1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2013 Politecnico di Torino, Italy 4 * TORSEC group -- https://security.polito.it 5 * 6 * Author: Roberto Sassu <roberto.sassu@polito.it> 7 * 8 * File: ima_template_lib.c 9 * Library of supported template fields. 10 */ 11 12 #include "ima_template_lib.h" 13 #include <linux/xattr.h> 14 #include <linux/evm.h> 15 16 static bool ima_template_hash_algo_allowed(u8 algo) 17 { 18 if (algo == HASH_ALGO_SHA1 || algo == HASH_ALGO_MD5) 19 return true; 20 21 return false; 22 } 23 24 enum data_formats { 25 DATA_FMT_DIGEST = 0, 26 DATA_FMT_DIGEST_WITH_ALGO, 27 DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO, 28 DATA_FMT_STRING, 29 DATA_FMT_HEX, 30 DATA_FMT_UINT 31 }; 32 33 enum digest_type { 34 DIGEST_TYPE_IMA, 35 DIGEST_TYPE_VERITY, 36 DIGEST_TYPE__LAST 37 }; 38 39 #define DIGEST_TYPE_NAME_LEN_MAX 7 /* including NUL */ 40 static const char * const digest_type_name[DIGEST_TYPE__LAST] = { 41 [DIGEST_TYPE_IMA] = "ima", 42 [DIGEST_TYPE_VERITY] = "verity" 43 }; 44 45 static int ima_write_template_field_data(const void *data, const u32 datalen, 46 enum data_formats datafmt, 47 struct ima_field_data *field_data) 48 { 49 u8 *buf, *buf_ptr; 50 u32 buflen = datalen; 51 52 if (datafmt == DATA_FMT_STRING) 53 buflen = datalen + 1; 54 55 buf = kzalloc(buflen, GFP_KERNEL); 56 if (!buf) 57 return -ENOMEM; 58 59 memcpy(buf, data, datalen); 60 61 /* 62 * Replace all space characters with underscore for event names and 63 * strings. This avoid that, during the parsing of a measurements list, 64 * filenames with spaces or that end with the suffix ' (deleted)' are 65 * split into multiple template fields (the space is the delimitator 66 * character for measurements lists in ASCII format). 67 */ 68 if (datafmt == DATA_FMT_STRING) { 69 for (buf_ptr = buf; buf_ptr - buf < datalen; buf_ptr++) 70 if (*buf_ptr == ' ') 71 *buf_ptr = '_'; 72 } 73 74 field_data->data = buf; 75 field_data->len = buflen; 76 return 0; 77 } 78 79 static void ima_show_template_data_ascii(struct seq_file *m, 80 enum ima_show_type show, 81 enum data_formats datafmt, 82 struct ima_field_data *field_data) 83 { 84 u8 *buf_ptr = field_data->data; 85 u32 buflen = field_data->len; 86 87 switch (datafmt) { 88 case DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO: 89 case DATA_FMT_DIGEST_WITH_ALGO: 90 buf_ptr = strrchr(field_data->data, ':'); 91 if (buf_ptr != field_data->data) 92 seq_printf(m, "%s", field_data->data); 93 94 /* skip ':' and '\0' */ 95 buf_ptr += 2; 96 buflen -= buf_ptr - field_data->data; 97 fallthrough; 98 case DATA_FMT_DIGEST: 99 case DATA_FMT_HEX: 100 if (!buflen) 101 break; 102 ima_print_digest(m, buf_ptr, buflen); 103 break; 104 case DATA_FMT_STRING: 105 seq_printf(m, "%s", buf_ptr); 106 break; 107 case DATA_FMT_UINT: 108 switch (field_data->len) { 109 case sizeof(u8): 110 seq_printf(m, "%u", *(u8 *)buf_ptr); 111 break; 112 case sizeof(u16): 113 if (ima_canonical_fmt) 114 seq_printf(m, "%u", 115 le16_to_cpu(*(__le16 *)buf_ptr)); 116 else 117 seq_printf(m, "%u", *(u16 *)buf_ptr); 118 break; 119 case sizeof(u32): 120 if (ima_canonical_fmt) 121 seq_printf(m, "%u", 122 le32_to_cpu(*(__le32 *)buf_ptr)); 123 else 124 seq_printf(m, "%u", *(u32 *)buf_ptr); 125 break; 126 case sizeof(u64): 127 if (ima_canonical_fmt) 128 seq_printf(m, "%llu", 129 le64_to_cpu(*(__le64 *)buf_ptr)); 130 else 131 seq_printf(m, "%llu", *(u64 *)buf_ptr); 132 break; 133 default: 134 break; 135 } 136 break; 137 default: 138 break; 139 } 140 } 141 142 static void ima_show_template_data_binary(struct seq_file *m, 143 enum ima_show_type show, 144 enum data_formats datafmt, 145 struct ima_field_data *field_data) 146 { 147 u32 len = (show == IMA_SHOW_BINARY_OLD_STRING_FMT) ? 148 strlen(field_data->data) : field_data->len; 149 150 if (show != IMA_SHOW_BINARY_NO_FIELD_LEN) { 151 u32 field_len = !ima_canonical_fmt ? 152 len : (__force u32)cpu_to_le32(len); 153 154 ima_putc(m, &field_len, sizeof(field_len)); 155 } 156 157 if (!len) 158 return; 159 160 ima_putc(m, field_data->data, len); 161 } 162 163 static void ima_show_template_field_data(struct seq_file *m, 164 enum ima_show_type show, 165 enum data_formats datafmt, 166 struct ima_field_data *field_data) 167 { 168 switch (show) { 169 case IMA_SHOW_ASCII: 170 ima_show_template_data_ascii(m, show, datafmt, field_data); 171 break; 172 case IMA_SHOW_BINARY: 173 case IMA_SHOW_BINARY_NO_FIELD_LEN: 174 case IMA_SHOW_BINARY_OLD_STRING_FMT: 175 ima_show_template_data_binary(m, show, datafmt, field_data); 176 break; 177 default: 178 break; 179 } 180 } 181 182 void ima_show_template_digest(struct seq_file *m, enum ima_show_type show, 183 struct ima_field_data *field_data) 184 { 185 ima_show_template_field_data(m, show, DATA_FMT_DIGEST, field_data); 186 } 187 188 void ima_show_template_digest_ng(struct seq_file *m, enum ima_show_type show, 189 struct ima_field_data *field_data) 190 { 191 ima_show_template_field_data(m, show, DATA_FMT_DIGEST_WITH_ALGO, 192 field_data); 193 } 194 195 void ima_show_template_digest_ngv2(struct seq_file *m, enum ima_show_type show, 196 struct ima_field_data *field_data) 197 { 198 ima_show_template_field_data(m, show, 199 DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO, 200 field_data); 201 } 202 203 void ima_show_template_string(struct seq_file *m, enum ima_show_type show, 204 struct ima_field_data *field_data) 205 { 206 ima_show_template_field_data(m, show, DATA_FMT_STRING, field_data); 207 } 208 209 void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, 210 struct ima_field_data *field_data) 211 { 212 ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); 213 } 214 215 void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, 216 struct ima_field_data *field_data) 217 { 218 ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); 219 } 220 221 void ima_show_template_uint(struct seq_file *m, enum ima_show_type show, 222 struct ima_field_data *field_data) 223 { 224 ima_show_template_field_data(m, show, DATA_FMT_UINT, field_data); 225 } 226 227 /** 228 * ima_parse_buf() - Parses lengths and data from an input buffer 229 * @bufstartp: Buffer start address. 230 * @bufendp: Buffer end address. 231 * @bufcurp: Pointer to remaining (non-parsed) data. 232 * @maxfields: Length of fields array. 233 * @fields: Array containing lengths and pointers of parsed data. 234 * @curfields: Number of array items containing parsed data. 235 * @len_mask: Bitmap (if bit is set, data length should not be parsed). 236 * @enforce_mask: Check if curfields == maxfields and/or bufcurp == bufendp. 237 * @bufname: String identifier of the input buffer. 238 * 239 * Return: 0 on success, -EINVAL on error. 240 */ 241 int ima_parse_buf(void *bufstartp, void *bufendp, void **bufcurp, 242 int maxfields, struct ima_field_data *fields, int *curfields, 243 unsigned long *len_mask, int enforce_mask, char *bufname) 244 { 245 void *bufp = bufstartp; 246 int i; 247 248 for (i = 0; i < maxfields; i++) { 249 if (len_mask == NULL || !test_bit(i, len_mask)) { 250 if (bufp > (bufendp - sizeof(u32))) 251 break; 252 253 if (ima_canonical_fmt) 254 fields[i].len = le32_to_cpu(*(__le32 *)bufp); 255 else 256 fields[i].len = *(u32 *)bufp; 257 258 bufp += sizeof(u32); 259 } 260 261 if (bufp > (bufendp - fields[i].len)) 262 break; 263 264 fields[i].data = bufp; 265 bufp += fields[i].len; 266 } 267 268 if ((enforce_mask & ENFORCE_FIELDS) && i != maxfields) { 269 pr_err("%s: nr of fields mismatch: expected: %d, current: %d\n", 270 bufname, maxfields, i); 271 return -EINVAL; 272 } 273 274 if ((enforce_mask & ENFORCE_BUFEND) && bufp != bufendp) { 275 pr_err("%s: buf end mismatch: expected: %p, current: %p\n", 276 bufname, bufendp, bufp); 277 return -EINVAL; 278 } 279 280 if (curfields) 281 *curfields = i; 282 283 if (bufcurp) 284 *bufcurp = bufp; 285 286 return 0; 287 } 288 289 static int ima_eventdigest_init_common(const u8 *digest, u32 digestsize, 290 u8 digest_type, u8 hash_algo, 291 struct ima_field_data *field_data) 292 { 293 /* 294 * digest formats: 295 * - DATA_FMT_DIGEST: digest 296 * - DATA_FMT_DIGEST_WITH_ALGO: <hash algo> + ':' + '\0' + digest, 297 * - DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO: 298 * <digest type> + ':' + <hash algo> + ':' + '\0' + digest, 299 * 300 * where 'DATA_FMT_DIGEST' is the original digest format ('d') 301 * with a hash size limitation of 20 bytes, 302 * where <digest type> is either "ima" or "verity", 303 * where <hash algo> is the hash_algo_name[] string. 304 */ 305 u8 buffer[DIGEST_TYPE_NAME_LEN_MAX + CRYPTO_MAX_ALG_NAME + 2 + 306 IMA_MAX_DIGEST_SIZE] = { 0 }; 307 enum data_formats fmt = DATA_FMT_DIGEST; 308 u32 offset = 0; 309 310 if (digest_type < DIGEST_TYPE__LAST && hash_algo < HASH_ALGO__LAST) { 311 fmt = DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO; 312 offset += 1 + sprintf(buffer, "%s:%s:", 313 digest_type_name[digest_type], 314 hash_algo_name[hash_algo]); 315 } else if (hash_algo < HASH_ALGO__LAST) { 316 fmt = DATA_FMT_DIGEST_WITH_ALGO; 317 offset += 1 + sprintf(buffer, "%s:", 318 hash_algo_name[hash_algo]); 319 } 320 321 if (digest) { 322 memcpy(buffer + offset, digest, digestsize); 323 } else { 324 /* 325 * If digest is NULL, the event being recorded is a violation. 326 * Make room for the digest by increasing the offset by the 327 * hash algorithm digest size. If the hash algorithm is not 328 * specified increase the offset by IMA_DIGEST_SIZE which 329 * fits SHA1 or MD5 330 */ 331 if (hash_algo < HASH_ALGO__LAST) 332 offset += hash_digest_size[hash_algo]; 333 else 334 offset += IMA_DIGEST_SIZE; 335 } 336 337 return ima_write_template_field_data(buffer, offset + digestsize, 338 fmt, field_data); 339 } 340 341 /* 342 * This function writes the digest of an event (with size limit). 343 */ 344 int ima_eventdigest_init(struct ima_event_data *event_data, 345 struct ima_field_data *field_data) 346 { 347 struct ima_max_digest_data hash; 348 u8 *cur_digest = NULL; 349 u32 cur_digestsize = 0; 350 struct inode *inode; 351 int result; 352 353 memset(&hash, 0, sizeof(hash)); 354 355 if (event_data->violation) /* recording a violation. */ 356 goto out; 357 358 if (ima_template_hash_algo_allowed(event_data->iint->ima_hash->algo)) { 359 cur_digest = event_data->iint->ima_hash->digest; 360 cur_digestsize = event_data->iint->ima_hash->length; 361 goto out; 362 } 363 364 if ((const char *)event_data->filename == boot_aggregate_name) { 365 if (ima_tpm_chip) { 366 hash.hdr.algo = HASH_ALGO_SHA1; 367 result = ima_calc_boot_aggregate(&hash.hdr); 368 369 /* algo can change depending on available PCR banks */ 370 if (!result && hash.hdr.algo != HASH_ALGO_SHA1) 371 result = -EINVAL; 372 373 if (result < 0) 374 memset(&hash, 0, sizeof(hash)); 375 } 376 377 cur_digest = hash.hdr.digest; 378 cur_digestsize = hash_digest_size[HASH_ALGO_SHA1]; 379 goto out; 380 } 381 382 if (!event_data->file) /* missing info to re-calculate the digest */ 383 return -EINVAL; 384 385 inode = file_inode(event_data->file); 386 hash.hdr.algo = ima_template_hash_algo_allowed(ima_hash_algo) ? 387 ima_hash_algo : HASH_ALGO_SHA1; 388 result = ima_calc_file_hash(event_data->file, &hash.hdr); 389 if (result) { 390 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, 391 event_data->filename, "collect_data", 392 "failed", result, 0); 393 return result; 394 } 395 cur_digest = hash.hdr.digest; 396 cur_digestsize = hash.hdr.length; 397 out: 398 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 399 DIGEST_TYPE__LAST, HASH_ALGO__LAST, 400 field_data); 401 } 402 403 /* 404 * This function writes the digest of an event (without size limit). 405 */ 406 int ima_eventdigest_ng_init(struct ima_event_data *event_data, 407 struct ima_field_data *field_data) 408 { 409 u8 *cur_digest = NULL, hash_algo = ima_hash_algo; 410 u32 cur_digestsize = 0; 411 412 if (event_data->violation) /* recording a violation. */ 413 goto out; 414 415 cur_digest = event_data->iint->ima_hash->digest; 416 cur_digestsize = event_data->iint->ima_hash->length; 417 418 hash_algo = event_data->iint->ima_hash->algo; 419 out: 420 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 421 DIGEST_TYPE__LAST, hash_algo, 422 field_data); 423 } 424 425 /* 426 * This function writes the digest of an event (without size limit), 427 * prefixed with both the digest type and hash algorithm. 428 */ 429 int ima_eventdigest_ngv2_init(struct ima_event_data *event_data, 430 struct ima_field_data *field_data) 431 { 432 u8 *cur_digest = NULL, hash_algo = ima_hash_algo; 433 u32 cur_digestsize = 0; 434 u8 digest_type = DIGEST_TYPE_IMA; 435 436 if (event_data->violation) /* recording a violation. */ 437 goto out; 438 439 cur_digest = event_data->iint->ima_hash->digest; 440 cur_digestsize = event_data->iint->ima_hash->length; 441 442 hash_algo = event_data->iint->ima_hash->algo; 443 if (event_data->iint->flags & IMA_VERITY_REQUIRED) 444 digest_type = DIGEST_TYPE_VERITY; 445 out: 446 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 447 digest_type, hash_algo, 448 field_data); 449 } 450 451 /* 452 * This function writes the digest of the file which is expected to match the 453 * digest contained in the file's appended signature. 454 */ 455 int ima_eventdigest_modsig_init(struct ima_event_data *event_data, 456 struct ima_field_data *field_data) 457 { 458 enum hash_algo hash_algo; 459 const u8 *cur_digest; 460 u32 cur_digestsize; 461 462 if (!event_data->modsig) 463 return 0; 464 465 if (event_data->violation) { 466 /* Recording a violation. */ 467 hash_algo = HASH_ALGO_SHA1; 468 cur_digest = NULL; 469 cur_digestsize = 0; 470 } else { 471 int rc; 472 473 rc = ima_get_modsig_digest(event_data->modsig, &hash_algo, 474 &cur_digest, &cur_digestsize); 475 if (rc) 476 return rc; 477 else if (hash_algo == HASH_ALGO__LAST || cur_digestsize == 0) 478 /* There was some error collecting the digest. */ 479 return -EINVAL; 480 } 481 482 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 483 DIGEST_TYPE__LAST, hash_algo, 484 field_data); 485 } 486 487 static int ima_eventname_init_common(struct ima_event_data *event_data, 488 struct ima_field_data *field_data, 489 bool size_limit) 490 { 491 const char *cur_filename = NULL; 492 struct name_snapshot filename; 493 u32 cur_filename_len = 0; 494 bool snapshot = false; 495 int ret; 496 497 BUG_ON(event_data->filename == NULL && event_data->file == NULL); 498 499 if (event_data->filename) { 500 cur_filename = event_data->filename; 501 cur_filename_len = strlen(event_data->filename); 502 503 if (!size_limit || cur_filename_len <= IMA_EVENT_NAME_LEN_MAX) 504 goto out; 505 } 506 507 if (event_data->file) { 508 take_dentry_name_snapshot(&filename, 509 event_data->file->f_path.dentry); 510 snapshot = true; 511 cur_filename = filename.name.name; 512 cur_filename_len = strlen(cur_filename); 513 } else 514 /* 515 * Truncate filename if the latter is too long and 516 * the file descriptor is not available. 517 */ 518 cur_filename_len = IMA_EVENT_NAME_LEN_MAX; 519 out: 520 ret = ima_write_template_field_data(cur_filename, cur_filename_len, 521 DATA_FMT_STRING, field_data); 522 523 if (snapshot) 524 release_dentry_name_snapshot(&filename); 525 526 return ret; 527 } 528 529 /* 530 * This function writes the name of an event (with size limit). 531 */ 532 int ima_eventname_init(struct ima_event_data *event_data, 533 struct ima_field_data *field_data) 534 { 535 return ima_eventname_init_common(event_data, field_data, true); 536 } 537 538 /* 539 * This function writes the name of an event (without size limit). 540 */ 541 int ima_eventname_ng_init(struct ima_event_data *event_data, 542 struct ima_field_data *field_data) 543 { 544 return ima_eventname_init_common(event_data, field_data, false); 545 } 546 547 /* 548 * ima_eventsig_init - include the file signature as part of the template data 549 */ 550 int ima_eventsig_init(struct ima_event_data *event_data, 551 struct ima_field_data *field_data) 552 { 553 struct evm_ima_xattr_data *xattr_value = event_data->xattr_value; 554 555 if (!xattr_value || 556 (xattr_value->type != EVM_IMA_XATTR_DIGSIG && 557 xattr_value->type != IMA_VERITY_DIGSIG)) 558 return ima_eventevmsig_init(event_data, field_data); 559 560 return ima_write_template_field_data(xattr_value, event_data->xattr_len, 561 DATA_FMT_HEX, field_data); 562 } 563 564 /* 565 * ima_eventbuf_init - include the buffer(kexec-cmldine) as part of the 566 * template data. 567 */ 568 int ima_eventbuf_init(struct ima_event_data *event_data, 569 struct ima_field_data *field_data) 570 { 571 if ((!event_data->buf) || (event_data->buf_len == 0)) 572 return 0; 573 574 return ima_write_template_field_data(event_data->buf, 575 event_data->buf_len, DATA_FMT_HEX, 576 field_data); 577 } 578 579 /* 580 * ima_eventmodsig_init - include the appended file signature as part of the 581 * template data 582 */ 583 int ima_eventmodsig_init(struct ima_event_data *event_data, 584 struct ima_field_data *field_data) 585 { 586 const void *data; 587 u32 data_len; 588 int rc; 589 590 if (!event_data->modsig) 591 return 0; 592 593 /* 594 * modsig is a runtime structure containing pointers. Get its raw data 595 * instead. 596 */ 597 rc = ima_get_raw_modsig(event_data->modsig, &data, &data_len); 598 if (rc) 599 return rc; 600 601 return ima_write_template_field_data(data, data_len, DATA_FMT_HEX, 602 field_data); 603 } 604 605 /* 606 * ima_eventevmsig_init - include the EVM portable signature as part of the 607 * template data 608 */ 609 int ima_eventevmsig_init(struct ima_event_data *event_data, 610 struct ima_field_data *field_data) 611 { 612 struct evm_ima_xattr_data *xattr_data = NULL; 613 int rc = 0; 614 615 if (!event_data->file) 616 return 0; 617 618 rc = vfs_getxattr_alloc(&nop_mnt_idmap, file_dentry(event_data->file), 619 XATTR_NAME_EVM, (char **)&xattr_data, 0, 620 GFP_NOFS); 621 if (rc <= 0 || xattr_data->type != EVM_XATTR_PORTABLE_DIGSIG) { 622 rc = 0; 623 goto out; 624 } 625 626 rc = ima_write_template_field_data((char *)xattr_data, rc, DATA_FMT_HEX, 627 field_data); 628 629 out: 630 kfree(xattr_data); 631 return rc; 632 } 633 634 static int ima_eventinodedac_init_common(struct ima_event_data *event_data, 635 struct ima_field_data *field_data, 636 bool get_uid) 637 { 638 unsigned int id; 639 640 if (!event_data->file) 641 return 0; 642 643 if (get_uid) 644 id = i_uid_read(file_inode(event_data->file)); 645 else 646 id = i_gid_read(file_inode(event_data->file)); 647 648 if (ima_canonical_fmt) { 649 if (sizeof(id) == sizeof(u16)) 650 id = (__force u16)cpu_to_le16(id); 651 else 652 id = (__force u32)cpu_to_le32(id); 653 } 654 655 return ima_write_template_field_data((void *)&id, sizeof(id), 656 DATA_FMT_UINT, field_data); 657 } 658 659 /* 660 * ima_eventinodeuid_init - include the inode UID as part of the template 661 * data 662 */ 663 int ima_eventinodeuid_init(struct ima_event_data *event_data, 664 struct ima_field_data *field_data) 665 { 666 return ima_eventinodedac_init_common(event_data, field_data, true); 667 } 668 669 /* 670 * ima_eventinodegid_init - include the inode GID as part of the template 671 * data 672 */ 673 int ima_eventinodegid_init(struct ima_event_data *event_data, 674 struct ima_field_data *field_data) 675 { 676 return ima_eventinodedac_init_common(event_data, field_data, false); 677 } 678 679 /* 680 * ima_eventinodemode_init - include the inode mode as part of the template 681 * data 682 */ 683 int ima_eventinodemode_init(struct ima_event_data *event_data, 684 struct ima_field_data *field_data) 685 { 686 struct inode *inode; 687 u16 mode; 688 689 if (!event_data->file) 690 return 0; 691 692 inode = file_inode(event_data->file); 693 mode = inode->i_mode; 694 if (ima_canonical_fmt) 695 mode = (__force u16)cpu_to_le16(mode); 696 697 return ima_write_template_field_data((char *)&mode, sizeof(mode), 698 DATA_FMT_UINT, field_data); 699 } 700 701 static int ima_eventinodexattrs_init_common(struct ima_event_data *event_data, 702 struct ima_field_data *field_data, 703 char type) 704 { 705 u8 *buffer = NULL; 706 int rc; 707 708 if (!event_data->file) 709 return 0; 710 711 rc = evm_read_protected_xattrs(file_dentry(event_data->file), NULL, 0, 712 type, ima_canonical_fmt); 713 if (rc < 0) 714 return 0; 715 716 buffer = kmalloc(rc, GFP_KERNEL); 717 if (!buffer) 718 return 0; 719 720 rc = evm_read_protected_xattrs(file_dentry(event_data->file), buffer, 721 rc, type, ima_canonical_fmt); 722 if (rc < 0) { 723 rc = 0; 724 goto out; 725 } 726 727 rc = ima_write_template_field_data((char *)buffer, rc, DATA_FMT_HEX, 728 field_data); 729 out: 730 kfree(buffer); 731 return rc; 732 } 733 734 /* 735 * ima_eventinodexattrnames_init - include a list of xattr names as part of the 736 * template data 737 */ 738 int ima_eventinodexattrnames_init(struct ima_event_data *event_data, 739 struct ima_field_data *field_data) 740 { 741 return ima_eventinodexattrs_init_common(event_data, field_data, 'n'); 742 } 743 744 /* 745 * ima_eventinodexattrlengths_init - include a list of xattr lengths as part of 746 * the template data 747 */ 748 int ima_eventinodexattrlengths_init(struct ima_event_data *event_data, 749 struct ima_field_data *field_data) 750 { 751 return ima_eventinodexattrs_init_common(event_data, field_data, 'l'); 752 } 753 754 /* 755 * ima_eventinodexattrvalues_init - include a list of xattr values as part of 756 * the template data 757 */ 758 int ima_eventinodexattrvalues_init(struct ima_event_data *event_data, 759 struct ima_field_data *field_data) 760 { 761 return ima_eventinodexattrs_init_common(event_data, field_data, 'v'); 762 } 763