[mirror_ubuntu-bionic-kernel.git] / security / integrity / evm / evm_main.c

/*
 * Copyright (C) 2005-2010 IBM Corporation
 *
 * Author:
 * Mimi Zohar <zohar@us.ibm.com>
 * Kylene Hall <kjhall@us.ibm.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 2 of the License.
 *
 * File: evm_main.c
 *	implements evm_inode_setxattr, evm_inode_post_setxattr,
 *	evm_inode_removexattr, and evm_verifyxattr
 */

#include <linux/module.h>
#include <linux/crypto.h>
#include <linux/audit.h>
#include <linux/xattr.h>
#include <linux/integrity.h>
#include <linux/evm.h>
#include <crypto/hash.h>
#include "evm.h"

int evm_initialized;

static char *integrity_status_msg[] = {
	"pass", "fail", "no_label", "no_xattrs", "unknown"
};
char *evm_hmac = "hmac(sha1)";
char *evm_hash = "sha1";
int evm_hmac_version = CONFIG_EVM_HMAC_VERSION;

char *evm_config_xattrnames[] = {
#ifdef CONFIG_SECURITY_SELINUX
	XATTR_NAME_SELINUX,
#endif
#ifdef CONFIG_SECURITY_SMACK
	XATTR_NAME_SMACK,
#endif
#ifdef CONFIG_IMA_APPRAISE
	XATTR_NAME_IMA,
#endif
	XATTR_NAME_CAPS,
	NULL
};

static int evm_fixmode;
static int __init evm_set_fixmode(char *str)
{
	if (strncmp(str, "fix", 3) == 0)
		evm_fixmode = 1;
	return 0;
}
__setup("evm=", evm_set_fixmode);

static int evm_find_protected_xattrs(struct dentry *dentry)
{
	struct inode *inode = dentry->d_inode;
	char **xattr;
	int error;
	int count = 0;

	if (!inode->i_op || !inode->i_op->getxattr)
		return -EOPNOTSUPP;

	for (xattr = evm_config_xattrnames; *xattr != NULL; xattr++) {
		error = inode->i_op->getxattr(dentry, *xattr, NULL, 0);
		if (error < 0) {
			if (error == -ENODATA)
				continue;
			return error;
		}
		count++;
	}

	return count;
}

/*
 * evm_verify_hmac - calculate and compare the HMAC with the EVM xattr
 *
 * Compute the HMAC on the dentry's protected set of extended attributes
 * and compare it against the stored security.evm xattr.
 *
 * For performance:
 * - use the previoulsy retrieved xattr value and length to calculate the
 *   HMAC.)
 * - cache the verification result in the iint, when available.
 *
 * Returns integrity status
 */
static enum integrity_status evm_verify_hmac(struct dentry *dentry,
					     const char *xattr_name,
					     char *xattr_value,
					     size_t xattr_value_len,
					     struct integrity_iint_cache *iint)
{
	struct evm_ima_xattr_data *xattr_data = NULL;
	struct evm_ima_xattr_data calc;
	enum integrity_status evm_status = INTEGRITY_PASS;
	int rc, xattr_len;

	if (iint && iint->evm_status == INTEGRITY_PASS)
		return iint->evm_status;

	/* if status is not PASS, try to check again - against -ENOMEM */

	/* first need to know the sig type */
	rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0,
				GFP_NOFS);
	if (rc <= 0) {
		if (rc == 0)
			evm_status = INTEGRITY_FAIL; /* empty */
		else if (rc == -ENODATA) {
			rc = evm_find_protected_xattrs(dentry);
			if (rc > 0)
				evm_status = INTEGRITY_NOLABEL;
			else if (rc == 0)
				evm_status = INTEGRITY_NOXATTRS; /* new file */
		}
		goto out;
	}

	xattr_len = rc;

	/* check value type */
	switch (xattr_data->type) {
	case EVM_XATTR_HMAC:
		rc = evm_calc_hmac(dentry, xattr_name, xattr_value,
				   xattr_value_len, calc.digest);
		if (rc)
			break;
		rc = memcmp(xattr_data->digest, calc.digest,
			    sizeof(calc.digest));
		if (rc)
			rc = -EINVAL;
		break;
	case EVM_IMA_XATTR_DIGSIG:
		rc = evm_calc_hash(dentry, xattr_name, xattr_value,
				xattr_value_len, calc.digest);
		if (rc)
			break;
		rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM,
					(const char *)xattr_data, xattr_len,
					calc.digest, sizeof(calc.digest));
		if (!rc) {
			/* we probably want to replace rsa with hmac here */
			evm_update_evmxattr(dentry, xattr_name, xattr_value,
				   xattr_value_len);
		}
		break;
	default:
		rc = -EINVAL;
		break;
	}

	if (rc)
		evm_status = (rc == -ENODATA) ?
				INTEGRITY_NOXATTRS : INTEGRITY_FAIL;
out:
	if (iint)
		iint->evm_status = evm_status;
	kfree(xattr_data);
	return evm_status;
}

static int evm_protected_xattr(const char *req_xattr_name)
{
	char **xattrname;
	int namelen;
	int found = 0;

	namelen = strlen(req_xattr_name);
	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
		if ((strlen(*xattrname) == namelen)
		    && (strncmp(req_xattr_name, *xattrname, namelen) == 0)) {
			found = 1;
			break;
		}
		if (strncmp(req_xattr_name,
			    *xattrname + XATTR_SECURITY_PREFIX_LEN,
			    strlen(req_xattr_name)) == 0) {
			found = 1;
			break;
		}
	}
	return found;
}

/**
 * evm_verifyxattr - verify the integrity of the requested xattr
 * @dentry: object of the verify xattr
 * @xattr_name: requested xattr
 * @xattr_value: requested xattr value
 * @xattr_value_len: requested xattr value length
 *
 * Calculate the HMAC for the given dentry and verify it against the stored
 * security.evm xattr. For performance, use the xattr value and length
 * previously retrieved to calculate the HMAC.
 *
 * Returns the xattr integrity status.
 *
 * This function requires the caller to lock the inode's i_mutex before it
 * is executed.
 */
enum integrity_status evm_verifyxattr(struct dentry *dentry,
				      const char *xattr_name,
				      void *xattr_value, size_t xattr_value_len,
				      struct integrity_iint_cache *iint)
{
	if (!evm_initialized || !evm_protected_xattr(xattr_name))
		return INTEGRITY_UNKNOWN;

	if (!iint) {
		iint = integrity_iint_find(dentry->d_inode);
		if (!iint)
			return INTEGRITY_UNKNOWN;
	}
	return evm_verify_hmac(dentry, xattr_name, xattr_value,
				 xattr_value_len, iint);
}
EXPORT_SYMBOL_GPL(evm_verifyxattr);

/*
 * evm_verify_current_integrity - verify the dentry's metadata integrity
 * @dentry: pointer to the affected dentry
 *
 * Verify and return the dentry's metadata integrity. The exceptions are
 * before EVM is initialized or in 'fix' mode.
 */
static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
{
	struct inode *inode = dentry->d_inode;

	if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode)
		return 0;
	return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
}

/*
 * evm_protect_xattr - protect the EVM extended attribute
 *
 * Prevent security.evm from being modified or removed without the
 * necessary permissions or when the existing value is invalid.
 *
 * The posix xattr acls are 'system' prefixed, which normally would not
 * affect security.evm.  An interesting side affect of writing posix xattr
 * acls is their modifying of the i_mode, which is included in security.evm.
 * For posix xattr acls only, permit security.evm, even if it currently
 * doesn't exist, to be updated.
 */
static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
			     const void *xattr_value, size_t xattr_value_len)
{
	enum integrity_status evm_status;

	if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
		if (!capable(CAP_SYS_ADMIN))
			return -EPERM;
	} else if (!evm_protected_xattr(xattr_name)) {
		if (!posix_xattr_acl(xattr_name))
			return 0;
		evm_status = evm_verify_current_integrity(dentry);
		if ((evm_status == INTEGRITY_PASS) ||
		    (evm_status == INTEGRITY_NOXATTRS))
			return 0;
		goto out;
	}
	evm_status = evm_verify_current_integrity(dentry);
out:
	if (evm_status != INTEGRITY_PASS)
		integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode,
				    dentry->d_name.name, "appraise_metadata",
				    integrity_status_msg[evm_status],
				    -EPERM, 0);
	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
}

/**
 * evm_inode_setxattr - protect the EVM extended attribute
 * @dentry: pointer to the affected dentry
 * @xattr_name: pointer to the affected extended attribute name
 * @xattr_value: pointer to the new extended attribute value
 * @xattr_value_len: pointer to the new extended attribute value length
 *
 * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
 * the current value is valid.
 */
int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
		       const void *xattr_value, size_t xattr_value_len)
{
	return evm_protect_xattr(dentry, xattr_name, xattr_value,
				 xattr_value_len);
}

/**
 * evm_inode_removexattr - protect the EVM extended attribute
 * @dentry: pointer to the affected dentry
 * @xattr_name: pointer to the affected extended attribute name
 *
 * Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that
 * the current value is valid.
 */
int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name)
{
	return evm_protect_xattr(dentry, xattr_name, NULL, 0);
}

/**
 * evm_inode_post_setxattr - update 'security.evm' to reflect the changes
 * @dentry: pointer to the affected dentry
 * @xattr_name: pointer to the affected extended attribute name
 * @xattr_value: pointer to the new extended attribute value
 * @xattr_value_len: pointer to the new extended attribute value length
 *
 * Update the HMAC stored in 'security.evm' to reflect the change.
 *
 * No need to take the i_mutex lock here, as this function is called from
 * __vfs_setxattr_noperm().  The caller of which has taken the inode's
 * i_mutex lock.
 */
void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name,
			     const void *xattr_value, size_t xattr_value_len)
{
	if (!evm_initialized || (!evm_protected_xattr(xattr_name)
				 && !posix_xattr_acl(xattr_name)))
		return;

	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
	return;
}

/**
 * evm_inode_post_removexattr - update 'security.evm' after removing the xattr
 * @dentry: pointer to the affected dentry
 * @xattr_name: pointer to the affected extended attribute name
 *
 * Update the HMAC stored in 'security.evm' to reflect removal of the xattr.
 */
void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name)
{
	struct inode *inode = dentry->d_inode;

	if (!evm_initialized || !evm_protected_xattr(xattr_name))
		return;

	mutex_lock(&inode->i_mutex);
	evm_update_evmxattr(dentry, xattr_name, NULL, 0);
	mutex_unlock(&inode->i_mutex);
	return;
}

/**
 * evm_inode_setattr - prevent updating an invalid EVM extended attribute
 * @dentry: pointer to the affected dentry
 */
int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
{
	unsigned int ia_valid = attr->ia_valid;
	enum integrity_status evm_status;

	if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)))
		return 0;
	evm_status = evm_verify_current_integrity(dentry);
	if ((evm_status == INTEGRITY_PASS) ||
	    (evm_status == INTEGRITY_NOXATTRS))
		return 0;
	integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode,
			    dentry->d_name.name, "appraise_metadata",
			    integrity_status_msg[evm_status], -EPERM, 0);
	return -EPERM;
}

/**
 * evm_inode_post_setattr - update 'security.evm' after modifying metadata
 * @dentry: pointer to the affected dentry
 * @ia_valid: for the UID and GID status
 *
 * For now, update the HMAC stored in 'security.evm' to reflect UID/GID
 * changes.
 *
 * This function is called from notify_change(), which expects the caller
 * to lock the inode's i_mutex.
 */
void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
{
	if (!evm_initialized)
		return;

	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))
		evm_update_evmxattr(dentry, NULL, NULL, 0);
	return;
}

/*
 * evm_inode_init_security - initializes security.evm
 */
int evm_inode_init_security(struct inode *inode,
				 const struct xattr *lsm_xattr,
				 struct xattr *evm_xattr)
{
	struct evm_ima_xattr_data *xattr_data;
	int rc;

	if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name))
		return 0;

	xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
	if (!xattr_data)
		return -ENOMEM;

	xattr_data->type = EVM_XATTR_HMAC;
	rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
	if (rc < 0)
		goto out;

	evm_xattr->value = xattr_data;
	evm_xattr->value_len = sizeof(*xattr_data);
	evm_xattr->name = XATTR_EVM_SUFFIX;
	return 0;
out:
	kfree(xattr_data);
	return rc;
}
EXPORT_SYMBOL_GPL(evm_inode_init_security);

static int __init init_evm(void)
{
	int error;

	error = evm_init_secfs();
	if (error < 0) {
		printk(KERN_INFO "EVM: Error registering secfs\n");
		goto err;
	}

	return 0;
err:
	return error;
}

/*
 * evm_display_config - list the EVM protected security extended attributes
 */
static int __init evm_display_config(void)
{
	char **xattrname;

	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++)
		printk(KERN_INFO "EVM: %s\n", *xattrname);
	return 0;
}

pure_initcall(evm_display_config);
late_initcall(init_evm);

MODULE_DESCRIPTION("Extended Verification Module");
MODULE_LICENSE("GPL");
Commit	Line	Data
66dbc325 MZ	1	/*
	2	* Copyright (C) 2005-2010 IBM Corporation
	3	*
	4	* Author:
	5	* Mimi Zohar <zohar@us.ibm.com>
	6	* Kylene Hall <kjhall@us.ibm.com>
	7	*
	8	* This program is free software; you can redistribute it and/or modify
	9	* it under the terms of the GNU General Public License as published by
	10	* the Free Software Foundation, version 2 of the License.
	11	*
	12	* File: evm_main.c
	13	* implements evm_inode_setxattr, evm_inode_post_setxattr,
	14	* evm_inode_removexattr, and evm_verifyxattr
	15	*/
	16
	17	#include <linux/module.h>
	18	#include <linux/crypto.h>
9b97b6cd	19	#include <linux/audit.h>
66dbc325 MZ	20	#include <linux/xattr.h>
66dbc325 MZ	21	#include <linux/integrity.h>
3e1be52d	22	#include <linux/evm.h>
d46eb369	23	#include <crypto/hash.h>
66dbc325 MZ	24	#include "evm.h"
	25
	26	int evm_initialized;
	27
9b97b6cd MZ	28	static char *integrity_status_msg[] = {
	29	"pass", "fail", "no_label", "no_xattrs", "unknown"
	30	};
66dbc325	31	char *evm_hmac = "hmac(sha1)";
15647eb3	32	char *evm_hash = "sha1";
74de6684	33	int evm_hmac_version = CONFIG_EVM_HMAC_VERSION;
66dbc325 MZ	34
	35	char *evm_config_xattrnames[] = {
	36	#ifdef CONFIG_SECURITY_SELINUX
	37	XATTR_NAME_SELINUX,
	38	#endif
	39	#ifdef CONFIG_SECURITY_SMACK
	40	XATTR_NAME_SMACK,
2fe5d6de MZ	41	#endif
	42	#ifdef CONFIG_IMA_APPRAISE
	43	XATTR_NAME_IMA,
66dbc325 MZ	44	#endif
	45	XATTR_NAME_CAPS,
	46	NULL
	47	};
	48
7102ebcd MZ	49	static int evm_fixmode;
	50	static int __init evm_set_fixmode(char *str)
	51	{
	52	if (strncmp(str, "fix", 3) == 0)
	53	evm_fixmode = 1;
	54	return 0;
	55	}
	56	__setup("evm=", evm_set_fixmode);
	57
15647eb3 DK	58	static int evm_find_protected_xattrs(struct dentry *dentry)
	59	{
	60	struct inode *inode = dentry->d_inode;
	61	char **xattr;
	62	int error;
	63	int count = 0;
	64
	65	if (!inode->i_op \|\| !inode->i_op->getxattr)
	66	return -EOPNOTSUPP;
	67
	68	for (xattr = evm_config_xattrnames; *xattr != NULL; xattr++) {
	69	error = inode->i_op->getxattr(dentry, *xattr, NULL, 0);
	70	if (error < 0) {
	71	if (error == -ENODATA)
	72	continue;
	73	return error;
	74	}
	75	count++;
	76	}
	77
	78	return count;
	79	}
	80
66dbc325 MZ	81	/*
	82	* evm_verify_hmac - calculate and compare the HMAC with the EVM xattr
	83	*
	84	* Compute the HMAC on the dentry's protected set of extended attributes
7102ebcd MZ	85	* and compare it against the stored security.evm xattr.
	86	*
	87	* For performance:
	88	* - use the previoulsy retrieved xattr value and length to calculate the
	89	* HMAC.)
	90	* - cache the verification result in the iint, when available.
66dbc325 MZ	91	*
	92	* Returns integrity status
	93	*/
	94	static enum integrity_status evm_verify_hmac(struct dentry *dentry,
	95	const char *xattr_name,
	96	char *xattr_value,
	97	size_t xattr_value_len,
	98	struct integrity_iint_cache *iint)
	99	{
15647eb3 DK	100	struct evm_ima_xattr_data *xattr_data = NULL;
15647eb3 DK	101	struct evm_ima_xattr_data calc;
566be59a	102	enum integrity_status evm_status = INTEGRITY_PASS;
15647eb3	103	int rc, xattr_len;
66dbc325	104
7102ebcd	105	if (iint && iint->evm_status == INTEGRITY_PASS)
24e0198e	106	return iint->evm_status;
66dbc325	107
6d38ca01 DK	108	/* if status is not PASS, try to check again - against -ENOMEM */
6d38ca01 DK	109
15647eb3 DK	110	/* first need to know the sig type */
	111	rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0,
	112	GFP_NOFS);
	113	if (rc <= 0) {
	114	if (rc == 0)
	115	evm_status = INTEGRITY_FAIL; /* empty */
	116	else if (rc == -ENODATA) {
	117	rc = evm_find_protected_xattrs(dentry);
	118	if (rc > 0)
	119	evm_status = INTEGRITY_NOLABEL;
	120	else if (rc == 0)
	121	evm_status = INTEGRITY_NOXATTRS; /* new file */
	122	}
566be59a MZ	123	goto out;
566be59a MZ	124	}
66dbc325	125
b1aaab22	126	xattr_len = rc;
15647eb3 DK	127
	128	/* check value type */
	129	switch (xattr_data->type) {
	130	case EVM_XATTR_HMAC:
	131	rc = evm_calc_hmac(dentry, xattr_name, xattr_value,
	132	xattr_value_len, calc.digest);
	133	if (rc)
	134	break;
	135	rc = memcmp(xattr_data->digest, calc.digest,
	136	sizeof(calc.digest));
	137	if (rc)
	138	rc = -EINVAL;
	139	break;
	140	case EVM_IMA_XATTR_DIGSIG:
	141	rc = evm_calc_hash(dentry, xattr_name, xattr_value,
	142	xattr_value_len, calc.digest);
	143	if (rc)
	144	break;
	145	rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM,
b1aaab22	146	(const char *)xattr_data, xattr_len,
15647eb3 DK	147	calc.digest, sizeof(calc.digest));
	148	if (!rc) {
	149	/* we probably want to replace rsa with hmac here */
	150	evm_update_evmxattr(dentry, xattr_name, xattr_value,
	151	xattr_value_len);
	152	}
	153	break;
	154	default:
	155	rc = -EINVAL;
	156	break;
	157	}
	158
	159	if (rc)
	160	evm_status = (rc == -ENODATA) ?
	161	INTEGRITY_NOXATTRS : INTEGRITY_FAIL;
7102ebcd MZ	162	out:
	163	if (iint)
	164	iint->evm_status = evm_status;
15647eb3	165	kfree(xattr_data);
7102ebcd	166	return evm_status;
66dbc325 MZ	167	}
	168
	169	static int evm_protected_xattr(const char *req_xattr_name)
	170	{
	171	char **xattrname;
	172	int namelen;
	173	int found = 0;
	174
	175	namelen = strlen(req_xattr_name);
	176	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
	177	if ((strlen(*xattrname) == namelen)
	178	&& (strncmp(req_xattr_name, *xattrname, namelen) == 0)) {
	179	found = 1;
	180	break;
	181	}
cb723180 MZ	182	if (strncmp(req_xattr_name,
	183	*xattrname + XATTR_SECURITY_PREFIX_LEN,
	184	strlen(req_xattr_name)) == 0) {
	185	found = 1;
	186	break;
	187	}
66dbc325 MZ	188	}
	189	return found;
	190	}
	191
	192	/**
	193	* evm_verifyxattr - verify the integrity of the requested xattr
	194	* @dentry: object of the verify xattr
	195	* @xattr_name: requested xattr
	196	* @xattr_value: requested xattr value
	197	* @xattr_value_len: requested xattr value length
	198	*
	199	* Calculate the HMAC for the given dentry and verify it against the stored
	200	* security.evm xattr. For performance, use the xattr value and length
	201	* previously retrieved to calculate the HMAC.
	202	*
	203	* Returns the xattr integrity status.
	204	*
	205	* This function requires the caller to lock the inode's i_mutex before it
	206	* is executed.
	207	*/
	208	enum integrity_status evm_verifyxattr(struct dentry *dentry,
	209	const char *xattr_name,
2960e6cb DK	210	void *xattr_value, size_t xattr_value_len,
2960e6cb DK	211	struct integrity_iint_cache *iint)
66dbc325	212	{
66dbc325 MZ	213	if (!evm_initialized \|\| !evm_protected_xattr(xattr_name))
	214	return INTEGRITY_UNKNOWN;
	215
2960e6cb DK	216	if (!iint) {
	217	iint = integrity_iint_find(dentry->d_inode);
	218	if (!iint)
	219	return INTEGRITY_UNKNOWN;
	220	}
	221	return evm_verify_hmac(dentry, xattr_name, xattr_value,
66dbc325	222	xattr_value_len, iint);
66dbc325 MZ	223	}
	224	EXPORT_SYMBOL_GPL(evm_verifyxattr);
	225
7102ebcd MZ	226	/*
	227	* evm_verify_current_integrity - verify the dentry's metadata integrity
	228	* @dentry: pointer to the affected dentry
	229	*
	230	* Verify and return the dentry's metadata integrity. The exceptions are
	231	* before EVM is initialized or in 'fix' mode.
	232	*/
	233	static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
	234	{
	235	struct inode *inode = dentry->d_inode;
	236
	237	if (!evm_initialized \|\| !S_ISREG(inode->i_mode) \|\| evm_fixmode)
	238	return 0;
	239	return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
	240	}
	241
a924ce0b MZ	242	/*
	243	* evm_protect_xattr - protect the EVM extended attribute
	244	*
bf6d0f5d MZ	245	* Prevent security.evm from being modified or removed without the
	246	* necessary permissions or when the existing value is invalid.
	247	*
	248	* The posix xattr acls are 'system' prefixed, which normally would not
	249	* affect security.evm. An interesting side affect of writing posix xattr
	250	* acls is their modifying of the i_mode, which is included in security.evm.
	251	* For posix xattr acls only, permit security.evm, even if it currently
	252	* doesn't exist, to be updated.
a924ce0b MZ	253	*/
	254	static int evm_protect_xattr(struct dentry dentry, const char xattr_name,
	255	const void *xattr_value, size_t xattr_value_len)
	256	{
	257	enum integrity_status evm_status;
	258
	259	if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
	260	if (!capable(CAP_SYS_ADMIN))
	261	return -EPERM;
bf6d0f5d MZ	262	} else if (!evm_protected_xattr(xattr_name)) {
	263	if (!posix_xattr_acl(xattr_name))
	264	return 0;
	265	evm_status = evm_verify_current_integrity(dentry);
	266	if ((evm_status == INTEGRITY_PASS) \|\|
566be59a	267	(evm_status == INTEGRITY_NOXATTRS))
bf6d0f5d	268	return 0;
9b97b6cd	269	goto out;
bf6d0f5d	270	}
a924ce0b	271	evm_status = evm_verify_current_integrity(dentry);
9b97b6cd MZ	272	out:
	273	if (evm_status != INTEGRITY_PASS)
	274	integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode,
	275	dentry->d_name.name, "appraise_metadata",
	276	integrity_status_msg[evm_status],
	277	-EPERM, 0);
a924ce0b MZ	278	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
	279	}
	280
66dbc325 MZ	281	/**
	282	* evm_inode_setxattr - protect the EVM extended attribute
	283	* @dentry: pointer to the affected dentry
	284	* @xattr_name: pointer to the affected extended attribute name
	285	* @xattr_value: pointer to the new extended attribute value
	286	* @xattr_value_len: pointer to the new extended attribute value length
	287	*
7102ebcd MZ	288	* Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
7102ebcd MZ	289	* the current value is valid.
66dbc325 MZ	290	*/
	291	int evm_inode_setxattr(struct dentry dentry, const char xattr_name,
	292	const void *xattr_value, size_t xattr_value_len)
	293	{
a924ce0b MZ	294	return evm_protect_xattr(dentry, xattr_name, xattr_value,
a924ce0b MZ	295	xattr_value_len);
66dbc325 MZ	296	}
	297
	298	/**
	299	* evm_inode_removexattr - protect the EVM extended attribute
	300	* @dentry: pointer to the affected dentry
	301	* @xattr_name: pointer to the affected extended attribute name
	302	*
7102ebcd MZ	303	* Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that
7102ebcd MZ	304	* the current value is valid.
66dbc325 MZ	305	*/
	306	int evm_inode_removexattr(struct dentry dentry, const char xattr_name)
	307	{
a924ce0b	308	return evm_protect_xattr(dentry, xattr_name, NULL, 0);
66dbc325 MZ	309	}
	310
	311	/**
	312	* evm_inode_post_setxattr - update 'security.evm' to reflect the changes
	313	* @dentry: pointer to the affected dentry
	314	* @xattr_name: pointer to the affected extended attribute name
	315	* @xattr_value: pointer to the new extended attribute value
	316	* @xattr_value_len: pointer to the new extended attribute value length
	317	*
	318	* Update the HMAC stored in 'security.evm' to reflect the change.
	319	*
	320	* No need to take the i_mutex lock here, as this function is called from
	321	* __vfs_setxattr_noperm(). The caller of which has taken the inode's
	322	* i_mutex lock.
	323	*/
	324	void evm_inode_post_setxattr(struct dentry dentry, const char xattr_name,
	325	const void *xattr_value, size_t xattr_value_len)
	326	{
bf6d0f5d MZ	327	if (!evm_initialized \|\| (!evm_protected_xattr(xattr_name)
bf6d0f5d MZ	328	&& !posix_xattr_acl(xattr_name)))
66dbc325 MZ	329	return;
	330
	331	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
	332	return;
	333	}
	334
	335	/**
	336	* evm_inode_post_removexattr - update 'security.evm' after removing the xattr
	337	* @dentry: pointer to the affected dentry
	338	* @xattr_name: pointer to the affected extended attribute name
	339	*
	340	* Update the HMAC stored in 'security.evm' to reflect removal of the xattr.
	341	*/
	342	void evm_inode_post_removexattr(struct dentry dentry, const char xattr_name)
	343	{
	344	struct inode *inode = dentry->d_inode;
	345
	346	if (!evm_initialized \|\| !evm_protected_xattr(xattr_name))
	347	return;
	348
	349	mutex_lock(&inode->i_mutex);
	350	evm_update_evmxattr(dentry, xattr_name, NULL, 0);
	351	mutex_unlock(&inode->i_mutex);
	352	return;
	353	}
	354
817b54aa MZ	355	/**
	356	* evm_inode_setattr - prevent updating an invalid EVM extended attribute
	357	* @dentry: pointer to the affected dentry
	358	*/
	359	int evm_inode_setattr(struct dentry dentry, struct iattr attr)
	360	{
	361	unsigned int ia_valid = attr->ia_valid;
	362	enum integrity_status evm_status;
	363
a924ce0b	364	if (!(ia_valid & (ATTR_MODE \| ATTR_UID \| ATTR_GID)))
817b54aa MZ	365	return 0;
817b54aa MZ	366	evm_status = evm_verify_current_integrity(dentry);
566be59a MZ	367	if ((evm_status == INTEGRITY_PASS) \|\|
	368	(evm_status == INTEGRITY_NOXATTRS))
	369	return 0;
9b97b6cd MZ	370	integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode,
	371	dentry->d_name.name, "appraise_metadata",
	372	integrity_status_msg[evm_status], -EPERM, 0);
566be59a	373	return -EPERM;
817b54aa MZ	374	}
817b54aa MZ	375
66dbc325 MZ	376	/**
	377	* evm_inode_post_setattr - update 'security.evm' after modifying metadata
	378	* @dentry: pointer to the affected dentry
	379	* @ia_valid: for the UID and GID status
	380	*
	381	* For now, update the HMAC stored in 'security.evm' to reflect UID/GID
	382	* changes.
	383	*
	384	* This function is called from notify_change(), which expects the caller
	385	* to lock the inode's i_mutex.
	386	*/
	387	void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
	388	{
	389	if (!evm_initialized)
	390	return;
	391
	392	if (ia_valid & (ATTR_MODE \| ATTR_UID \| ATTR_GID))
	393	evm_update_evmxattr(dentry, NULL, NULL, 0);
	394	return;
	395	}
	396
cb723180 MZ	397	/*
	398	* evm_inode_init_security - initializes security.evm
	399	*/
	400	int evm_inode_init_security(struct inode *inode,
	401	const struct xattr *lsm_xattr,
	402	struct xattr *evm_xattr)
	403	{
	404	struct evm_ima_xattr_data *xattr_data;
	405	int rc;
	406
	407	if (!evm_initialized \|\| !evm_protected_xattr(lsm_xattr->name))
5a4730ba	408	return 0;
cb723180 MZ	409
	410	xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
	411	if (!xattr_data)
	412	return -ENOMEM;
	413
	414	xattr_data->type = EVM_XATTR_HMAC;
	415	rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
	416	if (rc < 0)
	417	goto out;
	418
	419	evm_xattr->value = xattr_data;
	420	evm_xattr->value_len = sizeof(*xattr_data);
9548906b	421	evm_xattr->name = XATTR_EVM_SUFFIX;
cb723180 MZ	422	return 0;
	423	out:
	424	kfree(xattr_data);
	425	return rc;
	426	}
	427	EXPORT_SYMBOL_GPL(evm_inode_init_security);
	428
66dbc325 MZ	429	static int __init init_evm(void)
	430	{
	431	int error;
	432
66dbc325 MZ	433	error = evm_init_secfs();
	434	if (error < 0) {
	435	printk(KERN_INFO "EVM: Error registering secfs\n");
	436	goto err;
	437	}
15647eb3 DK	438
15647eb3 DK	439	return 0;
66dbc325 MZ	440	err:
	441	return error;
	442	}
	443
66dbc325 MZ	444	/*
	445	* evm_display_config - list the EVM protected security extended attributes
	446	*/
	447	static int __init evm_display_config(void)
	448	{
	449	char **xattrname;
	450
	451	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++)
	452	printk(KERN_INFO "EVM: %s\n", *xattrname);
	453	return 0;
	454	}
	455
	456	pure_initcall(evm_display_config);
	457	late_initcall(init_evm);
	458
	459	MODULE_DESCRIPTION("Extended Verification Module");
	460	MODULE_LICENSE("GPL");