]>
Commit | Line | Data |
---|---|---|
66dbc325 MZ |
1 | /* |
2 | * Copyright (C) 2005-2010 IBM Corporation | |
3 | * | |
4 | * Authors: | |
5 | * Mimi Zohar <zohar@us.ibm.com> | |
6 | * Kylene Hall <kjhall@us.ibm.com> | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation, version 2 of the License. | |
11 | * | |
12 | * File: evm_crypto.c | |
13 | * Using root's kernel master key (kmk), calculate the HMAC | |
14 | */ | |
15 | ||
20ee451f JP |
16 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
17 | ||
66dbc325 MZ |
18 | #include <linux/module.h> |
19 | #include <linux/crypto.h> | |
20 | #include <linux/xattr.h> | |
66dbc325 | 21 | #include <keys/encrypted-type.h> |
d46eb369 | 22 | #include <crypto/hash.h> |
66dbc325 MZ |
23 | #include "evm.h" |
24 | ||
25 | #define EVMKEY "evm-key" | |
26 | #define MAX_KEY_SIZE 128 | |
27 | static unsigned char evmkey[MAX_KEY_SIZE]; | |
28 | static int evmkey_len = MAX_KEY_SIZE; | |
29 | ||
d46eb369 | 30 | struct crypto_shash *hmac_tfm; |
15647eb3 | 31 | struct crypto_shash *hash_tfm; |
d46eb369 | 32 | |
97426f98 DK |
33 | static DEFINE_MUTEX(mutex); |
34 | ||
8fcc9954 | 35 | static struct shash_desc *init_desc(char type) |
66dbc325 | 36 | { |
143b01d3 | 37 | long rc; |
15647eb3 DK |
38 | char *algo; |
39 | struct crypto_shash **tfm; | |
d46eb369 DK |
40 | struct shash_desc *desc; |
41 | ||
15647eb3 DK |
42 | if (type == EVM_XATTR_HMAC) { |
43 | tfm = &hmac_tfm; | |
44 | algo = evm_hmac; | |
45 | } else { | |
46 | tfm = &hash_tfm; | |
47 | algo = evm_hash; | |
48 | } | |
49 | ||
50 | if (*tfm == NULL) { | |
97426f98 | 51 | mutex_lock(&mutex); |
143b01d3 | 52 | if (*tfm) |
97426f98 | 53 | goto out; |
15647eb3 DK |
54 | *tfm = crypto_alloc_shash(algo, 0, CRYPTO_ALG_ASYNC); |
55 | if (IS_ERR(*tfm)) { | |
15647eb3 | 56 | rc = PTR_ERR(*tfm); |
143b01d3 | 57 | pr_err("Can not allocate %s (reason: %ld)\n", algo, rc); |
15647eb3 | 58 | *tfm = NULL; |
97426f98 | 59 | mutex_unlock(&mutex); |
d46eb369 DK |
60 | return ERR_PTR(rc); |
61 | } | |
88d7ed35 DK |
62 | if (type == EVM_XATTR_HMAC) { |
63 | rc = crypto_shash_setkey(*tfm, evmkey, evmkey_len); | |
64 | if (rc) { | |
65 | crypto_free_shash(*tfm); | |
66 | *tfm = NULL; | |
143b01d3 | 67 | mutex_unlock(&mutex); |
88d7ed35 DK |
68 | return ERR_PTR(rc); |
69 | } | |
d21b5945 | 70 | } |
97426f98 DK |
71 | out: |
72 | mutex_unlock(&mutex); | |
66dbc325 | 73 | } |
d46eb369 | 74 | |
15647eb3 | 75 | desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm), |
d46eb369 DK |
76 | GFP_KERNEL); |
77 | if (!desc) | |
78 | return ERR_PTR(-ENOMEM); | |
79 | ||
15647eb3 | 80 | desc->tfm = *tfm; |
d46eb369 DK |
81 | desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; |
82 | ||
d46eb369 | 83 | rc = crypto_shash_init(desc); |
d46eb369 DK |
84 | if (rc) { |
85 | kfree(desc); | |
86 | return ERR_PTR(rc); | |
87 | } | |
88 | return desc; | |
66dbc325 MZ |
89 | } |
90 | ||
91 | /* Protect against 'cutting & pasting' security.evm xattr, include inode | |
92 | * specific info. | |
93 | * | |
94 | * (Additional directory/file metadata needs to be added for more complete | |
95 | * protection.) | |
96 | */ | |
d46eb369 | 97 | static void hmac_add_misc(struct shash_desc *desc, struct inode *inode, |
66dbc325 MZ |
98 | char *digest) |
99 | { | |
100 | struct h_misc { | |
101 | unsigned long ino; | |
102 | __u32 generation; | |
103 | uid_t uid; | |
104 | gid_t gid; | |
105 | umode_t mode; | |
106 | } hmac_misc; | |
66dbc325 | 107 | |
2bb930ab | 108 | memset(&hmac_misc, 0, sizeof(hmac_misc)); |
66dbc325 MZ |
109 | hmac_misc.ino = inode->i_ino; |
110 | hmac_misc.generation = inode->i_generation; | |
cf9c9352 EB |
111 | hmac_misc.uid = from_kuid(&init_user_ns, inode->i_uid); |
112 | hmac_misc.gid = from_kgid(&init_user_ns, inode->i_gid); | |
66dbc325 | 113 | hmac_misc.mode = inode->i_mode; |
2bb930ab | 114 | crypto_shash_update(desc, (const u8 *)&hmac_misc, sizeof(hmac_misc)); |
d3b33679 | 115 | if (evm_hmac_attrs & EVM_ATTR_FSUUID) |
74de6684 DK |
116 | crypto_shash_update(desc, inode->i_sb->s_uuid, |
117 | sizeof(inode->i_sb->s_uuid)); | |
d46eb369 | 118 | crypto_shash_final(desc, digest); |
66dbc325 MZ |
119 | } |
120 | ||
121 | /* | |
122 | * Calculate the HMAC value across the set of protected security xattrs. | |
123 | * | |
124 | * Instead of retrieving the requested xattr, for performance, calculate | |
125 | * the hmac using the requested xattr value. Don't alloc/free memory for | |
126 | * each xattr, but attempt to re-use the previously allocated memory. | |
127 | */ | |
15647eb3 DK |
128 | static int evm_calc_hmac_or_hash(struct dentry *dentry, |
129 | const char *req_xattr_name, | |
130 | const char *req_xattr_value, | |
131 | size_t req_xattr_value_len, | |
132 | char type, char *digest) | |
66dbc325 | 133 | { |
c6f493d6 | 134 | struct inode *inode = d_backing_inode(dentry); |
d46eb369 | 135 | struct shash_desc *desc; |
66dbc325 MZ |
136 | char **xattrname; |
137 | size_t xattr_size = 0; | |
138 | char *xattr_value = NULL; | |
139 | int error; | |
140 | int size; | |
141 | ||
627bf81a | 142 | if (!inode->i_op->getxattr) |
66dbc325 | 143 | return -EOPNOTSUPP; |
15647eb3 | 144 | desc = init_desc(type); |
d46eb369 DK |
145 | if (IS_ERR(desc)) |
146 | return PTR_ERR(desc); | |
66dbc325 MZ |
147 | |
148 | error = -ENODATA; | |
149 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { | |
150 | if ((req_xattr_name && req_xattr_value) | |
151 | && !strcmp(*xattrname, req_xattr_name)) { | |
152 | error = 0; | |
d46eb369 DK |
153 | crypto_shash_update(desc, (const u8 *)req_xattr_value, |
154 | req_xattr_value_len); | |
66dbc325 MZ |
155 | continue; |
156 | } | |
157 | size = vfs_getxattr_alloc(dentry, *xattrname, | |
158 | &xattr_value, xattr_size, GFP_NOFS); | |
159 | if (size == -ENOMEM) { | |
160 | error = -ENOMEM; | |
161 | goto out; | |
162 | } | |
163 | if (size < 0) | |
164 | continue; | |
165 | ||
166 | error = 0; | |
167 | xattr_size = size; | |
d46eb369 | 168 | crypto_shash_update(desc, (const u8 *)xattr_value, xattr_size); |
66dbc325 | 169 | } |
d46eb369 DK |
170 | hmac_add_misc(desc, inode, digest); |
171 | ||
66dbc325 | 172 | out: |
d46eb369 DK |
173 | kfree(xattr_value); |
174 | kfree(desc); | |
66dbc325 MZ |
175 | return error; |
176 | } | |
177 | ||
15647eb3 DK |
178 | int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name, |
179 | const char *req_xattr_value, size_t req_xattr_value_len, | |
180 | char *digest) | |
181 | { | |
182 | return evm_calc_hmac_or_hash(dentry, req_xattr_name, req_xattr_value, | |
183 | req_xattr_value_len, EVM_XATTR_HMAC, digest); | |
184 | } | |
185 | ||
186 | int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name, | |
187 | const char *req_xattr_value, size_t req_xattr_value_len, | |
188 | char *digest) | |
189 | { | |
190 | return evm_calc_hmac_or_hash(dentry, req_xattr_name, req_xattr_value, | |
191 | req_xattr_value_len, IMA_XATTR_DIGEST, digest); | |
192 | } | |
193 | ||
66dbc325 MZ |
194 | /* |
195 | * Calculate the hmac and update security.evm xattr | |
196 | * | |
197 | * Expects to be called with i_mutex locked. | |
198 | */ | |
199 | int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name, | |
200 | const char *xattr_value, size_t xattr_value_len) | |
201 | { | |
c6f493d6 | 202 | struct inode *inode = d_backing_inode(dentry); |
6be5cc52 | 203 | struct evm_ima_xattr_data xattr_data; |
66dbc325 MZ |
204 | int rc = 0; |
205 | ||
206 | rc = evm_calc_hmac(dentry, xattr_name, xattr_value, | |
6be5cc52 DK |
207 | xattr_value_len, xattr_data.digest); |
208 | if (rc == 0) { | |
209 | xattr_data.type = EVM_XATTR_HMAC; | |
66dbc325 | 210 | rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_EVM, |
6be5cc52 DK |
211 | &xattr_data, |
212 | sizeof(xattr_data), 0); | |
a67adb99 | 213 | } else if (rc == -ENODATA && inode->i_op->removexattr) { |
66dbc325 | 214 | rc = inode->i_op->removexattr(dentry, XATTR_NAME_EVM); |
a67adb99 | 215 | } |
66dbc325 MZ |
216 | return rc; |
217 | } | |
218 | ||
cb723180 MZ |
219 | int evm_init_hmac(struct inode *inode, const struct xattr *lsm_xattr, |
220 | char *hmac_val) | |
221 | { | |
d46eb369 | 222 | struct shash_desc *desc; |
cb723180 | 223 | |
15647eb3 | 224 | desc = init_desc(EVM_XATTR_HMAC); |
d46eb369 | 225 | if (IS_ERR(desc)) { |
20ee451f | 226 | pr_info("init_desc failed\n"); |
d46eb369 | 227 | return PTR_ERR(desc); |
cb723180 MZ |
228 | } |
229 | ||
d46eb369 DK |
230 | crypto_shash_update(desc, lsm_xattr->value, lsm_xattr->value_len); |
231 | hmac_add_misc(desc, inode, hmac_val); | |
232 | kfree(desc); | |
cb723180 MZ |
233 | return 0; |
234 | } | |
235 | ||
66dbc325 MZ |
236 | /* |
237 | * Get the key from the TPM for the SHA1-HMAC | |
238 | */ | |
239 | int evm_init_key(void) | |
240 | { | |
241 | struct key *evm_key; | |
242 | struct encrypted_key_payload *ekp; | |
243 | int rc = 0; | |
244 | ||
245 | evm_key = request_key(&key_type_encrypted, EVMKEY, NULL); | |
246 | if (IS_ERR(evm_key)) | |
247 | return -ENOENT; | |
248 | ||
249 | down_read(&evm_key->sem); | |
146aa8b1 | 250 | ekp = evm_key->payload.data[0]; |
66dbc325 MZ |
251 | if (ekp->decrypted_datalen > MAX_KEY_SIZE) { |
252 | rc = -EINVAL; | |
253 | goto out; | |
254 | } | |
255 | memcpy(evmkey, ekp->decrypted_data, ekp->decrypted_datalen); | |
256 | out: | |
257 | /* burn the original key contents */ | |
258 | memset(ekp->decrypted_data, 0, ekp->decrypted_datalen); | |
259 | up_read(&evm_key->sem); | |
260 | key_put(evm_key); | |
261 | return rc; | |
262 | } |