			result = kstrtoul(args[0].from, 16, &entry->fsmagic);
680 			if (!result)
681 				entry->flags |= IMA_FSMAGIC;
682 			break;
683 		case Opt_fsuuid:
684 			ima_log_string(ab, "fsuuid", args[0].from);
685 
686 			if (memchr_inv(entry->fsuuid, 0x00,
687 				       sizeof(entry->fsuuid))) {
688 				result = -EINVAL;
689 				break;
690 			}
691 
692 			result = blk_part_pack_uuid(args[0].from,
693 						    entry->fsuuid);
694 			if (!result)
695 				entry->flags |= IMA_FSUUID;
696 			break;
697 		case Opt_uid:
698 			ima_log_string(ab, "uid", args[0].from);
699 		case Opt_euid:
700 			if (token == Opt_euid)
701 				ima_log_string(ab, "euid", args[0].from);
702 
703 			if (uid_valid(entry->uid)) {
704 				result = -EINVAL;
705 				break;
706 			}
707 
708 			result = kstrtoul(args[0].from, 10, &lnum);
709 			if (!result) {
710 				entry->uid = make_kuid(current_user_ns(),
711 						       (uid_t) lnum);
712 				if (!uid_valid(entry->uid) ||
713 				    (uid_t)lnum != lnum)
714 					result = -EINVAL;
715 				else
716 					entry->flags |= (token == Opt_uid)
717 					    ? IMA_UID : IMA_EUID;
718 			}
719 			break;
720 		case Opt_fowner:
721 			ima_log_string(ab, "fowner", args[0].from);
722 
723 			if (uid_valid(entry->fowner)) {
724 				result = -EINVAL;
725 				break;
726 			}
727 
728 			result = kstrtoul(args[0].from, 10, &lnum);
729 			if (!result) {
730 				entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
731 				if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
732 					result = -EINVAL;
733 				else
734 					entry->flags |= IMA_FOWNER;
735 			}
736 			break;
737 		case Opt_obj_user:
738 			ima_log_string(ab, "obj_user", args[0].from);
739 			result = ima_lsm_rule_init(entry, args,
740 						   LSM_OBJ_USER,
741 						   AUDIT_OBJ_USER);
742 			break;
743 		case Opt_obj_role:
744 			ima_log_string(ab, "obj_role", args[0].from);
745 			result = ima_lsm_rule_init(entry, args,
746 						   LSM_OBJ_ROLE,
747 						   AUDIT_OBJ_ROLE);
748 			break;
749 		case Opt_obj_type:
750 			ima_log_string(ab, "obj_type", args[0].from);
751 			result = ima_lsm_rule_init(entry, args,
752 						   LSM_OBJ_TYPE,
753 						   AUDIT_OBJ_TYPE);
754 			break;
755 		case Opt_subj_user:
756 			ima_log_string(ab, "subj_user", args[0].from);
757 			result = ima_lsm_rule_init(entry, args,
758 						   LSM_SUBJ_USER,
759 						   AUDIT_SUBJ_USER);
760 			break;
761 		case Opt_subj_role:
762 			ima_log_string(ab, "subj_role", args[0].from);
763 			result = ima_lsm_rule_init(entry, args,
764 						   LSM_SUBJ_ROLE,
765 						   AUDIT_SUBJ_ROLE);
766 			break;
767 		case Opt_subj_type:
768 			ima_log_string(ab, "subj_type", args[0].from);
769 			result = ima_lsm_rule_init(entry, args,
770 						   LSM_SUBJ_TYPE,
771 						   AUDIT_SUBJ_TYPE);
772 			break;
773 		case Opt_appraise_type:
774 			if (entry->action != APPRAISE) {
775 				result = -EINVAL;
776 				break;
777 			}
778 
779 			ima_log_string(ab, "appraise_type", args[0].from);
780 			if ((strcmp(args[0].from, "imasig")) == 0)
781 				entry->flags |= IMA_DIGSIG_REQUIRED;
782 			else
783 				result = -EINVAL;
784 			break;
785 		case Opt_permit_directio:
786 			entry->flags |= IMA_PERMIT_DIRECTIO;
787 			break;
788 		case Opt_pcr:
789 			if (entry->action != MEASURE) {
790 				result = -EINVAL;
791 				break;
792 			}
793 			ima_log_string(ab, "pcr", args[0].from);
794 
795 			result = kstrtoint(args[0].from, 10, &entry->pcr);
796 			if (result || INVALID_PCR(entry->pcr))
797 				result = -EINVAL;
798 			else
799 				entry->flags |= IMA_PCR;
800 
801 			break;
802 		case Opt_err:
803 			ima_log_string(ab, "UNKNOWN", p);
804 			result = -EINVAL;
805 			break;
806 		}
807 	}
808 	if (!result && (entry->action == UNKNOWN))
809 		result = -EINVAL;
810 	else if (entry->func == MODULE_CHECK)
811 		temp_ima_appraise |= IMA_APPRAISE_MODULES;
812 	else if (entry->func == FIRMWARE_CHECK)
813 		temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
814 	else if (entry->func == POLICY_CHECK)
815 		temp_ima_appraise |= IMA_APPRAISE_POLICY;
816 	audit_log_format(ab, "res=%d", !result);
817 	audit_log_end(ab);
818 	return result;
819 }
820 
821 /**
822  * ima_parse_add_rule - add a rule to ima_policy_rules
823  * @rule - ima measurement policy rule
824  *
825  * Avoid locking by allowing just one writer at a time in ima_write_policy()
826  * Returns the length of the rule parsed, an error code on failure
827  */
828 ssize_t ima_parse_add_rule(char *rule)
829 {
830 	static const char op[] = "update_policy";
831 	char *p;
832 	struct ima_rule_entry *entry;
833 	ssize_t result, len;
834 	int audit_info = 0;
835 
836 	p = strsep(&rule, "\n");
837 	len = strlen(p) + 1;
838 	p += strspn(p, " \t");
839 
840 	if (*p == '#' || *p == '\0')
841 		return len;
842 
843 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
844 	if (!entry) {
845 		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
846 				    NULL, op, "-ENOMEM", -ENOMEM, audit_info);
847 		return -ENOMEM;
848 	}
849 
850 	INIT_LIST_HEAD(&entry->list);
851 
852 	result = ima_parse_rule(p, entry);
853 	if (result) {
854 		kfree(entry);
855 		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
856 				    NULL, op, "invalid-policy", result,
857 				    audit_info);
858 		return result;
859 	}
860 
861 	list_add_tail(&entry->list, &ima_temp_rules);
862 
863 	return len;
864 }
865 
866 /**
867  * ima_delete_rules() called to cleanup invalid in-flight policy.
868  * We don't need locking as we operate on the temp list, which is
869  * different from the active one.  There is also only one user of
870  * ima_delete_rules() at a time.
871  */
872 void ima_delete_rules(void)
873 {
874 	struct ima_rule_entry *entry, *tmp;
875 	int i;
876 
877 	temp_ima_appraise = 0;
878 	list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
879 		for (i = 0; i < MAX_LSM_RULES; i++)
880 			kfree(entry->lsm[i].args_p);
881 
882 		list_del(&entry->list);
883 		kfree(entry);
884 	}
885 }
886 
887 #ifdef	CONFIG_IMA_READ_POLICY
888 enum {
889 	mask_exec = 0, mask_write, mask_read, mask_append
890 };
891 
892 static char *mask_tokens[] = {
893 	"MAY_EXEC",
894 	"MAY_WRITE",
895 	"MAY_READ",
896 	"MAY_APPEND"
897 };
898 
899 enum {
900 	func_file = 0, func_mmap, func_bprm,
901 	func_module, func_firmware, func_post,
902 	func_kexec_kernel, func_kexec_initramfs,
903 	func_policy
904 };
905 
906 static char *func_tokens[] = {
907 	"FILE_CHECK",
908 	"MMAP_CHECK",
909 	"BPRM_CHECK",
910 	"MODULE_CHECK",
911 	"FIRMWARE_CHECK",
912 	"POST_SETATTR",
913 	"KEXEC_KERNEL_CHECK",
914 	"KEXEC_INITRAMFS_CHECK",
915 	"POLICY_CHECK"
916 };
917 
918 void *ima_policy_start(struct seq_file *m, loff_t *pos)
919 {
920 	loff_t l = *pos;
921 	struct ima_rule_entry *entry;
922 
923 	rcu_read_lock();
924 	list_for_each_entry_rcu(entry, ima_rules, list) {
925 		if (!l--) {
926 			rcu_read_unlock();
927 			return entry;
928 		}
929 	}
930 	rcu_read_unlock();
931 	return NULL;
932 }
933 
934 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
935 {
936 	struct ima_rule_entry *entry = v;
937 
938 	rcu_read_lock();
939 	entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
940 	rcu_read_unlock();
941 	(*pos)++;
942 
943 	return (&entry->list == ima_rules) ? NULL : entry;
944 }
945 
946 void ima_policy_stop(struct seq_file *m, void *v)
947 {
948 }
949 
950 #define pt(token)	policy_tokens[token + Opt_err].pattern
951 #define mt(token)	mask_tokens[token]
952 #define ft(token)	func_tokens[token]
953 
954 /*
955  * policy_func_show - display the ima_hooks policy rule
956  */
957 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
958 {
959 	char tbuf[64] = {0,};
960 
961 	switch (func) {
962 	case FILE_CHECK:
963 		seq_printf(m, pt(Opt_func), ft(func_file));
964 		break;
965 	case MMAP_CHECK:
966 		seq_printf(m, pt(Opt_func), ft(func_mmap));
967 		break;
968 	case BPRM_CHECK:
969 		seq_printf(m, pt(Opt_func), ft(func_bprm));
970 		break;
971 	case MODULE_CHECK:
972 		seq_printf(m, pt(Opt_func), ft(func_module));
973 		break;
974 	case FIRMWARE_CHECK:
975 		seq_printf(m, pt(Opt_func), ft(func_firmware));
976 		break;
977 	case POST_SETATTR:
978 		seq_printf(m, pt(Opt_func), ft(func_post));
979 		break;
980 	case KEXEC_KERNEL_CHECK:
981 		seq_printf(m, pt(Opt_func), ft(func_kexec_kernel));
982 		break;
983 	case KEXEC_INITRAMFS_CHECK:
984 		seq_printf(m, pt(Opt_func), ft(func_kexec_initramfs));
985 		break;
986 	case POLICY_CHECK:
987 		seq_printf(m, pt(Opt_func), ft(func_policy));
988 		break;
989 	default:
990 		snprintf(tbuf, sizeof(tbuf), "%d", func);
991 		seq_printf(m, pt(Opt_func), tbuf);
992 		break;
993 	}
994 	seq_puts(m, " ");
995 }
996 
997 int ima_policy_show(struct seq_file *m, void *v)
998 {
999 	struct ima_rule_entry *entry = v;
1000 	int i;
1001 	char tbuf[64] = {0,};
1002 
1003 	rcu_read_lock();
1004 
1005 	if (entry->action & MEASURE)
1006 		seq_puts(m, pt(Opt_measure));
1007 	if (entry->action & DONT_MEASURE)
1008 		seq_puts(m, pt(Opt_dont_measure));
1009 	if (entry->action & APPRAISE)
1010 		seq_puts(m, pt(Opt_appraise));
1011 	if (entry->action & DONT_APPRAISE)
1012 		seq_puts(m, pt(Opt_dont_appraise));
1013 	if (entry->action & AUDIT)
1014 		seq_puts(m, pt(Opt_audit));
1015 
1016 	seq_puts(m, " ");
1017 
1018 	if (entry->flags & IMA_FUNC)
1019 		policy_func_show(m, entry->func);
1020 
1021 	if (entry->flags & IMA_MASK) {
1022 		if (entry->mask & MAY_EXEC)
1023 			seq_printf(m, pt(Opt_mask), mt(mask_exec));
1024 		if (entry->mask & MAY_WRITE)
1025 			seq_printf(m, pt(Opt_mask), mt(mask_write));
1026 		if (entry->mask & MAY_READ)
1027 			seq_printf(m, pt(Opt_mask), mt(mask_read));
1028 		if (entry->mask & MAY_APPEND)
1029 			seq_printf(m, pt(Opt_mask), mt(mask_append));
1030 		seq_puts(m, " ");
1031 	}
1032 
1033 	if (entry->flags & IMA_FSMAGIC) {
1034 		snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1035 		seq_printf(m, pt(Opt_fsmagic), tbuf);
1036 		seq_puts(m, " ");
1037 	}
1038 
1039 	if (entry->flags & IMA_PCR) {
1040 		snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
1041 		seq_printf(m, pt(Opt_pcr), tbuf);
1042 		seq_puts(m, " ");
1043 	}
1044 
1045 	if (entry->flags & IMA_FSUUID) {
1046 		seq_printf(m, "fsuuid=%pU", entry->fsuuid);
1047 		seq_puts(m, " ");
1048 	}
1049 
1050 	if (entry->flags & IMA_UID) {
1051 		snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1052 		seq_printf(m, pt(Opt_uid), tbuf);
1053 		seq_puts(m, " ");
1054 	}
1055 
1056 	if (entry->flags & IMA_EUID) {
1057 		snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1058 		seq_printf(m, pt(Opt_euid), tbuf);
1059 		seq_puts(m, " ");
1060 	}
1061 
1062 	if (entry->flags & IMA_FOWNER) {
1063 		snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1064 		seq_printf(m, pt(Opt_fowner), tbuf);
1065 		seq_puts(m, " ");
1066 	}
1067 
1068 	for (i = 0; i < MAX_LSM_RULES; i++) {
1069 		if (entry->lsm[i].rule) {
1070 			switch (i) {
1071 			case LSM_OBJ_USER:
1072 				seq_printf(m, pt(Opt_obj_user),
1073 					   (char *)entry->lsm[i].args_p);
1074 				break;
1075 			case LSM_OBJ_ROLE:
1076 				seq_printf(m, pt(Opt_obj_role),
1077 					   (char *)entry->lsm[i].args_p);
1078 				break;
1079 			case LSM_OBJ_TYPE:
1080 				seq_printf(m, pt(Opt_obj_type),
1081 					   (char *)entry->lsm[i].args_p);
1082 				break;
1083 			case LSM_SUBJ_USER:
1084 				seq_printf(m, pt(Opt_subj_user),
1085 					   (char *)entry->lsm[i].args_p);
1086 				break;
1087 			case LSM_SUBJ_ROLE:
1088 				seq_printf(m, pt(Opt_subj_role),
1089 					   (char *)entry->lsm[i].args_p);
1090 				break;
1091 			case LSM_SUBJ_TYPE:
1092 				seq_printf(m, pt(Opt_subj_type),
1093 					   (char *)entry->lsm[i].args_p);
1094 				break;
1095 			}
1096 		}
1097 	}
1098 	if (entry->flags & IMA_DIGSIG_REQUIRED)
1099 		seq_puts(m, "appraise_type=imasig ");
1100 	if (entry->flags & IMA_PERMIT_DIRECTIO)
1101 		seq_puts(m, "permit_directio ");
1102 	rcu_read_unlock();
1103 	seq_puts(m, "\n");
1104 	return 0;
1105 }
1106 #endif	/* CONFIG_IMA_READ_POLICY */
1107