2 * Copyright (C) 2011 IBM Corporation
5 * Mimi Zohar <zohar@us.ibm.com>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation, version 2 of the License.
11 #include <linux/module.h>
12 #include <linux/file.h>
14 #include <linux/xattr.h>
15 #include <linux/magic.h>
16 #include <linux/ima.h>
17 #include <linux/evm.h>
21 static int __init
default_appraise_setup(char *str
)
23 if (strncmp(str
, "off", 3) == 0)
25 else if (strncmp(str
, "log", 3) == 0)
26 ima_appraise
= IMA_APPRAISE_LOG
;
27 else if (strncmp(str
, "fix", 3) == 0)
28 ima_appraise
= IMA_APPRAISE_FIX
;
32 __setup("ima_appraise=", default_appraise_setup
);
35 * ima_must_appraise - set appraise flag
37 * Return 1 to appraise
39 int ima_must_appraise(struct inode
*inode
, int mask
, enum ima_hooks func
)
44 return ima_match_policy(inode
, func
, mask
, IMA_APPRAISE
, NULL
);
47 static int ima_fix_xattr(struct dentry
*dentry
,
48 struct integrity_iint_cache
*iint
)
51 u8 algo
= iint
->ima_hash
->algo
;
53 if (algo
<= HASH_ALGO_SHA1
) {
55 iint
->ima_hash
->xattr
.sha1
.type
= IMA_XATTR_DIGEST
;
58 iint
->ima_hash
->xattr
.ng
.type
= IMA_XATTR_DIGEST_NG
;
59 iint
->ima_hash
->xattr
.ng
.algo
= algo
;
61 rc
= __vfs_setxattr_noperm(dentry
, XATTR_NAME_IMA
,
62 &iint
->ima_hash
->xattr
.data
[offset
],
63 (sizeof(iint
->ima_hash
->xattr
) - offset
) +
64 iint
->ima_hash
->length
, 0);
68 /* Return specific func appraised cached result */
69 enum integrity_status
ima_get_cache_status(struct integrity_iint_cache
*iint
,
74 return iint
->ima_mmap_status
;
76 return iint
->ima_bprm_status
;
79 return iint
->ima_file_status
;
80 case MODULE_CHECK
... MAX_CHECK
- 1:
82 return iint
->ima_read_status
;
86 static void ima_set_cache_status(struct integrity_iint_cache
*iint
,
88 enum integrity_status status
)
92 iint
->ima_mmap_status
= status
;
95 iint
->ima_bprm_status
= status
;
99 iint
->ima_file_status
= status
;
101 case MODULE_CHECK
... MAX_CHECK
- 1:
103 iint
->ima_read_status
= status
;
108 static void ima_cache_flags(struct integrity_iint_cache
*iint
,
113 iint
->flags
|= (IMA_MMAP_APPRAISED
| IMA_APPRAISED
);
116 iint
->flags
|= (IMA_BPRM_APPRAISED
| IMA_APPRAISED
);
120 iint
->flags
|= (IMA_FILE_APPRAISED
| IMA_APPRAISED
);
122 case MODULE_CHECK
... MAX_CHECK
- 1:
124 iint
->flags
|= (IMA_READ_APPRAISED
| IMA_APPRAISED
);
129 enum hash_algo
ima_get_hash_algo(struct evm_ima_xattr_data
*xattr_value
,
132 struct signature_v2_hdr
*sig
;
135 if (!xattr_value
|| xattr_len
< 2)
136 /* return default hash algo */
137 return ima_hash_algo
;
139 switch (xattr_value
->type
) {
140 case EVM_IMA_XATTR_DIGSIG
:
141 sig
= (typeof(sig
))xattr_value
;
142 if (sig
->version
!= 2 || xattr_len
<= sizeof(*sig
))
143 return ima_hash_algo
;
144 return sig
->hash_algo
;
146 case IMA_XATTR_DIGEST_NG
:
147 ret
= xattr_value
->digest
[0];
148 if (ret
< HASH_ALGO__LAST
)
151 case IMA_XATTR_DIGEST
:
152 /* this is for backward compatibility */
153 if (xattr_len
== 21) {
154 unsigned int zero
= 0;
155 if (!memcmp(&xattr_value
->digest
[16], &zero
, 4))
156 return HASH_ALGO_MD5
;
158 return HASH_ALGO_SHA1
;
159 } else if (xattr_len
== 17)
160 return HASH_ALGO_MD5
;
164 /* return default hash algo */
165 return ima_hash_algo
;
168 int ima_read_xattr(struct dentry
*dentry
,
169 struct evm_ima_xattr_data
**xattr_value
)
173 ret
= vfs_getxattr_alloc(dentry
, XATTR_NAME_IMA
, (char **)xattr_value
,
175 if (ret
== -EOPNOTSUPP
)
181 * ima_appraise_measurement - appraise file measurement
183 * Call evm_verifyxattr() to verify the integrity of 'security.ima'.
184 * Assuming success, compare the xattr hash with the collected measurement.
186 * Return 0 on success, error code otherwise
188 int ima_appraise_measurement(enum ima_hooks func
,
189 struct integrity_iint_cache
*iint
,
190 struct file
*file
, const unsigned char *filename
,
191 struct evm_ima_xattr_data
*xattr_value
,
192 int xattr_len
, int opened
)
194 static const char op
[] = "appraise_data";
195 char *cause
= "unknown";
196 struct dentry
*dentry
= file_dentry(file
);
197 struct inode
*inode
= d_backing_inode(dentry
);
198 enum integrity_status status
= INTEGRITY_UNKNOWN
;
199 int rc
= xattr_len
, hash_start
= 0;
201 if (!(inode
->i_opflags
& IOP_XATTR
))
202 return INTEGRITY_UNKNOWN
;
205 if (rc
&& rc
!= -ENODATA
)
208 cause
= "missing-hash";
209 status
= INTEGRITY_NOLABEL
;
210 if (opened
& FILE_CREATED
)
211 iint
->flags
|= IMA_NEW_FILE
;
212 if ((iint
->flags
& IMA_NEW_FILE
) &&
213 !(iint
->flags
& IMA_DIGSIG_REQUIRED
))
214 status
= INTEGRITY_PASS
;
218 status
= evm_verifyxattr(dentry
, XATTR_NAME_IMA
, xattr_value
, rc
, iint
);
219 if ((status
!= INTEGRITY_PASS
) && (status
!= INTEGRITY_UNKNOWN
)) {
220 if ((status
== INTEGRITY_NOLABEL
)
221 || (status
== INTEGRITY_NOXATTRS
))
222 cause
= "missing-HMAC";
223 else if (status
== INTEGRITY_FAIL
)
224 cause
= "invalid-HMAC";
227 switch (xattr_value
->type
) {
228 case IMA_XATTR_DIGEST_NG
:
229 /* first byte contains algorithm id */
231 case IMA_XATTR_DIGEST
:
232 if (iint
->flags
& IMA_DIGSIG_REQUIRED
) {
233 cause
= "IMA-signature-required";
234 status
= INTEGRITY_FAIL
;
237 if (xattr_len
- sizeof(xattr_value
->type
) - hash_start
>=
238 iint
->ima_hash
->length
)
239 /* xattr length may be longer. md5 hash in previous
240 version occupied 20 bytes in xattr, instead of 16
242 rc
= memcmp(&xattr_value
->digest
[hash_start
],
243 iint
->ima_hash
->digest
,
244 iint
->ima_hash
->length
);
248 cause
= "invalid-hash";
249 status
= INTEGRITY_FAIL
;
252 status
= INTEGRITY_PASS
;
254 case EVM_IMA_XATTR_DIGSIG
:
255 iint
->flags
|= IMA_DIGSIG
;
256 rc
= integrity_digsig_verify(INTEGRITY_KEYRING_IMA
,
257 (const char *)xattr_value
, rc
,
258 iint
->ima_hash
->digest
,
259 iint
->ima_hash
->length
);
260 if (rc
== -EOPNOTSUPP
) {
261 status
= INTEGRITY_UNKNOWN
;
263 cause
= "invalid-signature";
264 status
= INTEGRITY_FAIL
;
266 status
= INTEGRITY_PASS
;
270 status
= INTEGRITY_UNKNOWN
;
271 cause
= "unknown-ima-data";
276 if (status
!= INTEGRITY_PASS
) {
277 if ((ima_appraise
& IMA_APPRAISE_FIX
) &&
279 xattr_value
->type
!= EVM_IMA_XATTR_DIGSIG
)) {
280 if (!ima_fix_xattr(dentry
, iint
))
281 status
= INTEGRITY_PASS
;
282 } else if ((inode
->i_size
== 0) &&
283 (iint
->flags
& IMA_NEW_FILE
) &&
285 xattr_value
->type
== EVM_IMA_XATTR_DIGSIG
)) {
286 status
= INTEGRITY_PASS
;
288 integrity_audit_msg(AUDIT_INTEGRITY_DATA
, inode
, filename
,
291 ima_cache_flags(iint
, func
);
293 ima_set_cache_status(iint
, func
, status
);
298 * ima_update_xattr - update 'security.ima' hash value
300 void ima_update_xattr(struct integrity_iint_cache
*iint
, struct file
*file
)
302 struct dentry
*dentry
= file_dentry(file
);
305 /* do not collect and update hash for digital signatures */
306 if (iint
->flags
& IMA_DIGSIG
)
309 rc
= ima_collect_measurement(iint
, file
, NULL
, 0, ima_hash_algo
);
313 ima_fix_xattr(dentry
, iint
);
317 * ima_inode_post_setattr - reflect file metadata changes
318 * @dentry: pointer to the affected dentry
320 * Changes to a dentry's metadata might result in needing to appraise.
322 * This function is called from notify_change(), which expects the caller
323 * to lock the inode's i_mutex.
325 void ima_inode_post_setattr(struct dentry
*dentry
)
327 struct inode
*inode
= d_backing_inode(dentry
);
328 struct integrity_iint_cache
*iint
;
331 if (!(ima_policy_flag
& IMA_APPRAISE
) || !S_ISREG(inode
->i_mode
)
332 || !(inode
->i_opflags
& IOP_XATTR
))
335 must_appraise
= ima_must_appraise(inode
, MAY_ACCESS
, POST_SETATTR
);
336 iint
= integrity_iint_find(inode
);
338 iint
->flags
&= ~(IMA_APPRAISE
| IMA_APPRAISED
|
339 IMA_APPRAISE_SUBMASK
| IMA_APPRAISED_SUBMASK
|
340 IMA_ACTION_RULE_FLAGS
);
342 iint
->flags
|= IMA_APPRAISE
;
345 __vfs_removexattr(dentry
, XATTR_NAME_IMA
);
349 * ima_protect_xattr - protect 'security.ima'
351 * Ensure that not just anyone can modify or remove 'security.ima'.
353 static int ima_protect_xattr(struct dentry
*dentry
, const char *xattr_name
,
354 const void *xattr_value
, size_t xattr_value_len
)
356 if (strcmp(xattr_name
, XATTR_NAME_IMA
) == 0) {
357 if (!capable(CAP_SYS_ADMIN
))
364 static void ima_reset_appraise_flags(struct inode
*inode
, int digsig
)
366 struct integrity_iint_cache
*iint
;
368 if (!(ima_policy_flag
& IMA_APPRAISE
) || !S_ISREG(inode
->i_mode
))
371 iint
= integrity_iint_find(inode
);
375 iint
->flags
&= ~IMA_DONE_MASK
;
376 iint
->measured_pcrs
= 0;
378 iint
->flags
|= IMA_DIGSIG
;
382 int ima_inode_setxattr(struct dentry
*dentry
, const char *xattr_name
,
383 const void *xattr_value
, size_t xattr_value_len
)
385 const struct evm_ima_xattr_data
*xvalue
= xattr_value
;
388 result
= ima_protect_xattr(dentry
, xattr_name
, xattr_value
,
391 if (!xattr_value_len
|| (xvalue
->type
>= IMA_XATTR_LAST
))
393 ima_reset_appraise_flags(d_backing_inode(dentry
),
394 (xvalue
->type
== EVM_IMA_XATTR_DIGSIG
) ? 1 : 0);
400 int ima_inode_removexattr(struct dentry
*dentry
, const char *xattr_name
)
404 result
= ima_protect_xattr(dentry
, xattr_name
, NULL
, 0);
406 ima_reset_appraise_flags(d_backing_inode(dentry
), 0);