ima_fs.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510
  1. /*
  2. * Copyright (C) 2005,2006,2007,2008 IBM Corporation
  3. *
  4. * Authors:
  5. * Kylene Hall <kjhall@us.ibm.com>
  6. * Reiner Sailer <sailer@us.ibm.com>
  7. * Mimi Zohar <zohar@us.ibm.com>
  8. *
  9. * This program is free software; you can redistribute it and/or
  10. * modify it under the terms of the GNU General Public License as
  11. * published by the Free Software Foundation, version 2 of the
  12. * License.
  13. *
  14. * File: ima_fs.c
  15. * implemenents security file system for reporting
  16. * current measurement list and IMA statistics
  17. */
  18. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19. #include <linux/fcntl.h>
  20. #include <linux/slab.h>
  21. #include <linux/module.h>
  22. #include <linux/seq_file.h>
  23. #include <linux/rculist.h>
  24. #include <linux/rcupdate.h>
  25. #include <linux/parser.h>
  26. #include <linux/vmalloc.h>
  27. #include "ima.h"
  28. static DEFINE_MUTEX(ima_write_mutex);
  29. bool ima_canonical_fmt;
  30. static int __init default_canonical_fmt_setup(char *str)
  31. {
  32. #ifdef __BIG_ENDIAN
  33. ima_canonical_fmt = true;
  34. #endif
  35. return 1;
  36. }
  37. __setup("ima_canonical_fmt", default_canonical_fmt_setup);
  38. static int valid_policy = 1;
  39. static ssize_t ima_show_htable_value(char __user *buf, size_t count,
  40. loff_t *ppos, atomic_long_t *val)
  41. {
  42. char tmpbuf[32]; /* greater than largest 'long' string value */
  43. ssize_t len;
  44. len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val));
  45. return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
  46. }
  47. static ssize_t ima_show_htable_violations(struct file *filp,
  48. char __user *buf,
  49. size_t count, loff_t *ppos)
  50. {
  51. return ima_show_htable_value(buf, count, ppos, &ima_htable.violations);
  52. }
  53. static const struct file_operations ima_htable_violations_ops = {
  54. .read = ima_show_htable_violations,
  55. .llseek = generic_file_llseek,
  56. };
  57. static ssize_t ima_show_measurements_count(struct file *filp,
  58. char __user *buf,
  59. size_t count, loff_t *ppos)
  60. {
  61. return ima_show_htable_value(buf, count, ppos, &ima_htable.len);
  62. }
  63. static const struct file_operations ima_measurements_count_ops = {
  64. .read = ima_show_measurements_count,
  65. .llseek = generic_file_llseek,
  66. };
  67. /* returns pointer to hlist_node */
  68. static void *ima_measurements_start(struct seq_file *m, loff_t *pos)
  69. {
  70. loff_t l = *pos;
  71. struct ima_queue_entry *qe;
  72. /* we need a lock since pos could point beyond last element */
  73. rcu_read_lock();
  74. list_for_each_entry_rcu(qe, &ima_measurements, later) {
  75. if (!l--) {
  76. rcu_read_unlock();
  77. return qe;
  78. }
  79. }
  80. rcu_read_unlock();
  81. return NULL;
  82. }
  83. static void *ima_measurements_next(struct seq_file *m, void *v, loff_t *pos)
  84. {
  85. struct ima_queue_entry *qe = v;
  86. /* lock protects when reading beyond last element
  87. * against concurrent list-extension
  88. */
  89. rcu_read_lock();
  90. qe = list_entry_rcu(qe->later.next, struct ima_queue_entry, later);
  91. rcu_read_unlock();
  92. (*pos)++;
  93. return (&qe->later == &ima_measurements) ? NULL : qe;
  94. }
  95. static void ima_measurements_stop(struct seq_file *m, void *v)
  96. {
  97. }
  98. void ima_putc(struct seq_file *m, void *data, int datalen)
  99. {
  100. while (datalen--)
  101. seq_putc(m, *(char *)data++);
  102. }
  103. /* print format:
  104. * 32bit-le=pcr#
  105. * char[20]=template digest
  106. * 32bit-le=template name size
  107. * char[n]=template name
  108. * [eventdata length]
  109. * eventdata[n]=template specific data
  110. */
  111. int ima_measurements_show(struct seq_file *m, void *v)
  112. {
  113. /* the list never shrinks, so we don't need a lock here */
  114. struct ima_queue_entry *qe = v;
  115. struct ima_template_entry *e;
  116. char *template_name;
  117. u32 pcr, namelen, template_data_len; /* temporary fields */
  118. bool is_ima_template = false;
  119. int i;
  120. /* get entry */
  121. e = qe->entry;
  122. if (e == NULL)
  123. return -1;
  124. template_name = (e->template_desc->name[0] != '\0') ?
  125. e->template_desc->name : e->template_desc->fmt;
  126. /*
  127. * 1st: PCRIndex
  128. * PCR used defaults to the same (config option) in
  129. * little-endian format, unless set in policy
  130. */
  131. pcr = !ima_canonical_fmt ? e->pcr : cpu_to_le32(e->pcr);
  132. ima_putc(m, &pcr, sizeof(e->pcr));
  133. /* 2nd: template digest */
  134. ima_putc(m, e->digest, TPM_DIGEST_SIZE);
  135. /* 3rd: template name size */
  136. namelen = !ima_canonical_fmt ? strlen(template_name) :
  137. cpu_to_le32(strlen(template_name));
  138. ima_putc(m, &namelen, sizeof(namelen));
  139. /* 4th: template name */
  140. ima_putc(m, template_name, strlen(template_name));
  141. /* 5th: template length (except for 'ima' template) */
  142. if (strcmp(template_name, IMA_TEMPLATE_IMA_NAME) == 0)
  143. is_ima_template = true;
  144. if (!is_ima_template) {
  145. template_data_len = !ima_canonical_fmt ? e->template_data_len :
  146. cpu_to_le32(e->template_data_len);
  147. ima_putc(m, &template_data_len, sizeof(e->template_data_len));
  148. }
  149. /* 6th: template specific data */
  150. for (i = 0; i < e->template_desc->num_fields; i++) {
  151. enum ima_show_type show = IMA_SHOW_BINARY;
  152. const struct ima_template_field *field =
  153. e->template_desc->fields[i];
  154. if (is_ima_template && strcmp(field->field_id, "d") == 0)
  155. show = IMA_SHOW_BINARY_NO_FIELD_LEN;
  156. if (is_ima_template && strcmp(field->field_id, "n") == 0)
  157. show = IMA_SHOW_BINARY_OLD_STRING_FMT;
  158. field->field_show(m, show, &e->template_data[i]);
  159. }
  160. return 0;
  161. }
  162. static const struct seq_operations ima_measurments_seqops = {
  163. .start = ima_measurements_start,
  164. .next = ima_measurements_next,
  165. .stop = ima_measurements_stop,
  166. .show = ima_measurements_show
  167. };
  168. static int ima_measurements_open(struct inode *inode, struct file *file)
  169. {
  170. return seq_open(file, &ima_measurments_seqops);
  171. }
  172. static const struct file_operations ima_measurements_ops = {
  173. .open = ima_measurements_open,
  174. .read = seq_read,
  175. .llseek = seq_lseek,
  176. .release = seq_release,
  177. };
  178. void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
  179. {
  180. u32 i;
  181. for (i = 0; i < size; i++)
  182. seq_printf(m, "%02x", *(digest + i));
  183. }
  184. /* print in ascii */
  185. static int ima_ascii_measurements_show(struct seq_file *m, void *v)
  186. {
  187. /* the list never shrinks, so we don't need a lock here */
  188. struct ima_queue_entry *qe = v;
  189. struct ima_template_entry *e;
  190. char *template_name;
  191. int i;
  192. /* get entry */
  193. e = qe->entry;
  194. if (e == NULL)
  195. return -1;
  196. template_name = (e->template_desc->name[0] != '\0') ?
  197. e->template_desc->name : e->template_desc->fmt;
  198. /* 1st: PCR used (config option) */
  199. seq_printf(m, "%2d ", e->pcr);
  200. /* 2nd: SHA1 template hash */
  201. ima_print_digest(m, e->digest, TPM_DIGEST_SIZE);
  202. /* 3th: template name */
  203. seq_printf(m, " %s", template_name);
  204. /* 4th: template specific data */
  205. for (i = 0; i < e->template_desc->num_fields; i++) {
  206. seq_puts(m, " ");
  207. if (e->template_data[i].len == 0)
  208. continue;
  209. e->template_desc->fields[i]->field_show(m, IMA_SHOW_ASCII,
  210. &e->template_data[i]);
  211. }
  212. seq_puts(m, "\n");
  213. return 0;
  214. }
  215. static const struct seq_operations ima_ascii_measurements_seqops = {
  216. .start = ima_measurements_start,
  217. .next = ima_measurements_next,
  218. .stop = ima_measurements_stop,
  219. .show = ima_ascii_measurements_show
  220. };
  221. static int ima_ascii_measurements_open(struct inode *inode, struct file *file)
  222. {
  223. return seq_open(file, &ima_ascii_measurements_seqops);
  224. }
  225. static const struct file_operations ima_ascii_measurements_ops = {
  226. .open = ima_ascii_measurements_open,
  227. .read = seq_read,
  228. .llseek = seq_lseek,
  229. .release = seq_release,
  230. };
  231. static ssize_t ima_read_policy(char *path)
  232. {
  233. void *data;
  234. char *datap;
  235. loff_t size;
  236. int rc, pathlen = strlen(path);
  237. char *p;
  238. /* remove \n */
  239. datap = path;
  240. strsep(&datap, "\n");
  241. rc = kernel_read_file_from_path(path, &data, &size, 0, READING_POLICY);
  242. if (rc < 0) {
  243. pr_err("Unable to open file: %s (%d)", path, rc);
  244. return rc;
  245. }
  246. datap = data;
  247. while (size > 0 && (p = strsep(&datap, "\n"))) {
  248. pr_debug("rule: %s\n", p);
  249. rc = ima_parse_add_rule(p);
  250. if (rc < 0)
  251. break;
  252. size -= rc;
  253. }
  254. vfree(data);
  255. if (rc < 0)
  256. return rc;
  257. else if (size)
  258. return -EINVAL;
  259. else
  260. return pathlen;
  261. }
  262. static ssize_t ima_write_policy(struct file *file, const char __user *buf,
  263. size_t datalen, loff_t *ppos)
  264. {
  265. char *data;
  266. ssize_t result;
  267. if (datalen >= PAGE_SIZE)
  268. datalen = PAGE_SIZE - 1;
  269. /* No partial writes. */
  270. result = -EINVAL;
  271. if (*ppos != 0)
  272. goto out;
  273. data = memdup_user_nul(buf, datalen);
  274. if (IS_ERR(data)) {
  275. result = PTR_ERR(data);
  276. goto out;
  277. }
  278. result = mutex_lock_interruptible(&ima_write_mutex);
  279. if (result < 0)
  280. goto out_free;
  281. if (data[0] == '/') {
  282. result = ima_read_policy(data);
  283. } else if (ima_appraise & IMA_APPRAISE_POLICY) {
  284. pr_err("signed policy file (specified as an absolute pathname) required\n");
  285. integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
  286. "policy_update", "signed policy required",
  287. 1, 0);
  288. if (ima_appraise & IMA_APPRAISE_ENFORCE)
  289. result = -EACCES;
  290. } else {
  291. result = ima_parse_add_rule(data);
  292. }
  293. mutex_unlock(&ima_write_mutex);
  294. out_free:
  295. kfree(data);
  296. out:
  297. if (result < 0)
  298. valid_policy = 0;
  299. return result;
  300. }
  301. static struct dentry *ima_dir;
  302. static struct dentry *ima_symlink;
  303. static struct dentry *binary_runtime_measurements;
  304. static struct dentry *ascii_runtime_measurements;
  305. static struct dentry *runtime_measurements_count;
  306. static struct dentry *violations;
  307. static struct dentry *ima_policy;
  308. enum ima_fs_flags {
  309. IMA_FS_BUSY,
  310. };
  311. static unsigned long ima_fs_flags;
  312. #ifdef CONFIG_IMA_READ_POLICY
  313. static const struct seq_operations ima_policy_seqops = {
  314. .start = ima_policy_start,
  315. .next = ima_policy_next,
  316. .stop = ima_policy_stop,
  317. .show = ima_policy_show,
  318. };
  319. #endif
  320. /*
  321. * ima_open_policy: sequentialize access to the policy file
  322. */
  323. static int ima_open_policy(struct inode *inode, struct file *filp)
  324. {
  325. if (!(filp->f_flags & O_WRONLY)) {
  326. #ifndef CONFIG_IMA_READ_POLICY
  327. return -EACCES;
  328. #else
  329. if ((filp->f_flags & O_ACCMODE) != O_RDONLY)
  330. return -EACCES;
  331. if (!capable(CAP_SYS_ADMIN))
  332. return -EPERM;
  333. return seq_open(filp, &ima_policy_seqops);
  334. #endif
  335. }
  336. if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags))
  337. return -EBUSY;
  338. return 0;
  339. }
  340. /*
  341. * ima_release_policy - start using the new measure policy rules.
  342. *
  343. * Initially, ima_measure points to the default policy rules, now
  344. * point to the new policy rules, and remove the securityfs policy file,
  345. * assuming a valid policy.
  346. */
  347. static int ima_release_policy(struct inode *inode, struct file *file)
  348. {
  349. const char *cause = valid_policy ? "completed" : "failed";
  350. if ((file->f_flags & O_ACCMODE) == O_RDONLY)
  351. return seq_release(inode, file);
  352. if (valid_policy && ima_check_policy() < 0) {
  353. cause = "failed";
  354. valid_policy = 0;
  355. }
  356. pr_info("policy update %s\n", cause);
  357. integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
  358. "policy_update", cause, !valid_policy, 0);
  359. if (!valid_policy) {
  360. ima_delete_rules();
  361. valid_policy = 1;
  362. clear_bit(IMA_FS_BUSY, &ima_fs_flags);
  363. return 0;
  364. }
  365. ima_update_policy();
  366. #if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY)
  367. securityfs_remove(ima_policy);
  368. ima_policy = NULL;
  369. #elif defined(CONFIG_IMA_WRITE_POLICY)
  370. clear_bit(IMA_FS_BUSY, &ima_fs_flags);
  371. #elif defined(CONFIG_IMA_READ_POLICY)
  372. inode->i_mode &= ~S_IWUSR;
  373. #endif
  374. return 0;
  375. }
  376. static const struct file_operations ima_measure_policy_ops = {
  377. .open = ima_open_policy,
  378. .write = ima_write_policy,
  379. .read = seq_read,
  380. .release = ima_release_policy,
  381. .llseek = generic_file_llseek,
  382. };
  383. int __init ima_fs_init(void)
  384. {
  385. ima_dir = securityfs_create_dir("ima", integrity_dir);
  386. if (IS_ERR(ima_dir))
  387. return -1;
  388. ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima",
  389. NULL);
  390. if (IS_ERR(ima_symlink))
  391. goto out;
  392. binary_runtime_measurements =
  393. securityfs_create_file("binary_runtime_measurements",
  394. S_IRUSR | S_IRGRP, ima_dir, NULL,
  395. &ima_measurements_ops);
  396. if (IS_ERR(binary_runtime_measurements))
  397. goto out;
  398. ascii_runtime_measurements =
  399. securityfs_create_file("ascii_runtime_measurements",
  400. S_IRUSR | S_IRGRP, ima_dir, NULL,
  401. &ima_ascii_measurements_ops);
  402. if (IS_ERR(ascii_runtime_measurements))
  403. goto out;
  404. runtime_measurements_count =
  405. securityfs_create_file("runtime_measurements_count",
  406. S_IRUSR | S_IRGRP, ima_dir, NULL,
  407. &ima_measurements_count_ops);
  408. if (IS_ERR(runtime_measurements_count))
  409. goto out;
  410. violations =
  411. securityfs_create_file("violations", S_IRUSR | S_IRGRP,
  412. ima_dir, NULL, &ima_htable_violations_ops);
  413. if (IS_ERR(violations))
  414. goto out;
  415. ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS,
  416. ima_dir, NULL,
  417. &ima_measure_policy_ops);
  418. if (IS_ERR(ima_policy))
  419. goto out;
  420. return 0;
  421. out:
  422. securityfs_remove(violations);
  423. securityfs_remove(runtime_measurements_count);
  424. securityfs_remove(ascii_runtime_measurements);
  425. securityfs_remove(binary_runtime_measurements);
  426. securityfs_remove(ima_symlink);
  427. securityfs_remove(ima_dir);
  428. securityfs_remove(ima_policy);
  429. return -1;
  430. }