]>
Commit | Line | Data |
---|---|---|
66dbc325 MZ |
1 | /* |
2 | * Copyright (C) 2005-2010 IBM Corporation | |
3 | * | |
4 | * Author: | |
5 | * Mimi Zohar <zohar@us.ibm.com> | |
6 | * Kylene Hall <kjhall@us.ibm.com> | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation, version 2 of the License. | |
11 | * | |
12 | * File: evm_main.c | |
13 | * implements evm_inode_setxattr, evm_inode_post_setxattr, | |
14 | * evm_inode_removexattr, and evm_verifyxattr | |
15 | */ | |
16 | ||
17 | #include <linux/module.h> | |
18 | #include <linux/crypto.h> | |
19 | #include <linux/xattr.h> | |
20 | #include <linux/integrity.h> | |
3e1be52d | 21 | #include <linux/evm.h> |
d46eb369 | 22 | #include <crypto/hash.h> |
66dbc325 MZ |
23 | #include "evm.h" |
24 | ||
25 | int evm_initialized; | |
26 | ||
27 | char *evm_hmac = "hmac(sha1)"; | |
28 | ||
29 | char *evm_config_xattrnames[] = { | |
30 | #ifdef CONFIG_SECURITY_SELINUX | |
31 | XATTR_NAME_SELINUX, | |
32 | #endif | |
33 | #ifdef CONFIG_SECURITY_SMACK | |
34 | XATTR_NAME_SMACK, | |
35 | #endif | |
36 | XATTR_NAME_CAPS, | |
37 | NULL | |
38 | }; | |
39 | ||
7102ebcd MZ |
40 | static int evm_fixmode; |
41 | static int __init evm_set_fixmode(char *str) | |
42 | { | |
43 | if (strncmp(str, "fix", 3) == 0) | |
44 | evm_fixmode = 1; | |
45 | return 0; | |
46 | } | |
47 | __setup("evm=", evm_set_fixmode); | |
48 | ||
66dbc325 MZ |
49 | /* |
50 | * evm_verify_hmac - calculate and compare the HMAC with the EVM xattr | |
51 | * | |
52 | * Compute the HMAC on the dentry's protected set of extended attributes | |
7102ebcd MZ |
53 | * and compare it against the stored security.evm xattr. |
54 | * | |
55 | * For performance: | |
56 | * - use the previoulsy retrieved xattr value and length to calculate the | |
57 | * HMAC.) | |
58 | * - cache the verification result in the iint, when available. | |
66dbc325 MZ |
59 | * |
60 | * Returns integrity status | |
61 | */ | |
62 | static enum integrity_status evm_verify_hmac(struct dentry *dentry, | |
63 | const char *xattr_name, | |
64 | char *xattr_value, | |
65 | size_t xattr_value_len, | |
66 | struct integrity_iint_cache *iint) | |
67 | { | |
6be5cc52 | 68 | struct evm_ima_xattr_data xattr_data; |
7102ebcd | 69 | enum integrity_status evm_status; |
66dbc325 MZ |
70 | int rc; |
71 | ||
7102ebcd | 72 | if (iint && iint->evm_status == INTEGRITY_PASS) |
24e0198e | 73 | return iint->evm_status; |
66dbc325 | 74 | |
6d38ca01 DK |
75 | /* if status is not PASS, try to check again - against -ENOMEM */ |
76 | ||
66dbc325 | 77 | rc = evm_calc_hmac(dentry, xattr_name, xattr_value, |
6be5cc52 | 78 | xattr_value_len, xattr_data.digest); |
66dbc325 | 79 | if (rc < 0) |
6d38ca01 | 80 | goto err_out; |
66dbc325 | 81 | |
6be5cc52 DK |
82 | xattr_data.type = EVM_XATTR_HMAC; |
83 | rc = vfs_xattr_cmp(dentry, XATTR_NAME_EVM, (u8 *)&xattr_data, | |
84 | sizeof xattr_data, GFP_NOFS); | |
66dbc325 MZ |
85 | if (rc < 0) |
86 | goto err_out; | |
7102ebcd MZ |
87 | evm_status = INTEGRITY_PASS; |
88 | goto out; | |
66dbc325 MZ |
89 | |
90 | err_out: | |
91 | switch (rc) { | |
92 | case -ENODATA: /* file not labelled */ | |
7102ebcd | 93 | evm_status = INTEGRITY_NOLABEL; |
66dbc325 | 94 | break; |
66dbc325 | 95 | default: |
7102ebcd | 96 | evm_status = INTEGRITY_FAIL; |
66dbc325 | 97 | } |
7102ebcd MZ |
98 | out: |
99 | if (iint) | |
100 | iint->evm_status = evm_status; | |
101 | return evm_status; | |
66dbc325 MZ |
102 | } |
103 | ||
104 | static int evm_protected_xattr(const char *req_xattr_name) | |
105 | { | |
106 | char **xattrname; | |
107 | int namelen; | |
108 | int found = 0; | |
109 | ||
110 | namelen = strlen(req_xattr_name); | |
111 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { | |
112 | if ((strlen(*xattrname) == namelen) | |
113 | && (strncmp(req_xattr_name, *xattrname, namelen) == 0)) { | |
114 | found = 1; | |
115 | break; | |
116 | } | |
cb723180 MZ |
117 | if (strncmp(req_xattr_name, |
118 | *xattrname + XATTR_SECURITY_PREFIX_LEN, | |
119 | strlen(req_xattr_name)) == 0) { | |
120 | found = 1; | |
121 | break; | |
122 | } | |
66dbc325 MZ |
123 | } |
124 | return found; | |
125 | } | |
126 | ||
127 | /** | |
128 | * evm_verifyxattr - verify the integrity of the requested xattr | |
129 | * @dentry: object of the verify xattr | |
130 | * @xattr_name: requested xattr | |
131 | * @xattr_value: requested xattr value | |
132 | * @xattr_value_len: requested xattr value length | |
133 | * | |
134 | * Calculate the HMAC for the given dentry and verify it against the stored | |
135 | * security.evm xattr. For performance, use the xattr value and length | |
136 | * previously retrieved to calculate the HMAC. | |
137 | * | |
138 | * Returns the xattr integrity status. | |
139 | * | |
140 | * This function requires the caller to lock the inode's i_mutex before it | |
141 | * is executed. | |
142 | */ | |
143 | enum integrity_status evm_verifyxattr(struct dentry *dentry, | |
144 | const char *xattr_name, | |
2960e6cb DK |
145 | void *xattr_value, size_t xattr_value_len, |
146 | struct integrity_iint_cache *iint) | |
66dbc325 | 147 | { |
66dbc325 MZ |
148 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) |
149 | return INTEGRITY_UNKNOWN; | |
150 | ||
2960e6cb DK |
151 | if (!iint) { |
152 | iint = integrity_iint_find(dentry->d_inode); | |
153 | if (!iint) | |
154 | return INTEGRITY_UNKNOWN; | |
155 | } | |
156 | return evm_verify_hmac(dentry, xattr_name, xattr_value, | |
66dbc325 | 157 | xattr_value_len, iint); |
66dbc325 MZ |
158 | } |
159 | EXPORT_SYMBOL_GPL(evm_verifyxattr); | |
160 | ||
161 | /* | |
162 | * evm_protect_xattr - protect the EVM extended attribute | |
163 | * | |
164 | * Prevent security.evm from being modified or removed. | |
165 | */ | |
166 | static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, | |
167 | const void *xattr_value, size_t xattr_value_len) | |
168 | { | |
169 | if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { | |
170 | if (!capable(CAP_SYS_ADMIN)) | |
171 | return -EPERM; | |
172 | } | |
173 | return 0; | |
174 | } | |
175 | ||
7102ebcd MZ |
176 | /* |
177 | * evm_verify_current_integrity - verify the dentry's metadata integrity | |
178 | * @dentry: pointer to the affected dentry | |
179 | * | |
180 | * Verify and return the dentry's metadata integrity. The exceptions are | |
181 | * before EVM is initialized or in 'fix' mode. | |
182 | */ | |
183 | static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) | |
184 | { | |
185 | struct inode *inode = dentry->d_inode; | |
186 | ||
187 | if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode) | |
188 | return 0; | |
189 | return evm_verify_hmac(dentry, NULL, NULL, 0, NULL); | |
190 | } | |
191 | ||
66dbc325 MZ |
192 | /** |
193 | * evm_inode_setxattr - protect the EVM extended attribute | |
194 | * @dentry: pointer to the affected dentry | |
195 | * @xattr_name: pointer to the affected extended attribute name | |
196 | * @xattr_value: pointer to the new extended attribute value | |
197 | * @xattr_value_len: pointer to the new extended attribute value length | |
198 | * | |
7102ebcd MZ |
199 | * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that |
200 | * the current value is valid. | |
66dbc325 MZ |
201 | */ |
202 | int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, | |
203 | const void *xattr_value, size_t xattr_value_len) | |
204 | { | |
7102ebcd MZ |
205 | |
206 | enum integrity_status evm_status; | |
207 | int ret; | |
208 | ||
209 | ret = evm_protect_xattr(dentry, xattr_name, xattr_value, | |
210 | xattr_value_len); | |
211 | if (ret) | |
212 | return ret; | |
213 | evm_status = evm_verify_current_integrity(dentry); | |
214 | return evm_status == INTEGRITY_PASS ? 0 : -EPERM; | |
66dbc325 MZ |
215 | } |
216 | ||
217 | /** | |
218 | * evm_inode_removexattr - protect the EVM extended attribute | |
219 | * @dentry: pointer to the affected dentry | |
220 | * @xattr_name: pointer to the affected extended attribute name | |
221 | * | |
7102ebcd MZ |
222 | * Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that |
223 | * the current value is valid. | |
66dbc325 MZ |
224 | */ |
225 | int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name) | |
226 | { | |
7102ebcd MZ |
227 | enum integrity_status evm_status; |
228 | int ret; | |
229 | ||
230 | ret = evm_protect_xattr(dentry, xattr_name, NULL, 0); | |
231 | if (ret) | |
232 | return ret; | |
233 | evm_status = evm_verify_current_integrity(dentry); | |
234 | return evm_status == INTEGRITY_PASS ? 0 : -EPERM; | |
66dbc325 MZ |
235 | } |
236 | ||
237 | /** | |
238 | * evm_inode_post_setxattr - update 'security.evm' to reflect the changes | |
239 | * @dentry: pointer to the affected dentry | |
240 | * @xattr_name: pointer to the affected extended attribute name | |
241 | * @xattr_value: pointer to the new extended attribute value | |
242 | * @xattr_value_len: pointer to the new extended attribute value length | |
243 | * | |
244 | * Update the HMAC stored in 'security.evm' to reflect the change. | |
245 | * | |
246 | * No need to take the i_mutex lock here, as this function is called from | |
247 | * __vfs_setxattr_noperm(). The caller of which has taken the inode's | |
248 | * i_mutex lock. | |
249 | */ | |
250 | void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name, | |
251 | const void *xattr_value, size_t xattr_value_len) | |
252 | { | |
253 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) | |
254 | return; | |
255 | ||
256 | evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len); | |
257 | return; | |
258 | } | |
259 | ||
260 | /** | |
261 | * evm_inode_post_removexattr - update 'security.evm' after removing the xattr | |
262 | * @dentry: pointer to the affected dentry | |
263 | * @xattr_name: pointer to the affected extended attribute name | |
264 | * | |
265 | * Update the HMAC stored in 'security.evm' to reflect removal of the xattr. | |
266 | */ | |
267 | void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name) | |
268 | { | |
269 | struct inode *inode = dentry->d_inode; | |
270 | ||
271 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) | |
272 | return; | |
273 | ||
274 | mutex_lock(&inode->i_mutex); | |
275 | evm_update_evmxattr(dentry, xattr_name, NULL, 0); | |
276 | mutex_unlock(&inode->i_mutex); | |
277 | return; | |
278 | } | |
279 | ||
817b54aa MZ |
280 | /** |
281 | * evm_inode_setattr - prevent updating an invalid EVM extended attribute | |
282 | * @dentry: pointer to the affected dentry | |
283 | */ | |
284 | int evm_inode_setattr(struct dentry *dentry, struct iattr *attr) | |
285 | { | |
286 | unsigned int ia_valid = attr->ia_valid; | |
287 | enum integrity_status evm_status; | |
288 | ||
289 | if (ia_valid & ~(ATTR_MODE | ATTR_UID | ATTR_GID)) | |
290 | return 0; | |
291 | evm_status = evm_verify_current_integrity(dentry); | |
292 | return evm_status == INTEGRITY_PASS ? 0 : -EPERM; | |
293 | } | |
294 | ||
66dbc325 MZ |
295 | /** |
296 | * evm_inode_post_setattr - update 'security.evm' after modifying metadata | |
297 | * @dentry: pointer to the affected dentry | |
298 | * @ia_valid: for the UID and GID status | |
299 | * | |
300 | * For now, update the HMAC stored in 'security.evm' to reflect UID/GID | |
301 | * changes. | |
302 | * | |
303 | * This function is called from notify_change(), which expects the caller | |
304 | * to lock the inode's i_mutex. | |
305 | */ | |
306 | void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) | |
307 | { | |
308 | if (!evm_initialized) | |
309 | return; | |
310 | ||
311 | if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)) | |
312 | evm_update_evmxattr(dentry, NULL, NULL, 0); | |
313 | return; | |
314 | } | |
315 | ||
cb723180 MZ |
316 | /* |
317 | * evm_inode_init_security - initializes security.evm | |
318 | */ | |
319 | int evm_inode_init_security(struct inode *inode, | |
320 | const struct xattr *lsm_xattr, | |
321 | struct xattr *evm_xattr) | |
322 | { | |
323 | struct evm_ima_xattr_data *xattr_data; | |
324 | int rc; | |
325 | ||
326 | if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name)) | |
327 | return -EOPNOTSUPP; | |
328 | ||
329 | xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS); | |
330 | if (!xattr_data) | |
331 | return -ENOMEM; | |
332 | ||
333 | xattr_data->type = EVM_XATTR_HMAC; | |
334 | rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest); | |
335 | if (rc < 0) | |
336 | goto out; | |
337 | ||
338 | evm_xattr->value = xattr_data; | |
339 | evm_xattr->value_len = sizeof(*xattr_data); | |
340 | evm_xattr->name = kstrdup(XATTR_EVM_SUFFIX, GFP_NOFS); | |
341 | return 0; | |
342 | out: | |
343 | kfree(xattr_data); | |
344 | return rc; | |
345 | } | |
346 | EXPORT_SYMBOL_GPL(evm_inode_init_security); | |
347 | ||
66dbc325 MZ |
348 | static int __init init_evm(void) |
349 | { | |
350 | int error; | |
351 | ||
66dbc325 MZ |
352 | error = evm_init_secfs(); |
353 | if (error < 0) { | |
354 | printk(KERN_INFO "EVM: Error registering secfs\n"); | |
355 | goto err; | |
356 | } | |
357 | err: | |
358 | return error; | |
359 | } | |
360 | ||
361 | static void __exit cleanup_evm(void) | |
362 | { | |
363 | evm_cleanup_secfs(); | |
d46eb369 DK |
364 | if (hmac_tfm) |
365 | crypto_free_shash(hmac_tfm); | |
66dbc325 MZ |
366 | } |
367 | ||
368 | /* | |
369 | * evm_display_config - list the EVM protected security extended attributes | |
370 | */ | |
371 | static int __init evm_display_config(void) | |
372 | { | |
373 | char **xattrname; | |
374 | ||
375 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) | |
376 | printk(KERN_INFO "EVM: %s\n", *xattrname); | |
377 | return 0; | |
378 | } | |
379 | ||
380 | pure_initcall(evm_display_config); | |
381 | late_initcall(init_evm); | |
382 | ||
383 | MODULE_DESCRIPTION("Extended Verification Module"); | |
384 | MODULE_LICENSE("GPL"); |