security/integrity/ima/ima_policy.c

   1 /*
   2  * Copyright (C) 2008 IBM Corporation
   3  * Author: Mimi Zohar <zohar@us.ibm.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, version 2 of the License.
   8  *
   9  * ima_policy.c
  10  *      - initialize default measure policy rules
  11  *
  12  */
  13 #include <linux/module.h>
  14 #include <linux/list.h>
  15 #include <linux/fs.h>
  16 #include <linux/security.h>
  17 #include <linux/magic.h>
  18 #include <linux/parser.h>
  19 #include <linux/slab.h>
  20 #include <linux/rculist.h>
  21 #include <linux/genhd.h>
  22 #include <linux/seq_file.h>
  23
  24 #include "ima.h"
  25
  26 /* flags definitions */
  27 #define IMA_FUNC        0x0001
  28 #define IMA_MASK        0x0002
  29 #define IMA_FSMAGIC     0x0004
  30 #define IMA_UID         0x0008
  31 #define IMA_FOWNER      0x0010
  32 #define IMA_FSUUID      0x0020
  33 #define IMA_INMASK      0x0040
  34 #define IMA_EUID        0x0080
  35 #define IMA_PCR         0x0100
  36
  37 #define UNKNOWN         0
  38 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  39 #define DONT_MEASURE    0x0002
  40 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  41 #define DONT_APPRAISE   0x0008
  42 #define AUDIT           0x0040
  43 #define HASH            0x0100
  44 #define DONT_HASH       0x0200
  45
  46 #define INVALID_PCR(a) (((a) < 0) || \
  47         (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
  48
  49 int ima_policy_flag;
  50 static int temp_ima_appraise;
  51
  52 #define MAX_LSM_RULES 6
  53 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  54         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  55 };
  56
  57 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  58
  59 struct ima_rule_entry {
  60         struct list_head list;
  61         int action;
  62         unsigned int flags;
  63         enum ima_hooks func;
  64         int mask;
  65         unsigned long fsmagic;
  66         uuid_t fsuuid;
  67         kuid_t uid;
  68         kuid_t fowner;
  69         bool (*uid_op)(kuid_t, kuid_t);    /* Handlers for operators       */
  70         bool (*fowner_op)(kuid_t, kuid_t); /* uid_eq(), uid_gt(), uid_lt() */
  71         int pcr;
  72         struct {
  73                 void *rule;     /* LSM file metadata specific */
  74                 void *args_p;   /* audit value */
  75                 int type;       /* audit type */
  76         } lsm[MAX_LSM_RULES];
  77 };
  78
  79 /*
  80  * Without LSM specific knowledge, the default policy can only be
  81  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  82  */
  83
  84 /*
  85  * The minimum rule set to allow for full TCB coverage.  Measures all files
  86  * opened or mmap for exec and everything read by root.  Dangerous because
  87  * normal users can easily run the machine out of memory simply building
  88  * and running executables.
  89  */
  90 static struct ima_rule_entry dont_measure_rules[] __ro_after_init = {
  91         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  92         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
  93         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
  94         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
  95         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  96         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
  97         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
  98         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
  99         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
 100          .flags = IMA_FSMAGIC},
 101         {.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC,
 102          .flags = IMA_FSMAGIC},
 103         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
 104 };
 105
 106 static struct ima_rule_entry original_measurement_rules[] __ro_after_init = {
 107         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 108          .flags = IMA_FUNC | IMA_MASK},
 109         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 110          .flags = IMA_FUNC | IMA_MASK},
 111         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 112          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 113          .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 114         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 115         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 116 };
 117
 118 static struct ima_rule_entry default_measurement_rules[] __ro_after_init = {
 119         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 120          .flags = IMA_FUNC | IMA_MASK},
 121         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 122          .flags = IMA_FUNC | IMA_MASK},
 123         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 124          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 125          .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 126         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 127          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 128          .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 129         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 130         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 131         {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
 132 };
 133
 134 static struct ima_rule_entry default_appraise_rules[] __ro_after_init = {
 135         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 136         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 137         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 138         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 139         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 140         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 141         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 142         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 143         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 144         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 145         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 146         {.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 147 #ifdef CONFIG_IMA_WRITE_POLICY
 148         {.action = APPRAISE, .func = POLICY_CHECK,
 149         .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 150 #endif
 151 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 152         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
 153          .flags = IMA_FOWNER},
 154 #else
 155         /* force signature */
 156         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
 157          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 158 #endif
 159 };
 160
 161 static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
 162         {.action = APPRAISE, .func = MODULE_CHECK,
 163          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 164         {.action = APPRAISE, .func = FIRMWARE_CHECK,
 165          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 166         {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
 167          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 168         {.action = APPRAISE, .func = POLICY_CHECK,
 169          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 170 };
 171
 172 static LIST_HEAD(ima_default_rules);
 173 static LIST_HEAD(ima_policy_rules);
 174 static LIST_HEAD(ima_temp_rules);
 175 static struct list_head *ima_rules;
 176
 177 static int ima_policy __initdata;
 178
 179 static int __init default_measure_policy_setup(char *str)
 180 {
 181         if (ima_policy)
 182                 return 1;
 183
 184         ima_policy = ORIGINAL_TCB;
 185         return 1;
 186 }
 187 __setup("ima_tcb", default_measure_policy_setup);
 188
 189 static bool ima_use_appraise_tcb __initdata;
 190 static bool ima_use_secure_boot __initdata;
 191 static int __init policy_setup(char *str)
 192 {
 193         char *p;
 194
 195         while ((p = strsep(&str, " |\n")) != NULL) {
 196                 if (*p == ' ')
 197                         continue;
 198                 if ((strcmp(p, "tcb") == 0) && !ima_policy)
 199                         ima_policy = DEFAULT_TCB;
 200                 else if (strcmp(p, "appraise_tcb") == 0)
 201                         ima_use_appraise_tcb = true;
 202                 else if (strcmp(p, "secure_boot") == 0)
 203                         ima_use_secure_boot = true;
 204         }
 205
 206         return 1;
 207 }
 208 __setup("ima_policy=", policy_setup);
 209
 210 static int __init default_appraise_policy_setup(char *str)
 211 {
 212         ima_use_appraise_tcb = true;
 213         return 1;
 214 }
 215 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 216
 217 /*
 218  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 219  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 220  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
 221  * they don't.
 222  */
 223 static void ima_lsm_update_rules(void)
 224 {
 225         struct ima_rule_entry *entry;
 226         int result;
 227         int i;
 228
 229         list_for_each_entry(entry, &ima_policy_rules, list) {
 230                 for (i = 0; i < MAX_LSM_RULES; i++) {
 231                         if (!entry->lsm[i].rule)
 232                                 continue;
 233                         result = security_filter_rule_init(entry->lsm[i].type,
 234                                                            Audit_equal,
 235                                                            entry->lsm[i].args_p,
 236                                                            &entry->lsm[i].rule);
 237                         BUG_ON(!entry->lsm[i].rule);
 238                 }
 239         }
 240 }
 241
 242 /**
 243  * ima_match_rules - determine whether an inode matches the measure rule.
 244  * @rule: a pointer to a rule
 245  * @inode: a pointer to an inode
 246  * @func: LIM hook identifier
 247  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 248  *
 249  * Returns true on rule match, false on failure.
 250  */
 251 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 252                             enum ima_hooks func, int mask)
 253 {
 254         struct task_struct *tsk = current;
 255         const struct cred *cred = current_cred();
 256         int i;
 257
 258         if ((rule->flags & IMA_FUNC) &&
 259             (rule->func != func && func != POST_SETATTR))
 260                 return false;
 261         if ((rule->flags & IMA_MASK) &&
 262             (rule->mask != mask && func != POST_SETATTR))
 263                 return false;
 264         if ((rule->flags & IMA_INMASK) &&
 265             (!(rule->mask & mask) && func != POST_SETATTR))
 266                 return false;
 267         if ((rule->flags & IMA_FSMAGIC)
 268             && rule->fsmagic != inode->i_sb->s_magic)
 269                 return false;
 270         if ((rule->flags & IMA_FSUUID) &&
 271             !uuid_equal(&rule->fsuuid, &inode->i_sb->s_uuid))
 272                 return false;
 273         if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
 274                 return false;
 275         if (rule->flags & IMA_EUID) {
 276                 if (has_capability_noaudit(current, CAP_SETUID)) {
 277                         if (!rule->uid_op(cred->euid, rule->uid)
 278                             && !rule->uid_op(cred->suid, rule->uid)
 279                             && !rule->uid_op(cred->uid, rule->uid))
 280                                 return false;
 281                 } else if (!rule->uid_op(cred->euid, rule->uid))
 282                         return false;
 283         }
 284
 285         if ((rule->flags & IMA_FOWNER) &&
 286             !rule->fowner_op(inode->i_uid, rule->fowner))
 287                 return false;
 288         for (i = 0; i < MAX_LSM_RULES; i++) {
 289                 int rc = 0;
 290                 u32 osid, sid;
 291                 int retried = 0;
 292
 293                 if (!rule->lsm[i].rule)
 294                         continue;
 295 retry:
 296                 switch (i) {
 297                 case LSM_OBJ_USER:
 298                 case LSM_OBJ_ROLE:
 299                 case LSM_OBJ_TYPE:
 300                         security_inode_getsecid(inode, &osid);
 301                         rc = security_filter_rule_match(osid,
 302                                                         rule->lsm[i].type,
 303                                                         Audit_equal,
 304                                                         rule->lsm[i].rule,
 305                                                         NULL);
 306                         break;
 307                 case LSM_SUBJ_USER:
 308                 case LSM_SUBJ_ROLE:
 309                 case LSM_SUBJ_TYPE:
 310                         security_task_getsecid(tsk, &sid);
 311                         rc = security_filter_rule_match(sid,
 312                                                         rule->lsm[i].type,
 313                                                         Audit_equal,
 314                                                         rule->lsm[i].rule,
 315                                                         NULL);
 316                 default:
 317                         break;
 318                 }
 319                 if ((rc < 0) && (!retried)) {
 320                         retried = 1;
 321                         ima_lsm_update_rules();
 322                         goto retry;
 323                 }
 324                 if (!rc)
 325                         return false;
 326         }
 327         return true;
 328 }
 329
 330 /*
 331  * In addition to knowing that we need to appraise the file in general,
 332  * we need to differentiate between calling hooks, for hook specific rules.
 333  */
 334 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
 335 {
 336         if (!(rule->flags & IMA_FUNC))
 337                 return IMA_FILE_APPRAISE;
 338
 339         switch (func) {
 340         case MMAP_CHECK:
 341                 return IMA_MMAP_APPRAISE;
 342         case BPRM_CHECK:
 343                 return IMA_BPRM_APPRAISE;
 344         case FILE_CHECK:
 345         case POST_SETATTR:
 346                 return IMA_FILE_APPRAISE;
 347         case MODULE_CHECK ... MAX_CHECK - 1:
 348         default:
 349                 return IMA_READ_APPRAISE;
 350         }
 351 }
 352
 353 /**
 354  * ima_match_policy - decision based on LSM and other conditions
 355  * @inode: pointer to an inode for which the policy decision is being made
 356  * @func: IMA hook identifier
 357  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 358  * @pcr: set the pcr to extend
 359  *
 360  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 361  * conditions.
 362  *
 363  * Since the IMA policy may be updated multiple times we need to lock the
 364  * list when walking it.  Reads are many orders of magnitude more numerous
 365  * than writes so ima_match_policy() is classical RCU candidate.
 366  */
 367 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
 368                      int flags, int *pcr)
 369 {
 370         struct ima_rule_entry *entry;
 371         int action = 0, actmask = flags | (flags << 1);
 372
 373         rcu_read_lock();
 374         list_for_each_entry_rcu(entry, ima_rules, list) {
 375
 376                 if (!(entry->action & actmask))
 377                         continue;
 378
 379                 if (!ima_match_rules(entry, inode, func, mask))
 380                         continue;
 381
 382                 action |= entry->flags & IMA_ACTION_FLAGS;
 383
 384                 action |= entry->action & IMA_DO_MASK;
 385                 if (entry->action & IMA_APPRAISE) {
 386                         action |= get_subaction(entry, func);
 387                         action ^= IMA_HASH;
 388                 }
 389
 390                 if (entry->action & IMA_DO_MASK)
 391                         actmask &= ~(entry->action | entry->action << 1);
 392                 else
 393                         actmask &= ~(entry->action | entry->action >> 1);
 394
 395                 if ((pcr) && (entry->flags & IMA_PCR))
 396                         *pcr = entry->pcr;
 397
 398                 if (!actmask)
 399                         break;
 400         }
 401         rcu_read_unlock();
 402
 403         return action;
 404 }
 405
 406 /*
 407  * Initialize the ima_policy_flag variable based on the currently
 408  * loaded policy.  Based on this flag, the decision to short circuit
 409  * out of a function or not call the function in the first place
 410  * can be made earlier.
 411  */
 412 void ima_update_policy_flag(void)
 413 {
 414         struct ima_rule_entry *entry;
 415
 416         list_for_each_entry(entry, ima_rules, list) {
 417                 if (entry->action & IMA_DO_MASK)
 418                         ima_policy_flag |= entry->action;
 419         }
 420
 421         ima_appraise |= temp_ima_appraise;
 422         if (!ima_appraise)
 423                 ima_policy_flag &= ~IMA_APPRAISE;
 424 }
 425
 426 /**
 427  * ima_init_policy - initialize the default measure rules.
 428  *
 429  * ima_rules points to either the ima_default_rules or the
 430  * the new ima_policy_rules.
 431  */
 432 void __init ima_init_policy(void)
 433 {
 434         int i, measure_entries, appraise_entries, secure_boot_entries;
 435
 436         /* if !ima_policy set entries = 0 so we load NO default rules */
 437         measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 438         appraise_entries = ima_use_appraise_tcb ?
 439                          ARRAY_SIZE(default_appraise_rules) : 0;
 440         secure_boot_entries = ima_use_secure_boot ?
 441                         ARRAY_SIZE(secure_boot_rules) : 0;
 442
 443         for (i = 0; i < measure_entries; i++)
 444                 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
 445
 446         switch (ima_policy) {
 447         case ORIGINAL_TCB:
 448                 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
 449                         list_add_tail(&original_measurement_rules[i].list,
 450                                       &ima_default_rules);
 451                 break;
 452         case DEFAULT_TCB:
 453                 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
 454                         list_add_tail(&default_measurement_rules[i].list,
 455                                       &ima_default_rules);
 456         default:
 457                 break;
 458         }
 459
 460         /*
 461          * Insert the appraise rules requiring file signatures, prior to
 462          * any other appraise rules.
 463          */
 464         for (i = 0; i < secure_boot_entries; i++)
 465                 list_add_tail(&secure_boot_rules[i].list,
 466                               &ima_default_rules);
 467
 468         for (i = 0; i < appraise_entries; i++) {
 469                 list_add_tail(&default_appraise_rules[i].list,
 470                               &ima_default_rules);
 471                 if (default_appraise_rules[i].func == POLICY_CHECK)
 472                         temp_ima_appraise |= IMA_APPRAISE_POLICY;
 473         }
 474
 475         ima_rules = &ima_default_rules;
 476         ima_update_policy_flag();
 477 }
 478
 479 /* Make sure we have a valid policy, at least containing some rules. */
 480 int ima_check_policy(void)
 481 {
 482         if (list_empty(&ima_temp_rules))
 483                 return -EINVAL;
 484         return 0;
 485 }
 486
 487 /**
 488  * ima_update_policy - update default_rules with new measure rules
 489  *
 490  * Called on file .release to update the default rules with a complete new
 491  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 492  * they make a queue.  The policy may be updated multiple times and this is the
 493  * RCU updater.
 494  *
 495  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 496  * we switch from the default policy to user defined.
 497  */
 498 void ima_update_policy(void)
 499 {
 500         struct list_head *first, *last, *policy;
 501
 502         /* append current policy with the new rules */
 503         first = (&ima_temp_rules)->next;
 504         last = (&ima_temp_rules)->prev;
 505         policy = &ima_policy_rules;
 506
 507         synchronize_rcu();
 508
 509         last->next = policy;
 510         rcu_assign_pointer(list_next_rcu(policy->prev), first);
 511         first->prev = policy->prev;
 512         policy->prev = last;
 513
 514         /* prepare for the next policy rules addition */
 515         INIT_LIST_HEAD(&ima_temp_rules);
 516
 517         if (ima_rules != policy) {
 518                 ima_policy_flag = 0;
 519                 ima_rules = policy;
 520         }
 521         ima_update_policy_flag();
 522 }
 523
 524 enum {
 525         Opt_err = -1,
 526         Opt_measure = 1, Opt_dont_measure,
 527         Opt_appraise, Opt_dont_appraise,
 528         Opt_audit, Opt_hash, Opt_dont_hash,
 529         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 530         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 531         Opt_func, Opt_mask, Opt_fsmagic,
 532         Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq,
 533         Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt,
 534         Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt,
 535         Opt_appraise_type, Opt_permit_directio,
 536         Opt_pcr
 537 };
 538
 539 static match_table_t policy_tokens = {
 540         {Opt_measure, "measure"},
 541         {Opt_dont_measure, "dont_measure"},
 542         {Opt_appraise, "appraise"},
 543         {Opt_dont_appraise, "dont_appraise"},
 544         {Opt_audit, "audit"},
 545         {Opt_hash, "hash"},
 546         {Opt_dont_hash, "dont_hash"},
 547         {Opt_obj_user, "obj_user=%s"},
 548         {Opt_obj_role, "obj_role=%s"},
 549         {Opt_obj_type, "obj_type=%s"},
 550         {Opt_subj_user, "subj_user=%s"},
 551         {Opt_subj_role, "subj_role=%s"},
 552         {Opt_subj_type, "subj_type=%s"},
 553         {Opt_func, "func=%s"},
 554         {Opt_mask, "mask=%s"},
 555         {Opt_fsmagic, "fsmagic=%s"},
 556         {Opt_fsuuid, "fsuuid=%s"},
 557         {Opt_uid_eq, "uid=%s"},
 558         {Opt_euid_eq, "euid=%s"},
 559         {Opt_fowner_eq, "fowner=%s"},
 560         {Opt_uid_gt, "uid>%s"},
 561         {Opt_euid_gt, "euid>%s"},
 562         {Opt_fowner_gt, "fowner>%s"},
 563         {Opt_uid_lt, "uid<%s"},
 564         {Opt_euid_lt, "euid<%s"},
 565         {Opt_fowner_lt, "fowner<%s"},
 566         {Opt_appraise_type, "appraise_type=%s"},
 567         {Opt_permit_directio, "permit_directio"},
 568         {Opt_pcr, "pcr=%s"},
 569         {Opt_err, NULL}
 570 };
 571
 572 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 573                              substring_t *args, int lsm_rule, int audit_type)
 574 {
 575         int result;
 576
 577         if (entry->lsm[lsm_rule].rule)
 578                 return -EINVAL;
 579
 580         entry->lsm[lsm_rule].args_p = match_strdup(args);
 581         if (!entry->lsm[lsm_rule].args_p)
 582                 return -ENOMEM;
 583
 584         entry->lsm[lsm_rule].type = audit_type;
 585         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 586                                            Audit_equal,
 587                                            entry->lsm[lsm_rule].args_p,
 588                                            &entry->lsm[lsm_rule].rule);
 589         if (!entry->lsm[lsm_rule].rule) {
 590                 kfree(entry->lsm[lsm_rule].args_p);
 591                 return -EINVAL;
 592         }
 593
 594         return result;
 595 }
 596
 597 static void ima_log_string_op(struct audit_buffer *ab, char *key, char *value,
 598                               bool (*rule_operator)(kuid_t, kuid_t))
 599 {
 600         if (rule_operator == &uid_gt)
 601                 audit_log_format(ab, "%s>", key);
 602         else if (rule_operator == &uid_lt)
 603                 audit_log_format(ab, "%s<", key);
 604         else
 605                 audit_log_format(ab, "%s=", key);
 606         audit_log_untrustedstring(ab, value);
 607         audit_log_format(ab, " ");
 608 }
 609 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
 610 {
 611         ima_log_string_op(ab, key, value, NULL);
 612 }
 613
 614 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 615 {
 616         struct audit_buffer *ab;
 617         char *from;
 618         char *p;
 619         bool uid_token;
 620         int result = 0;
 621
 622         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
 623
 624         entry->uid = INVALID_UID;
 625         entry->fowner = INVALID_UID;
 626         entry->uid_op = &uid_eq;
 627         entry->fowner_op = &uid_eq;
 628         entry->action = UNKNOWN;
 629         while ((p = strsep(&rule, " \t")) != NULL) {
 630                 substring_t args[MAX_OPT_ARGS];
 631                 int token;
 632                 unsigned long lnum;
 633
 634                 if (result < 0)
 635                         break;
 636                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
 637                         continue;
 638                 token = match_token(p, policy_tokens, args);
 639                 switch (token) {
 640                 case Opt_measure:
 641                         ima_log_string(ab, "action", "measure");
 642
 643                         if (entry->action != UNKNOWN)
 644                                 result = -EINVAL;
 645
 646                         entry->action = MEASURE;
 647                         break;
 648                 case Opt_dont_measure:
 649                         ima_log_string(ab, "action", "dont_measure");
 650
 651                         if (entry->action != UNKNOWN)
 652                                 result = -EINVAL;
 653
 654                         entry->action = DONT_MEASURE;
 655                         break;
 656                 case Opt_appraise:
 657                         ima_log_string(ab, "action", "appraise");
 658
 659                         if (entry->action != UNKNOWN)
 660                                 result = -EINVAL;
 661
 662                         entry->action = APPRAISE;
 663                         break;
 664                 case Opt_dont_appraise:
 665                         ima_log_string(ab, "action", "dont_appraise");
 666
 667                         if (entry->action != UNKNOWN)
 668                                 result = -EINVAL;
 669
 670                         entry->action = DONT_APPRAISE;
 671                         break;
 672                 case Opt_audit:
 673                         ima_log_string(ab, "action", "audit");
 674
 675                         if (entry->action != UNKNOWN)
 676                                 result = -EINVAL;
 677
 678                         entry->action = AUDIT;
 679                         break;
 680                 case Opt_hash:
 681                         ima_log_string(ab, "action", "hash");
 682
 683                         if (entry->action != UNKNOWN)
 684                                 result = -EINVAL;
 685
 686                         entry->action = HASH;
 687                         break;
 688                 case Opt_dont_hash:
 689                         ima_log_string(ab, "action", "dont_hash");
 690
 691                         if (entry->action != UNKNOWN)
 692                                 result = -EINVAL;
 693
 694                         entry->action = DONT_HASH;
 695                         break;
 696                 case Opt_func:
 697                         ima_log_string(ab, "func", args[0].from);
 698
 699                         if (entry->func)
 700                                 result = -EINVAL;
 701
 702                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
 703                                 entry->func = FILE_CHECK;
 704                         /* PATH_CHECK is for backwards compat */
 705                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
 706                                 entry->func = FILE_CHECK;
 707                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
 708                                 entry->func = MODULE_CHECK;
 709                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
 710                                 entry->func = FIRMWARE_CHECK;
 711                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
 712                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
 713                                 entry->func = MMAP_CHECK;
 714                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
 715                                 entry->func = BPRM_CHECK;
 716                         else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
 717                                  0)
 718                                 entry->func = KEXEC_KERNEL_CHECK;
 719                         else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
 720                                  == 0)
 721                                 entry->func = KEXEC_INITRAMFS_CHECK;
 722                         else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
 723                                 entry->func = POLICY_CHECK;
 724                         else
 725                                 result = -EINVAL;
 726                         if (!result)
 727                                 entry->flags |= IMA_FUNC;
 728                         break;
 729                 case Opt_mask:
 730                         ima_log_string(ab, "mask", args[0].from);
 731
 732                         if (entry->mask)
 733                                 result = -EINVAL;
 734
 735                         from = args[0].from;
 736                         if (*from == '^')
 737                                 from++;
 738
 739                         if ((strcmp(from, "MAY_EXEC")) == 0)
 740                                 entry->mask = MAY_EXEC;
 741                         else if (strcmp(from, "MAY_WRITE") == 0)
 742                                 entry->mask = MAY_WRITE;
 743                         else if (strcmp(from, "MAY_READ") == 0)
 744                                 entry->mask = MAY_READ;
 745                         else if (strcmp(from, "MAY_APPEND") == 0)
 746                                 entry->mask = MAY_APPEND;
 747                         else
 748                                 result = -EINVAL;
 749                         if (!result)
 750                                 entry->flags |= (*args[0].from == '^')
 751                                      ? IMA_INMASK : IMA_MASK;
 752                         break;
 753                 case Opt_fsmagic:
 754                         ima_log_string(ab, "fsmagic", args[0].from);
 755
 756                         if (entry->fsmagic) {
 757                                 result = -EINVAL;
 758                                 break;
 759                         }
 760
 761                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
 762                         if (!result)
 763                                 entry->flags |= IMA_FSMAGIC;
 764                         break;
 765                 case Opt_fsuuid:
 766                         ima_log_string(ab, "fsuuid", args[0].from);
 767
 768                         if (!uuid_is_null(&entry->fsuuid)) {
 769                                 result = -EINVAL;
 770                                 break;
 771                         }
 772
 773                         result = uuid_parse(args[0].from, &entry->fsuuid);
 774                         if (!result)
 775                                 entry->flags |= IMA_FSUUID;
 776                         break;
 777                 case Opt_uid_gt:
 778                 case Opt_euid_gt:
 779                         entry->uid_op = &uid_gt;
 780                 case Opt_uid_lt:
 781                 case Opt_euid_lt:
 782                         if ((token == Opt_uid_lt) || (token == Opt_euid_lt))
 783                                 entry->uid_op = &uid_lt;
 784                 case Opt_uid_eq:
 785                 case Opt_euid_eq:
 786                         uid_token = (token == Opt_uid_eq) ||
 787                                     (token == Opt_uid_gt) ||
 788                                     (token == Opt_uid_lt);
 789
 790                         ima_log_string_op(ab, uid_token ? "uid" : "euid",
 791                                           args[0].from, entry->uid_op);
 792
 793                         if (uid_valid(entry->uid)) {
 794                                 result = -EINVAL;
 795                                 break;
 796                         }
 797
 798                         result = kstrtoul(args[0].from, 10, &lnum);
 799                         if (!result) {
 800                                 entry->uid = make_kuid(current_user_ns(),
 801                                                        (uid_t) lnum);
 802                                 if (!uid_valid(entry->uid) ||
 803                                     (uid_t)lnum != lnum)
 804                                         result = -EINVAL;
 805                                 else
 806                                         entry->flags |= uid_token
 807                                             ? IMA_UID : IMA_EUID;
 808                         }
 809                         break;
 810                 case Opt_fowner_gt:
 811                         entry->fowner_op = &uid_gt;
 812                 case Opt_fowner_lt:
 813                         if (token == Opt_fowner_lt)
 814                                 entry->fowner_op = &uid_lt;
 815                 case Opt_fowner_eq:
 816                         ima_log_string_op(ab, "fowner", args[0].from,
 817                                           entry->fowner_op);
 818
 819                         if (uid_valid(entry->fowner)) {
 820                                 result = -EINVAL;
 821                                 break;
 822                         }
 823
 824                         result = kstrtoul(args[0].from, 10, &lnum);
 825                         if (!result) {
 826                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
 827                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
 828                                         result = -EINVAL;
 829                                 else
 830                                         entry->flags |= IMA_FOWNER;
 831                         }
 832                         break;
 833                 case Opt_obj_user:
 834                         ima_log_string(ab, "obj_user", args[0].from);
 835                         result = ima_lsm_rule_init(entry, args,
 836                                                    LSM_OBJ_USER,
 837                                                    AUDIT_OBJ_USER);
 838                         break;
 839                 case Opt_obj_role:
 840                         ima_log_string(ab, "obj_role", args[0].from);
 841                         result = ima_lsm_rule_init(entry, args,
 842                                                    LSM_OBJ_ROLE,
 843                                                    AUDIT_OBJ_ROLE);
 844                         break;
 845                 case Opt_obj_type:
 846                         ima_log_string(ab, "obj_type", args[0].from);
 847                         result = ima_lsm_rule_init(entry, args,
 848                                                    LSM_OBJ_TYPE,
 849                                                    AUDIT_OBJ_TYPE);
 850                         break;
 851                 case Opt_subj_user:
 852                         ima_log_string(ab, "subj_user", args[0].from);
 853                         result = ima_lsm_rule_init(entry, args,
 854                                                    LSM_SUBJ_USER,
 855                                                    AUDIT_SUBJ_USER);
 856                         break;
 857                 case Opt_subj_role:
 858                         ima_log_string(ab, "subj_role", args[0].from);
 859                         result = ima_lsm_rule_init(entry, args,
 860                                                    LSM_SUBJ_ROLE,
 861                                                    AUDIT_SUBJ_ROLE);
 862                         break;
 863                 case Opt_subj_type:
 864                         ima_log_string(ab, "subj_type", args[0].from);
 865                         result = ima_lsm_rule_init(entry, args,
 866                                                    LSM_SUBJ_TYPE,
 867                                                    AUDIT_SUBJ_TYPE);
 868                         break;
 869                 case Opt_appraise_type:
 870                         if (entry->action != APPRAISE) {
 871                                 result = -EINVAL;
 872                                 break;
 873                         }
 874
 875                         ima_log_string(ab, "appraise_type", args[0].from);
 876                         if ((strcmp(args[0].from, "imasig")) == 0)
 877                                 entry->flags |= IMA_DIGSIG_REQUIRED;
 878                         else
 879                                 result = -EINVAL;
 880                         break;
 881                 case Opt_permit_directio:
 882                         entry->flags |= IMA_PERMIT_DIRECTIO;
 883                         break;
 884                 case Opt_pcr:
 885                         if (entry->action != MEASURE) {
 886                                 result = -EINVAL;
 887                                 break;
 888                         }
 889                         ima_log_string(ab, "pcr", args[0].from);
 890
 891                         result = kstrtoint(args[0].from, 10, &entry->pcr);
 892                         if (result || INVALID_PCR(entry->pcr))
 893                                 result = -EINVAL;
 894                         else
 895                                 entry->flags |= IMA_PCR;
 896
 897                         break;
 898                 case Opt_err:
 899                         ima_log_string(ab, "UNKNOWN", p);
 900                         result = -EINVAL;
 901                         break;
 902                 }
 903         }
 904         if (!result && (entry->action == UNKNOWN))
 905                 result = -EINVAL;
 906         else if (entry->func == MODULE_CHECK)
 907                 temp_ima_appraise |= IMA_APPRAISE_MODULES;
 908         else if (entry->func == FIRMWARE_CHECK)
 909                 temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
 910         else if (entry->func == POLICY_CHECK)
 911                 temp_ima_appraise |= IMA_APPRAISE_POLICY;
 912         audit_log_format(ab, "res=%d", !result);
 913         audit_log_end(ab);
 914         return result;
 915 }
 916
 917 /**
 918  * ima_parse_add_rule - add a rule to ima_policy_rules
 919  * @rule - ima measurement policy rule
 920  *
 921  * Avoid locking by allowing just one writer at a time in ima_write_policy()
 922  * Returns the length of the rule parsed, an error code on failure
 923  */
 924 ssize_t ima_parse_add_rule(char *rule)
 925 {
 926         static const char op[] = "update_policy";
 927         char *p;
 928         struct ima_rule_entry *entry;
 929         ssize_t result, len;
 930         int audit_info = 0;
 931
 932         p = strsep(&rule, "\n");
 933         len = strlen(p) + 1;
 934         p += strspn(p, " \t");
 935
 936         if (*p == '#' || *p == '\0')
 937                 return len;
 938
 939         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 940         if (!entry) {
 941                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 942                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
 943                 return -ENOMEM;
 944         }
 945
 946         INIT_LIST_HEAD(&entry->list);
 947
 948         result = ima_parse_rule(p, entry);
 949         if (result) {
 950                 kfree(entry);
 951                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 952                                     NULL, op, "invalid-policy", result,
 953                                     audit_info);
 954                 return result;
 955         }
 956
 957         list_add_tail(&entry->list, &ima_temp_rules);
 958
 959         return len;
 960 }
 961
 962 /**
 963  * ima_delete_rules() called to cleanup invalid in-flight policy.
 964  * We don't need locking as we operate on the temp list, which is
 965  * different from the active one.  There is also only one user of
 966  * ima_delete_rules() at a time.
 967  */
 968 void ima_delete_rules(void)
 969 {
 970         struct ima_rule_entry *entry, *tmp;
 971         int i;
 972
 973         temp_ima_appraise = 0;
 974         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
 975                 for (i = 0; i < MAX_LSM_RULES; i++)
 976                         kfree(entry->lsm[i].args_p);
 977
 978                 list_del(&entry->list);
 979                 kfree(entry);
 980         }
 981 }
 982
 983 #ifdef  CONFIG_IMA_READ_POLICY
 984 enum {
 985         mask_exec = 0, mask_write, mask_read, mask_append
 986 };
 987
 988 static const char *const mask_tokens[] = {
 989         "MAY_EXEC",
 990         "MAY_WRITE",
 991         "MAY_READ",
 992         "MAY_APPEND"
 993 };
 994
 995 #define __ima_hook_stringify(str)       (#str),
 996
 997 static const char *const func_tokens[] = {
 998         __ima_hooks(__ima_hook_stringify)
 999 };
1000
1001 void *ima_policy_start(struct seq_file *m, loff_t *pos)
1002 {
1003         loff_t l = *pos;
1004         struct ima_rule_entry *entry;
1005
1006         rcu_read_lock();
1007         list_for_each_entry_rcu(entry, ima_rules, list) {
1008                 if (!l--) {
1009                         rcu_read_unlock();
1010                         return entry;
1011                 }
1012         }
1013         rcu_read_unlock();
1014         return NULL;
1015 }
1016
1017 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
1018 {
1019         struct ima_rule_entry *entry = v;
1020
1021         rcu_read_lock();
1022         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
1023         rcu_read_unlock();
1024         (*pos)++;
1025
1026         return (&entry->list == ima_rules) ? NULL : entry;
1027 }
1028
1029 void ima_policy_stop(struct seq_file *m, void *v)
1030 {
1031 }
1032
1033 #define pt(token)       policy_tokens[token + Opt_err].pattern
1034 #define mt(token)       mask_tokens[token]
1035
1036 /*
1037  * policy_func_show - display the ima_hooks policy rule
1038  */
1039 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
1040 {
1041         if (func > 0 && func < MAX_CHECK)
1042                 seq_printf(m, "func=%s ", func_tokens[func]);
1043         else
1044                 seq_printf(m, "func=%d ", func);
1045 }
1046
1047 int ima_policy_show(struct seq_file *m, void *v)
1048 {
1049         struct ima_rule_entry *entry = v;
1050         int i;
1051         char tbuf[64] = {0,};
1052
1053         rcu_read_lock();
1054
1055         if (entry->action & MEASURE)
1056                 seq_puts(m, pt(Opt_measure));
1057         if (entry->action & DONT_MEASURE)
1058                 seq_puts(m, pt(Opt_dont_measure));
1059         if (entry->action & APPRAISE)
1060                 seq_puts(m, pt(Opt_appraise));
1061         if (entry->action & DONT_APPRAISE)
1062                 seq_puts(m, pt(Opt_dont_appraise));
1063         if (entry->action & AUDIT)
1064                 seq_puts(m, pt(Opt_audit));
1065         if (entry->action & HASH)
1066                 seq_puts(m, pt(Opt_hash));
1067         if (entry->action & DONT_HASH)
1068                 seq_puts(m, pt(Opt_dont_hash));
1069
1070         seq_puts(m, " ");
1071
1072         if (entry->flags & IMA_FUNC)
1073                 policy_func_show(m, entry->func);
1074
1075         if (entry->flags & IMA_MASK) {
1076                 if (entry->mask & MAY_EXEC)
1077                         seq_printf(m, pt(Opt_mask), mt(mask_exec));
1078                 if (entry->mask & MAY_WRITE)
1079                         seq_printf(m, pt(Opt_mask), mt(mask_write));
1080                 if (entry->mask & MAY_READ)
1081                         seq_printf(m, pt(Opt_mask), mt(mask_read));
1082                 if (entry->mask & MAY_APPEND)
1083                         seq_printf(m, pt(Opt_mask), mt(mask_append));
1084                 seq_puts(m, " ");
1085         }
1086
1087         if (entry->flags & IMA_FSMAGIC) {
1088                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1089                 seq_printf(m, pt(Opt_fsmagic), tbuf);
1090                 seq_puts(m, " ");
1091         }
1092
1093         if (entry->flags & IMA_PCR) {
1094                 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
1095                 seq_printf(m, pt(Opt_pcr), tbuf);
1096                 seq_puts(m, " ");
1097         }
1098
1099         if (entry->flags & IMA_FSUUID) {
1100                 seq_printf(m, "fsuuid=%pU", &entry->fsuuid);
1101                 seq_puts(m, " ");
1102         }
1103
1104         if (entry->flags & IMA_UID) {
1105                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1106                 if (entry->uid_op == &uid_gt)
1107                         seq_printf(m, pt(Opt_uid_gt), tbuf);
1108                 else if (entry->uid_op == &uid_lt)
1109                         seq_printf(m, pt(Opt_uid_lt), tbuf);
1110                 else
1111                         seq_printf(m, pt(Opt_uid_eq), tbuf);
1112                 seq_puts(m, " ");
1113         }
1114
1115         if (entry->flags & IMA_EUID) {
1116                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1117                 if (entry->uid_op == &uid_gt)
1118                         seq_printf(m, pt(Opt_euid_gt), tbuf);
1119                 else if (entry->uid_op == &uid_lt)
1120                         seq_printf(m, pt(Opt_euid_lt), tbuf);
1121                 else
1122                         seq_printf(m, pt(Opt_euid_eq), tbuf);
1123                 seq_puts(m, " ");
1124         }
1125
1126         if (entry->flags & IMA_FOWNER) {
1127                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1128                 if (entry->fowner_op == &uid_gt)
1129                         seq_printf(m, pt(Opt_fowner_gt), tbuf);
1130                 else if (entry->fowner_op == &uid_lt)
1131                         seq_printf(m, pt(Opt_fowner_lt), tbuf);
1132                 else
1133                         seq_printf(m, pt(Opt_fowner_eq), tbuf);
1134                 seq_puts(m, " ");
1135         }
1136
1137         for (i = 0; i < MAX_LSM_RULES; i++) {
1138                 if (entry->lsm[i].rule) {
1139                         switch (i) {
1140                         case LSM_OBJ_USER:
1141                                 seq_printf(m, pt(Opt_obj_user),
1142                                            (char *)entry->lsm[i].args_p);
1143                                 break;
1144                         case LSM_OBJ_ROLE:
1145                                 seq_printf(m, pt(Opt_obj_role),
1146                                            (char *)entry->lsm[i].args_p);
1147                                 break;
1148                         case LSM_OBJ_TYPE:
1149                                 seq_printf(m, pt(Opt_obj_type),
1150                                            (char *)entry->lsm[i].args_p);
1151                                 break;
1152                         case LSM_SUBJ_USER:
1153                                 seq_printf(m, pt(Opt_subj_user),
1154                                            (char *)entry->lsm[i].args_p);
1155                                 break;
1156                         case LSM_SUBJ_ROLE:
1157                                 seq_printf(m, pt(Opt_subj_role),
1158                                            (char *)entry->lsm[i].args_p);
1159                                 break;
1160                         case LSM_SUBJ_TYPE:
1161                                 seq_printf(m, pt(Opt_subj_type),
1162                                            (char *)entry->lsm[i].args_p);
1163                                 break;
1164                         }
1165                 }
1166         }
1167         if (entry->flags & IMA_DIGSIG_REQUIRED)
1168                 seq_puts(m, "appraise_type=imasig ");
1169         if (entry->flags & IMA_PERMIT_DIRECTIO)
1170                 seq_puts(m, "permit_directio ");
1171         rcu_read_unlock();
1172         seq_puts(m, "\n");
1173         return 0;
1174 }
1175 #endif  /* CONFIG_IMA_READ_POLICY */