]>
Commit | Line | Data |
---|---|---|
66dbc325 MZ |
1 | /* |
2 | * Copyright (C) 2005-2010 IBM Corporation | |
3 | * | |
4 | * Author: | |
5 | * Mimi Zohar <zohar@us.ibm.com> | |
6 | * Kylene Hall <kjhall@us.ibm.com> | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation, version 2 of the License. | |
11 | * | |
12 | * File: evm_main.c | |
13 | * implements evm_inode_setxattr, evm_inode_post_setxattr, | |
14 | * evm_inode_removexattr, and evm_verifyxattr | |
15 | */ | |
16 | ||
17 | #include <linux/module.h> | |
18 | #include <linux/crypto.h> | |
9b97b6cd | 19 | #include <linux/audit.h> |
66dbc325 MZ |
20 | #include <linux/xattr.h> |
21 | #include <linux/integrity.h> | |
3e1be52d | 22 | #include <linux/evm.h> |
d46eb369 | 23 | #include <crypto/hash.h> |
66dbc325 MZ |
24 | #include "evm.h" |
25 | ||
26 | int evm_initialized; | |
27 | ||
9b97b6cd MZ |
28 | static char *integrity_status_msg[] = { |
29 | "pass", "fail", "no_label", "no_xattrs", "unknown" | |
30 | }; | |
66dbc325 | 31 | char *evm_hmac = "hmac(sha1)"; |
15647eb3 | 32 | char *evm_hash = "sha1"; |
74de6684 | 33 | int evm_hmac_version = CONFIG_EVM_HMAC_VERSION; |
66dbc325 MZ |
34 | |
35 | char *evm_config_xattrnames[] = { | |
36 | #ifdef CONFIG_SECURITY_SELINUX | |
37 | XATTR_NAME_SELINUX, | |
38 | #endif | |
39 | #ifdef CONFIG_SECURITY_SMACK | |
40 | XATTR_NAME_SMACK, | |
2fe5d6de MZ |
41 | #endif |
42 | #ifdef CONFIG_IMA_APPRAISE | |
43 | XATTR_NAME_IMA, | |
66dbc325 MZ |
44 | #endif |
45 | XATTR_NAME_CAPS, | |
46 | NULL | |
47 | }; | |
48 | ||
7102ebcd MZ |
49 | static int evm_fixmode; |
50 | static int __init evm_set_fixmode(char *str) | |
51 | { | |
52 | if (strncmp(str, "fix", 3) == 0) | |
53 | evm_fixmode = 1; | |
54 | return 0; | |
55 | } | |
56 | __setup("evm=", evm_set_fixmode); | |
57 | ||
15647eb3 DK |
58 | static int evm_find_protected_xattrs(struct dentry *dentry) |
59 | { | |
60 | struct inode *inode = dentry->d_inode; | |
61 | char **xattr; | |
62 | int error; | |
63 | int count = 0; | |
64 | ||
65 | if (!inode->i_op || !inode->i_op->getxattr) | |
66 | return -EOPNOTSUPP; | |
67 | ||
68 | for (xattr = evm_config_xattrnames; *xattr != NULL; xattr++) { | |
69 | error = inode->i_op->getxattr(dentry, *xattr, NULL, 0); | |
70 | if (error < 0) { | |
71 | if (error == -ENODATA) | |
72 | continue; | |
73 | return error; | |
74 | } | |
75 | count++; | |
76 | } | |
77 | ||
78 | return count; | |
79 | } | |
80 | ||
66dbc325 MZ |
81 | /* |
82 | * evm_verify_hmac - calculate and compare the HMAC with the EVM xattr | |
83 | * | |
84 | * Compute the HMAC on the dentry's protected set of extended attributes | |
7102ebcd MZ |
85 | * and compare it against the stored security.evm xattr. |
86 | * | |
87 | * For performance: | |
88 | * - use the previoulsy retrieved xattr value and length to calculate the | |
89 | * HMAC.) | |
90 | * - cache the verification result in the iint, when available. | |
66dbc325 MZ |
91 | * |
92 | * Returns integrity status | |
93 | */ | |
94 | static enum integrity_status evm_verify_hmac(struct dentry *dentry, | |
95 | const char *xattr_name, | |
96 | char *xattr_value, | |
97 | size_t xattr_value_len, | |
98 | struct integrity_iint_cache *iint) | |
99 | { | |
15647eb3 DK |
100 | struct evm_ima_xattr_data *xattr_data = NULL; |
101 | struct evm_ima_xattr_data calc; | |
566be59a | 102 | enum integrity_status evm_status = INTEGRITY_PASS; |
15647eb3 | 103 | int rc, xattr_len; |
66dbc325 | 104 | |
7102ebcd | 105 | if (iint && iint->evm_status == INTEGRITY_PASS) |
24e0198e | 106 | return iint->evm_status; |
66dbc325 | 107 | |
6d38ca01 DK |
108 | /* if status is not PASS, try to check again - against -ENOMEM */ |
109 | ||
15647eb3 DK |
110 | /* first need to know the sig type */ |
111 | rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0, | |
112 | GFP_NOFS); | |
113 | if (rc <= 0) { | |
114 | if (rc == 0) | |
115 | evm_status = INTEGRITY_FAIL; /* empty */ | |
116 | else if (rc == -ENODATA) { | |
117 | rc = evm_find_protected_xattrs(dentry); | |
118 | if (rc > 0) | |
119 | evm_status = INTEGRITY_NOLABEL; | |
120 | else if (rc == 0) | |
121 | evm_status = INTEGRITY_NOXATTRS; /* new file */ | |
122 | } | |
566be59a MZ |
123 | goto out; |
124 | } | |
66dbc325 | 125 | |
15647eb3 DK |
126 | xattr_len = rc - 1; |
127 | ||
128 | /* check value type */ | |
129 | switch (xattr_data->type) { | |
130 | case EVM_XATTR_HMAC: | |
131 | rc = evm_calc_hmac(dentry, xattr_name, xattr_value, | |
132 | xattr_value_len, calc.digest); | |
133 | if (rc) | |
134 | break; | |
135 | rc = memcmp(xattr_data->digest, calc.digest, | |
136 | sizeof(calc.digest)); | |
137 | if (rc) | |
138 | rc = -EINVAL; | |
139 | break; | |
140 | case EVM_IMA_XATTR_DIGSIG: | |
141 | rc = evm_calc_hash(dentry, xattr_name, xattr_value, | |
142 | xattr_value_len, calc.digest); | |
143 | if (rc) | |
144 | break; | |
145 | rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM, | |
146 | xattr_data->digest, xattr_len, | |
147 | calc.digest, sizeof(calc.digest)); | |
148 | if (!rc) { | |
149 | /* we probably want to replace rsa with hmac here */ | |
150 | evm_update_evmxattr(dentry, xattr_name, xattr_value, | |
151 | xattr_value_len); | |
152 | } | |
153 | break; | |
154 | default: | |
155 | rc = -EINVAL; | |
156 | break; | |
157 | } | |
158 | ||
159 | if (rc) | |
160 | evm_status = (rc == -ENODATA) ? | |
161 | INTEGRITY_NOXATTRS : INTEGRITY_FAIL; | |
7102ebcd MZ |
162 | out: |
163 | if (iint) | |
164 | iint->evm_status = evm_status; | |
15647eb3 | 165 | kfree(xattr_data); |
7102ebcd | 166 | return evm_status; |
66dbc325 MZ |
167 | } |
168 | ||
169 | static int evm_protected_xattr(const char *req_xattr_name) | |
170 | { | |
171 | char **xattrname; | |
172 | int namelen; | |
173 | int found = 0; | |
174 | ||
175 | namelen = strlen(req_xattr_name); | |
176 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { | |
177 | if ((strlen(*xattrname) == namelen) | |
178 | && (strncmp(req_xattr_name, *xattrname, namelen) == 0)) { | |
179 | found = 1; | |
180 | break; | |
181 | } | |
cb723180 MZ |
182 | if (strncmp(req_xattr_name, |
183 | *xattrname + XATTR_SECURITY_PREFIX_LEN, | |
184 | strlen(req_xattr_name)) == 0) { | |
185 | found = 1; | |
186 | break; | |
187 | } | |
66dbc325 MZ |
188 | } |
189 | return found; | |
190 | } | |
191 | ||
192 | /** | |
193 | * evm_verifyxattr - verify the integrity of the requested xattr | |
194 | * @dentry: object of the verify xattr | |
195 | * @xattr_name: requested xattr | |
196 | * @xattr_value: requested xattr value | |
197 | * @xattr_value_len: requested xattr value length | |
198 | * | |
199 | * Calculate the HMAC for the given dentry and verify it against the stored | |
200 | * security.evm xattr. For performance, use the xattr value and length | |
201 | * previously retrieved to calculate the HMAC. | |
202 | * | |
203 | * Returns the xattr integrity status. | |
204 | * | |
205 | * This function requires the caller to lock the inode's i_mutex before it | |
206 | * is executed. | |
207 | */ | |
208 | enum integrity_status evm_verifyxattr(struct dentry *dentry, | |
209 | const char *xattr_name, | |
2960e6cb DK |
210 | void *xattr_value, size_t xattr_value_len, |
211 | struct integrity_iint_cache *iint) | |
66dbc325 | 212 | { |
66dbc325 MZ |
213 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) |
214 | return INTEGRITY_UNKNOWN; | |
215 | ||
2960e6cb DK |
216 | if (!iint) { |
217 | iint = integrity_iint_find(dentry->d_inode); | |
218 | if (!iint) | |
219 | return INTEGRITY_UNKNOWN; | |
220 | } | |
221 | return evm_verify_hmac(dentry, xattr_name, xattr_value, | |
66dbc325 | 222 | xattr_value_len, iint); |
66dbc325 MZ |
223 | } |
224 | EXPORT_SYMBOL_GPL(evm_verifyxattr); | |
225 | ||
7102ebcd MZ |
226 | /* |
227 | * evm_verify_current_integrity - verify the dentry's metadata integrity | |
228 | * @dentry: pointer to the affected dentry | |
229 | * | |
230 | * Verify and return the dentry's metadata integrity. The exceptions are | |
231 | * before EVM is initialized or in 'fix' mode. | |
232 | */ | |
233 | static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) | |
234 | { | |
235 | struct inode *inode = dentry->d_inode; | |
236 | ||
237 | if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode) | |
238 | return 0; | |
239 | return evm_verify_hmac(dentry, NULL, NULL, 0, NULL); | |
240 | } | |
241 | ||
a924ce0b MZ |
242 | /* |
243 | * evm_protect_xattr - protect the EVM extended attribute | |
244 | * | |
bf6d0f5d MZ |
245 | * Prevent security.evm from being modified or removed without the |
246 | * necessary permissions or when the existing value is invalid. | |
247 | * | |
248 | * The posix xattr acls are 'system' prefixed, which normally would not | |
249 | * affect security.evm. An interesting side affect of writing posix xattr | |
250 | * acls is their modifying of the i_mode, which is included in security.evm. | |
251 | * For posix xattr acls only, permit security.evm, even if it currently | |
252 | * doesn't exist, to be updated. | |
a924ce0b MZ |
253 | */ |
254 | static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, | |
255 | const void *xattr_value, size_t xattr_value_len) | |
256 | { | |
257 | enum integrity_status evm_status; | |
258 | ||
259 | if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { | |
260 | if (!capable(CAP_SYS_ADMIN)) | |
261 | return -EPERM; | |
bf6d0f5d MZ |
262 | } else if (!evm_protected_xattr(xattr_name)) { |
263 | if (!posix_xattr_acl(xattr_name)) | |
264 | return 0; | |
265 | evm_status = evm_verify_current_integrity(dentry); | |
266 | if ((evm_status == INTEGRITY_PASS) || | |
566be59a | 267 | (evm_status == INTEGRITY_NOXATTRS)) |
bf6d0f5d | 268 | return 0; |
9b97b6cd | 269 | goto out; |
bf6d0f5d | 270 | } |
a924ce0b | 271 | evm_status = evm_verify_current_integrity(dentry); |
9b97b6cd MZ |
272 | out: |
273 | if (evm_status != INTEGRITY_PASS) | |
274 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode, | |
275 | dentry->d_name.name, "appraise_metadata", | |
276 | integrity_status_msg[evm_status], | |
277 | -EPERM, 0); | |
a924ce0b MZ |
278 | return evm_status == INTEGRITY_PASS ? 0 : -EPERM; |
279 | } | |
280 | ||
66dbc325 MZ |
281 | /** |
282 | * evm_inode_setxattr - protect the EVM extended attribute | |
283 | * @dentry: pointer to the affected dentry | |
284 | * @xattr_name: pointer to the affected extended attribute name | |
285 | * @xattr_value: pointer to the new extended attribute value | |
286 | * @xattr_value_len: pointer to the new extended attribute value length | |
287 | * | |
7102ebcd MZ |
288 | * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that |
289 | * the current value is valid. | |
66dbc325 MZ |
290 | */ |
291 | int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, | |
292 | const void *xattr_value, size_t xattr_value_len) | |
293 | { | |
a924ce0b MZ |
294 | return evm_protect_xattr(dentry, xattr_name, xattr_value, |
295 | xattr_value_len); | |
66dbc325 MZ |
296 | } |
297 | ||
298 | /** | |
299 | * evm_inode_removexattr - protect the EVM extended attribute | |
300 | * @dentry: pointer to the affected dentry | |
301 | * @xattr_name: pointer to the affected extended attribute name | |
302 | * | |
7102ebcd MZ |
303 | * Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that |
304 | * the current value is valid. | |
66dbc325 MZ |
305 | */ |
306 | int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name) | |
307 | { | |
a924ce0b | 308 | return evm_protect_xattr(dentry, xattr_name, NULL, 0); |
66dbc325 MZ |
309 | } |
310 | ||
311 | /** | |
312 | * evm_inode_post_setxattr - update 'security.evm' to reflect the changes | |
313 | * @dentry: pointer to the affected dentry | |
314 | * @xattr_name: pointer to the affected extended attribute name | |
315 | * @xattr_value: pointer to the new extended attribute value | |
316 | * @xattr_value_len: pointer to the new extended attribute value length | |
317 | * | |
318 | * Update the HMAC stored in 'security.evm' to reflect the change. | |
319 | * | |
320 | * No need to take the i_mutex lock here, as this function is called from | |
321 | * __vfs_setxattr_noperm(). The caller of which has taken the inode's | |
322 | * i_mutex lock. | |
323 | */ | |
324 | void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name, | |
325 | const void *xattr_value, size_t xattr_value_len) | |
326 | { | |
bf6d0f5d MZ |
327 | if (!evm_initialized || (!evm_protected_xattr(xattr_name) |
328 | && !posix_xattr_acl(xattr_name))) | |
66dbc325 MZ |
329 | return; |
330 | ||
331 | evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len); | |
332 | return; | |
333 | } | |
334 | ||
335 | /** | |
336 | * evm_inode_post_removexattr - update 'security.evm' after removing the xattr | |
337 | * @dentry: pointer to the affected dentry | |
338 | * @xattr_name: pointer to the affected extended attribute name | |
339 | * | |
340 | * Update the HMAC stored in 'security.evm' to reflect removal of the xattr. | |
341 | */ | |
342 | void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name) | |
343 | { | |
344 | struct inode *inode = dentry->d_inode; | |
345 | ||
346 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) | |
347 | return; | |
348 | ||
349 | mutex_lock(&inode->i_mutex); | |
350 | evm_update_evmxattr(dentry, xattr_name, NULL, 0); | |
351 | mutex_unlock(&inode->i_mutex); | |
352 | return; | |
353 | } | |
354 | ||
817b54aa MZ |
355 | /** |
356 | * evm_inode_setattr - prevent updating an invalid EVM extended attribute | |
357 | * @dentry: pointer to the affected dentry | |
358 | */ | |
359 | int evm_inode_setattr(struct dentry *dentry, struct iattr *attr) | |
360 | { | |
361 | unsigned int ia_valid = attr->ia_valid; | |
362 | enum integrity_status evm_status; | |
363 | ||
a924ce0b | 364 | if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))) |
817b54aa MZ |
365 | return 0; |
366 | evm_status = evm_verify_current_integrity(dentry); | |
566be59a MZ |
367 | if ((evm_status == INTEGRITY_PASS) || |
368 | (evm_status == INTEGRITY_NOXATTRS)) | |
369 | return 0; | |
9b97b6cd MZ |
370 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode, |
371 | dentry->d_name.name, "appraise_metadata", | |
372 | integrity_status_msg[evm_status], -EPERM, 0); | |
566be59a | 373 | return -EPERM; |
817b54aa MZ |
374 | } |
375 | ||
66dbc325 MZ |
376 | /** |
377 | * evm_inode_post_setattr - update 'security.evm' after modifying metadata | |
378 | * @dentry: pointer to the affected dentry | |
379 | * @ia_valid: for the UID and GID status | |
380 | * | |
381 | * For now, update the HMAC stored in 'security.evm' to reflect UID/GID | |
382 | * changes. | |
383 | * | |
384 | * This function is called from notify_change(), which expects the caller | |
385 | * to lock the inode's i_mutex. | |
386 | */ | |
387 | void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) | |
388 | { | |
389 | if (!evm_initialized) | |
390 | return; | |
391 | ||
392 | if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)) | |
393 | evm_update_evmxattr(dentry, NULL, NULL, 0); | |
394 | return; | |
395 | } | |
396 | ||
cb723180 MZ |
397 | /* |
398 | * evm_inode_init_security - initializes security.evm | |
399 | */ | |
400 | int evm_inode_init_security(struct inode *inode, | |
401 | const struct xattr *lsm_xattr, | |
402 | struct xattr *evm_xattr) | |
403 | { | |
404 | struct evm_ima_xattr_data *xattr_data; | |
405 | int rc; | |
406 | ||
407 | if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name)) | |
5a4730ba | 408 | return 0; |
cb723180 MZ |
409 | |
410 | xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS); | |
411 | if (!xattr_data) | |
412 | return -ENOMEM; | |
413 | ||
414 | xattr_data->type = EVM_XATTR_HMAC; | |
415 | rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest); | |
416 | if (rc < 0) | |
417 | goto out; | |
418 | ||
419 | evm_xattr->value = xattr_data; | |
420 | evm_xattr->value_len = sizeof(*xattr_data); | |
9548906b | 421 | evm_xattr->name = XATTR_EVM_SUFFIX; |
cb723180 MZ |
422 | return 0; |
423 | out: | |
424 | kfree(xattr_data); | |
425 | return rc; | |
426 | } | |
427 | EXPORT_SYMBOL_GPL(evm_inode_init_security); | |
428 | ||
66dbc325 MZ |
429 | static int __init init_evm(void) |
430 | { | |
431 | int error; | |
432 | ||
66dbc325 MZ |
433 | error = evm_init_secfs(); |
434 | if (error < 0) { | |
435 | printk(KERN_INFO "EVM: Error registering secfs\n"); | |
436 | goto err; | |
437 | } | |
15647eb3 DK |
438 | |
439 | return 0; | |
66dbc325 MZ |
440 | err: |
441 | return error; | |
442 | } | |
443 | ||
66dbc325 MZ |
444 | /* |
445 | * evm_display_config - list the EVM protected security extended attributes | |
446 | */ | |
447 | static int __init evm_display_config(void) | |
448 | { | |
449 | char **xattrname; | |
450 | ||
451 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) | |
452 | printk(KERN_INFO "EVM: %s\n", *xattrname); | |
453 | return 0; | |
454 | } | |
455 | ||
456 | pure_initcall(evm_display_config); | |
457 | late_initcall(init_evm); | |
458 | ||
459 | MODULE_DESCRIPTION("Extended Verification Module"); | |
460 | MODULE_LICENSE("GPL"); |