1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (C) 2008 IBM Corporation
5 * Author: Mimi Zohar <zohar@us.ibm.com>
8 * Implements must_appraise_or_measure, collect_measurement,
9 * appraise_measurement, store_measurement and store_template.
11 #include <linux/slab.h>
12 #include <linux/file.h>
14 #include <linux/xattr.h>
15 #include <linux/evm.h>
16 #include <linux/iversion.h>
17 #include <linux/fsverity.h>
22 * ima_free_template_entry - free an existing template entry
24 void ima_free_template_entry(struct ima_template_entry *entry)
28 for (i = 0; i < entry->template_desc->num_fields; i++)
29 kfree(entry->template_data[i].data);
31 kfree(entry->digests);
36 * ima_alloc_init_template - create and initialize a new template entry
38 int ima_alloc_init_template(struct ima_event_data *event_data,
39 struct ima_template_entry **entry,
40 struct ima_template_desc *desc)
42 struct ima_template_desc *template_desc;
43 struct tpm_digest *digests;
49 template_desc = ima_template_desc_current();
51 *entry = kzalloc(struct_size(*entry, template_data,
52 template_desc->num_fields), GFP_NOFS);
56 digests = kcalloc(NR_BANKS(ima_tpm_chip) + ima_extra_slots,
57 sizeof(*digests), GFP_NOFS);
64 (*entry)->digests = digests;
65 (*entry)->template_desc = template_desc;
66 for (i = 0; i < template_desc->num_fields; i++) {
67 const struct ima_template_field *field =
68 template_desc->fields[i];
71 result = field->field_init(event_data,
72 &((*entry)->template_data[i]));
76 len = (*entry)->template_data[i].len;
77 (*entry)->template_data_len += sizeof(len);
78 (*entry)->template_data_len += len;
82 ima_free_template_entry(*entry);
88 * ima_store_template - store ima template measurements
90 * Calculate the hash of a template entry, add the template entry
91 * to an ordered list of measurement entries maintained inside the kernel,
92 * and also update the aggregate integrity value (maintained inside the
93 * configured TPM PCR) over the hashes of the current list of measurement
96 * Applications retrieve the current kernel-held measurement list through
97 * the securityfs entries in /sys/kernel/security/ima. The signed aggregate
98 * TPM PCR (called quote) can be retrieved using a TPM user space library
99 * and is used to validate the measurement list.
101 * Returns 0 on success, error code otherwise
103 int ima_store_template(struct ima_template_entry *entry,
104 int violation, struct inode *inode,
105 const unsigned char *filename, int pcr)
107 static const char op[] = "add_template_measure";
108 static const char audit_cause[] = "hashing_error";
109 char *template_name = entry->template_desc->name;
113 result = ima_calc_field_array_hash(&entry->template_data[0],
116 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
118 audit_cause, result, 0);
123 result = ima_add_template_entry(entry, violation, op, inode, filename);
128 * ima_add_violation - add violation to measurement list.
130 * Violations are flagged in the measurement list with zero hash values.
131 * By extending the PCR with 0xFF's instead of with zeroes, the PCR
132 * value is invalidated.
134 void ima_add_violation(struct file *file, const unsigned char *filename,
135 struct integrity_iint_cache *iint,
136 const char *op, const char *cause)
138 struct ima_template_entry *entry;
139 struct inode *inode = file_inode(file);
140 struct ima_event_data event_data = { .iint = iint,
142 .filename = filename,
143 .violation = cause };
147 /* can overflow, only indicator */
148 atomic_long_inc(&ima_htable.violations);
150 result = ima_alloc_init_template(&event_data, &entry, NULL);
155 result = ima_store_template(entry, violation, inode,
156 filename, CONFIG_IMA_MEASURE_PCR_IDX);
158 ima_free_template_entry(entry);
160 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
161 op, cause, result, 0);
165 * ima_get_action - appraise & measure decision based on policy.
166 * @mnt_userns: user namespace of the mount the inode was found from
167 * @inode: pointer to the inode associated with the object being validated
168 * @cred: pointer to credentials structure to validate
169 * @secid: secid of the task being validated
170 * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
172 * @func: caller identifier
173 * @pcr: pointer filled in if matched measure policy sets pcr=
174 * @template_desc: pointer filled in if matched measure policy sets template=
175 * @func_data: func specific data, may be NULL
176 * @allowed_algos: allowlist of hash algorithms for the IMA xattr
178 * The policy is defined in terms of keypairs:
179 * subj=, obj=, type=, func=, mask=, fsmagic=
180 * subj,obj, and type: are LSM specific.
181 * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK
182 * | KEXEC_CMDLINE | KEY_CHECK | CRITICAL_DATA
183 * mask: contains the permission mask
186 * Returns IMA_MEASURE, IMA_APPRAISE mask.
189 int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
190 const struct cred *cred, u32 secid, int mask,
191 enum ima_hooks func, int *pcr,
192 struct ima_template_desc **template_desc,
193 const char *func_data, unsigned int *allowed_algos)
195 int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
197 flags &= ima_policy_flag;
199 return ima_match_policy(mnt_userns, inode, cred, secid, func, mask,
200 flags, pcr, template_desc, func_data,
204 static int ima_get_verity_digest(struct integrity_iint_cache *iint,
205 struct ima_max_digest_data *hash)
207 enum hash_algo verity_alg;
211 * On failure, 'measure' policy rules will result in a file data
212 * hash containing 0's.
214 ret = fsverity_get_digest(iint->inode, hash->digest, &verity_alg);
219 * Unlike in the case of actually calculating the file hash, in
220 * the fsverity case regardless of the hash algorithm, return
221 * the verity digest to be included in the measurement list. A
222 * mismatch between the verity algorithm and the xattr signature
223 * algorithm, if one exists, will be detected later.
225 hash->hdr.algo = verity_alg;
226 hash->hdr.length = hash_digest_size[verity_alg];
231 * ima_collect_measurement - collect file measurement
233 * Calculate the file hash, if it doesn't already exist,
234 * storing the measurement and i_version in the iint.
236 * Must be called with iint->mutex held.
238 * Return 0 on success, error code otherwise
240 int ima_collect_measurement(struct integrity_iint_cache *iint,
241 struct file *file, void *buf, loff_t size,
242 enum hash_algo algo, struct modsig *modsig)
244 const char *audit_cause = "failed";
245 struct inode *inode = file_inode(file);
246 const char *filename = file->f_path.dentry->d_name.name;
247 struct ima_max_digest_data hash;
254 * Always collect the modsig, because IMA might have already collected
255 * the file digest without collecting the modsig in a previous
259 ima_collect_modsig(modsig, buf, size);
261 if (iint->flags & IMA_COLLECTED)
265 * Detecting file change is based on i_version. On filesystems
266 * which do not support i_version, support was originally limited
267 * to an initial measurement/appraisal/audit, but was modified to
268 * assume the file changed.
270 i_version = inode_query_iversion(inode);
271 hash.hdr.algo = algo;
272 hash.hdr.length = hash_digest_size[algo];
274 /* Initialize hash digest to 0's in case of failure */
275 memset(&hash.digest, 0, sizeof(hash.digest));
277 if (iint->flags & IMA_VERITY_REQUIRED) {
278 result = ima_get_verity_digest(iint, &hash);
283 audit_cause = "no-verity-digest";
286 audit_cause = "invalid-verity-digest";
290 result = ima_calc_buffer_hash(buf, size, &hash.hdr);
292 result = ima_calc_file_hash(file, &hash.hdr);
295 if (result && result != -EBADF && result != -EINVAL)
298 length = sizeof(hash.hdr) + hash.hdr.length;
299 tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS);
305 iint->ima_hash = tmpbuf;
306 memcpy(iint->ima_hash, &hash, length);
307 iint->version = i_version;
309 /* Possibly temporary failure due to type of read (eg. O_DIRECT) */
311 iint->flags |= IMA_COLLECTED;
314 if (file->f_flags & O_DIRECT)
315 audit_cause = "failed(directio)";
317 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
318 filename, "collect_data", audit_cause,
325 * ima_store_measurement - store file measurement
327 * Create an "ima" template and then store the template by calling
328 * ima_store_template.
330 * We only get here if the inode has not already been measured,
331 * but the measurement could already exist:
332 * - multiple copies of the same file on either the same or
333 * different filesystems.
334 * - the inode was previously flushed as well as the iint info,
335 * containing the hashing info.
337 * Must be called with iint->mutex held.
339 void ima_store_measurement(struct integrity_iint_cache *iint,
340 struct file *file, const unsigned char *filename,
341 struct evm_ima_xattr_data *xattr_value,
342 int xattr_len, const struct modsig *modsig, int pcr,
343 struct ima_template_desc *template_desc)
345 static const char op[] = "add_template_measure";
346 static const char audit_cause[] = "ENOMEM";
347 int result = -ENOMEM;
348 struct inode *inode = file_inode(file);
349 struct ima_template_entry *entry;
350 struct ima_event_data event_data = { .iint = iint,
352 .filename = filename,
353 .xattr_value = xattr_value,
354 .xattr_len = xattr_len,
359 * We still need to store the measurement in the case of MODSIG because
360 * we only have its contents to put in the list at the time of
361 * appraisal, but a file measurement from earlier might already exist in
362 * the measurement list.
364 if (iint->measured_pcrs & (0x1 << pcr) && !modsig)
367 result = ima_alloc_init_template(&event_data, &entry, template_desc);
369 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
370 op, audit_cause, result, 0);
374 result = ima_store_template(entry, violation, inode, filename, pcr);
375 if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {
376 iint->flags |= IMA_MEASURED;
377 iint->measured_pcrs |= (0x1 << pcr);
380 ima_free_template_entry(entry);
383 void ima_audit_measurement(struct integrity_iint_cache *iint,
384 const unsigned char *filename)
386 struct audit_buffer *ab;
388 const char *algo_name = hash_algo_name[iint->ima_hash->algo];
391 if (iint->flags & IMA_AUDITED)
394 hash = kzalloc((iint->ima_hash->length * 2) + 1, GFP_KERNEL);
398 for (i = 0; i < iint->ima_hash->length; i++)
399 hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
402 ab = audit_log_start(audit_context(), GFP_KERNEL,
403 AUDIT_INTEGRITY_RULE);
407 audit_log_format(ab, "file=");
408 audit_log_untrustedstring(ab, filename);
409 audit_log_format(ab, " hash=\"%s:%s\"", algo_name, hash);
411 audit_log_task_info(ab);
414 iint->flags |= IMA_AUDITED;
421 * ima_d_path - return a pointer to the full pathname
423 * Attempt to return a pointer to the full pathname for use in the
424 * IMA measurement list, IMA audit records, and auditing logs.
426 * On failure, return a pointer to a copy of the filename, not dname.
427 * Returning a pointer to dname, could result in using the pointer
428 * after the memory has been freed.
430 const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
432 char *pathname = NULL;
434 *pathbuf = __getname();
436 pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
437 if (IS_ERR(pathname)) {
445 strscpy(namebuf, path->dentry->d_name.name, NAME_MAX);