1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Copyright (C) 2005,2006,2007,2008 IBM Corporation 4 * 5 * Authors: 6 * Reiner Sailer <sailer@watson.ibm.com> 7 * Mimi Zohar <zohar@us.ibm.com> 8 * 9 * File: ima.h 10 * internal Integrity Measurement Architecture (IMA) definitions 11 */ 12 13 #ifndef __LINUX_IMA_H 14 #define __LINUX_IMA_H 15 16 #include <linux/types.h> 17 #include <linux/crypto.h> 18 #include <linux/fs.h> 19 #include <linux/security.h> 20 #include <linux/hash.h> 21 #include <linux/tpm.h> 22 #include <linux/audit.h> 23 #include <crypto/hash_info.h> 24 25 #include "../integrity.h" 26 27 enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, 28 IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; 29 enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 }; 30 31 /* 32 * BINARY: current binary measurements list 33 * BINARY_STAGED: staged binary measurements list 34 * BINARY_FULL: binary measurements list since IMA init (lost after kexec) 35 */ 36 enum binary_lists { 37 BINARY, BINARY_STAGED, BINARY_FULL, BINARY__LAST 38 }; 39 40 /* digest size for IMA, fits SHA1 or MD5 */ 41 #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE 42 #define IMA_EVENT_NAME_LEN_MAX 255 43 44 #define IMA_HASH_BITS 10 45 #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS) 46 47 #define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16 48 #define IMA_TEMPLATE_NUM_FIELDS_MAX 15 49 50 #define IMA_TEMPLATE_IMA_NAME "ima" 51 #define IMA_TEMPLATE_IMA_FMT "d|n" 52 53 #define NR_BANKS(chip) ((chip != NULL) ? chip->nr_allocated_banks : 0) 54 55 /* current content of the policy */ 56 extern int ima_policy_flag; 57 58 /* bitset of digests algorithms allowed in the setxattr hook */ 59 extern atomic_t ima_setxattr_allowed_hash_algorithms; 60 61 /* IMA hash algorithm description */ 62 struct ima_algo_desc { 63 struct crypto_shash *tfm; 64 enum hash_algo algo; 65 unsigned int digest_size; 66 }; 67 68 /* set during initialization */ 69 extern int ima_hash_algo __ro_after_init; 70 extern int ima_sha1_idx __ro_after_init; 71 extern int ima_hash_algo_idx __ro_after_init; 72 extern int ima_extra_slots __ro_after_init; 73 extern struct ima_algo_desc *ima_algo_array __ro_after_init; 74 75 extern int ima_appraise; 76 extern struct tpm_chip *ima_tpm_chip; 77 extern const char boot_aggregate_name[]; 78 79 /* IMA event related data */ 80 struct ima_event_data { 81 struct ima_iint_cache *iint; 82 struct file *file; 83 const unsigned char *filename; 84 struct evm_ima_xattr_data *xattr_value; 85 int xattr_len; 86 const struct modsig *modsig; 87 const char *violation; 88 const void *buf; 89 int buf_len; 90 }; 91 92 /* IMA template field data definition */ 93 struct ima_field_data { 94 u8 *data; 95 u32 len; 96 }; 97 98 /* IMA template field definition */ 99 struct ima_template_field { 100 const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN]; 101 int (*field_init)(struct ima_event_data *event_data, 102 struct ima_field_data *field_data); 103 void (*field_show)(struct seq_file *m, enum ima_show_type show, 104 struct ima_field_data *field_data); 105 }; 106 107 /* IMA template descriptor definition */ 108 struct ima_template_desc { 109 struct list_head list; 110 char *name; 111 char *fmt; 112 int num_fields; 113 const struct ima_template_field **fields; 114 }; 115 116 struct ima_template_entry { 117 int pcr; 118 struct tpm_digest *digests; 119 struct ima_template_desc *template_desc; /* template descriptor */ 120 u32 template_data_len; 121 struct ima_field_data template_data[]; /* template related data */ 122 }; 123 124 struct ima_queue_entry { 125 struct hlist_node hnext; /* place in hash collision list */ 126 struct list_head later; /* place in ima_measurements list */ 127 struct ima_template_entry *entry; 128 }; 129 extern struct list_head ima_measurements; /* list of all measurements */ 130 extern struct list_head ima_measurements_staged; /* list of staged meas. */ 131 132 /* Some details preceding the binary serialized measurement list */ 133 struct ima_kexec_hdr { 134 u16 version; 135 u16 _reserved0; 136 u32 _reserved1; 137 u64 buffer_size; 138 u64 count; 139 }; 140 141 /* IMA iint action cache flags */ 142 #define IMA_MEASURE 0x00000001 143 #define IMA_MEASURED 0x00000002 144 #define IMA_APPRAISE 0x00000004 145 #define IMA_APPRAISED 0x00000008 146 /*#define IMA_COLLECT 0x00000010 do not use this flag */ 147 #define IMA_COLLECTED 0x00000020 148 #define IMA_AUDIT 0x00000040 149 #define IMA_AUDITED 0x00000080 150 #define IMA_HASH 0x00000100 151 #define IMA_HASHED 0x00000200 152 153 /* IMA iint policy rule cache flags */ 154 #define IMA_NONACTION_FLAGS 0xff000000 155 #define IMA_DIGSIG_REQUIRED 0x01000000 156 #define IMA_PERMIT_DIRECTIO 0x02000000 157 #define IMA_NEW_FILE 0x04000000 158 #define IMA_SIGV3_REQUIRED 0x08000000 159 #define IMA_FAIL_UNVERIFIABLE_SIGS 0x10000000 160 #define IMA_MODSIG_ALLOWED 0x20000000 161 #define IMA_CHECK_BLACKLIST 0x40000000 162 #define IMA_VERITY_REQUIRED 0x80000000 163 164 /* Exclude non-action flags which are not rule-specific. */ 165 #define IMA_NONACTION_RULE_FLAGS (IMA_NONACTION_FLAGS & ~IMA_NEW_FILE) 166 167 #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ 168 IMA_HASH | IMA_APPRAISE_SUBMASK) 169 #define IMA_DONE_MASK (IMA_MEASURED | IMA_APPRAISED | IMA_AUDITED | \ 170 IMA_HASHED | IMA_COLLECTED | \ 171 IMA_APPRAISED_SUBMASK) 172 173 /* IMA iint subaction appraise cache flags */ 174 #define IMA_FILE_APPRAISE 0x00001000 175 #define IMA_FILE_APPRAISED 0x00002000 176 #define IMA_MMAP_APPRAISE 0x00004000 177 #define IMA_MMAP_APPRAISED 0x00008000 178 #define IMA_BPRM_APPRAISE 0x00010000 179 #define IMA_BPRM_APPRAISED 0x00020000 180 #define IMA_READ_APPRAISE 0x00040000 181 #define IMA_READ_APPRAISED 0x00080000 182 #define IMA_CREDS_APPRAISE 0x00100000 183 #define IMA_CREDS_APPRAISED 0x00200000 184 #define IMA_APPRAISE_SUBMASK (IMA_FILE_APPRAISE | IMA_MMAP_APPRAISE | \ 185 IMA_BPRM_APPRAISE | IMA_READ_APPRAISE | \ 186 IMA_CREDS_APPRAISE) 187 #define IMA_APPRAISED_SUBMASK (IMA_FILE_APPRAISED | IMA_MMAP_APPRAISED | \ 188 IMA_BPRM_APPRAISED | IMA_READ_APPRAISED | \ 189 IMA_CREDS_APPRAISED) 190 191 /* 192 * IMA iint cache atomic_flags 193 * 194 * IMA_CHANGE_ATTR - indicates that chATTR() was called (chmod, chown, chgrp) 195 * and file attributes have changed. On file open, it causes IMA to clear 196 * iint->flags to re-evaluate policy and perform IMA functions again. 197 * 198 * IMA_CHANGE_XATTR - indicates that setxattr or removexattr was called and 199 * extended attributes have changed. On file open, it causes IMA to clear 200 * iint->flags IMA_DONE_MASK to re-appraise. 201 * 202 * IMA_UPDATE_XATTR - indicates that security.ima needs to be updated. It is 203 * cleared if file policy changes and no update is needed. 204 * 205 * IMA_DIGSIG - indicates that file security.ima has signature and file 206 * security.ima must not update on file close. 207 * 208 * IMA_MAY_EMIT_TOMTOU - indicates to add Time-of-Measure-Time-of-Use (ToMToU) 209 * integrity violation (a file that is already opened for read is opened for 210 * write) to the measurement list and to also emit an audit message. 211 * 212 * IMA_EMITTED_OPENWRITERS - indicates to add open-writers integrity violation 213 * (a file that is already opened for write is opened for read) to the 214 * measurement list and to also emit an audit message. 215 * 216 */ 217 #define IMA_CHANGE_XATTR 0 218 #define IMA_UPDATE_XATTR 1 219 #define IMA_CHANGE_ATTR 2 220 #define IMA_DIGSIG 3 221 #define IMA_MAY_EMIT_TOMTOU 4 222 #define IMA_EMITTED_OPENWRITERS 5 223 224 /* IMA integrity metadata associated with an inode */ 225 struct ima_iint_cache { 226 struct mutex mutex; /* protects: version, flags, digest */ 227 struct integrity_inode_attributes real_inode; 228 unsigned long flags; 229 unsigned long measured_pcrs; 230 unsigned long atomic_flags; 231 enum integrity_status ima_file_status:4; 232 enum integrity_status ima_mmap_status:4; 233 enum integrity_status ima_bprm_status:4; 234 enum integrity_status ima_read_status:4; 235 enum integrity_status ima_creds_status:4; 236 struct ima_digest_data *ima_hash; 237 }; 238 239 extern struct lsm_blob_sizes ima_blob_sizes; 240 241 static inline struct ima_iint_cache * 242 ima_inode_get_iint(const struct inode *inode) 243 { 244 struct ima_iint_cache **iint_sec; 245 246 if (unlikely(!inode->i_security)) 247 return NULL; 248 249 iint_sec = inode->i_security + ima_blob_sizes.lbs_inode; 250 return *iint_sec; 251 } 252 253 static inline void ima_inode_set_iint(const struct inode *inode, 254 struct ima_iint_cache *iint) 255 { 256 struct ima_iint_cache **iint_sec; 257 258 if (unlikely(!inode->i_security)) 259 return; 260 261 iint_sec = inode->i_security + ima_blob_sizes.lbs_inode; 262 *iint_sec = iint; 263 } 264 265 struct ima_iint_cache *ima_iint_find(struct inode *inode); 266 struct ima_iint_cache *ima_inode_get(struct inode *inode); 267 void ima_inode_free_rcu(void *inode_security); 268 void __init ima_iintcache_init(void); 269 270 extern const int read_idmap[]; 271 272 #ifdef CONFIG_HAVE_IMA_KEXEC 273 void ima_load_kexec_buffer(void); 274 #else 275 static inline void ima_load_kexec_buffer(void) {} 276 #endif /* CONFIG_HAVE_IMA_KEXEC */ 277 278 #ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS 279 void ima_post_key_create_or_update(struct key *keyring, struct key *key, 280 const void *payload, size_t plen, 281 unsigned long flags, bool create); 282 #endif 283 284 #ifdef CONFIG_IMA_KEXEC 285 void ima_measure_kexec_event(const char *event_name); 286 #else 287 static inline void ima_measure_kexec_event(const char *event_name) {} 288 #endif 289 290 /* 291 * The default binary_runtime_measurements list format is defined as the 292 * platform native format. The canonical format is defined as little-endian. 293 */ 294 extern bool ima_canonical_fmt; 295 296 /* Internal IMA function definitions */ 297 int ima_init(void); 298 int ima_fs_init(void); 299 int ima_add_template_entry(struct ima_template_entry *entry, int violation, 300 const char *op, struct inode *inode, 301 const unsigned char *filename); 302 int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash); 303 int ima_calc_buffer_hash(const void *buf, loff_t len, 304 struct ima_digest_data *hash); 305 int ima_calc_field_array_hash(struct ima_field_data *field_data, 306 struct ima_template_entry *entry); 307 int ima_calc_boot_aggregate(struct ima_digest_data *hash); 308 void ima_add_violation(struct file *file, const unsigned char *filename, 309 struct ima_iint_cache *iint, const char *op, 310 const char *cause); 311 int ima_init_crypto(void); 312 void ima_putc(struct seq_file *m, void *data, int datalen); 313 void ima_print_digest(struct seq_file *m, u8 *digest, u32 size); 314 int template_desc_init_fields(const char *template_fmt, 315 const struct ima_template_field ***fields, 316 int *num_fields); 317 struct ima_template_desc *ima_template_desc_current(void); 318 struct ima_template_desc *ima_template_desc_buf(void); 319 struct ima_template_desc *lookup_template_desc(const char *name); 320 bool ima_template_has_modsig(const struct ima_template_desc *ima_template); 321 int ima_queue_stage(void); 322 int ima_queue_staged_delete_all(void); 323 int ima_queue_delete_partial(unsigned long req_value); 324 int ima_restore_measurement_entry(struct ima_template_entry *entry); 325 int ima_restore_measurement_list(loff_t bufsize, void *buf); 326 int ima_measurements_show(struct seq_file *m, void *v); 327 int __init ima_init_htable(void); 328 unsigned long ima_get_binary_runtime_size(enum binary_lists binary_list); 329 int ima_init_template(void); 330 void ima_init_template_list(void); 331 int __init ima_init_digests(void); 332 void __init ima_init_reboot_notifier(void); 333 int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event, 334 void *lsm_data); 335 336 /* 337 * used to protect h_table and sha_table 338 */ 339 extern spinlock_t ima_queue_lock; 340 341 /* Total number of measurement list records since hard boot. */ 342 extern atomic_long_t ima_num_records[BINARY__LAST]; 343 /* Total number of violations since hard boot. */ 344 extern atomic_long_t ima_num_violations; 345 extern struct hlist_head __rcu *ima_htable; 346 extern bool ima_flush_htable; 347 348 static inline unsigned int ima_hash_key(u8 *digest) 349 { 350 /* there is no point in taking a hash of part of a digest */ 351 return (digest[0] | digest[1] << 8) % IMA_MEASURE_HTABLE_SIZE; 352 } 353 354 #define __ima_hooks(hook) \ 355 hook(NONE, none) \ 356 hook(FILE_CHECK, file) \ 357 hook(MMAP_CHECK, mmap) \ 358 hook(MMAP_CHECK_REQPROT, mmap_reqprot) \ 359 hook(BPRM_CHECK, bprm) \ 360 hook(CREDS_CHECK, creds) \ 361 hook(POST_SETATTR, post_setattr) \ 362 hook(MODULE_CHECK, module) \ 363 hook(FIRMWARE_CHECK, firmware) \ 364 hook(KEXEC_KERNEL_CHECK, kexec_kernel) \ 365 hook(KEXEC_INITRAMFS_CHECK, kexec_initramfs) \ 366 hook(POLICY_CHECK, policy) \ 367 hook(KEXEC_CMDLINE, kexec_cmdline) \ 368 hook(KEY_CHECK, key) \ 369 hook(CRITICAL_DATA, critical_data) \ 370 hook(SETXATTR_CHECK, setxattr_check) \ 371 hook(MAX_CHECK, none) 372 373 #define __ima_hook_enumify(ENUM, str) ENUM, 374 #define __ima_stringify(arg) (#arg) 375 #define __ima_hook_measuring_stringify(ENUM, str) \ 376 (__ima_stringify(measuring_ ##str)), 377 378 enum ima_hooks { 379 __ima_hooks(__ima_hook_enumify) 380 }; 381 382 static const char * const ima_hooks_measure_str[] = { 383 __ima_hooks(__ima_hook_measuring_stringify) 384 }; 385 386 static inline const char *func_measure_str(enum ima_hooks func) 387 { 388 if (func >= MAX_CHECK) 389 return ima_hooks_measure_str[NONE]; 390 391 return ima_hooks_measure_str[func]; 392 } 393 394 extern const char *const func_tokens[]; 395 396 struct modsig; 397 398 #ifdef CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS 399 /* 400 * To track keys that need to be measured. 401 */ 402 struct ima_key_entry { 403 struct list_head list; 404 void *payload; 405 size_t payload_len; 406 char *keyring_name; 407 }; 408 void ima_init_key_queue(void); 409 bool ima_should_queue_key(void); 410 bool ima_queue_key(struct key *keyring, const void *payload, 411 size_t payload_len); 412 void ima_process_queued_keys(void); 413 #else 414 static inline void ima_init_key_queue(void) {} 415 static inline bool ima_should_queue_key(void) { return false; } 416 static inline bool ima_queue_key(struct key *keyring, 417 const void *payload, 418 size_t payload_len) { return false; } 419 static inline void ima_process_queued_keys(void) {} 420 #endif /* CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS */ 421 422 /* LIM API function definitions */ 423 int ima_get_action(struct mnt_idmap *idmap, struct inode *inode, 424 const struct cred *cred, struct lsm_prop *prop, int mask, 425 enum ima_hooks func, int *pcr, 426 struct ima_template_desc **template_desc, 427 const char *func_data, unsigned int *allowed_algos); 428 int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func); 429 int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file, 430 void *buf, loff_t size, enum hash_algo algo, 431 struct modsig *modsig); 432 void ima_store_measurement(struct ima_iint_cache *iint, struct file *file, 433 const unsigned char *filename, 434 struct evm_ima_xattr_data *xattr_value, 435 int xattr_len, const struct modsig *modsig, int pcr, 436 struct ima_template_desc *template_desc); 437 int process_buffer_measurement(struct mnt_idmap *idmap, 438 struct inode *inode, const void *buf, int size, 439 const char *eventname, enum ima_hooks func, 440 int pcr, const char *func_data, 441 bool buf_hash, u8 *digest, size_t digest_len); 442 void ima_audit_measurement(struct ima_iint_cache *iint, 443 const unsigned char *filename); 444 int ima_alloc_init_template(struct ima_event_data *event_data, 445 struct ima_template_entry **entry, 446 struct ima_template_desc *template_desc); 447 int ima_store_template(struct ima_template_entry *entry, int violation, 448 struct inode *inode, 449 const unsigned char *filename, int pcr); 450 void ima_free_template_entry(struct ima_template_entry *entry); 451 const char *ima_d_path(const struct path *path, char **pathbuf, char *filename); 452 453 /* IMA policy related functions */ 454 int ima_match_policy(struct mnt_idmap *idmap, struct inode *inode, 455 const struct cred *cred, struct lsm_prop *prop, 456 enum ima_hooks func, int mask, int flags, int *pcr, 457 struct ima_template_desc **template_desc, 458 const char *func_data, unsigned int *allowed_algos); 459 void ima_init_policy(void); 460 void ima_update_policy(void); 461 void ima_update_policy_flags(void); 462 ssize_t ima_parse_add_rule(char *); 463 void ima_delete_rules(void); 464 int ima_check_policy(void); 465 void *ima_policy_start(struct seq_file *m, loff_t *pos); 466 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos); 467 void ima_policy_stop(struct seq_file *m, void *v); 468 int ima_policy_show(struct seq_file *m, void *v); 469 470 /* Appraise integrity measurements */ 471 #define IMA_APPRAISE_ENFORCE 0x01 472 #define IMA_APPRAISE_FIX 0x02 473 #define IMA_APPRAISE_LOG 0x04 474 #define IMA_APPRAISE_MODULES 0x08 475 #define IMA_APPRAISE_FIRMWARE 0x10 476 #define IMA_APPRAISE_POLICY 0x20 477 #define IMA_APPRAISE_KEXEC 0x40 478 479 #ifdef CONFIG_IMA_APPRAISE 480 int ima_check_blacklist(struct ima_iint_cache *iint, 481 const struct modsig *modsig, int pcr); 482 int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint, 483 struct file *file, const unsigned char *filename, 484 struct evm_ima_xattr_data *xattr_value, 485 int xattr_len, const struct modsig *modsig, 486 bool bprm_is_check); 487 int ima_must_appraise(struct mnt_idmap *idmap, struct inode *inode, 488 int mask, enum ima_hooks func); 489 void ima_update_xattr(struct ima_iint_cache *iint, struct file *file); 490 enum integrity_status ima_get_cache_status(struct ima_iint_cache *iint, 491 enum ima_hooks func); 492 enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value, 493 int xattr_len); 494 int ima_read_xattr(struct dentry *dentry, 495 struct evm_ima_xattr_data **xattr_value, int xattr_len); 496 void __init init_ima_appraise_lsm(const struct lsm_id *lsmid); 497 498 #else 499 static inline int ima_check_blacklist(struct ima_iint_cache *iint, 500 const struct modsig *modsig, int pcr) 501 { 502 return 0; 503 } 504 505 static inline int ima_appraise_measurement(enum ima_hooks func, 506 struct ima_iint_cache *iint, 507 struct file *file, 508 const unsigned char *filename, 509 struct evm_ima_xattr_data *xattr_value, 510 int xattr_len, 511 const struct modsig *modsig, 512 bool bprm_is_check) 513 { 514 return INTEGRITY_UNKNOWN; 515 } 516 517 static inline int ima_must_appraise(struct mnt_idmap *idmap, 518 struct inode *inode, int mask, 519 enum ima_hooks func) 520 { 521 return 0; 522 } 523 524 static inline void ima_update_xattr(struct ima_iint_cache *iint, 525 struct file *file) 526 { 527 } 528 529 static inline enum integrity_status 530 ima_get_cache_status(struct ima_iint_cache *iint, enum ima_hooks func) 531 { 532 return INTEGRITY_UNKNOWN; 533 } 534 535 static inline enum hash_algo 536 ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len) 537 { 538 return ima_hash_algo; 539 } 540 541 static inline int ima_read_xattr(struct dentry *dentry, 542 struct evm_ima_xattr_data **xattr_value, 543 int xattr_len) 544 { 545 return 0; 546 } 547 548 static inline void __init init_ima_appraise_lsm(const struct lsm_id *lsmid) 549 { 550 } 551 552 #endif /* CONFIG_IMA_APPRAISE */ 553 554 #ifdef CONFIG_IMA_APPRAISE_MODSIG 555 int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len, 556 struct modsig **modsig); 557 void ima_collect_modsig(struct modsig *modsig, const void *buf, loff_t size); 558 int ima_get_modsig_digest(const struct modsig *modsig, enum hash_algo *algo, 559 const u8 **digest, u32 *digest_size); 560 int ima_get_raw_modsig(const struct modsig *modsig, const void **data, 561 u32 *data_len); 562 void ima_free_modsig(struct modsig *modsig); 563 #else 564 static inline int ima_read_modsig(enum ima_hooks func, const void *buf, 565 loff_t buf_len, struct modsig **modsig) 566 { 567 return -EOPNOTSUPP; 568 } 569 570 static inline void ima_collect_modsig(struct modsig *modsig, const void *buf, 571 loff_t size) 572 { 573 } 574 575 static inline int ima_get_modsig_digest(const struct modsig *modsig, 576 enum hash_algo *algo, const u8 **digest, 577 u32 *digest_size) 578 { 579 return -EOPNOTSUPP; 580 } 581 582 static inline int ima_get_raw_modsig(const struct modsig *modsig, 583 const void **data, u32 *data_len) 584 { 585 return -EOPNOTSUPP; 586 } 587 588 static inline void ima_free_modsig(struct modsig *modsig) 589 { 590 } 591 #endif /* CONFIG_IMA_APPRAISE_MODSIG */ 592 593 /* LSM based policy rules require audit */ 594 #ifdef CONFIG_IMA_LSM_RULES 595 596 #define ima_filter_rule_init security_audit_rule_init 597 #define ima_filter_rule_free security_audit_rule_free 598 #define ima_filter_rule_match security_audit_rule_match 599 600 #else 601 602 static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr, 603 void **lsmrule, gfp_t gfp) 604 { 605 return -EINVAL; 606 } 607 608 static inline void ima_filter_rule_free(void *lsmrule) 609 { 610 } 611 612 static inline int ima_filter_rule_match(struct lsm_prop *prop, u32 field, u32 op, 613 void *lsmrule) 614 { 615 return -EINVAL; 616 } 617 #endif /* CONFIG_IMA_LSM_RULES */ 618 619 #ifdef CONFIG_IMA_READ_POLICY 620 #define POLICY_FILE_FLAGS (S_IWUSR | S_IRUSR) 621 #else 622 #define POLICY_FILE_FLAGS S_IWUSR 623 #endif /* CONFIG_IMA_READ_POLICY */ 624 625 #endif /* __LINUX_IMA_H */ 626