]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - security/integrity/ima/ima_appraise.c
2 * Copyright (C) 2011 IBM Corporation
5 * Mimi Zohar <zohar@us.ibm.com>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation, version 2 of the License.
11 #include <linux/module.h>
12 #include <linux/file.h>
14 #include <linux/xattr.h>
15 #include <linux/magic.h>
16 #include <linux/ima.h>
17 #include <linux/evm.h>
21 static int __init
default_appraise_setup(char *str
)
23 #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
24 if (strncmp(str
, "off", 3) == 0)
26 else if (strncmp(str
, "log", 3) == 0)
27 ima_appraise
= IMA_APPRAISE_LOG
;
28 else if (strncmp(str
, "fix", 3) == 0)
29 ima_appraise
= IMA_APPRAISE_FIX
;
34 __setup("ima_appraise=", default_appraise_setup
);
37 * is_ima_appraise_enabled - return appraise status
39 * Only return enabled, if not in ima_appraise="fix" or "log" modes.
41 bool is_ima_appraise_enabled(void)
43 return ima_appraise
& IMA_APPRAISE_ENFORCE
;
47 * ima_must_appraise - set appraise flag
49 * Return 1 to appraise
51 int ima_must_appraise(struct inode
*inode
, int mask
, enum ima_hooks func
)
56 return ima_match_policy(inode
, func
, mask
, IMA_APPRAISE
, NULL
);
59 static int ima_fix_xattr(struct dentry
*dentry
,
60 struct integrity_iint_cache
*iint
)
63 u8 algo
= iint
->ima_hash
->algo
;
65 if (algo
<= HASH_ALGO_SHA1
) {
67 iint
->ima_hash
->xattr
.sha1
.type
= IMA_XATTR_DIGEST
;
70 iint
->ima_hash
->xattr
.ng
.type
= IMA_XATTR_DIGEST_NG
;
71 iint
->ima_hash
->xattr
.ng
.algo
= algo
;
73 rc
= __vfs_setxattr_noperm(dentry
, XATTR_NAME_IMA
,
74 &iint
->ima_hash
->xattr
.data
[offset
],
75 (sizeof(iint
->ima_hash
->xattr
) - offset
) +
76 iint
->ima_hash
->length
, 0);
80 /* Return specific func appraised cached result */
81 enum integrity_status
ima_get_cache_status(struct integrity_iint_cache
*iint
,
86 return iint
->ima_mmap_status
;
88 return iint
->ima_bprm_status
;
91 return iint
->ima_file_status
;
92 case MODULE_CHECK
... MAX_CHECK
- 1:
94 return iint
->ima_read_status
;
98 static void ima_set_cache_status(struct integrity_iint_cache
*iint
,
100 enum integrity_status status
)
104 iint
->ima_mmap_status
= status
;
107 iint
->ima_bprm_status
= status
;
111 iint
->ima_file_status
= status
;
113 case MODULE_CHECK
... MAX_CHECK
- 1:
115 iint
->ima_read_status
= status
;
120 static void ima_cache_flags(struct integrity_iint_cache
*iint
,
125 iint
->flags
|= (IMA_MMAP_APPRAISED
| IMA_APPRAISED
);
128 iint
->flags
|= (IMA_BPRM_APPRAISED
| IMA_APPRAISED
);
132 iint
->flags
|= (IMA_FILE_APPRAISED
| IMA_APPRAISED
);
134 case MODULE_CHECK
... MAX_CHECK
- 1:
136 iint
->flags
|= (IMA_READ_APPRAISED
| IMA_APPRAISED
);
141 enum hash_algo
ima_get_hash_algo(struct evm_ima_xattr_data
*xattr_value
,
144 struct signature_v2_hdr
*sig
;
147 if (!xattr_value
|| xattr_len
< 2)
148 /* return default hash algo */
149 return ima_hash_algo
;
151 switch (xattr_value
->type
) {
152 case EVM_IMA_XATTR_DIGSIG
:
153 sig
= (typeof(sig
))xattr_value
;
154 if (sig
->version
!= 2 || xattr_len
<= sizeof(*sig
))
155 return ima_hash_algo
;
156 return sig
->hash_algo
;
158 case IMA_XATTR_DIGEST_NG
:
159 ret
= xattr_value
->digest
[0];
160 if (ret
< HASH_ALGO__LAST
)
163 case IMA_XATTR_DIGEST
:
164 /* this is for backward compatibility */
165 if (xattr_len
== 21) {
166 unsigned int zero
= 0;
167 if (!memcmp(&xattr_value
->digest
[16], &zero
, 4))
168 return HASH_ALGO_MD5
;
170 return HASH_ALGO_SHA1
;
171 } else if (xattr_len
== 17)
172 return HASH_ALGO_MD5
;
176 /* return default hash algo */
177 return ima_hash_algo
;
180 int ima_read_xattr(struct dentry
*dentry
,
181 struct evm_ima_xattr_data
**xattr_value
)
185 ret
= vfs_getxattr_alloc(dentry
, XATTR_NAME_IMA
, (char **)xattr_value
,
187 if (ret
== -EOPNOTSUPP
)
193 * ima_appraise_measurement - appraise file measurement
195 * Call evm_verifyxattr() to verify the integrity of 'security.ima'.
196 * Assuming success, compare the xattr hash with the collected measurement.
198 * Return 0 on success, error code otherwise
200 int ima_appraise_measurement(enum ima_hooks func
,
201 struct integrity_iint_cache
*iint
,
202 struct file
*file
, const unsigned char *filename
,
203 struct evm_ima_xattr_data
*xattr_value
,
204 int xattr_len
, int opened
)
206 static const char op
[] = "appraise_data";
207 char *cause
= "unknown";
208 struct dentry
*dentry
= file_dentry(file
);
209 struct inode
*inode
= d_backing_inode(dentry
);
210 enum integrity_status status
= INTEGRITY_UNKNOWN
;
211 int rc
= xattr_len
, hash_start
= 0;
213 if (!(inode
->i_opflags
& IOP_XATTR
))
214 return INTEGRITY_UNKNOWN
;
217 if (rc
&& rc
!= -ENODATA
)
220 cause
= iint
->flags
& IMA_DIGSIG_REQUIRED
?
221 "IMA-signature-required" : "missing-hash";
222 status
= INTEGRITY_NOLABEL
;
223 if (opened
& FILE_CREATED
)
224 iint
->flags
|= IMA_NEW_FILE
;
225 if ((iint
->flags
& IMA_NEW_FILE
) &&
226 !(iint
->flags
& IMA_DIGSIG_REQUIRED
))
227 status
= INTEGRITY_PASS
;
231 status
= evm_verifyxattr(dentry
, XATTR_NAME_IMA
, xattr_value
, rc
, iint
);
232 if ((status
!= INTEGRITY_PASS
) && (status
!= INTEGRITY_UNKNOWN
)) {
233 if ((status
== INTEGRITY_NOLABEL
)
234 || (status
== INTEGRITY_NOXATTRS
))
235 cause
= "missing-HMAC";
236 else if (status
== INTEGRITY_FAIL
)
237 cause
= "invalid-HMAC";
240 switch (xattr_value
->type
) {
241 case IMA_XATTR_DIGEST_NG
:
242 /* first byte contains algorithm id */
245 case IMA_XATTR_DIGEST
:
246 if (iint
->flags
& IMA_DIGSIG_REQUIRED
) {
247 cause
= "IMA-signature-required";
248 status
= INTEGRITY_FAIL
;
251 if (xattr_len
- sizeof(xattr_value
->type
) - hash_start
>=
252 iint
->ima_hash
->length
)
253 /* xattr length may be longer. md5 hash in previous
254 version occupied 20 bytes in xattr, instead of 16
256 rc
= memcmp(&xattr_value
->digest
[hash_start
],
257 iint
->ima_hash
->digest
,
258 iint
->ima_hash
->length
);
262 cause
= "invalid-hash";
263 status
= INTEGRITY_FAIL
;
266 status
= INTEGRITY_PASS
;
268 case EVM_IMA_XATTR_DIGSIG
:
269 iint
->flags
|= IMA_DIGSIG
;
270 rc
= integrity_digsig_verify(INTEGRITY_KEYRING_IMA
,
271 (const char *)xattr_value
, rc
,
272 iint
->ima_hash
->digest
,
273 iint
->ima_hash
->length
);
274 if (rc
== -EOPNOTSUPP
) {
275 status
= INTEGRITY_UNKNOWN
;
277 cause
= "invalid-signature";
278 status
= INTEGRITY_FAIL
;
280 status
= INTEGRITY_PASS
;
284 status
= INTEGRITY_UNKNOWN
;
285 cause
= "unknown-ima-data";
290 if (status
!= INTEGRITY_PASS
) {
291 if ((ima_appraise
& IMA_APPRAISE_FIX
) &&
293 xattr_value
->type
!= EVM_IMA_XATTR_DIGSIG
)) {
294 if (!ima_fix_xattr(dentry
, iint
))
295 status
= INTEGRITY_PASS
;
296 } else if ((inode
->i_size
== 0) &&
297 (iint
->flags
& IMA_NEW_FILE
) &&
299 xattr_value
->type
== EVM_IMA_XATTR_DIGSIG
)) {
300 status
= INTEGRITY_PASS
;
302 integrity_audit_msg(AUDIT_INTEGRITY_DATA
, inode
, filename
,
305 ima_cache_flags(iint
, func
);
307 ima_set_cache_status(iint
, func
, status
);
312 * ima_update_xattr - update 'security.ima' hash value
314 void ima_update_xattr(struct integrity_iint_cache
*iint
, struct file
*file
)
316 struct dentry
*dentry
= file_dentry(file
);
319 /* do not collect and update hash for digital signatures */
320 if (iint
->flags
& IMA_DIGSIG
)
323 rc
= ima_collect_measurement(iint
, file
, NULL
, 0, ima_hash_algo
);
327 ima_fix_xattr(dentry
, iint
);
331 * ima_inode_post_setattr - reflect file metadata changes
332 * @dentry: pointer to the affected dentry
334 * Changes to a dentry's metadata might result in needing to appraise.
336 * This function is called from notify_change(), which expects the caller
337 * to lock the inode's i_mutex.
339 void ima_inode_post_setattr(struct dentry
*dentry
)
341 struct inode
*inode
= d_backing_inode(dentry
);
342 struct integrity_iint_cache
*iint
;
345 if (!(ima_policy_flag
& IMA_APPRAISE
) || !S_ISREG(inode
->i_mode
)
346 || !(inode
->i_opflags
& IOP_XATTR
))
349 must_appraise
= ima_must_appraise(inode
, MAY_ACCESS
, POST_SETATTR
);
350 iint
= integrity_iint_find(inode
);
352 iint
->flags
&= ~(IMA_APPRAISE
| IMA_APPRAISED
|
353 IMA_APPRAISE_SUBMASK
| IMA_APPRAISED_SUBMASK
|
354 IMA_ACTION_RULE_FLAGS
);
356 iint
->flags
|= IMA_APPRAISE
;
359 __vfs_removexattr(dentry
, XATTR_NAME_IMA
);
363 * ima_protect_xattr - protect 'security.ima'
365 * Ensure that not just anyone can modify or remove 'security.ima'.
367 static int ima_protect_xattr(struct dentry
*dentry
, const char *xattr_name
,
368 const void *xattr_value
, size_t xattr_value_len
)
370 if (strcmp(xattr_name
, XATTR_NAME_IMA
) == 0) {
371 if (!capable(CAP_SYS_ADMIN
))
378 static void ima_reset_appraise_flags(struct inode
*inode
, int digsig
)
380 struct integrity_iint_cache
*iint
;
382 if (!(ima_policy_flag
& IMA_APPRAISE
) || !S_ISREG(inode
->i_mode
))
385 iint
= integrity_iint_find(inode
);
389 iint
->flags
&= ~IMA_DONE_MASK
;
390 iint
->measured_pcrs
= 0;
392 iint
->flags
|= IMA_DIGSIG
;
396 int ima_inode_setxattr(struct dentry
*dentry
, const char *xattr_name
,
397 const void *xattr_value
, size_t xattr_value_len
)
399 const struct evm_ima_xattr_data
*xvalue
= xattr_value
;
402 result
= ima_protect_xattr(dentry
, xattr_name
, xattr_value
,
405 if (!xattr_value_len
|| (xvalue
->type
>= IMA_XATTR_LAST
))
407 ima_reset_appraise_flags(d_backing_inode(dentry
),
408 xvalue
->type
== EVM_IMA_XATTR_DIGSIG
);
414 int ima_inode_removexattr(struct dentry
*dentry
, const char *xattr_name
)
418 result
= ima_protect_xattr(dentry
, xattr_name
, NULL
, 0);
420 ima_reset_appraise_flags(d_backing_inode(dentry
), 0);