ima: support new "hash" and "dont_hash" policy actions

The builtin ima_appraise_tcb policy, which is specified on the boot
command line, can be replaced with a custom policy, normally early in
the boot process.  Custom policies can be more restrictive in some ways,
like requiring file signatures, but can be less restrictive in other
ways, like not appraising mutable files.  With a less restrictive policy
in place, files in the builtin policy might not be hashed and labeled
with a security.ima hash.  On reboot, files which should be labeled in
the ima_appraise_tcb are not labeled, possibly preventing the system
from booting properly.

To resolve this problem, this patch extends the existing IMA policy
actions "measure", "dont_measure", "appraise", "dont_appraise", and
"audit" with "hash" and "dont_hash".  The new "hash" action will write
the file hash as security.ima, but without requiring the file to be
appraised as well.

For example, the builtin ima_appraise_tcb policy includes the rule,
"appraise fowner=0".  Adding the "hash fowner=0" rule to a custom
policy, will cause the needed file hashes to be calculated and written
as security.ima xattrs.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
index e76432b9954d5e81283a71ea31069bc5d2b69896..2028f2d093b2049ca0a75b265d80dd14446d397a 100644 (file)
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -17,7 +17,8 @@ Description:
 
                rule format: action [condition ...]
 
-               action: measure | dont_measure | appraise | dont_appraise | audit
+               action: measure | dont_measure | appraise | dont_appraise |
+                       audit | hash | dont_hash
                condition:= base | lsm  [option]
                        base:   [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
                                [euid=] [fowner=]]

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index c7e8db0ea4c0e4bad275892f8c7b83c012ba8214..877f446fdca2d19c168131d44699e01de18d093d 100644 (file)
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -174,7 +174,7 @@ err_out:
  */
 int ima_get_action(struct inode *inode, int mask, enum ima_hooks func, int *pcr)
 {
-       int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE;
+       int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
 
        flags &= ima_policy_flag;
 

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index ea1245606a14896e1e98764f780fe76d6f8aaab4..f2803a40ff82ceb81160ca32d01eaf39263c1079 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -46,14 +46,15 @@ bool is_ima_appraise_enabled(void)
 /*
  * ima_must_appraise - set appraise flag
  *
- * Return 1 to appraise
+ * Return 1 to appraise or hash
  */
 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
 {
        if (!ima_appraise)
                return 0;
 
-       return ima_match_policy(inode, func, mask, IMA_APPRAISE, NULL);
+       return ima_match_policy(inode, func, mask, IMA_APPRAISE | IMA_HASH,
+                               NULL);
 }
 
 static int ima_fix_xattr(struct dentry *dentry,
@@ -324,7 +325,8 @@ void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
        if (test_bit(IMA_DIGSIG, &iint->atomic_flags))
                return;
 
-       if (iint->ima_file_status != INTEGRITY_PASS)
+       if ((iint->ima_file_status != INTEGRITY_PASS) &&
+           !(iint->flags & IMA_HASH))
                return;
 
        rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo);
@@ -349,19 +351,19 @@ void ima_inode_post_setattr(struct dentry *dentry)
 {
        struct inode *inode = d_backing_inode(dentry);
        struct integrity_iint_cache *iint;
-       int must_appraise;
+       int action;
 
        if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)
            || !(inode->i_opflags & IOP_XATTR))
                return;
 
-       must_appraise = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
-       if (!must_appraise)
+       action = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
+       if (!action)
                __vfs_removexattr(dentry, XATTR_NAME_IMA);
        iint = integrity_iint_find(inode);
        if (iint) {
                set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
-               if (!must_appraise)
+               if (!action)
                        clear_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
        }
 }

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index edf4e071749451726cd698580da874f4df90c662..be1987e13c43b031ad99c591f38d3198d022331a 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -243,6 +243,18 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
        if ((action & IMA_MEASURE) && (iint->measured_pcrs & (0x1 << pcr)))
                action ^= IMA_MEASURE;
 
+       /* HASH sets the digital signature and update flags, nothing else */
+       if ((action & IMA_HASH) &&
+           !(test_bit(IMA_DIGSIG, &iint->atomic_flags))) {
+               xattr_len = ima_read_xattr(file_dentry(file), &xattr_value);
+               if ((xattr_value && xattr_len > 2) &&
+                   (xattr_value->type == EVM_IMA_XATTR_DIGSIG))
+                       set_bit(IMA_DIGSIG, &iint->atomic_flags);
+               iint->flags |= IMA_HASHED;
+               action ^= IMA_HASH;
+               set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
+       }
+
        /* Nothing to do, just return existing appraised status */
        if (!action) {
                if (must_appraise)

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index ee4613fa58403dd8842fa60399845293e24253df..93dcf1bf92a8a2025a8b6d8900b4fd2985dfd874 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -40,6 +40,8 @@
 #define APPRAISE       0x0004  /* same as IMA_APPRAISE */
 #define DONT_APPRAISE  0x0008
 #define AUDIT          0x0040
+#define HASH           0x0100
+#define DONT_HASH      0x0200
 
 #define INVALID_PCR(a) (((a) < 0) || \
        (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
@@ -380,8 +382,10 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
                action |= entry->flags & IMA_ACTION_FLAGS;
 
                action |= entry->action & IMA_DO_MASK;
-               if (entry->action & IMA_APPRAISE)
+               if (entry->action & IMA_APPRAISE) {
                        action |= get_subaction(entry, func);
+                       action ^= IMA_HASH;
+               }
 
                if (entry->action & IMA_DO_MASK)
                        actmask &= ~(entry->action | entry->action << 1);
@@ -521,7 +525,7 @@ enum {
        Opt_err = -1,
        Opt_measure = 1, Opt_dont_measure,
        Opt_appraise, Opt_dont_appraise,
-       Opt_audit,
+       Opt_audit, Opt_hash, Opt_dont_hash,
        Opt_obj_user, Opt_obj_role, Opt_obj_type,
        Opt_subj_user, Opt_subj_role, Opt_subj_type,
        Opt_func, Opt_mask, Opt_fsmagic,
@@ -538,6 +542,8 @@ static match_table_t policy_tokens = {
        {Opt_appraise, "appraise"},
        {Opt_dont_appraise, "dont_appraise"},
        {Opt_audit, "audit"},
+       {Opt_hash, "hash"},
+       {Opt_dont_hash, "dont_hash"},
        {Opt_obj_user, "obj_user=%s"},
        {Opt_obj_role, "obj_role=%s"},
        {Opt_obj_type, "obj_type=%s"},
@@ -671,6 +677,22 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 
                        entry->action = AUDIT;
                        break;
+               case Opt_hash:
+                       ima_log_string(ab, "action", "hash");
+
+                       if (entry->action != UNKNOWN)
+                               result = -EINVAL;
+
+                       entry->action = HASH;
+                       break;
+               case Opt_dont_hash:
+                       ima_log_string(ab, "action", "dont_hash");
+
+                       if (entry->action != UNKNOWN)
+                               result = -EINVAL;
+
+                       entry->action = DONT_HASH;
+                       break;
                case Opt_func:
                        ima_log_string(ab, "func", args[0].from);
 
@@ -1040,6 +1062,10 @@ int ima_policy_show(struct seq_file *m, void *v)
                seq_puts(m, pt(Opt_dont_appraise));
        if (entry->action & AUDIT)
                seq_puts(m, pt(Opt_audit));
+       if (entry->action & HASH)
+               seq_puts(m, pt(Opt_hash));
+       if (entry->action & DONT_HASH)
+               seq_puts(m, pt(Opt_dont_hash));
 
        seq_puts(m, " ");
 

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index c64ea8f88f66e00a6a79cde65721e38753d9cfb2..50a8e3365df7387cb62ee03ad605af1905c1ad97 100644 (file)
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -25,6 +25,8 @@
 #define IMA_COLLECTED          0x00000020
 #define IMA_AUDIT              0x00000040
 #define IMA_AUDITED            0x00000080
+#define IMA_HASH               0x00000100
+#define IMA_HASHED             0x00000200
 
 /* iint cache flags */
 #define IMA_ACTION_FLAGS       0xff000000
@@ -35,19 +37,20 @@
 #define EVM_IMMUTABLE_DIGSIG   0x08000000
 
 #define IMA_DO_MASK            (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
-                                IMA_APPRAISE_SUBMASK)
+                                IMA_HASH | IMA_APPRAISE_SUBMASK)
 #define IMA_DONE_MASK          (IMA_MEASURED | IMA_APPRAISED | IMA_AUDITED | \
-                                IMA_COLLECTED | IMA_APPRAISED_SUBMASK)
+                                IMA_HASHED | IMA_COLLECTED | \
+                                IMA_APPRAISED_SUBMASK)
 
 /* iint subaction appraise cache flags */
-#define IMA_FILE_APPRAISE      0x00000100
-#define IMA_FILE_APPRAISED     0x00000200
-#define IMA_MMAP_APPRAISE      0x00000400
-#define IMA_MMAP_APPRAISED     0x00000800
-#define IMA_BPRM_APPRAISE      0x00001000
-#define IMA_BPRM_APPRAISED     0x00002000
-#define IMA_READ_APPRAISE      0x00004000
-#define IMA_READ_APPRAISED     0x00008000
+#define IMA_FILE_APPRAISE      0x00001000
+#define IMA_FILE_APPRAISED     0x00002000
+#define IMA_MMAP_APPRAISE      0x00004000
+#define IMA_MMAP_APPRAISED     0x00008000
+#define IMA_BPRM_APPRAISE      0x00010000
+#define IMA_BPRM_APPRAISED     0x00020000
+#define IMA_READ_APPRAISE      0x00040000
+#define IMA_READ_APPRAISED     0x00080000
 #define IMA_APPRAISE_SUBMASK   (IMA_FILE_APPRAISE | IMA_MMAP_APPRAISE | \
                                 IMA_BPRM_APPRAISE | IMA_READ_APPRAISE)
 #define IMA_APPRAISED_SUBMASK  (IMA_FILE_APPRAISED | IMA_MMAP_APPRAISED | \