security/ipe/eval.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
   4  */
   5
   6 #include <linux/fs.h>
   7 #include <linux/types.h>
   8 #include <linux/slab.h>
   9 #include <linux/file.h>
  10 #include <linux/sched.h>
  11 #include <linux/rcupdate.h>
  12 #include <linux/moduleparam.h>
  13 #include <linux/fsverity.h>
  14
  15 #include "ipe.h"
  16 #include "eval.h"
  17 #include "policy.h"
  18 #include "audit.h"
  19 #include "digest.h"
  20
  21 struct ipe_policy __rcu *ipe_active_policy;
  22 bool success_audit;
  23 bool enforce = true;
  24 #define INO_BLOCK_DEV(ino) ((ino)->i_sb->s_bdev)
  25
  26 #define FILE_SUPERBLOCK(f) ((f)->f_path.mnt->mnt_sb)
  27
  28 /**
  29  * build_ipe_sb_ctx() - Build initramfs field of an ipe evaluation context.
  30  * @ctx: Supplies a pointer to the context to be populated.
  31  * @file: Supplies the file struct of the file triggered IPE event.
  32  */
  33 static void build_ipe_sb_ctx(struct ipe_eval_ctx *ctx, const struct file *const file)
  34 {
  35         ctx->initramfs = ipe_sb(FILE_SUPERBLOCK(file))->initramfs;
  36 }
  37
  38 #ifdef CONFIG_IPE_PROP_DM_VERITY
  39 /**
  40  * build_ipe_bdev_ctx() - Build ipe_bdev field of an evaluation context.
  41  * @ctx: Supplies a pointer to the context to be populated.
  42  * @ino: Supplies the inode struct of the file triggered IPE event.
  43  */
  44 static void build_ipe_bdev_ctx(struct ipe_eval_ctx *ctx, const struct inode *const ino)
  45 {
  46         if (INO_BLOCK_DEV(ino))
  47                 ctx->ipe_bdev = ipe_bdev(INO_BLOCK_DEV(ino));
  48 }
  49 #else
  50 static void build_ipe_bdev_ctx(struct ipe_eval_ctx *ctx, const struct inode *const ino)
  51 {
  52 }
  53 #endif /* CONFIG_IPE_PROP_DM_VERITY */
  54
  55 #ifdef CONFIG_IPE_PROP_FS_VERITY
  56 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
  57 static void build_ipe_inode_blob_ctx(struct ipe_eval_ctx *ctx,
  58                                      const struct inode *const ino)
  59 {
  60         ctx->ipe_inode = ipe_inode(ctx->ino);
  61 }
  62 #else
  63 static inline void build_ipe_inode_blob_ctx(struct ipe_eval_ctx *ctx,
  64                                             const struct inode *const ino)
  65 {
  66 }
  67 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
  68
  69 /**
  70  * build_ipe_inode_ctx() - Build inode fields of an evaluation context.
  71  * @ctx: Supplies a pointer to the context to be populated.
  72  * @ino: Supplies the inode struct of the file triggered IPE event.
  73  */
  74 static void build_ipe_inode_ctx(struct ipe_eval_ctx *ctx, const struct inode *const ino)
  75 {
  76         ctx->ino = ino;
  77         build_ipe_inode_blob_ctx(ctx, ino);
  78 }
  79 #else
  80 static void build_ipe_inode_ctx(struct ipe_eval_ctx *ctx, const struct inode *const ino)
  81 {
  82 }
  83 #endif /* CONFIG_IPE_PROP_FS_VERITY */
  84
  85 /**
  86  * ipe_build_eval_ctx() - Build an ipe evaluation context.
  87  * @ctx: Supplies a pointer to the context to be populated.
  88  * @file: Supplies a pointer to the file to associated with the evaluation.
  89  * @op: Supplies the IPE policy operation associated with the evaluation.
  90  * @hook: Supplies the LSM hook associated with the evaluation.
  91  */
  92 void ipe_build_eval_ctx(struct ipe_eval_ctx *ctx,
  93                         const struct file *file,
  94                         enum ipe_op_type op,
  95                         enum ipe_hook_type hook)
  96 {
  97         struct inode *ino;
  98
  99         ctx->file = file;
 100         ctx->op = op;
 101         ctx->hook = hook;
 102
 103         if (file) {
 104                 build_ipe_sb_ctx(ctx, file);
 105                 ino = d_real_inode(file->f_path.dentry);
 106                 build_ipe_bdev_ctx(ctx, ino);
 107                 build_ipe_inode_ctx(ctx, ino);
 108         }
 109 }
 110
 111 /**
 112  * evaluate_boot_verified() - Evaluate @ctx for the boot verified property.
 113  * @ctx: Supplies a pointer to the context being evaluated.
 114  *
 115  * Return:
 116  * * %true      - The current @ctx match the @p
 117  * * %false     - The current @ctx doesn't match the @p
 118  */
 119 static bool evaluate_boot_verified(const struct ipe_eval_ctx *const ctx)
 120 {
 121         return ctx->initramfs;
 122 }
 123
 124 #ifdef CONFIG_IPE_PROP_DM_VERITY
 125 /**
 126  * evaluate_dmv_roothash() - Evaluate @ctx against a dmv roothash property.
 127  * @ctx: Supplies a pointer to the context being evaluated.
 128  * @p: Supplies a pointer to the property being evaluated.
 129  *
 130  * Return:
 131  * * %true      - The current @ctx match the @p
 132  * * %false     - The current @ctx doesn't match the @p
 133  */
 134 static bool evaluate_dmv_roothash(const struct ipe_eval_ctx *const ctx,
 135                                   struct ipe_prop *p)
 136 {
 137         return !!ctx->ipe_bdev &&
 138                !!ctx->ipe_bdev->root_hash &&
 139                ipe_digest_eval(p->value,
 140                                ctx->ipe_bdev->root_hash);
 141 }
 142 #else
 143 static bool evaluate_dmv_roothash(const struct ipe_eval_ctx *const ctx,
 144                                   struct ipe_prop *p)
 145 {
 146         return false;
 147 }
 148 #endif /* CONFIG_IPE_PROP_DM_VERITY */
 149
 150 #ifdef CONFIG_IPE_PROP_DM_VERITY_SIGNATURE
 151 /**
 152  * evaluate_dmv_sig_false() - Evaluate @ctx against a dmv sig false property.
 153  * @ctx: Supplies a pointer to the context being evaluated.
 154  *
 155  * Return:
 156  * * %true      - The current @ctx match the property
 157  * * %false     - The current @ctx doesn't match the property
 158  */
 159 static bool evaluate_dmv_sig_false(const struct ipe_eval_ctx *const ctx)
 160 {
 161         return !ctx->ipe_bdev || (!ctx->ipe_bdev->dm_verity_signed);
 162 }
 163
 164 /**
 165  * evaluate_dmv_sig_true() - Evaluate @ctx against a dmv sig true property.
 166  * @ctx: Supplies a pointer to the context being evaluated.
 167  *
 168  * Return:
 169  * * %true      - The current @ctx match the property
 170  * * %false     - The current @ctx doesn't match the property
 171  */
 172 static bool evaluate_dmv_sig_true(const struct ipe_eval_ctx *const ctx)
 173 {
 174         return !evaluate_dmv_sig_false(ctx);
 175 }
 176 #else
 177 static bool evaluate_dmv_sig_false(const struct ipe_eval_ctx *const ctx)
 178 {
 179         return false;
 180 }
 181
 182 static bool evaluate_dmv_sig_true(const struct ipe_eval_ctx *const ctx)
 183 {
 184         return false;
 185 }
 186 #endif /* CONFIG_IPE_PROP_DM_VERITY_SIGNATURE */
 187
 188 #ifdef CONFIG_IPE_PROP_FS_VERITY
 189 /**
 190  * evaluate_fsv_digest() - Evaluate @ctx against a fsv digest property.
 191  * @ctx: Supplies a pointer to the context being evaluated.
 192  * @p: Supplies a pointer to the property being evaluated.
 193  *
 194  * Return:
 195  * * %true      - The current @ctx match the @p
 196  * * %false     - The current @ctx doesn't match the @p
 197  */
 198 static bool evaluate_fsv_digest(const struct ipe_eval_ctx *const ctx,
 199                                 struct ipe_prop *p)
 200 {
 201         enum hash_algo alg;
 202         u8 digest[FS_VERITY_MAX_DIGEST_SIZE];
 203         struct digest_info info;
 204
 205         if (!ctx->ino)
 206                 return false;
 207         if (!fsverity_get_digest((struct inode *)ctx->ino,
 208                                  digest,
 209                                  NULL,
 210                                  &alg))
 211                 return false;
 212
 213         info.alg = hash_algo_name[alg];
 214         info.digest = digest;
 215         info.digest_len = hash_digest_size[alg];
 216
 217         return ipe_digest_eval(p->value, &info);
 218 }
 219 #else
 220 static bool evaluate_fsv_digest(const struct ipe_eval_ctx *const ctx,
 221                                 struct ipe_prop *p)
 222 {
 223         return false;
 224 }
 225 #endif /* CONFIG_IPE_PROP_FS_VERITY */
 226
 227 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
 228 /**
 229  * evaluate_fsv_sig_false() - Evaluate @ctx against a fsv sig false property.
 230  * @ctx: Supplies a pointer to the context being evaluated.
 231  *
 232  * Return:
 233  * * %true      - The current @ctx match the property
 234  * * %false     - The current @ctx doesn't match the property
 235  */
 236 static bool evaluate_fsv_sig_false(const struct ipe_eval_ctx *const ctx)
 237 {
 238         return !ctx->ino ||
 239                !IS_VERITY(ctx->ino) ||
 240                !ctx->ipe_inode ||
 241                !ctx->ipe_inode->fs_verity_signed;
 242 }
 243
 244 /**
 245  * evaluate_fsv_sig_true() - Evaluate @ctx against a fsv sig true property.
 246  * @ctx: Supplies a pointer to the context being evaluated.
 247  *
 248  * Return:
 249  * * %true - The current @ctx match the property
 250  * * %false - The current @ctx doesn't match the property
 251  */
 252 static bool evaluate_fsv_sig_true(const struct ipe_eval_ctx *const ctx)
 253 {
 254         return !evaluate_fsv_sig_false(ctx);
 255 }
 256 #else
 257 static bool evaluate_fsv_sig_false(const struct ipe_eval_ctx *const ctx)
 258 {
 259         return false;
 260 }
 261
 262 static bool evaluate_fsv_sig_true(const struct ipe_eval_ctx *const ctx)
 263 {
 264         return false;
 265 }
 266 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
 267
 268 /**
 269  * evaluate_property() - Analyze @ctx against a rule property.
 270  * @ctx: Supplies a pointer to the context to be evaluated.
 271  * @p: Supplies a pointer to the property to be evaluated.
 272  *
 273  * This function Determines whether the specified @ctx
 274  * matches the conditions defined by a rule property @p.
 275  *
 276  * Return:
 277  * * %true      - The current @ctx match the @p
 278  * * %false     - The current @ctx doesn't match the @p
 279  */
 280 static bool evaluate_property(const struct ipe_eval_ctx *const ctx,
 281                               struct ipe_prop *p)
 282 {
 283         switch (p->type) {
 284         case IPE_PROP_BOOT_VERIFIED_FALSE:
 285                 return !evaluate_boot_verified(ctx);
 286         case IPE_PROP_BOOT_VERIFIED_TRUE:
 287                 return evaluate_boot_verified(ctx);
 288         case IPE_PROP_DMV_ROOTHASH:
 289                 return evaluate_dmv_roothash(ctx, p);
 290         case IPE_PROP_DMV_SIG_FALSE:
 291                 return evaluate_dmv_sig_false(ctx);
 292         case IPE_PROP_DMV_SIG_TRUE:
 293                 return evaluate_dmv_sig_true(ctx);
 294         case IPE_PROP_FSV_DIGEST:
 295                 return evaluate_fsv_digest(ctx, p);
 296         case IPE_PROP_FSV_SIG_FALSE:
 297                 return evaluate_fsv_sig_false(ctx);
 298         case IPE_PROP_FSV_SIG_TRUE:
 299                 return evaluate_fsv_sig_true(ctx);
 300         default:
 301                 return false;
 302         }
 303 }
 304
 305 /**
 306  * ipe_evaluate_event() - Analyze @ctx against the current active policy.
 307  * @ctx: Supplies a pointer to the context to be evaluated.
 308  *
 309  * This is the loop where all policy evaluations happen against the IPE policy.
 310  *
 311  * Return:
 312  * * %0         - Success
 313  * * %-EACCES   - @ctx did not pass evaluation
 314  */
 315 int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
 316 {
 317         const struct ipe_op_table *rules = NULL;
 318         const struct ipe_rule *rule = NULL;
 319         struct ipe_policy *pol = NULL;
 320         struct ipe_prop *prop = NULL;
 321         enum ipe_action_type action;
 322         enum ipe_match match_type;
 323         bool match = false;
 324         int rc = 0;
 325
 326         rcu_read_lock();
 327
 328         pol = rcu_dereference(ipe_active_policy);
 329         if (!pol) {
 330                 rcu_read_unlock();
 331                 return 0;
 332         }
 333
 334         if (ctx->op == IPE_OP_INVALID) {
 335                 if (pol->parsed->global_default_action == IPE_ACTION_INVALID) {
 336                         WARN(1, "no default rule set for unknown op, ALLOW it");
 337                         action = IPE_ACTION_ALLOW;
 338                 } else {
 339                         action = pol->parsed->global_default_action;
 340                 }
 341                 match_type = IPE_MATCH_GLOBAL;
 342                 goto eval;
 343         }
 344
 345         rules = &pol->parsed->rules[ctx->op];
 346
 347         list_for_each_entry(rule, &rules->rules, next) {
 348                 match = true;
 349
 350                 list_for_each_entry(prop, &rule->props, next) {
 351                         match = evaluate_property(ctx, prop);
 352                         if (!match)
 353                                 break;
 354                 }
 355
 356                 if (match)
 357                         break;
 358         }
 359
 360         if (match) {
 361                 action = rule->action;
 362                 match_type = IPE_MATCH_RULE;
 363         } else if (rules->default_action != IPE_ACTION_INVALID) {
 364                 action = rules->default_action;
 365                 match_type = IPE_MATCH_TABLE;
 366         } else {
 367                 action = pol->parsed->global_default_action;
 368                 match_type = IPE_MATCH_GLOBAL;
 369         }
 370
 371 eval:
 372         ipe_audit_match(ctx, match_type, action, rule);
 373         rcu_read_unlock();
 374
 375         if (action == IPE_ACTION_DENY)
 376                 rc = -EACCES;
 377
 378         if (!READ_ONCE(enforce))
 379                 rc = 0;
 380
 381         return rc;
 382 }
 383
 384 /* Set the right module name */
 385 #ifdef KBUILD_MODNAME
 386 #undef KBUILD_MODNAME
 387 #define KBUILD_MODNAME "ipe"
 388 #endif
 389
 390 module_param(success_audit, bool, 0400);
 391 MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
 392 module_param(enforce, bool, 0400);
 393 MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");