[mirror_ubuntu-jammy-kernel.git] / security / selinux / ima.c

// SPDX-License-Identifier: GPL-2.0+
/*
 * Copyright (C) 2021 Microsoft Corporation
 *
 * Author: Lakshmi Ramasubramanian (nramas@linux.microsoft.com)
 *
 * Measure critical data structures maintainted by SELinux
 * using IMA subsystem.
 */
#include <linux/vmalloc.h>
#include <linux/ima.h>
#include "security.h"
#include "ima.h"

/*
 * selinux_ima_collect_state - Read selinux configuration settings
 *
 * @state: selinux_state
 *
 * On success returns the configuration settings string.
 * On error, returns NULL.
 */
static char *selinux_ima_collect_state(struct selinux_state *state)
{
	const char *on = "=1;", *off = "=0;";
	char *buf;
	int buf_len, len, i, rc;

	buf_len = strlen("initialized=0;enforcing=0;checkreqprot=0;") + 1;

	len = strlen(on);
	for (i = 0; i < __POLICYDB_CAPABILITY_MAX; i++)
		buf_len += strlen(selinux_policycap_names[i]) + len;

	buf = kzalloc(buf_len, GFP_KERNEL);
	if (!buf)
		return NULL;

	rc = strscpy(buf, "initialized", buf_len);
	WARN_ON(rc < 0);

	rc = strlcat(buf, selinux_initialized(state) ? on : off, buf_len);
	WARN_ON(rc >= buf_len);

	rc = strlcat(buf, "enforcing", buf_len);
	WARN_ON(rc >= buf_len);

	rc = strlcat(buf, enforcing_enabled(state) ? on : off, buf_len);
	WARN_ON(rc >= buf_len);

	rc = strlcat(buf, "checkreqprot", buf_len);
	WARN_ON(rc >= buf_len);

	rc = strlcat(buf, checkreqprot_get(state) ? on : off, buf_len);
	WARN_ON(rc >= buf_len);

	for (i = 0; i < __POLICYDB_CAPABILITY_MAX; i++) {
		rc = strlcat(buf, selinux_policycap_names[i], buf_len);
		WARN_ON(rc >= buf_len);

		rc = strlcat(buf, state->policycap[i] ? on : off, buf_len);
		WARN_ON(rc >= buf_len);
	}

	return buf;
}

/*
 * selinux_ima_measure_state_locked - Measure SELinux state and hash of policy
 *
 * @state: selinux state struct
 */
void selinux_ima_measure_state_locked(struct selinux_state *state)
{
	char *state_str = NULL;
	void *policy = NULL;
	size_t policy_len;
	int rc = 0;

	WARN_ON(!mutex_is_locked(&state->policy_mutex));

	state_str = selinux_ima_collect_state(state);
	if (!state_str) {
		pr_err("SELinux: %s: failed to read state.\n", __func__);
		return;
	}

	ima_measure_critical_data("selinux", "selinux-state",
				  state_str, strlen(state_str), false,
				  NULL, 0);

	kfree(state_str);

	/*
	 * Measure SELinux policy only after initialization is completed.
	 */
	if (!selinux_initialized(state))
		return;

	rc = security_read_state_kernel(state, &policy, &policy_len);
	if (rc) {
		pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc);
		return;
	}

	ima_measure_critical_data("selinux", "selinux-policy-hash",
				  policy, policy_len, true,
				  NULL, 0);

	vfree(policy);
}

/*
 * selinux_ima_measure_state - Measure SELinux state and hash of policy
 *
 * @state: selinux state struct
 */
void selinux_ima_measure_state(struct selinux_state *state)
{
	WARN_ON(mutex_is_locked(&state->policy_mutex));

	mutex_lock(&state->policy_mutex);
	selinux_ima_measure_state_locked(state);
	mutex_unlock(&state->policy_mutex);
}
Commit	Line	Data
fdd1ffe8 LR	1	// SPDX-License-Identifier: GPL-2.0+
	2	/*
	3	* Copyright (C) 2021 Microsoft Corporation
	4	*
	5	* Author: Lakshmi Ramasubramanian (nramas@linux.microsoft.com)
	6	*
	7	* Measure critical data structures maintainted by SELinux
	8	* using IMA subsystem.
	9	*/
	10	#include <linux/vmalloc.h>
	11	#include <linux/ima.h>
	12	#include "security.h"
	13	#include "ima.h"
	14
	15	/*
2554a48f	16	* selinux_ima_collect_state - Read selinux configuration settings
fdd1ffe8	17	*
2554a48f	18	* @state: selinux_state
fdd1ffe8	19	*
2554a48f LR	20	* On success returns the configuration settings string.
2554a48f LR	21	* On error, returns NULL.
fdd1ffe8	22	*/
2554a48f	23	static char selinux_ima_collect_state(struct selinux_state state)
fdd1ffe8	24	{
2554a48f LR	25	const char on = "=1;", off = "=0;";
	26	char *buf;
	27	int buf_len, len, i, rc;
	28
	29	buf_len = strlen("initialized=0;enforcing=0;checkreqprot=0;") + 1;
	30
	31	len = strlen(on);
	32	for (i = 0; i < __POLICYDB_CAPABILITY_MAX; i++)
	33	buf_len += strlen(selinux_policycap_names[i]) + len;
	34
	35	buf = kzalloc(buf_len, GFP_KERNEL);
	36	if (!buf)
	37	return NULL;
	38
	39	rc = strscpy(buf, "initialized", buf_len);
	40	WARN_ON(rc < 0);
	41
	42	rc = strlcat(buf, selinux_initialized(state) ? on : off, buf_len);
	43	WARN_ON(rc >= buf_len);
	44
	45	rc = strlcat(buf, "enforcing", buf_len);
	46	WARN_ON(rc >= buf_len);
	47
	48	rc = strlcat(buf, enforcing_enabled(state) ? on : off, buf_len);
	49	WARN_ON(rc >= buf_len);
	50
	51	rc = strlcat(buf, "checkreqprot", buf_len);
	52	WARN_ON(rc >= buf_len);
	53
	54	rc = strlcat(buf, checkreqprot_get(state) ? on : off, buf_len);
	55	WARN_ON(rc >= buf_len);
	56
	57	for (i = 0; i < __POLICYDB_CAPABILITY_MAX; i++) {
	58	rc = strlcat(buf, selinux_policycap_names[i], buf_len);
	59	WARN_ON(rc >= buf_len);
	60
	61	rc = strlcat(buf, state->policycap[i] ? on : off, buf_len);
	62	WARN_ON(rc >= buf_len);
	63	}
	64
	65	return buf;
	66	}
	67
	68	/*
	69	* selinux_ima_measure_state_locked - Measure SELinux state and hash of policy
	70	*
	71	* @state: selinux state struct
	72	*/
	73	void selinux_ima_measure_state_locked(struct selinux_state *state)
	74	{
	75	char *state_str = NULL;
fdd1ffe8 LR	76	void *policy = NULL;
	77	size_t policy_len;
	78	int rc = 0;
	79
2554a48f LR	80	WARN_ON(!mutex_is_locked(&state->policy_mutex));
	81
	82	state_str = selinux_ima_collect_state(state);
	83	if (!state_str) {
	84	pr_err("SELinux: %s: failed to read state.\n", __func__);
	85	return;
	86	}
	87
	88	ima_measure_critical_data("selinux", "selinux-state",
ca3c9bdb RS	89	state_str, strlen(state_str), false,
ca3c9bdb RS	90	NULL, 0);
2554a48f LR	91
	92	kfree(state_str);
	93
fdd1ffe8 LR	94	/*
	95	* Measure SELinux policy only after initialization is completed.
	96	*/
	97	if (!selinux_initialized(state))
	98	return;
	99
	100	rc = security_read_state_kernel(state, &policy, &policy_len);
	101	if (rc) {
	102	pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc);
	103	return;
	104	}
	105
	106	ima_measure_critical_data("selinux", "selinux-policy-hash",
ca3c9bdb RS	107	policy, policy_len, true,
ca3c9bdb RS	108	NULL, 0);
fdd1ffe8 LR	109
	110	vfree(policy);
	111	}
2554a48f LR	112
	113	/*
	114	* selinux_ima_measure_state - Measure SELinux state and hash of policy
	115	*
	116	* @state: selinux state struct
	117	*/
	118	void selinux_ima_measure_state(struct selinux_state *state)
	119	{
	120	WARN_ON(mutex_is_locked(&state->policy_mutex));
	121
	122	mutex_lock(&state->policy_mutex);
	123	selinux_ima_measure_state_locked(state);
	124	mutex_unlock(&state->policy_mutex);
	125	}