[mirror_ubuntu-bionic-kernel.git] / security / integrity / ima / ima_policy.c

/*
 * Copyright (C) 2008 IBM Corporation
 * Author: Mimi Zohar <zohar@us.ibm.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 2 of the License.
 *
 * ima_policy.c
 * 	- initialize default measure policy rules
 *
 */
#include <linux/module.h>
#include <linux/list.h>
#include <linux/security.h>
#include <linux/magic.h>
#include <linux/parser.h>
#include <linux/slab.h>

#include "ima.h"

/* flags definitions */
#define IMA_FUNC 	0x0001
#define IMA_MASK 	0x0002
#define IMA_FSMAGIC	0x0004
#define IMA_UID		0x0008
#define IMA_FOWNER	0x0010

#define UNKNOWN		0
#define MEASURE		0x0001	/* same as IMA_MEASURE */
#define DONT_MEASURE	0x0002
#define APPRAISE	0x0004	/* same as IMA_APPRAISE */
#define DONT_APPRAISE	0x0008
#define AUDIT		0x0040

#define MAX_LSM_RULES 6
enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
	LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
};

struct ima_rule_entry {
	struct list_head list;
	int action;
	unsigned int flags;
	enum ima_hooks func;
	int mask;
	unsigned long fsmagic;
	kuid_t uid;
	kuid_t fowner;
	struct {
		void *rule;	/* LSM file metadata specific */
		void *args_p;	/* audit value */
		int type;	/* audit type */
	} lsm[MAX_LSM_RULES];
};

/*
 * Without LSM specific knowledge, the default policy can only be
 * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
 */

/*
 * The minimum rule set to allow for full TCB coverage.  Measures all files
 * opened or mmap for exec and everything read by root.  Dangerous because
 * normal users can easily run the machine out of memory simply building
 * and running executables.
 */
static struct ima_rule_entry default_rules[] = {
	{.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
	{.action = MEASURE,.func = MMAP_CHECK,.mask = MAY_EXEC,
	 .flags = IMA_FUNC | IMA_MASK},
	{.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
	 .flags = IMA_FUNC | IMA_MASK},
	{.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = GLOBAL_ROOT_UID,
	 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
	{.action = MEASURE,.func = MODULE_CHECK, .flags = IMA_FUNC},
};

static struct ima_rule_entry default_appraise_rules[] = {
	{.action = DONT_APPRAISE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE,.fsmagic = CGROUP_SUPER_MAGIC,.flags = IMA_FSMAGIC},
	{.action = APPRAISE,.fowner = GLOBAL_ROOT_UID,.flags = IMA_FOWNER},
};

static LIST_HEAD(ima_default_rules);
static LIST_HEAD(ima_policy_rules);
static struct list_head *ima_rules;

static DEFINE_MUTEX(ima_rules_mutex);

static bool ima_use_tcb __initdata;
static int __init default_measure_policy_setup(char *str)
{
	ima_use_tcb = 1;
	return 1;
}
__setup("ima_tcb", default_measure_policy_setup);

static bool ima_use_appraise_tcb __initdata;
static int __init default_appraise_policy_setup(char *str)
{
	ima_use_appraise_tcb = 1;
	return 1;
}
__setup("ima_appraise_tcb", default_appraise_policy_setup);

/* 
 * Although the IMA policy does not change, the LSM policy can be
 * reloaded, leaving the IMA LSM based rules referring to the old,
 * stale LSM policy.
 *
 * Update the IMA LSM based rules to reflect the reloaded LSM policy. 
 * We assume the rules still exist; and BUG_ON() if they don't.
 */
static void ima_lsm_update_rules(void)
{
	struct ima_rule_entry *entry, *tmp;
	int result;
	int i;

	mutex_lock(&ima_rules_mutex);
	list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) {
		for (i = 0; i < MAX_LSM_RULES; i++) {
			if (!entry->lsm[i].rule)
				continue;
			result = security_filter_rule_init(entry->lsm[i].type,
							   Audit_equal,
							   entry->lsm[i].args_p,
							   &entry->lsm[i].rule);
			BUG_ON(!entry->lsm[i].rule);
		}
	}
	mutex_unlock(&ima_rules_mutex);
}

/**
 * ima_match_rules - determine whether an inode matches the measure rule.
 * @rule: a pointer to a rule
 * @inode: a pointer to an inode
 * @func: LIM hook identifier
 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 *
 * Returns true on rule match, false on failure.
 */
static bool ima_match_rules(struct ima_rule_entry *rule,
			    struct inode *inode, enum ima_hooks func, int mask)
{
	struct task_struct *tsk = current;
	const struct cred *cred = current_cred();
	int i;

	if ((rule->flags & IMA_FUNC) && rule->func != func)
		return false;
	if ((rule->flags & IMA_MASK) && rule->mask != mask)
		return false;
	if ((rule->flags & IMA_FSMAGIC)
	    && rule->fsmagic != inode->i_sb->s_magic)
		return false;
	if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
		return false;
	if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
		return false;
	for (i = 0; i < MAX_LSM_RULES; i++) {
		int rc = 0;
		u32 osid, sid;
		int retried = 0;

		if (!rule->lsm[i].rule)
			continue;
retry:
		switch (i) {
		case LSM_OBJ_USER:
		case LSM_OBJ_ROLE:
		case LSM_OBJ_TYPE:
			security_inode_getsecid(inode, &osid);
			rc = security_filter_rule_match(osid,
							rule->lsm[i].type,
							Audit_equal,
							rule->lsm[i].rule,
							NULL);
			break;
		case LSM_SUBJ_USER:
		case LSM_SUBJ_ROLE:
		case LSM_SUBJ_TYPE:
			security_task_getsecid(tsk, &sid);
			rc = security_filter_rule_match(sid,
							rule->lsm[i].type,
							Audit_equal,
							rule->lsm[i].rule,
							NULL);
		default:
			break;
		}
		if ((rc < 0) && (!retried)) {
			retried = 1;
			ima_lsm_update_rules();
			goto retry;
		} 
		if (!rc)
			return false;
	}
	return true;
}

/**
 * ima_match_policy - decision based on LSM and other conditions
 * @inode: pointer to an inode for which the policy decision is being made
 * @func: IMA hook identifier
 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 *
 * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 * conditions.
 *
 * (There is no need for locking when walking the policy list,
 * as elements in the list are never deleted, nor does the list
 * change.)
 */
int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
		     int flags)
{
	struct ima_rule_entry *entry;
	int action = 0, actmask = flags | (flags << 1);

	list_for_each_entry(entry, ima_rules, list) {

		if (!(entry->action & actmask))
			continue;

		if (!ima_match_rules(entry, inode, func, mask))
			continue;

		action |= entry->action & IMA_DO_MASK;
		if (entry->action & IMA_DO_MASK)
			actmask &= ~(entry->action | entry->action << 1);
		else
			actmask &= ~(entry->action | entry->action >> 1);

		if (!actmask)
			break;
	}

	return action;
}

/**
 * ima_init_policy - initialize the default measure rules.
 *
 * ima_rules points to either the ima_default_rules or the
 * the new ima_policy_rules.
 */
void __init ima_init_policy(void)
{
	int i, measure_entries, appraise_entries;

	/* if !ima_use_tcb set entries = 0 so we load NO default rules */
	measure_entries = ima_use_tcb ? ARRAY_SIZE(default_rules) : 0;
	appraise_entries = ima_use_appraise_tcb ?
			 ARRAY_SIZE(default_appraise_rules) : 0;
	
	for (i = 0; i < measure_entries + appraise_entries; i++) {
		if (i < measure_entries)
			list_add_tail(&default_rules[i].list,
				      &ima_default_rules);
		else {
			int j = i - measure_entries;

			list_add_tail(&default_appraise_rules[j].list,
				      &ima_default_rules);
		}
	}

	ima_rules = &ima_default_rules;
}

/**
 * ima_update_policy - update default_rules with new measure rules
 *
 * Called on file .release to update the default rules with a complete new
 * policy.  Once updated, the policy is locked, no additional rules can be
 * added to the policy.
 */
void ima_update_policy(void)
{
	const char *op = "policy_update";
	const char *cause = "already exists";
	int result = 1;
	int audit_info = 0;

	if (ima_rules == &ima_default_rules) {
		ima_rules = &ima_policy_rules;
		cause = "complete";
		result = 0;
	}
	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
			    NULL, op, cause, result, audit_info);
}

enum {
	Opt_err = -1,
	Opt_measure = 1, Opt_dont_measure,
	Opt_appraise, Opt_dont_appraise,
	Opt_audit,
	Opt_obj_user, Opt_obj_role, Opt_obj_type,
	Opt_subj_user, Opt_subj_role, Opt_subj_type,
	Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner
};

static match_table_t policy_tokens = {
	{Opt_measure, "measure"},
	{Opt_dont_measure, "dont_measure"},
	{Opt_appraise, "appraise"},
	{Opt_dont_appraise, "dont_appraise"},
	{Opt_audit, "audit"},
	{Opt_obj_user, "obj_user=%s"},
	{Opt_obj_role, "obj_role=%s"},
	{Opt_obj_type, "obj_type=%s"},
	{Opt_subj_user, "subj_user=%s"},
	{Opt_subj_role, "subj_role=%s"},
	{Opt_subj_type, "subj_type=%s"},
	{Opt_func, "func=%s"},
	{Opt_mask, "mask=%s"},
	{Opt_fsmagic, "fsmagic=%s"},
	{Opt_uid, "uid=%s"},
	{Opt_fowner, "fowner=%s"},
	{Opt_err, NULL}
};

static int ima_lsm_rule_init(struct ima_rule_entry *entry,
			     substring_t *args, int lsm_rule, int audit_type)
{
	int result;

	if (entry->lsm[lsm_rule].rule)
		return -EINVAL;

	entry->lsm[lsm_rule].args_p = match_strdup(args);
	if (!entry->lsm[lsm_rule].args_p)
		return -ENOMEM;

	entry->lsm[lsm_rule].type = audit_type;
	result = security_filter_rule_init(entry->lsm[lsm_rule].type,
					   Audit_equal,
					   entry->lsm[lsm_rule].args_p,
					   &entry->lsm[lsm_rule].rule);
	if (!entry->lsm[lsm_rule].rule) {
		kfree(entry->lsm[lsm_rule].args_p);
		return -EINVAL;
	}

	return result;
}

static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
{
	audit_log_format(ab, "%s=", key);
	audit_log_untrustedstring(ab, value);
	audit_log_format(ab, " ");
}

static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
{
	struct audit_buffer *ab;
	char *p;
	int result = 0;

	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);

	entry->uid = INVALID_UID;
	entry->fowner = INVALID_UID;
	entry->action = UNKNOWN;
	while ((p = strsep(&rule, " \t")) != NULL) {
		substring_t args[MAX_OPT_ARGS];
		int token;
		unsigned long lnum;

		if (result < 0)
			break;
		if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
			continue;
		token = match_token(p, policy_tokens, args);
		switch (token) {
		case Opt_measure:
			ima_log_string(ab, "action", "measure");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = MEASURE;
			break;
		case Opt_dont_measure:
			ima_log_string(ab, "action", "dont_measure");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = DONT_MEASURE;
			break;
		case Opt_appraise:
			ima_log_string(ab, "action", "appraise");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = APPRAISE;
			break;
		case Opt_dont_appraise:
			ima_log_string(ab, "action", "dont_appraise");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = DONT_APPRAISE;
			break;
		case Opt_audit:
			ima_log_string(ab, "action", "audit");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = AUDIT;
			break;
		case Opt_func:
			ima_log_string(ab, "func", args[0].from);

			if (entry->func)
				result = -EINVAL;

			if (strcmp(args[0].from, "FILE_CHECK") == 0)
				entry->func = FILE_CHECK;
			/* PATH_CHECK is for backwards compat */
			else if (strcmp(args[0].from, "PATH_CHECK") == 0)
				entry->func = FILE_CHECK;
			else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
				entry->func = MODULE_CHECK;
			else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
				|| (strcmp(args[0].from, "MMAP_CHECK") == 0))
				entry->func = MMAP_CHECK;
			else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
				entry->func = BPRM_CHECK;
			else
				result = -EINVAL;
			if (!result)
				entry->flags |= IMA_FUNC;
			break;
		case Opt_mask:
			ima_log_string(ab, "mask", args[0].from);

			if (entry->mask)
				result = -EINVAL;

			if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
				entry->mask = MAY_EXEC;
			else if (strcmp(args[0].from, "MAY_WRITE") == 0)
				entry->mask = MAY_WRITE;
			else if (strcmp(args[0].from, "MAY_READ") == 0)
				entry->mask = MAY_READ;
			else if (strcmp(args[0].from, "MAY_APPEND") == 0)
				entry->mask = MAY_APPEND;
			else
				result = -EINVAL;
			if (!result)
				entry->flags |= IMA_MASK;
			break;
		case Opt_fsmagic:
			ima_log_string(ab, "fsmagic", args[0].from);

			if (entry->fsmagic) {
				result = -EINVAL;
				break;
			}

			result = strict_strtoul(args[0].from, 16,
						&entry->fsmagic);
			if (!result)
				entry->flags |= IMA_FSMAGIC;
			break;
		case Opt_uid:
			ima_log_string(ab, "uid", args[0].from);

			if (uid_valid(entry->uid)) {
				result = -EINVAL;
				break;
			}

			result = strict_strtoul(args[0].from, 10, &lnum);
			if (!result) {
				entry->uid = make_kuid(current_user_ns(), (uid_t)lnum);
				if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum))
					result = -EINVAL;
				else
					entry->flags |= IMA_UID;
			}
			break;
		case Opt_fowner:
			ima_log_string(ab, "fowner", args[0].from);

			if (uid_valid(entry->fowner)) {
				result = -EINVAL;
				break;
			}

			result = strict_strtoul(args[0].from, 10, &lnum);
			if (!result) {
				entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
				if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
					result = -EINVAL;
				else
					entry->flags |= IMA_FOWNER;
			}
			break;
		case Opt_obj_user:
			ima_log_string(ab, "obj_user", args[0].from);
			result = ima_lsm_rule_init(entry, args,
						   LSM_OBJ_USER,
						   AUDIT_OBJ_USER);
			break;
		case Opt_obj_role:
			ima_log_string(ab, "obj_role", args[0].from);
			result = ima_lsm_rule_init(entry, args,
						   LSM_OBJ_ROLE,
						   AUDIT_OBJ_ROLE);
			break;
		case Opt_obj_type:
			ima_log_string(ab, "obj_type", args[0].from);
			result = ima_lsm_rule_init(entry, args,
						   LSM_OBJ_TYPE,
						   AUDIT_OBJ_TYPE);
			break;
		case Opt_subj_user:
			ima_log_string(ab, "subj_user", args[0].from);
			result = ima_lsm_rule_init(entry, args,
						   LSM_SUBJ_USER,
						   AUDIT_SUBJ_USER);
			break;
		case Opt_subj_role:
			ima_log_string(ab, "subj_role", args[0].from);
			result = ima_lsm_rule_init(entry, args,
						   LSM_SUBJ_ROLE,
						   AUDIT_SUBJ_ROLE);
			break;
		case Opt_subj_type:
			ima_log_string(ab, "subj_type", args[0].from);
			result = ima_lsm_rule_init(entry, args,
						   LSM_SUBJ_TYPE,
						   AUDIT_SUBJ_TYPE);
			break;
		case Opt_err:
			ima_log_string(ab, "UNKNOWN", p);
			result = -EINVAL;
			break;
		}
	}
	if (!result && (entry->action == UNKNOWN))
		result = -EINVAL;

	audit_log_format(ab, "res=%d", !result);
	audit_log_end(ab);
	return result;
}

/**
 * ima_parse_add_rule - add a rule to ima_policy_rules
 * @rule - ima measurement policy rule
 *
 * Uses a mutex to protect the policy list from multiple concurrent writers.
 * Returns the length of the rule parsed, an error code on failure
 */
ssize_t ima_parse_add_rule(char *rule)
{
	const char *op = "update_policy";
	char *p;
	struct ima_rule_entry *entry;
	ssize_t result, len;
	int audit_info = 0;

	/* Prevent installed policy from changing */
	if (ima_rules != &ima_default_rules) {
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
				    NULL, op, "already exists",
				    -EACCES, audit_info);
		return -EACCES;
	}

	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
	if (!entry) {
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
				    NULL, op, "-ENOMEM", -ENOMEM, audit_info);
		return -ENOMEM;
	}

	INIT_LIST_HEAD(&entry->list);

	p = strsep(&rule, "\n");
	len = strlen(p) + 1;

	if (*p == '#') {
		kfree(entry);
		return len;
	}

	result = ima_parse_rule(p, entry);
	if (result) {
		kfree(entry);
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
				    NULL, op, "invalid policy", result,
				    audit_info);
		return result;
	}

	mutex_lock(&ima_rules_mutex);
	list_add_tail(&entry->list, &ima_policy_rules);
	mutex_unlock(&ima_rules_mutex);

	return len;
}

/* ima_delete_rules called to cleanup invalid policy */
void ima_delete_rules(void)
{
	struct ima_rule_entry *entry, *tmp;
	int i;

	mutex_lock(&ima_rules_mutex);
	list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) {
		for (i = 0; i < MAX_LSM_RULES; i++)
			kfree(entry->lsm[i].args_p);

		list_del(&entry->list);
		kfree(entry);
	}
	mutex_unlock(&ima_rules_mutex);
}
Commit	Line	Data
3323eec9 MZ	1	/*
	2	* Copyright (C) 2008 IBM Corporation
	3	* Author: Mimi Zohar <zohar@us.ibm.com>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License as published by
	7	* the Free Software Foundation, version 2 of the License.
	8	*
	9	* ima_policy.c
	10	* - initialize default measure policy rules
	11	*
	12	*/
	13	#include <linux/module.h>
	14	#include <linux/list.h>
3323eec9 MZ	15	#include <linux/security.h>
3323eec9 MZ	16	#include <linux/magic.h>
4af4662f	17	#include <linux/parser.h>
5a0e3ad6	18	#include <linux/slab.h>
3323eec9 MZ	19
	20	#include "ima.h"
	21
	22	/* flags definitions */
	23	#define IMA_FUNC 0x0001
	24	#define IMA_MASK 0x0002
	25	#define IMA_FSMAGIC 0x0004
	26	#define IMA_UID 0x0008
07f6a794	27	#define IMA_FOWNER 0x0010
3323eec9	28
45e2472e DK	29	#define UNKNOWN 0
	30	#define MEASURE 0x0001 /* same as IMA_MEASURE */
	31	#define DONT_MEASURE 0x0002
	32	#define APPRAISE 0x0004 /* same as IMA_APPRAISE */
	33	#define DONT_APPRAISE 0x0008
e7c568e0	34	#define AUDIT 0x0040
4af4662f MZ	35
	36	#define MAX_LSM_RULES 6
	37	enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
	38	LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
	39	};
3323eec9	40
07f6a794	41	struct ima_rule_entry {
3323eec9	42	struct list_head list;
2fe5d6de	43	int action;
3323eec9 MZ	44	unsigned int flags;
	45	enum ima_hooks func;
	46	int mask;
	47	unsigned long fsmagic;
8b94eea4	48	kuid_t uid;
88265322	49	kuid_t fowner;
4af4662f MZ	50	struct {
4af4662f MZ	51	void rule; / LSM file metadata specific */
7163a993	52	void args_p; / audit value */
4af4662f MZ	53	int type; /* audit type */
4af4662f MZ	54	} lsm[MAX_LSM_RULES];
3323eec9 MZ	55	};
3323eec9 MZ	56
5789ba3b EP	57	/*
5789ba3b EP	58	* Without LSM specific knowledge, the default policy can only be
07f6a794	59	* written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
4af4662f	60	*/
5789ba3b EP	61
	62	/*
	63	* The minimum rule set to allow for full TCB coverage. Measures all files
	64	* opened or mmap for exec and everything read by root. Dangerous because
	65	* normal users can easily run the machine out of memory simply building
	66	* and running executables.
	67	*/
07f6a794	68	static struct ima_rule_entry default_rules[] = {
75834fc3	69	{.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
3323eec9 MZ	70	{.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
	71	{.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
	72	{.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
4c2c3927	73	{.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
8445d64d DK	74	{.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
8445d64d DK	75	{.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
75834fc3 EP	76	{.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
75834fc3 EP	77	{.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
16cac49f	78	{.action = MEASURE,.func = MMAP_CHECK,.mask = MAY_EXEC,
3323eec9 MZ	79	.flags = IMA_FUNC \| IMA_MASK},
	80	{.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
	81	.flags = IMA_FUNC \| IMA_MASK},
8b94eea4	82	{.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = GLOBAL_ROOT_UID,
5789ba3b	83	.flags = IMA_FUNC \| IMA_MASK \| IMA_UID},
fdf90729	84	{.action = MEASURE,.func = MODULE_CHECK, .flags = IMA_FUNC},
3323eec9 MZ	85	};
3323eec9 MZ	86
07f6a794 MZ	87	static struct ima_rule_entry default_appraise_rules[] = {
	88	{.action = DONT_APPRAISE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
	89	{.action = DONT_APPRAISE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
	90	{.action = DONT_APPRAISE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
	91	{.action = DONT_APPRAISE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
	92	{.action = DONT_APPRAISE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
	93	{.action = DONT_APPRAISE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
	94	{.action = DONT_APPRAISE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
	95	{.action = DONT_APPRAISE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
	96	{.action = DONT_APPRAISE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
	97	{.action = DONT_APPRAISE,.fsmagic = CGROUP_SUPER_MAGIC,.flags = IMA_FSMAGIC},
88265322	98	{.action = APPRAISE,.fowner = GLOBAL_ROOT_UID,.flags = IMA_FOWNER},
07f6a794 MZ	99	};
	100
	101	static LIST_HEAD(ima_default_rules);
	102	static LIST_HEAD(ima_policy_rules);
	103	static struct list_head *ima_rules;
3323eec9	104
07f6a794	105	static DEFINE_MUTEX(ima_rules_mutex);
4af4662f	106
5789ba3b	107	static bool ima_use_tcb __initdata;
07f6a794	108	static int __init default_measure_policy_setup(char *str)
5789ba3b EP	109	{
	110	ima_use_tcb = 1;
	111	return 1;
	112	}
07f6a794 MZ	113	__setup("ima_tcb", default_measure_policy_setup);
	114
	115	static bool ima_use_appraise_tcb __initdata;
	116	static int __init default_appraise_policy_setup(char *str)
	117	{
	118	ima_use_appraise_tcb = 1;
	119	return 1;
	120	}
	121	__setup("ima_appraise_tcb", default_appraise_policy_setup);
5789ba3b	122
7163a993 MZ	123	/*
	124	* Although the IMA policy does not change, the LSM policy can be
	125	* reloaded, leaving the IMA LSM based rules referring to the old,
	126	* stale LSM policy.
	127	*
	128	* Update the IMA LSM based rules to reflect the reloaded LSM policy.
	129	* We assume the rules still exist; and BUG_ON() if they don't.
	130	*/
	131	static void ima_lsm_update_rules(void)
	132	{
	133	struct ima_rule_entry entry, tmp;
	134	int result;
	135	int i;
	136
	137	mutex_lock(&ima_rules_mutex);
	138	list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) {
	139	for (i = 0; i < MAX_LSM_RULES; i++) {
	140	if (!entry->lsm[i].rule)
	141	continue;
	142	result = security_filter_rule_init(entry->lsm[i].type,
	143	Audit_equal,
	144	entry->lsm[i].args_p,
	145	&entry->lsm[i].rule);
	146	BUG_ON(!entry->lsm[i].rule);
	147	}
	148	}
	149	mutex_unlock(&ima_rules_mutex);
	150	}
	151
3323eec9 MZ	152	/**
	153	* ima_match_rules - determine whether an inode matches the measure rule.
	154	* @rule: a pointer to a rule
	155	* @inode: a pointer to an inode
	156	* @func: LIM hook identifier
	157	* @mask: requested action (MAY_READ \| MAY_WRITE \| MAY_APPEND \| MAY_EXEC)
	158	*
	159	* Returns true on rule match, false on failure.
	160	*/
07f6a794	161	static bool ima_match_rules(struct ima_rule_entry *rule,
3323eec9 MZ	162	struct inode *inode, enum ima_hooks func, int mask)
	163	{
	164	struct task_struct *tsk = current;
3db59dd9	165	const struct cred *cred = current_cred();
4af4662f	166	int i;
3323eec9 MZ	167
	168	if ((rule->flags & IMA_FUNC) && rule->func != func)
	169	return false;
	170	if ((rule->flags & IMA_MASK) && rule->mask != mask)
	171	return false;
	172	if ((rule->flags & IMA_FSMAGIC)
	173	&& rule->fsmagic != inode->i_sb->s_magic)
	174	return false;
8b94eea4	175	if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
3323eec9	176	return false;
88265322	177	if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
07f6a794	178	return false;
4af4662f	179	for (i = 0; i < MAX_LSM_RULES; i++) {
53fc0e22	180	int rc = 0;
4af4662f	181	u32 osid, sid;
7163a993	182	int retried = 0;
4af4662f MZ	183
	184	if (!rule->lsm[i].rule)
	185	continue;
7163a993	186	retry:
4af4662f MZ	187	switch (i) {
	188	case LSM_OBJ_USER:
	189	case LSM_OBJ_ROLE:
	190	case LSM_OBJ_TYPE:
	191	security_inode_getsecid(inode, &osid);
	192	rc = security_filter_rule_match(osid,
	193	rule->lsm[i].type,
53fc0e22	194	Audit_equal,
4af4662f MZ	195	rule->lsm[i].rule,
	196	NULL);
	197	break;
	198	case LSM_SUBJ_USER:
	199	case LSM_SUBJ_ROLE:
	200	case LSM_SUBJ_TYPE:
	201	security_task_getsecid(tsk, &sid);
	202	rc = security_filter_rule_match(sid,
	203	rule->lsm[i].type,
53fc0e22	204	Audit_equal,
4af4662f MZ	205	rule->lsm[i].rule,
	206	NULL);
	207	default:
	208	break;
	209	}
7163a993 MZ	210	if ((rc < 0) && (!retried)) {
	211	retried = 1;
	212	ima_lsm_update_rules();
	213	goto retry;
	214	}
4af4662f MZ	215	if (!rc)
	216	return false;
	217	}
3323eec9 MZ	218	return true;
	219	}
	220
	221	/**
	222	* ima_match_policy - decision based on LSM and other conditions
	223	* @inode: pointer to an inode for which the policy decision is being made
	224	* @func: IMA hook identifier
	225	* @mask: requested action (MAY_READ \| MAY_WRITE \| MAY_APPEND \| MAY_EXEC)
	226	*
	227	* Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
	228	* conditions.
	229	*
	230	* (There is no need for locking when walking the policy list,
	231	* as elements in the list are never deleted, nor does the list
	232	* change.)
	233	*/
2fe5d6de MZ	234	int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
2fe5d6de MZ	235	int flags)
3323eec9	236	{
07f6a794	237	struct ima_rule_entry *entry;
2fe5d6de	238	int action = 0, actmask = flags \| (flags << 1);
3323eec9	239
07f6a794	240	list_for_each_entry(entry, ima_rules, list) {
3323eec9	241
2fe5d6de MZ	242	if (!(entry->action & actmask))
	243	continue;
	244
	245	if (!ima_match_rules(entry, inode, func, mask))
	246	continue;
3323eec9	247
45e2472e DK	248	action \|= entry->action & IMA_DO_MASK;
	249	if (entry->action & IMA_DO_MASK)
	250	actmask &= ~(entry->action \| entry->action << 1);
	251	else
	252	actmask &= ~(entry->action \| entry->action >> 1);
3323eec9	253
2fe5d6de MZ	254	if (!actmask)
2fe5d6de MZ	255	break;
3323eec9	256	}
2fe5d6de MZ	257
2fe5d6de MZ	258	return action;
3323eec9 MZ	259	}
	260
	261	/**
	262	* ima_init_policy - initialize the default measure rules.
	263	*
07f6a794 MZ	264	* ima_rules points to either the ima_default_rules or the
07f6a794 MZ	265	* the new ima_policy_rules.
3323eec9	266	*/
932995f0	267	void __init ima_init_policy(void)
3323eec9	268	{
07f6a794	269	int i, measure_entries, appraise_entries;
5789ba3b EP	270
5789ba3b EP	271	/* if !ima_use_tcb set entries = 0 so we load NO default rules */
07f6a794 MZ	272	measure_entries = ima_use_tcb ? ARRAY_SIZE(default_rules) : 0;
	273	appraise_entries = ima_use_appraise_tcb ?
	274	ARRAY_SIZE(default_appraise_rules) : 0;
	275
	276	for (i = 0; i < measure_entries + appraise_entries; i++) {
	277	if (i < measure_entries)
	278	list_add_tail(&default_rules[i].list,
	279	&ima_default_rules);
	280	else {
	281	int j = i - measure_entries;
	282
	283	list_add_tail(&default_appraise_rules[j].list,
	284	&ima_default_rules);
	285	}
	286	}
	287
	288	ima_rules = &ima_default_rules;
3323eec9	289	}
4af4662f MZ	290
	291	/**
	292	* ima_update_policy - update default_rules with new measure rules
	293	*
	294	* Called on file .release to update the default rules with a complete new
	295	* policy. Once updated, the policy is locked, no additional rules can be
	296	* added to the policy.
	297	*/
	298	void ima_update_policy(void)
	299	{
	300	const char *op = "policy_update";
	301	const char *cause = "already exists";
	302	int result = 1;
	303	int audit_info = 0;
	304
07f6a794 MZ	305	if (ima_rules == &ima_default_rules) {
07f6a794 MZ	306	ima_rules = &ima_policy_rules;
4af4662f MZ	307	cause = "complete";
	308	result = 0;
	309	}
	310	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
	311	NULL, op, cause, result, audit_info);
	312	}
	313
	314	enum {
	315	Opt_err = -1,
	316	Opt_measure = 1, Opt_dont_measure,
07f6a794	317	Opt_appraise, Opt_dont_appraise,
e7c568e0	318	Opt_audit,
4af4662f MZ	319	Opt_obj_user, Opt_obj_role, Opt_obj_type,
4af4662f MZ	320	Opt_subj_user, Opt_subj_role, Opt_subj_type,
07f6a794	321	Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner
4af4662f MZ	322	};
	323
	324	static match_table_t policy_tokens = {
	325	{Opt_measure, "measure"},
	326	{Opt_dont_measure, "dont_measure"},
07f6a794 MZ	327	{Opt_appraise, "appraise"},
07f6a794 MZ	328	{Opt_dont_appraise, "dont_appraise"},
e7c568e0	329	{Opt_audit, "audit"},
4af4662f MZ	330	{Opt_obj_user, "obj_user=%s"},
	331	{Opt_obj_role, "obj_role=%s"},
	332	{Opt_obj_type, "obj_type=%s"},
	333	{Opt_subj_user, "subj_user=%s"},
	334	{Opt_subj_role, "subj_role=%s"},
	335	{Opt_subj_type, "subj_type=%s"},
	336	{Opt_func, "func=%s"},
	337	{Opt_mask, "mask=%s"},
	338	{Opt_fsmagic, "fsmagic=%s"},
	339	{Opt_uid, "uid=%s"},
07f6a794	340	{Opt_fowner, "fowner=%s"},
4af4662f MZ	341	{Opt_err, NULL}
	342	};
	343
07f6a794	344	static int ima_lsm_rule_init(struct ima_rule_entry *entry,
7163a993	345	substring_t *args, int lsm_rule, int audit_type)
4af4662f MZ	346	{
	347	int result;
	348
7b62e162 EP	349	if (entry->lsm[lsm_rule].rule)
	350	return -EINVAL;
	351
7163a993 MZ	352	entry->lsm[lsm_rule].args_p = match_strdup(args);
	353	if (!entry->lsm[lsm_rule].args_p)
	354	return -ENOMEM;
	355
4af4662f MZ	356	entry->lsm[lsm_rule].type = audit_type;
4af4662f MZ	357	result = security_filter_rule_init(entry->lsm[lsm_rule].type,
7163a993 MZ	358	Audit_equal,
7163a993 MZ	359	entry->lsm[lsm_rule].args_p,
4af4662f	360	&entry->lsm[lsm_rule].rule);
7163a993 MZ	361	if (!entry->lsm[lsm_rule].rule) {
7163a993 MZ	362	kfree(entry->lsm[lsm_rule].args_p);
867c2026	363	return -EINVAL;
7163a993 MZ	364	}
7163a993 MZ	365
4af4662f MZ	366	return result;
	367	}
	368
2f1506cd EP	369	static void ima_log_string(struct audit_buffer ab, char key, char *value)
	370	{
	371	audit_log_format(ab, "%s=", key);
	372	audit_log_untrustedstring(ab, value);
	373	audit_log_format(ab, " ");
	374	}
	375
07f6a794	376	static int ima_parse_rule(char rule, struct ima_rule_entry entry)
4af4662f MZ	377	{
	378	struct audit_buffer *ab;
	379	char *p;
	380	int result = 0;
	381
523979ad	382	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
4af4662f	383
8b94eea4	384	entry->uid = INVALID_UID;
88265322	385	entry->fowner = INVALID_UID;
b9035b1f	386	entry->action = UNKNOWN;
28ef4002	387	while ((p = strsep(&rule, " \t")) != NULL) {
4af4662f MZ	388	substring_t args[MAX_OPT_ARGS];
	389	int token;
	390	unsigned long lnum;
	391
	392	if (result < 0)
	393	break;
28ef4002 EP	394	if ((p == '\0') \|\| (p == ' ') \|\| (*p == '\t'))
28ef4002 EP	395	continue;
4af4662f MZ	396	token = match_token(p, policy_tokens, args);
	397	switch (token) {
	398	case Opt_measure:
2f1506cd	399	ima_log_string(ab, "action", "measure");
7b62e162 EP	400
	401	if (entry->action != UNKNOWN)
	402	result = -EINVAL;
	403
4af4662f MZ	404	entry->action = MEASURE;
	405	break;
	406	case Opt_dont_measure:
2f1506cd	407	ima_log_string(ab, "action", "dont_measure");
7b62e162 EP	408
	409	if (entry->action != UNKNOWN)
	410	result = -EINVAL;
	411
4af4662f MZ	412	entry->action = DONT_MEASURE;
4af4662f MZ	413	break;
07f6a794 MZ	414	case Opt_appraise:
	415	ima_log_string(ab, "action", "appraise");
	416
	417	if (entry->action != UNKNOWN)
	418	result = -EINVAL;
	419
	420	entry->action = APPRAISE;
	421	break;
	422	case Opt_dont_appraise:
	423	ima_log_string(ab, "action", "dont_appraise");
	424
	425	if (entry->action != UNKNOWN)
	426	result = -EINVAL;
	427
	428	entry->action = DONT_APPRAISE;
	429	break;
e7c568e0 PM	430	case Opt_audit:
	431	ima_log_string(ab, "action", "audit");
	432
	433	if (entry->action != UNKNOWN)
	434	result = -EINVAL;
	435
	436	entry->action = AUDIT;
	437	break;
4af4662f	438	case Opt_func:
2f1506cd	439	ima_log_string(ab, "func", args[0].from);
7b62e162 EP	440
7b62e162 EP	441	if (entry->func)
07f6a794	442	result = -EINVAL;
7b62e162	443
1e93d005 MZ	444	if (strcmp(args[0].from, "FILE_CHECK") == 0)
	445	entry->func = FILE_CHECK;
	446	/* PATH_CHECK is for backwards compat */
	447	else if (strcmp(args[0].from, "PATH_CHECK") == 0)
	448	entry->func = FILE_CHECK;
fdf90729 MZ	449	else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
fdf90729 MZ	450	entry->func = MODULE_CHECK;
16cac49f MZ	451	else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
	452	\|\| (strcmp(args[0].from, "MMAP_CHECK") == 0))
	453	entry->func = MMAP_CHECK;
4af4662f MZ	454	else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
	455	entry->func = BPRM_CHECK;
	456	else
	457	result = -EINVAL;
	458	if (!result)
	459	entry->flags \|= IMA_FUNC;
	460	break;
	461	case Opt_mask:
2f1506cd	462	ima_log_string(ab, "mask", args[0].from);
7b62e162 EP	463
	464	if (entry->mask)
	465	result = -EINVAL;
	466
4af4662f MZ	467	if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
	468	entry->mask = MAY_EXEC;
	469	else if (strcmp(args[0].from, "MAY_WRITE") == 0)
	470	entry->mask = MAY_WRITE;
	471	else if (strcmp(args[0].from, "MAY_READ") == 0)
	472	entry->mask = MAY_READ;
	473	else if (strcmp(args[0].from, "MAY_APPEND") == 0)
	474	entry->mask = MAY_APPEND;
	475	else
	476	result = -EINVAL;
	477	if (!result)
	478	entry->flags \|= IMA_MASK;
	479	break;
	480	case Opt_fsmagic:
2f1506cd	481	ima_log_string(ab, "fsmagic", args[0].from);
7b62e162 EP	482
	483	if (entry->fsmagic) {
	484	result = -EINVAL;
	485	break;
	486	}
	487
4af4662f MZ	488	result = strict_strtoul(args[0].from, 16,
	489	&entry->fsmagic);
	490	if (!result)
	491	entry->flags \|= IMA_FSMAGIC;
	492	break;
	493	case Opt_uid:
2f1506cd	494	ima_log_string(ab, "uid", args[0].from);
7b62e162	495
8b94eea4	496	if (uid_valid(entry->uid)) {
7b62e162 EP	497	result = -EINVAL;
	498	break;
	499	}
	500
4af4662f MZ	501	result = strict_strtoul(args[0].from, 10, &lnum);
4af4662f MZ	502	if (!result) {
8b94eea4 EB	503	entry->uid = make_kuid(current_user_ns(), (uid_t)lnum);
8b94eea4 EB	504	if (!uid_valid(entry->uid) \|\| (((uid_t)lnum) != lnum))
4af4662f MZ	505	result = -EINVAL;
	506	else
	507	entry->flags \|= IMA_UID;
	508	}
	509	break;
07f6a794 MZ	510	case Opt_fowner:
	511	ima_log_string(ab, "fowner", args[0].from);
	512
88265322	513	if (uid_valid(entry->fowner)) {
07f6a794 MZ	514	result = -EINVAL;
	515	break;
	516	}
	517
	518	result = strict_strtoul(args[0].from, 10, &lnum);
	519	if (!result) {
88265322 LT	520	entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
88265322 LT	521	if (!uid_valid(entry->fowner) \|\| (((uid_t)lnum) != lnum))
07f6a794 MZ	522	result = -EINVAL;
	523	else
	524	entry->flags \|= IMA_FOWNER;
	525	}
	526	break;
4af4662f	527	case Opt_obj_user:
2f1506cd	528	ima_log_string(ab, "obj_user", args[0].from);
7163a993	529	result = ima_lsm_rule_init(entry, args,
4af4662f MZ	530	LSM_OBJ_USER,
	531	AUDIT_OBJ_USER);
	532	break;
	533	case Opt_obj_role:
2f1506cd	534	ima_log_string(ab, "obj_role", args[0].from);
7163a993	535	result = ima_lsm_rule_init(entry, args,
4af4662f MZ	536	LSM_OBJ_ROLE,
	537	AUDIT_OBJ_ROLE);
	538	break;
	539	case Opt_obj_type:
2f1506cd	540	ima_log_string(ab, "obj_type", args[0].from);
7163a993	541	result = ima_lsm_rule_init(entry, args,
4af4662f MZ	542	LSM_OBJ_TYPE,
	543	AUDIT_OBJ_TYPE);
	544	break;
	545	case Opt_subj_user:
2f1506cd	546	ima_log_string(ab, "subj_user", args[0].from);
7163a993	547	result = ima_lsm_rule_init(entry, args,
4af4662f MZ	548	LSM_SUBJ_USER,
	549	AUDIT_SUBJ_USER);
	550	break;
	551	case Opt_subj_role:
2f1506cd	552	ima_log_string(ab, "subj_role", args[0].from);
7163a993	553	result = ima_lsm_rule_init(entry, args,
4af4662f MZ	554	LSM_SUBJ_ROLE,
	555	AUDIT_SUBJ_ROLE);
	556	break;
	557	case Opt_subj_type:
2f1506cd	558	ima_log_string(ab, "subj_type", args[0].from);
7163a993	559	result = ima_lsm_rule_init(entry, args,
4af4662f MZ	560	LSM_SUBJ_TYPE,
	561	AUDIT_SUBJ_TYPE);
	562	break;
	563	case Opt_err:
2f1506cd	564	ima_log_string(ab, "UNKNOWN", p);
e9d393bf	565	result = -EINVAL;
4af4662f MZ	566	break;
	567	}
	568	}
7b62e162	569	if (!result && (entry->action == UNKNOWN))
4af4662f MZ	570	result = -EINVAL;
4af4662f MZ	571
b0d5de4d	572	audit_log_format(ab, "res=%d", !result);
4af4662f MZ	573	audit_log_end(ab);
	574	return result;
	575	}
	576
	577	/**
07f6a794	578	* ima_parse_add_rule - add a rule to ima_policy_rules
4af4662f MZ	579	* @rule - ima measurement policy rule
	580	*
	581	* Uses a mutex to protect the policy list from multiple concurrent writers.
6ccd0456	582	* Returns the length of the rule parsed, an error code on failure
4af4662f	583	*/
6ccd0456	584	ssize_t ima_parse_add_rule(char *rule)
4af4662f	585	{
523979ad	586	const char *op = "update_policy";
6ccd0456	587	char *p;
07f6a794	588	struct ima_rule_entry *entry;
6ccd0456	589	ssize_t result, len;
4af4662f MZ	590	int audit_info = 0;
	591
	592	/* Prevent installed policy from changing */
07f6a794	593	if (ima_rules != &ima_default_rules) {
4af4662f MZ	594	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
	595	NULL, op, "already exists",
	596	-EACCES, audit_info);
	597	return -EACCES;
	598	}
	599
	600	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
	601	if (!entry) {
	602	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
	603	NULL, op, "-ENOMEM", -ENOMEM, audit_info);
	604	return -ENOMEM;
	605	}
	606
	607	INIT_LIST_HEAD(&entry->list);
	608
6ccd0456 EP	609	p = strsep(&rule, "\n");
6ccd0456 EP	610	len = strlen(p) + 1;
7233e3ee EP	611
	612	if (*p == '#') {
	613	kfree(entry);
	614	return len;
	615	}
	616
6ccd0456	617	result = ima_parse_rule(p, entry);
7233e3ee	618	if (result) {
4af4662f	619	kfree(entry);
523979ad MZ	620	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
	621	NULL, op, "invalid policy", result,
	622	audit_info);
7233e3ee	623	return result;
523979ad	624	}
7233e3ee	625
07f6a794 MZ	626	mutex_lock(&ima_rules_mutex);
	627	list_add_tail(&entry->list, &ima_policy_rules);
	628	mutex_unlock(&ima_rules_mutex);
7233e3ee EP	629
7233e3ee EP	630	return len;
4af4662f MZ	631	}
	632
	633	/* ima_delete_rules called to cleanup invalid policy */
64c61d80	634	void ima_delete_rules(void)
4af4662f	635	{
07f6a794	636	struct ima_rule_entry entry, tmp;
7163a993	637	int i;
4af4662f	638
07f6a794 MZ	639	mutex_lock(&ima_rules_mutex);
07f6a794 MZ	640	list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) {
7163a993 MZ	641	for (i = 0; i < MAX_LSM_RULES; i++)
	642	kfree(entry->lsm[i].args_p);
	643
4af4662f MZ	644	list_del(&entry->list);
	645	kfree(entry);
	646	}
07f6a794	647	mutex_unlock(&ima_rules_mutex);
4af4662f	648	}