]>
Commit | Line | Data |
---|---|---|
3323eec9 MZ |
1 | /* |
2 | * Copyright (C) 2008 IBM Corporation | |
3 | * Author: Mimi Zohar <zohar@us.ibm.com> | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of the GNU General Public License as published by | |
7 | * the Free Software Foundation, version 2 of the License. | |
8 | * | |
9 | * ima_policy.c | |
10 | * - initialize default measure policy rules | |
11 | * | |
12 | */ | |
13 | #include <linux/module.h> | |
14 | #include <linux/list.h> | |
3323eec9 MZ |
15 | #include <linux/security.h> |
16 | #include <linux/magic.h> | |
4af4662f | 17 | #include <linux/parser.h> |
3323eec9 MZ |
18 | |
19 | #include "ima.h" | |
20 | ||
21 | /* flags definitions */ | |
22 | #define IMA_FUNC 0x0001 | |
23 | #define IMA_MASK 0x0002 | |
24 | #define IMA_FSMAGIC 0x0004 | |
25 | #define IMA_UID 0x0008 | |
26 | ||
4af4662f MZ |
27 | enum ima_action { UNKNOWN = -1, DONT_MEASURE = 0, MEASURE }; |
28 | ||
29 | #define MAX_LSM_RULES 6 | |
30 | enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, | |
31 | LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE | |
32 | }; | |
3323eec9 MZ |
33 | |
34 | struct ima_measure_rule_entry { | |
35 | struct list_head list; | |
36 | enum ima_action action; | |
37 | unsigned int flags; | |
38 | enum ima_hooks func; | |
39 | int mask; | |
40 | unsigned long fsmagic; | |
41 | uid_t uid; | |
4af4662f MZ |
42 | struct { |
43 | void *rule; /* LSM file metadata specific */ | |
44 | int type; /* audit type */ | |
45 | } lsm[MAX_LSM_RULES]; | |
3323eec9 MZ |
46 | }; |
47 | ||
5789ba3b EP |
48 | /* |
49 | * Without LSM specific knowledge, the default policy can only be | |
4af4662f MZ |
50 | * written in terms of .action, .func, .mask, .fsmagic, and .uid |
51 | */ | |
5789ba3b EP |
52 | |
53 | /* | |
54 | * The minimum rule set to allow for full TCB coverage. Measures all files | |
55 | * opened or mmap for exec and everything read by root. Dangerous because | |
56 | * normal users can easily run the machine out of memory simply building | |
57 | * and running executables. | |
58 | */ | |
3323eec9 | 59 | static struct ima_measure_rule_entry default_rules[] = { |
75834fc3 | 60 | {.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC}, |
3323eec9 MZ |
61 | {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC}, |
62 | {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC}, | |
63 | {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC}, | |
75834fc3 EP |
64 | {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC}, |
65 | {.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC}, | |
3323eec9 MZ |
66 | {.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC, |
67 | .flags = IMA_FUNC | IMA_MASK}, | |
68 | {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC, | |
69 | .flags = IMA_FUNC | IMA_MASK}, | |
1e93d005 | 70 | {.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = 0, |
5789ba3b | 71 | .flags = IMA_FUNC | IMA_MASK | IMA_UID}, |
3323eec9 MZ |
72 | }; |
73 | ||
74 | static LIST_HEAD(measure_default_rules); | |
4af4662f | 75 | static LIST_HEAD(measure_policy_rules); |
3323eec9 MZ |
76 | static struct list_head *ima_measure; |
77 | ||
4af4662f MZ |
78 | static DEFINE_MUTEX(ima_measure_mutex); |
79 | ||
5789ba3b EP |
80 | static bool ima_use_tcb __initdata; |
81 | static int __init default_policy_setup(char *str) | |
82 | { | |
83 | ima_use_tcb = 1; | |
84 | return 1; | |
85 | } | |
86 | __setup("ima_tcb", default_policy_setup); | |
87 | ||
3323eec9 MZ |
88 | /** |
89 | * ima_match_rules - determine whether an inode matches the measure rule. | |
90 | * @rule: a pointer to a rule | |
91 | * @inode: a pointer to an inode | |
92 | * @func: LIM hook identifier | |
93 | * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) | |
94 | * | |
95 | * Returns true on rule match, false on failure. | |
96 | */ | |
97 | static bool ima_match_rules(struct ima_measure_rule_entry *rule, | |
98 | struct inode *inode, enum ima_hooks func, int mask) | |
99 | { | |
100 | struct task_struct *tsk = current; | |
4af4662f | 101 | int i; |
3323eec9 MZ |
102 | |
103 | if ((rule->flags & IMA_FUNC) && rule->func != func) | |
104 | return false; | |
105 | if ((rule->flags & IMA_MASK) && rule->mask != mask) | |
106 | return false; | |
107 | if ((rule->flags & IMA_FSMAGIC) | |
108 | && rule->fsmagic != inode->i_sb->s_magic) | |
109 | return false; | |
110 | if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid) | |
111 | return false; | |
4af4662f | 112 | for (i = 0; i < MAX_LSM_RULES; i++) { |
53fc0e22 | 113 | int rc = 0; |
4af4662f MZ |
114 | u32 osid, sid; |
115 | ||
116 | if (!rule->lsm[i].rule) | |
117 | continue; | |
118 | ||
119 | switch (i) { | |
120 | case LSM_OBJ_USER: | |
121 | case LSM_OBJ_ROLE: | |
122 | case LSM_OBJ_TYPE: | |
123 | security_inode_getsecid(inode, &osid); | |
124 | rc = security_filter_rule_match(osid, | |
125 | rule->lsm[i].type, | |
53fc0e22 | 126 | Audit_equal, |
4af4662f MZ |
127 | rule->lsm[i].rule, |
128 | NULL); | |
129 | break; | |
130 | case LSM_SUBJ_USER: | |
131 | case LSM_SUBJ_ROLE: | |
132 | case LSM_SUBJ_TYPE: | |
133 | security_task_getsecid(tsk, &sid); | |
134 | rc = security_filter_rule_match(sid, | |
135 | rule->lsm[i].type, | |
53fc0e22 | 136 | Audit_equal, |
4af4662f MZ |
137 | rule->lsm[i].rule, |
138 | NULL); | |
139 | default: | |
140 | break; | |
141 | } | |
142 | if (!rc) | |
143 | return false; | |
144 | } | |
3323eec9 MZ |
145 | return true; |
146 | } | |
147 | ||
148 | /** | |
149 | * ima_match_policy - decision based on LSM and other conditions | |
150 | * @inode: pointer to an inode for which the policy decision is being made | |
151 | * @func: IMA hook identifier | |
152 | * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) | |
153 | * | |
154 | * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type) | |
155 | * conditions. | |
156 | * | |
157 | * (There is no need for locking when walking the policy list, | |
158 | * as elements in the list are never deleted, nor does the list | |
159 | * change.) | |
160 | */ | |
161 | int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask) | |
162 | { | |
163 | struct ima_measure_rule_entry *entry; | |
164 | ||
165 | list_for_each_entry(entry, ima_measure, list) { | |
166 | bool rc; | |
167 | ||
168 | rc = ima_match_rules(entry, inode, func, mask); | |
169 | if (rc) | |
170 | return entry->action; | |
171 | } | |
172 | return 0; | |
173 | } | |
174 | ||
175 | /** | |
176 | * ima_init_policy - initialize the default measure rules. | |
177 | * | |
3323eec9 | 178 | * ima_measure points to either the measure_default_rules or the |
4af4662f | 179 | * the new measure_policy_rules. |
3323eec9 | 180 | */ |
932995f0 | 181 | void __init ima_init_policy(void) |
3323eec9 | 182 | { |
5789ba3b EP |
183 | int i, entries; |
184 | ||
185 | /* if !ima_use_tcb set entries = 0 so we load NO default rules */ | |
186 | if (ima_use_tcb) | |
187 | entries = ARRAY_SIZE(default_rules); | |
188 | else | |
189 | entries = 0; | |
3323eec9 | 190 | |
5789ba3b | 191 | for (i = 0; i < entries; i++) |
3323eec9 MZ |
192 | list_add_tail(&default_rules[i].list, &measure_default_rules); |
193 | ima_measure = &measure_default_rules; | |
194 | } | |
4af4662f MZ |
195 | |
196 | /** | |
197 | * ima_update_policy - update default_rules with new measure rules | |
198 | * | |
199 | * Called on file .release to update the default rules with a complete new | |
200 | * policy. Once updated, the policy is locked, no additional rules can be | |
201 | * added to the policy. | |
202 | */ | |
203 | void ima_update_policy(void) | |
204 | { | |
205 | const char *op = "policy_update"; | |
206 | const char *cause = "already exists"; | |
207 | int result = 1; | |
208 | int audit_info = 0; | |
209 | ||
210 | if (ima_measure == &measure_default_rules) { | |
211 | ima_measure = &measure_policy_rules; | |
212 | cause = "complete"; | |
213 | result = 0; | |
214 | } | |
215 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
216 | NULL, op, cause, result, audit_info); | |
217 | } | |
218 | ||
219 | enum { | |
220 | Opt_err = -1, | |
221 | Opt_measure = 1, Opt_dont_measure, | |
222 | Opt_obj_user, Opt_obj_role, Opt_obj_type, | |
223 | Opt_subj_user, Opt_subj_role, Opt_subj_type, | |
224 | Opt_func, Opt_mask, Opt_fsmagic, Opt_uid | |
225 | }; | |
226 | ||
227 | static match_table_t policy_tokens = { | |
228 | {Opt_measure, "measure"}, | |
229 | {Opt_dont_measure, "dont_measure"}, | |
230 | {Opt_obj_user, "obj_user=%s"}, | |
231 | {Opt_obj_role, "obj_role=%s"}, | |
232 | {Opt_obj_type, "obj_type=%s"}, | |
233 | {Opt_subj_user, "subj_user=%s"}, | |
234 | {Opt_subj_role, "subj_role=%s"}, | |
235 | {Opt_subj_type, "subj_type=%s"}, | |
236 | {Opt_func, "func=%s"}, | |
237 | {Opt_mask, "mask=%s"}, | |
238 | {Opt_fsmagic, "fsmagic=%s"}, | |
239 | {Opt_uid, "uid=%s"}, | |
240 | {Opt_err, NULL} | |
241 | }; | |
242 | ||
243 | static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry, | |
244 | char *args, int lsm_rule, int audit_type) | |
245 | { | |
246 | int result; | |
247 | ||
248 | entry->lsm[lsm_rule].type = audit_type; | |
249 | result = security_filter_rule_init(entry->lsm[lsm_rule].type, | |
53fc0e22 | 250 | Audit_equal, args, |
4af4662f MZ |
251 | &entry->lsm[lsm_rule].rule); |
252 | return result; | |
253 | } | |
254 | ||
255 | static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry) | |
256 | { | |
257 | struct audit_buffer *ab; | |
258 | char *p; | |
259 | int result = 0; | |
260 | ||
523979ad | 261 | ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE); |
4af4662f MZ |
262 | |
263 | entry->action = -1; | |
264 | while ((p = strsep(&rule, " \n")) != NULL) { | |
265 | substring_t args[MAX_OPT_ARGS]; | |
266 | int token; | |
267 | unsigned long lnum; | |
268 | ||
269 | if (result < 0) | |
270 | break; | |
271 | if (!*p) | |
272 | continue; | |
273 | token = match_token(p, policy_tokens, args); | |
274 | switch (token) { | |
275 | case Opt_measure: | |
276 | audit_log_format(ab, "%s ", "measure"); | |
277 | entry->action = MEASURE; | |
278 | break; | |
279 | case Opt_dont_measure: | |
280 | audit_log_format(ab, "%s ", "dont_measure"); | |
281 | entry->action = DONT_MEASURE; | |
282 | break; | |
283 | case Opt_func: | |
284 | audit_log_format(ab, "func=%s ", args[0].from); | |
1e93d005 MZ |
285 | if (strcmp(args[0].from, "FILE_CHECK") == 0) |
286 | entry->func = FILE_CHECK; | |
287 | /* PATH_CHECK is for backwards compat */ | |
288 | else if (strcmp(args[0].from, "PATH_CHECK") == 0) | |
289 | entry->func = FILE_CHECK; | |
4af4662f MZ |
290 | else if (strcmp(args[0].from, "FILE_MMAP") == 0) |
291 | entry->func = FILE_MMAP; | |
292 | else if (strcmp(args[0].from, "BPRM_CHECK") == 0) | |
293 | entry->func = BPRM_CHECK; | |
294 | else | |
295 | result = -EINVAL; | |
296 | if (!result) | |
297 | entry->flags |= IMA_FUNC; | |
298 | break; | |
299 | case Opt_mask: | |
300 | audit_log_format(ab, "mask=%s ", args[0].from); | |
301 | if ((strcmp(args[0].from, "MAY_EXEC")) == 0) | |
302 | entry->mask = MAY_EXEC; | |
303 | else if (strcmp(args[0].from, "MAY_WRITE") == 0) | |
304 | entry->mask = MAY_WRITE; | |
305 | else if (strcmp(args[0].from, "MAY_READ") == 0) | |
306 | entry->mask = MAY_READ; | |
307 | else if (strcmp(args[0].from, "MAY_APPEND") == 0) | |
308 | entry->mask = MAY_APPEND; | |
309 | else | |
310 | result = -EINVAL; | |
311 | if (!result) | |
312 | entry->flags |= IMA_MASK; | |
313 | break; | |
314 | case Opt_fsmagic: | |
315 | audit_log_format(ab, "fsmagic=%s ", args[0].from); | |
316 | result = strict_strtoul(args[0].from, 16, | |
317 | &entry->fsmagic); | |
318 | if (!result) | |
319 | entry->flags |= IMA_FSMAGIC; | |
320 | break; | |
321 | case Opt_uid: | |
322 | audit_log_format(ab, "uid=%s ", args[0].from); | |
323 | result = strict_strtoul(args[0].from, 10, &lnum); | |
324 | if (!result) { | |
325 | entry->uid = (uid_t) lnum; | |
326 | if (entry->uid != lnum) | |
327 | result = -EINVAL; | |
328 | else | |
329 | entry->flags |= IMA_UID; | |
330 | } | |
331 | break; | |
332 | case Opt_obj_user: | |
333 | audit_log_format(ab, "obj_user=%s ", args[0].from); | |
334 | result = ima_lsm_rule_init(entry, args[0].from, | |
335 | LSM_OBJ_USER, | |
336 | AUDIT_OBJ_USER); | |
337 | break; | |
338 | case Opt_obj_role: | |
339 | audit_log_format(ab, "obj_role=%s ", args[0].from); | |
340 | result = ima_lsm_rule_init(entry, args[0].from, | |
341 | LSM_OBJ_ROLE, | |
342 | AUDIT_OBJ_ROLE); | |
343 | break; | |
344 | case Opt_obj_type: | |
345 | audit_log_format(ab, "obj_type=%s ", args[0].from); | |
346 | result = ima_lsm_rule_init(entry, args[0].from, | |
347 | LSM_OBJ_TYPE, | |
348 | AUDIT_OBJ_TYPE); | |
349 | break; | |
350 | case Opt_subj_user: | |
351 | audit_log_format(ab, "subj_user=%s ", args[0].from); | |
352 | result = ima_lsm_rule_init(entry, args[0].from, | |
353 | LSM_SUBJ_USER, | |
354 | AUDIT_SUBJ_USER); | |
355 | break; | |
356 | case Opt_subj_role: | |
357 | audit_log_format(ab, "subj_role=%s ", args[0].from); | |
358 | result = ima_lsm_rule_init(entry, args[0].from, | |
359 | LSM_SUBJ_ROLE, | |
360 | AUDIT_SUBJ_ROLE); | |
361 | break; | |
362 | case Opt_subj_type: | |
363 | audit_log_format(ab, "subj_type=%s ", args[0].from); | |
364 | result = ima_lsm_rule_init(entry, args[0].from, | |
365 | LSM_SUBJ_TYPE, | |
366 | AUDIT_SUBJ_TYPE); | |
367 | break; | |
368 | case Opt_err: | |
523979ad | 369 | audit_log_format(ab, "UNKNOWN=%s ", p); |
4af4662f MZ |
370 | break; |
371 | } | |
372 | } | |
373 | if (entry->action == UNKNOWN) | |
374 | result = -EINVAL; | |
375 | ||
523979ad | 376 | audit_log_format(ab, "res=%d", !result ? 0 : 1); |
4af4662f MZ |
377 | audit_log_end(ab); |
378 | return result; | |
379 | } | |
380 | ||
381 | /** | |
382 | * ima_parse_add_rule - add a rule to measure_policy_rules | |
383 | * @rule - ima measurement policy rule | |
384 | * | |
385 | * Uses a mutex to protect the policy list from multiple concurrent writers. | |
386 | * Returns 0 on success, an error code on failure. | |
387 | */ | |
388 | int ima_parse_add_rule(char *rule) | |
389 | { | |
523979ad | 390 | const char *op = "update_policy"; |
4af4662f MZ |
391 | struct ima_measure_rule_entry *entry; |
392 | int result = 0; | |
393 | int audit_info = 0; | |
394 | ||
395 | /* Prevent installed policy from changing */ | |
396 | if (ima_measure != &measure_default_rules) { | |
397 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
398 | NULL, op, "already exists", | |
399 | -EACCES, audit_info); | |
400 | return -EACCES; | |
401 | } | |
402 | ||
403 | entry = kzalloc(sizeof(*entry), GFP_KERNEL); | |
404 | if (!entry) { | |
405 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, | |
406 | NULL, op, "-ENOMEM", -ENOMEM, audit_info); | |
407 | return -ENOMEM; | |
408 | } | |
409 | ||
410 | INIT_LIST_HEAD(&entry->list); | |
411 | ||
412 | result = ima_parse_rule(rule, entry); | |
413 | if (!result) { | |
414 | mutex_lock(&ima_measure_mutex); | |
415 | list_add_tail(&entry->list, &measure_policy_rules); | |
416 | mutex_unlock(&ima_measure_mutex); | |
523979ad | 417 | } else { |
4af4662f | 418 | kfree(entry); |
523979ad MZ |
419 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, |
420 | NULL, op, "invalid policy", result, | |
421 | audit_info); | |
422 | } | |
4af4662f MZ |
423 | return result; |
424 | } | |
425 | ||
426 | /* ima_delete_rules called to cleanup invalid policy */ | |
64c61d80 | 427 | void ima_delete_rules(void) |
4af4662f MZ |
428 | { |
429 | struct ima_measure_rule_entry *entry, *tmp; | |
430 | ||
431 | mutex_lock(&ima_measure_mutex); | |
432 | list_for_each_entry_safe(entry, tmp, &measure_policy_rules, list) { | |
433 | list_del(&entry->list); | |
434 | kfree(entry); | |
435 | } | |
436 | mutex_unlock(&ima_measure_mutex); | |
437 | } |