security/integrity/ima/ima_policy.c

   1 /*
   2  * Copyright (C) 2008 IBM Corporation
   3  * Author: Mimi Zohar <zohar@us.ibm.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, version 2 of the License.
   8  *
   9  * ima_policy.c
  10  *      - initialize default measure policy rules
  11  *
  12  */
  13 #include <linux/module.h>
  14 #include <linux/list.h>
  15 #include <linux/fs.h>
  16 #include <linux/security.h>
  17 #include <linux/magic.h>
  18 #include <linux/parser.h>
  19 #include <linux/slab.h>
  20 #include <linux/rculist.h>
  21 #include <linux/genhd.h>
  22 #include <linux/seq_file.h>
  23
  24 #include "ima.h"
  25
  26 /* flags definitions */
  27 #define IMA_FUNC        0x0001
  28 #define IMA_MASK        0x0002
  29 #define IMA_FSMAGIC     0x0004
  30 #define IMA_UID         0x0008
  31 #define IMA_FOWNER      0x0010
  32 #define IMA_FSUUID      0x0020
  33 #define IMA_INMASK      0x0040
  34 #define IMA_EUID        0x0080
  35 #define IMA_PCR         0x0100
  36
  37 #define UNKNOWN         0
  38 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  39 #define DONT_MEASURE    0x0002
  40 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  41 #define DONT_APPRAISE   0x0008
  42 #define AUDIT           0x0040
  43
  44 #define INVALID_PCR(a) (((a) < 0) || \
  45         (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
  46
  47 int ima_policy_flag;
  48 static int temp_ima_appraise;
  49
  50 #define MAX_LSM_RULES 6
  51 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  52         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  53 };
  54
  55 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  56
  57 struct ima_rule_entry {
  58         struct list_head list;
  59         int action;
  60         unsigned int flags;
  61         enum ima_hooks func;
  62         int mask;
  63         unsigned long fsmagic;
  64         u8 fsuuid[16];
  65         kuid_t uid;
  66         kuid_t fowner;
  67         int pcr;
  68         struct {
  69                 void *rule;     /* LSM file metadata specific */
  70                 void *args_p;   /* audit value */
  71                 int type;       /* audit type */
  72         } lsm[MAX_LSM_RULES];
  73 };
  74
  75 /*
  76  * Without LSM specific knowledge, the default policy can only be
  77  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  78  */
  79
  80 /*
  81  * The minimum rule set to allow for full TCB coverage.  Measures all files
  82  * opened or mmap for exec and everything read by root.  Dangerous because
  83  * normal users can easily run the machine out of memory simply building
  84  * and running executables.
  85  */
  86 static struct ima_rule_entry dont_measure_rules[] = {
  87         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  88         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
  89         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
  90         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
  91         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  92         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
  93         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
  94         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
  95         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
  96          .flags = IMA_FSMAGIC},
  97         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
  98 };
  99
 100 static struct ima_rule_entry original_measurement_rules[] = {
 101         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 102          .flags = IMA_FUNC | IMA_MASK},
 103         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 104          .flags = IMA_FUNC | IMA_MASK},
 105         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 106          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 107         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 108         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 109 };
 110
 111 static struct ima_rule_entry default_measurement_rules[] = {
 112         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 113          .flags = IMA_FUNC | IMA_MASK},
 114         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 115          .flags = IMA_FUNC | IMA_MASK},
 116         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 117          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 118         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 119          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 120         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 121         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 122         {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
 123 };
 124
 125 static struct ima_rule_entry default_appraise_rules[] = {
 126         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 127         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 128         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 129         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 130         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 131         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 132         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 133         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 134         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 135         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 136         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 137 #ifdef CONFIG_IMA_WRITE_POLICY
 138         {.action = APPRAISE, .func = POLICY_CHECK,
 139         .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 140 #endif
 141 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 142         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
 143 #else
 144         /* force signature */
 145         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID,
 146          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 147 #endif
 148 };
 149
 150 static LIST_HEAD(ima_default_rules);
 151 static LIST_HEAD(ima_policy_rules);
 152 static LIST_HEAD(ima_temp_rules);
 153 static struct list_head *ima_rules = &ima_default_rules;
 154
 155 static int ima_policy __initdata;
 156
 157 static int __init default_measure_policy_setup(char *str)
 158 {
 159         if (ima_policy)
 160                 return 1;
 161
 162         ima_policy = ORIGINAL_TCB;
 163         return 1;
 164 }
 165 __setup("ima_tcb", default_measure_policy_setup);
 166
 167 static int __init policy_setup(char *str)
 168 {
 169         if (ima_policy)
 170                 return 1;
 171
 172         if (strcmp(str, "tcb") == 0)
 173                 ima_policy = DEFAULT_TCB;
 174
 175         return 1;
 176 }
 177 __setup("ima_policy=", policy_setup);
 178
 179 static bool ima_use_appraise_tcb __initdata;
 180 static int __init default_appraise_policy_setup(char *str)
 181 {
 182         ima_use_appraise_tcb = 1;
 183         return 1;
 184 }
 185 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 186
 187 /*
 188  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 189  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 190  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
 191  * they don't.
 192  */
 193 static void ima_lsm_update_rules(void)
 194 {
 195         struct ima_rule_entry *entry;
 196         int result;
 197         int i;
 198
 199         list_for_each_entry(entry, &ima_policy_rules, list) {
 200                 for (i = 0; i < MAX_LSM_RULES; i++) {
 201                         if (!entry->lsm[i].rule)
 202                                 continue;
 203                         result = security_filter_rule_init(entry->lsm[i].type,
 204                                                            Audit_equal,
 205                                                            entry->lsm[i].args_p,
 206                                                            &entry->lsm[i].rule);
 207                         BUG_ON(!entry->lsm[i].rule);
 208                 }
 209         }
 210 }
 211
 212 /**
 213  * ima_match_rules - determine whether an inode matches the measure rule.
 214  * @rule: a pointer to a rule
 215  * @inode: a pointer to an inode
 216  * @func: LIM hook identifier
 217  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 218  *
 219  * Returns true on rule match, false on failure.
 220  */
 221 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 222                             enum ima_hooks func, int mask)
 223 {
 224         struct task_struct *tsk = current;
 225         const struct cred *cred = current_cred();
 226         int i;
 227
 228         if ((rule->flags & IMA_FUNC) &&
 229             (rule->func != func && func != POST_SETATTR))
 230                 return false;
 231         if ((rule->flags & IMA_MASK) &&
 232             (rule->mask != mask && func != POST_SETATTR))
 233                 return false;
 234         if ((rule->flags & IMA_INMASK) &&
 235             (!(rule->mask & mask) && func != POST_SETATTR))
 236                 return false;
 237         if ((rule->flags & IMA_FSMAGIC)
 238             && rule->fsmagic != inode->i_sb->s_magic)
 239                 return false;
 240         if ((rule->flags & IMA_FSUUID) &&
 241             memcmp(rule->fsuuid, inode->i_sb->s_uuid, sizeof(rule->fsuuid)))
 242                 return false;
 243         if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
 244                 return false;
 245         if (rule->flags & IMA_EUID) {
 246                 if (has_capability_noaudit(current, CAP_SETUID)) {
 247                         if (!uid_eq(rule->uid, cred->euid)
 248                             && !uid_eq(rule->uid, cred->suid)
 249                             && !uid_eq(rule->uid, cred->uid))
 250                                 return false;
 251                 } else if (!uid_eq(rule->uid, cred->euid))
 252                         return false;
 253         }
 254
 255         if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
 256                 return false;
 257         for (i = 0; i < MAX_LSM_RULES; i++) {
 258                 int rc = 0;
 259                 u32 osid, sid;
 260                 int retried = 0;
 261
 262                 if (!rule->lsm[i].rule)
 263                         continue;
 264 retry:
 265                 switch (i) {
 266                 case LSM_OBJ_USER:
 267                 case LSM_OBJ_ROLE:
 268                 case LSM_OBJ_TYPE:
 269                         security_inode_getsecid(inode, &osid);
 270                         rc = security_filter_rule_match(osid,
 271                                                         rule->lsm[i].type,
 272                                                         Audit_equal,
 273                                                         rule->lsm[i].rule,
 274                                                         NULL);
 275                         break;
 276                 case LSM_SUBJ_USER:
 277                 case LSM_SUBJ_ROLE:
 278                 case LSM_SUBJ_TYPE:
 279                         security_task_getsecid(tsk, &sid);
 280                         rc = security_filter_rule_match(sid,
 281                                                         rule->lsm[i].type,
 282                                                         Audit_equal,
 283                                                         rule->lsm[i].rule,
 284                                                         NULL);
 285                 default:
 286                         break;
 287                 }
 288                 if ((rc < 0) && (!retried)) {
 289                         retried = 1;
 290                         ima_lsm_update_rules();
 291                         goto retry;
 292                 }
 293                 if (!rc)
 294                         return false;
 295         }
 296         return true;
 297 }
 298
 299 /*
 300  * In addition to knowing that we need to appraise the file in general,
 301  * we need to differentiate between calling hooks, for hook specific rules.
 302  */
 303 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
 304 {
 305         if (!(rule->flags & IMA_FUNC))
 306                 return IMA_FILE_APPRAISE;
 307
 308         switch (func) {
 309         case MMAP_CHECK:
 310                 return IMA_MMAP_APPRAISE;
 311         case BPRM_CHECK:
 312                 return IMA_BPRM_APPRAISE;
 313         case FILE_CHECK:
 314         case POST_SETATTR:
 315                 return IMA_FILE_APPRAISE;
 316         case MODULE_CHECK ... MAX_CHECK - 1:
 317         default:
 318                 return IMA_READ_APPRAISE;
 319         }
 320 }
 321
 322 /**
 323  * ima_match_policy - decision based on LSM and other conditions
 324  * @inode: pointer to an inode for which the policy decision is being made
 325  * @func: IMA hook identifier
 326  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 327  * @pcr: set the pcr to extend
 328  *
 329  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 330  * conditions.
 331  *
 332  * Since the IMA policy may be updated multiple times we need to lock the
 333  * list when walking it.  Reads are many orders of magnitude more numerous
 334  * than writes so ima_match_policy() is classical RCU candidate.
 335  */
 336 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
 337                      int flags, int *pcr)
 338 {
 339         struct ima_rule_entry *entry;
 340         int action = 0, actmask = flags | (flags << 1);
 341
 342         rcu_read_lock();
 343         list_for_each_entry_rcu(entry, ima_rules, list) {
 344
 345                 if (!(entry->action & actmask))
 346                         continue;
 347
 348                 if (!ima_match_rules(entry, inode, func, mask))
 349                         continue;
 350
 351                 action |= entry->flags & IMA_ACTION_FLAGS;
 352
 353                 action |= entry->action & IMA_DO_MASK;
 354                 if (entry->action & IMA_APPRAISE)
 355                         action |= get_subaction(entry, func);
 356
 357                 if (entry->action & IMA_DO_MASK)
 358                         actmask &= ~(entry->action | entry->action << 1);
 359                 else
 360                         actmask &= ~(entry->action | entry->action >> 1);
 361
 362                 if ((pcr) && (entry->flags & IMA_PCR))
 363                         *pcr = entry->pcr;
 364
 365                 if (!actmask)
 366                         break;
 367         }
 368         rcu_read_unlock();
 369
 370         return action;
 371 }
 372
 373 /*
 374  * Initialize the ima_policy_flag variable based on the currently
 375  * loaded policy.  Based on this flag, the decision to short circuit
 376  * out of a function or not call the function in the first place
 377  * can be made earlier.
 378  */
 379 void ima_update_policy_flag(void)
 380 {
 381         struct ima_rule_entry *entry;
 382
 383         list_for_each_entry(entry, ima_rules, list) {
 384                 if (entry->action & IMA_DO_MASK)
 385                         ima_policy_flag |= entry->action;
 386         }
 387
 388         ima_appraise |= temp_ima_appraise;
 389         if (!ima_appraise)
 390                 ima_policy_flag &= ~IMA_APPRAISE;
 391 }
 392
 393 /**
 394  * ima_init_policy - initialize the default measure rules.
 395  *
 396  * ima_rules points to either the ima_default_rules or the
 397  * the new ima_policy_rules.
 398  */
 399 void __init ima_init_policy(void)
 400 {
 401         int i, measure_entries, appraise_entries;
 402
 403         /* if !ima_policy set entries = 0 so we load NO default rules */
 404         measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 405         appraise_entries = ima_use_appraise_tcb ?
 406                          ARRAY_SIZE(default_appraise_rules) : 0;
 407
 408         for (i = 0; i < measure_entries; i++)
 409                 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
 410
 411         switch (ima_policy) {
 412         case ORIGINAL_TCB:
 413                 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
 414                         list_add_tail(&original_measurement_rules[i].list,
 415                                       &ima_default_rules);
 416                 break;
 417         case DEFAULT_TCB:
 418                 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
 419                         list_add_tail(&default_measurement_rules[i].list,
 420                                       &ima_default_rules);
 421         default:
 422                 break;
 423         }
 424
 425         for (i = 0; i < appraise_entries; i++) {
 426                 list_add_tail(&default_appraise_rules[i].list,
 427                               &ima_default_rules);
 428                 if (default_appraise_rules[i].func == POLICY_CHECK)
 429                         temp_ima_appraise |= IMA_APPRAISE_POLICY;
 430         }
 431
 432         ima_update_policy_flag();
 433 }
 434
 435 /* Make sure we have a valid policy, at least containing some rules. */
 436 int ima_check_policy(void)
 437 {
 438         if (list_empty(&ima_temp_rules))
 439                 return -EINVAL;
 440         return 0;
 441 }
 442
 443 /**
 444  * ima_update_policy - update default_rules with new measure rules
 445  *
 446  * Called on file .release to update the default rules with a complete new
 447  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 448  * they make a queue.  The policy may be updated multiple times and this is the
 449  * RCU updater.
 450  *
 451  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 452  * we switch from the default policy to user defined.
 453  */
 454 void ima_update_policy(void)
 455 {
 456         struct list_head *first, *last, *policy;
 457
 458         /* append current policy with the new rules */
 459         first = (&ima_temp_rules)->next;
 460         last = (&ima_temp_rules)->prev;
 461         policy = &ima_policy_rules;
 462
 463         synchronize_rcu();
 464
 465         last->next = policy;
 466         rcu_assign_pointer(list_next_rcu(policy->prev), first);
 467         first->prev = policy->prev;
 468         policy->prev = last;
 469
 470         /* prepare for the next policy rules addition */
 471         INIT_LIST_HEAD(&ima_temp_rules);
 472
 473         if (ima_rules != policy) {
 474                 ima_policy_flag = 0;
 475                 ima_rules = policy;
 476         }
 477         ima_update_policy_flag();
 478 }
 479
 480 enum {
 481         Opt_err = -1,
 482         Opt_measure = 1, Opt_dont_measure,
 483         Opt_appraise, Opt_dont_appraise,
 484         Opt_audit,
 485         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 486         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 487         Opt_func, Opt_mask, Opt_fsmagic,
 488         Opt_fsuuid, Opt_uid, Opt_euid, Opt_fowner,
 489         Opt_appraise_type, Opt_permit_directio,
 490         Opt_pcr
 491 };
 492
 493 static match_table_t policy_tokens = {
 494         {Opt_measure, "measure"},
 495         {Opt_dont_measure, "dont_measure"},
 496         {Opt_appraise, "appraise"},
 497         {Opt_dont_appraise, "dont_appraise"},
 498         {Opt_audit, "audit"},
 499         {Opt_obj_user, "obj_user=%s"},
 500         {Opt_obj_role, "obj_role=%s"},
 501         {Opt_obj_type, "obj_type=%s"},
 502         {Opt_subj_user, "subj_user=%s"},
 503         {Opt_subj_role, "subj_role=%s"},
 504         {Opt_subj_type, "subj_type=%s"},
 505         {Opt_func, "func=%s"},
 506         {Opt_mask, "mask=%s"},
 507         {Opt_fsmagic, "fsmagic=%s"},
 508         {Opt_fsuuid, "fsuuid=%s"},
 509         {Opt_uid, "uid=%s"},
 510         {Opt_euid, "euid=%s"},
 511         {Opt_fowner, "fowner=%s"},
 512         {Opt_appraise_type, "appraise_type=%s"},
 513         {Opt_permit_directio, "permit_directio"},
 514         {Opt_pcr, "pcr=%s"},
 515         {Opt_err, NULL}
 516 };
 517
 518 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 519                              substring_t *args, int lsm_rule, int audit_type)
 520 {
 521         int result;
 522
 523         if (entry->lsm[lsm_rule].rule)
 524                 return -EINVAL;
 525
 526         entry->lsm[lsm_rule].args_p = match_strdup(args);
 527         if (!entry->lsm[lsm_rule].args_p)
 528                 return -ENOMEM;
 529
 530         entry->lsm[lsm_rule].type = audit_type;
 531         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 532                                            Audit_equal,
 533                                            entry->lsm[lsm_rule].args_p,
 534                                            &entry->lsm[lsm_rule].rule);
 535         if (!entry->lsm[lsm_rule].rule) {
 536                 kfree(entry->lsm[lsm_rule].args_p);
 537                 return -EINVAL;
 538         }
 539
 540         return result;
 541 }
 542
 543 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
 544 {
 545         audit_log_format(ab, "%s=", key);
 546         audit_log_untrustedstring(ab, value);
 547         audit_log_format(ab, " ");
 548 }
 549
 550 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 551 {
 552         struct audit_buffer *ab;
 553         char *from;
 554         char *p;
 555         int result = 0;
 556
 557         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
 558
 559         entry->uid = INVALID_UID;
 560         entry->fowner = INVALID_UID;
 561         entry->action = UNKNOWN;
 562         while ((p = strsep(&rule, " \t")) != NULL) {
 563                 substring_t args[MAX_OPT_ARGS];
 564                 int token;
 565                 unsigned long lnum;
 566
 567                 if (result < 0)
 568                         break;
 569                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
 570                         continue;
 571                 token = match_token(p, policy_tokens, args);
 572                 switch (token) {
 573                 case Opt_measure:
 574                         ima_log_string(ab, "action", "measure");
 575
 576                         if (entry->action != UNKNOWN)
 577                                 result = -EINVAL;
 578
 579                         entry->action = MEASURE;
 580                         break;
 581                 case Opt_dont_measure:
 582                         ima_log_string(ab, "action", "dont_measure");
 583
 584                         if (entry->action != UNKNOWN)
 585                                 result = -EINVAL;
 586
 587                         entry->action = DONT_MEASURE;
 588                         break;
 589                 case Opt_appraise:
 590                         ima_log_string(ab, "action", "appraise");
 591
 592                         if (entry->action != UNKNOWN)
 593                                 result = -EINVAL;
 594
 595                         entry->action = APPRAISE;
 596                         break;
 597                 case Opt_dont_appraise:
 598                         ima_log_string(ab, "action", "dont_appraise");
 599
 600                         if (entry->action != UNKNOWN)
 601                                 result = -EINVAL;
 602
 603                         entry->action = DONT_APPRAISE;
 604                         break;
 605                 case Opt_audit:
 606                         ima_log_string(ab, "action", "audit");
 607
 608                         if (entry->action != UNKNOWN)
 609                                 result = -EINVAL;
 610
 611                         entry->action = AUDIT;
 612                         break;
 613                 case Opt_func:
 614                         ima_log_string(ab, "func", args[0].from);
 615
 616                         if (entry->func)
 617                                 result = -EINVAL;
 618
 619                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
 620                                 entry->func = FILE_CHECK;
 621                         /* PATH_CHECK is for backwards compat */
 622                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
 623                                 entry->func = FILE_CHECK;
 624                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
 625                                 entry->func = MODULE_CHECK;
 626                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
 627                                 entry->func = FIRMWARE_CHECK;
 628                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
 629                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
 630                                 entry->func = MMAP_CHECK;
 631                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
 632                                 entry->func = BPRM_CHECK;
 633                         else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
 634                                  0)
 635                                 entry->func = KEXEC_KERNEL_CHECK;
 636                         else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
 637                                  == 0)
 638                                 entry->func = KEXEC_INITRAMFS_CHECK;
 639                         else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
 640                                 entry->func = POLICY_CHECK;
 641                         else
 642                                 result = -EINVAL;
 643                         if (!result)
 644                                 entry->flags |= IMA_FUNC;
 645                         break;
 646                 case Opt_mask:
 647                         ima_log_string(ab, "mask", args[0].from);
 648
 649                         if (entry->mask)
 650                                 result = -EINVAL;
 651
 652                         from = args[0].from;
 653                         if (*from == '^')
 654                                 from++;
 655
 656                         if ((strcmp(from, "MAY_EXEC")) == 0)
 657                                 entry->mask = MAY_EXEC;
 658                         else if (strcmp(from, "MAY_WRITE") == 0)
 659                                 entry->mask = MAY_WRITE;
 660                         else if (strcmp(from, "MAY_READ") == 0)
 661                                 entry->mask = MAY_READ;
 662                         else if (strcmp(from, "MAY_APPEND") == 0)
 663                                 entry->mask = MAY_APPEND;
 664                         else
 665                                 result = -EINVAL;
 666                         if (!result)
 667                                 entry->flags |= (*args[0].from == '^')
 668                                      ? IMA_INMASK : IMA_MASK;
 669                         break;
 670                 case Opt_fsmagic:
 671                         ima_log_string(ab, "fsmagic", args[0].from);
 672
 673                         if (entry->fsmagic) {
 674                                 result = -EINVAL;
 675                                 break;
 676                         }
 677
 678                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
 679                         if (!result)
 680                                 entry->flags |= IMA_FSMAGIC;
 681                         break;
 682                 case Opt_fsuuid:
 683                         ima_log_string(ab, "fsuuid", args[0].from);
 684
 685                         if (memchr_inv(entry->fsuuid, 0x00,
 686                                        sizeof(entry->fsuuid))) {
 687                                 result = -EINVAL;
 688                                 break;
 689                         }
 690
 691                         result = blk_part_pack_uuid(args[0].from,
 692                                                     entry->fsuuid);
 693                         if (!result)
 694                                 entry->flags |= IMA_FSUUID;
 695                         break;
 696                 case Opt_uid:
 697                         ima_log_string(ab, "uid", args[0].from);
 698                 case Opt_euid:
 699                         if (token == Opt_euid)
 700                                 ima_log_string(ab, "euid", args[0].from);
 701
 702                         if (uid_valid(entry->uid)) {
 703                                 result = -EINVAL;
 704                                 break;
 705                         }
 706
 707                         result = kstrtoul(args[0].from, 10, &lnum);
 708                         if (!result) {
 709                                 entry->uid = make_kuid(current_user_ns(),
 710                                                        (uid_t) lnum);
 711                                 if (!uid_valid(entry->uid) ||
 712                                     (uid_t)lnum != lnum)
 713                                         result = -EINVAL;
 714                                 else
 715                                         entry->flags |= (token == Opt_uid)
 716                                             ? IMA_UID : IMA_EUID;
 717                         }
 718                         break;
 719                 case Opt_fowner:
 720                         ima_log_string(ab, "fowner", args[0].from);
 721
 722                         if (uid_valid(entry->fowner)) {
 723                                 result = -EINVAL;
 724                                 break;
 725                         }
 726
 727                         result = kstrtoul(args[0].from, 10, &lnum);
 728                         if (!result) {
 729                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
 730                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
 731                                         result = -EINVAL;
 732                                 else
 733                                         entry->flags |= IMA_FOWNER;
 734                         }
 735                         break;
 736                 case Opt_obj_user:
 737                         ima_log_string(ab, "obj_user", args[0].from);
 738                         result = ima_lsm_rule_init(entry, args,
 739                                                    LSM_OBJ_USER,
 740                                                    AUDIT_OBJ_USER);
 741                         break;
 742                 case Opt_obj_role:
 743                         ima_log_string(ab, "obj_role", args[0].from);
 744                         result = ima_lsm_rule_init(entry, args,
 745                                                    LSM_OBJ_ROLE,
 746                                                    AUDIT_OBJ_ROLE);
 747                         break;
 748                 case Opt_obj_type:
 749                         ima_log_string(ab, "obj_type", args[0].from);
 750                         result = ima_lsm_rule_init(entry, args,
 751                                                    LSM_OBJ_TYPE,
 752                                                    AUDIT_OBJ_TYPE);
 753                         break;
 754                 case Opt_subj_user:
 755                         ima_log_string(ab, "subj_user", args[0].from);
 756                         result = ima_lsm_rule_init(entry, args,
 757                                                    LSM_SUBJ_USER,
 758                                                    AUDIT_SUBJ_USER);
 759                         break;
 760                 case Opt_subj_role:
 761                         ima_log_string(ab, "subj_role", args[0].from);
 762                         result = ima_lsm_rule_init(entry, args,
 763                                                    LSM_SUBJ_ROLE,
 764                                                    AUDIT_SUBJ_ROLE);
 765                         break;
 766                 case Opt_subj_type:
 767                         ima_log_string(ab, "subj_type", args[0].from);
 768                         result = ima_lsm_rule_init(entry, args,
 769                                                    LSM_SUBJ_TYPE,
 770                                                    AUDIT_SUBJ_TYPE);
 771                         break;
 772                 case Opt_appraise_type:
 773                         if (entry->action != APPRAISE) {
 774                                 result = -EINVAL;
 775                                 break;
 776                         }
 777
 778                         ima_log_string(ab, "appraise_type", args[0].from);
 779                         if ((strcmp(args[0].from, "imasig")) == 0)
 780                                 entry->flags |= IMA_DIGSIG_REQUIRED;
 781                         else
 782                                 result = -EINVAL;
 783                         break;
 784                 case Opt_permit_directio:
 785                         entry->flags |= IMA_PERMIT_DIRECTIO;
 786                         break;
 787                 case Opt_pcr:
 788                         if (entry->action != MEASURE) {
 789                                 result = -EINVAL;
 790                                 break;
 791                         }
 792                         ima_log_string(ab, "pcr", args[0].from);
 793
 794                         result = kstrtoint(args[0].from, 10, &entry->pcr);
 795                         if (result || INVALID_PCR(entry->pcr))
 796                                 result = -EINVAL;
 797                         else
 798                                 entry->flags |= IMA_PCR;
 799
 800                         break;
 801                 case Opt_err:
 802                         ima_log_string(ab, "UNKNOWN", p);
 803                         result = -EINVAL;
 804                         break;
 805                 }
 806         }
 807         if (!result && (entry->action == UNKNOWN))
 808                 result = -EINVAL;
 809         else if (entry->func == MODULE_CHECK)
 810                 temp_ima_appraise |= IMA_APPRAISE_MODULES;
 811         else if (entry->func == FIRMWARE_CHECK)
 812                 temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
 813         else if (entry->func == POLICY_CHECK)
 814                 temp_ima_appraise |= IMA_APPRAISE_POLICY;
 815         audit_log_format(ab, "res=%d", !result);
 816         audit_log_end(ab);
 817         return result;
 818 }
 819
 820 /**
 821  * ima_parse_add_rule - add a rule to ima_policy_rules
 822  * @rule - ima measurement policy rule
 823  *
 824  * Avoid locking by allowing just one writer at a time in ima_write_policy()
 825  * Returns the length of the rule parsed, an error code on failure
 826  */
 827 ssize_t ima_parse_add_rule(char *rule)
 828 {
 829         static const char op[] = "update_policy";
 830         char *p;
 831         struct ima_rule_entry *entry;
 832         ssize_t result, len;
 833         int audit_info = 0;
 834
 835         p = strsep(&rule, "\n");
 836         len = strlen(p) + 1;
 837         p += strspn(p, " \t");
 838
 839         if (*p == '#' || *p == '\0')
 840                 return len;
 841
 842         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 843         if (!entry) {
 844                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 845                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
 846                 return -ENOMEM;
 847         }
 848
 849         INIT_LIST_HEAD(&entry->list);
 850
 851         result = ima_parse_rule(p, entry);
 852         if (result) {
 853                 kfree(entry);
 854                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 855                                     NULL, op, "invalid-policy", result,
 856                                     audit_info);
 857                 return result;
 858         }
 859
 860         list_add_tail(&entry->list, &ima_temp_rules);
 861
 862         return len;
 863 }
 864
 865 /**
 866  * ima_delete_rules() called to cleanup invalid in-flight policy.
 867  * We don't need locking as we operate on the temp list, which is
 868  * different from the active one.  There is also only one user of
 869  * ima_delete_rules() at a time.
 870  */
 871 void ima_delete_rules(void)
 872 {
 873         struct ima_rule_entry *entry, *tmp;
 874         int i;
 875
 876         temp_ima_appraise = 0;
 877         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
 878                 for (i = 0; i < MAX_LSM_RULES; i++)
 879                         kfree(entry->lsm[i].args_p);
 880
 881                 list_del(&entry->list);
 882                 kfree(entry);
 883         }
 884 }
 885
 886 #ifdef  CONFIG_IMA_READ_POLICY
 887 enum {
 888         mask_exec = 0, mask_write, mask_read, mask_append
 889 };
 890
 891 static char *mask_tokens[] = {
 892         "MAY_EXEC",
 893         "MAY_WRITE",
 894         "MAY_READ",
 895         "MAY_APPEND"
 896 };
 897
 898 enum {
 899         func_file = 0, func_mmap, func_bprm,
 900         func_module, func_firmware, func_post,
 901         func_kexec_kernel, func_kexec_initramfs,
 902         func_policy
 903 };
 904
 905 static char *func_tokens[] = {
 906         "FILE_CHECK",
 907         "MMAP_CHECK",
 908         "BPRM_CHECK",
 909         "MODULE_CHECK",
 910         "FIRMWARE_CHECK",
 911         "POST_SETATTR",
 912         "KEXEC_KERNEL_CHECK",
 913         "KEXEC_INITRAMFS_CHECK",
 914         "POLICY_CHECK"
 915 };
 916
 917 void *ima_policy_start(struct seq_file *m, loff_t *pos)
 918 {
 919         loff_t l = *pos;
 920         struct ima_rule_entry *entry;
 921
 922         rcu_read_lock();
 923         list_for_each_entry_rcu(entry, ima_rules, list) {
 924                 if (!l--) {
 925                         rcu_read_unlock();
 926                         return entry;
 927                 }
 928         }
 929         rcu_read_unlock();
 930         return NULL;
 931 }
 932
 933 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
 934 {
 935         struct ima_rule_entry *entry = v;
 936
 937         rcu_read_lock();
 938         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
 939         rcu_read_unlock();
 940         (*pos)++;
 941
 942         return (&entry->list == ima_rules) ? NULL : entry;
 943 }
 944
 945 void ima_policy_stop(struct seq_file *m, void *v)
 946 {
 947 }
 948
 949 #define pt(token)       policy_tokens[token + Opt_err].pattern
 950 #define mt(token)       mask_tokens[token]
 951 #define ft(token)       func_tokens[token]
 952
 953 /*
 954  * policy_func_show - display the ima_hooks policy rule
 955  */
 956 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
 957 {
 958         char tbuf[64] = {0,};
 959
 960         switch (func) {
 961         case FILE_CHECK:
 962                 seq_printf(m, pt(Opt_func), ft(func_file));
 963                 break;
 964         case MMAP_CHECK:
 965                 seq_printf(m, pt(Opt_func), ft(func_mmap));
 966                 break;
 967         case BPRM_CHECK:
 968                 seq_printf(m, pt(Opt_func), ft(func_bprm));
 969                 break;
 970         case MODULE_CHECK:
 971                 seq_printf(m, pt(Opt_func), ft(func_module));
 972                 break;
 973         case FIRMWARE_CHECK:
 974                 seq_printf(m, pt(Opt_func), ft(func_firmware));
 975                 break;
 976         case POST_SETATTR:
 977                 seq_printf(m, pt(Opt_func), ft(func_post));
 978                 break;
 979         case KEXEC_KERNEL_CHECK:
 980                 seq_printf(m, pt(Opt_func), ft(func_kexec_kernel));
 981                 break;
 982         case KEXEC_INITRAMFS_CHECK:
 983                 seq_printf(m, pt(Opt_func), ft(func_kexec_initramfs));
 984                 break;
 985         case POLICY_CHECK:
 986                 seq_printf(m, pt(Opt_func), ft(func_policy));
 987                 break;
 988         default:
 989                 snprintf(tbuf, sizeof(tbuf), "%d", func);
 990                 seq_printf(m, pt(Opt_func), tbuf);
 991                 break;
 992         }
 993         seq_puts(m, " ");
 994 }
 995
 996 int ima_policy_show(struct seq_file *m, void *v)
 997 {
 998         struct ima_rule_entry *entry = v;
 999         int i;
1000         char tbuf[64] = {0,};
1001
1002         rcu_read_lock();
1003
1004         if (entry->action & MEASURE)
1005                 seq_puts(m, pt(Opt_measure));
1006         if (entry->action & DONT_MEASURE)
1007                 seq_puts(m, pt(Opt_dont_measure));
1008         if (entry->action & APPRAISE)
1009                 seq_puts(m, pt(Opt_appraise));
1010         if (entry->action & DONT_APPRAISE)
1011                 seq_puts(m, pt(Opt_dont_appraise));
1012         if (entry->action & AUDIT)
1013                 seq_puts(m, pt(Opt_audit));
1014
1015         seq_puts(m, " ");
1016
1017         if (entry->flags & IMA_FUNC)
1018                 policy_func_show(m, entry->func);
1019
1020         if (entry->flags & IMA_MASK) {
1021                 if (entry->mask & MAY_EXEC)
1022                         seq_printf(m, pt(Opt_mask), mt(mask_exec));
1023                 if (entry->mask & MAY_WRITE)
1024                         seq_printf(m, pt(Opt_mask), mt(mask_write));
1025                 if (entry->mask & MAY_READ)
1026                         seq_printf(m, pt(Opt_mask), mt(mask_read));
1027                 if (entry->mask & MAY_APPEND)
1028                         seq_printf(m, pt(Opt_mask), mt(mask_append));
1029                 seq_puts(m, " ");
1030         }
1031
1032         if (entry->flags & IMA_FSMAGIC) {
1033                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1034                 seq_printf(m, pt(Opt_fsmagic), tbuf);
1035                 seq_puts(m, " ");
1036         }
1037
1038         if (entry->flags & IMA_PCR) {
1039                 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
1040                 seq_printf(m, pt(Opt_pcr), tbuf);
1041                 seq_puts(m, " ");
1042         }
1043
1044         if (entry->flags & IMA_FSUUID) {
1045                 seq_printf(m, "fsuuid=%pU", entry->fsuuid);
1046                 seq_puts(m, " ");
1047         }
1048
1049         if (entry->flags & IMA_UID) {
1050                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1051                 seq_printf(m, pt(Opt_uid), tbuf);
1052                 seq_puts(m, " ");
1053         }
1054
1055         if (entry->flags & IMA_EUID) {
1056                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1057                 seq_printf(m, pt(Opt_euid), tbuf);
1058                 seq_puts(m, " ");
1059         }
1060
1061         if (entry->flags & IMA_FOWNER) {
1062                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1063                 seq_printf(m, pt(Opt_fowner), tbuf);
1064                 seq_puts(m, " ");
1065         }
1066
1067         for (i = 0; i < MAX_LSM_RULES; i++) {
1068                 if (entry->lsm[i].rule) {
1069                         switch (i) {
1070                         case LSM_OBJ_USER:
1071                                 seq_printf(m, pt(Opt_obj_user),
1072                                            (char *)entry->lsm[i].args_p);
1073                                 break;
1074                         case LSM_OBJ_ROLE:
1075                                 seq_printf(m, pt(Opt_obj_role),
1076                                            (char *)entry->lsm[i].args_p);
1077                                 break;
1078                         case LSM_OBJ_TYPE:
1079                                 seq_printf(m, pt(Opt_obj_type),
1080                                            (char *)entry->lsm[i].args_p);
1081                                 break;
1082                         case LSM_SUBJ_USER:
1083                                 seq_printf(m, pt(Opt_subj_user),
1084                                            (char *)entry->lsm[i].args_p);
1085                                 break;
1086                         case LSM_SUBJ_ROLE:
1087                                 seq_printf(m, pt(Opt_subj_role),
1088                                            (char *)entry->lsm[i].args_p);
1089                                 break;
1090                         case LSM_SUBJ_TYPE:
1091                                 seq_printf(m, pt(Opt_subj_type),
1092                                            (char *)entry->lsm[i].args_p);
1093                                 break;
1094                         }
1095                 }
1096         }
1097         if (entry->flags & IMA_DIGSIG_REQUIRED)
1098                 seq_puts(m, "appraise_type=imasig ");
1099         if (entry->flags & IMA_PERMIT_DIRECTIO)
1100                 seq_puts(m, "permit_directio ");
1101         rcu_read_unlock();
1102         seq_puts(m, "\n");
1103         return 0;
1104 }
1105 #endif  /* CONFIG_IMA_READ_POLICY */