1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
4 *
5 * Authors:
6 * Kylene Hall <kjhall@us.ibm.com>
7 * Reiner Sailer <sailer@us.ibm.com>
8 * Mimi Zohar <zohar@us.ibm.com>
9 *
10 * File: ima_fs.c
11 * implemenents security file system for reporting
12 * current measurement list and IMA statistics
13 */
14
15 #include <linux/fcntl.h>
16 #include <linux/kernel_read_file.h>
17 #include <linux/slab.h>
18 #include <linux/init.h>
19 #include <linux/seq_file.h>
20 #include <linux/rculist.h>
21 #include <linux/rcupdate.h>
22 #include <linux/parser.h>
23 #include <linux/vmalloc.h>
24
25 #include "ima.h"
26
27 static DEFINE_MUTEX(ima_write_mutex);
28
29 bool ima_canonical_fmt;
default_canonical_fmt_setup(char * str)30 static int __init default_canonical_fmt_setup(char *str)
31 {
32 #ifdef __BIG_ENDIAN
33 ima_canonical_fmt = true;
34 #endif
35 return 1;
36 }
37 __setup("ima_canonical_fmt", default_canonical_fmt_setup);
38
39 static int valid_policy = 1;
40
ima_show_htable_value(char __user * buf,size_t count,loff_t * ppos,atomic_long_t * val)41 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
42 loff_t *ppos, atomic_long_t *val)
43 {
44 char tmpbuf[32]; /* greater than largest 'long' string value */
45 ssize_t len;
46
47 len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val));
48 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
49 }
50
ima_show_htable_violations(struct file * filp,char __user * buf,size_t count,loff_t * ppos)51 static ssize_t ima_show_htable_violations(struct file *filp,
52 char __user *buf,
53 size_t count, loff_t *ppos)
54 {
55 return ima_show_htable_value(buf, count, ppos, &ima_htable.violations);
56 }
57
58 static const struct file_operations ima_htable_violations_ops = {
59 .read = ima_show_htable_violations,
60 .llseek = generic_file_llseek,
61 };
62
ima_show_measurements_count(struct file * filp,char __user * buf,size_t count,loff_t * ppos)63 static ssize_t ima_show_measurements_count(struct file *filp,
64 char __user *buf,
65 size_t count, loff_t *ppos)
66 {
67 return ima_show_htable_value(buf, count, ppos, &ima_htable.len);
68
69 }
70
71 static const struct file_operations ima_measurements_count_ops = {
72 .read = ima_show_measurements_count,
73 .llseek = generic_file_llseek,
74 };
75
76 /* returns pointer to hlist_node */
ima_measurements_start(struct seq_file * m,loff_t * pos)77 static void *ima_measurements_start(struct seq_file *m, loff_t *pos)
78 {
79 loff_t l = *pos;
80 struct ima_queue_entry *qe;
81
82 /* we need a lock since pos could point beyond last element */
83 rcu_read_lock();
84 list_for_each_entry_rcu(qe, &ima_measurements, later) {
85 if (!l--) {
86 rcu_read_unlock();
87 return qe;
88 }
89 }
90 rcu_read_unlock();
91 return NULL;
92 }
93
ima_measurements_next(struct seq_file * m,void * v,loff_t * pos)94 static void *ima_measurements_next(struct seq_file *m, void *v, loff_t *pos)
95 {
96 struct ima_queue_entry *qe = v;
97
98 /* lock protects when reading beyond last element
99 * against concurrent list-extension
100 */
101 rcu_read_lock();
102 qe = list_entry_rcu(qe->later.next, struct ima_queue_entry, later);
103 rcu_read_unlock();
104 (*pos)++;
105
106 return (&qe->later == &ima_measurements) ? NULL : qe;
107 }
108
ima_measurements_stop(struct seq_file * m,void * v)109 static void ima_measurements_stop(struct seq_file *m, void *v)
110 {
111 }
112
ima_putc(struct seq_file * m,void * data,int datalen)113 void ima_putc(struct seq_file *m, void *data, int datalen)
114 {
115 while (datalen--)
116 seq_putc(m, *(char *)data++);
117 }
118
119 static struct dentry **ascii_securityfs_measurement_lists __ro_after_init;
120 static struct dentry **binary_securityfs_measurement_lists __ro_after_init;
121 static int securityfs_measurement_list_count __ro_after_init;
122
lookup_template_data_hash_algo(int * algo_idx,enum hash_algo * algo,struct seq_file * m,struct dentry ** lists)123 static void lookup_template_data_hash_algo(int *algo_idx, enum hash_algo *algo,
124 struct seq_file *m,
125 struct dentry **lists)
126 {
127 struct dentry *dentry;
128 int i;
129
130 dentry = file_dentry(m->file);
131
132 for (i = 0; i < securityfs_measurement_list_count; i++) {
133 if (dentry == lists[i]) {
134 *algo_idx = i;
135 *algo = ima_algo_array[i].algo;
136 break;
137 }
138 }
139 }
140
141 /* print format:
142 * 32bit-le=pcr#
143 * char[n]=template digest
144 * 32bit-le=template name size
145 * char[n]=template name
146 * [eventdata length]
147 * eventdata[n]=template specific data
148 */
ima_measurements_show(struct seq_file * m,void * v)149 int ima_measurements_show(struct seq_file *m, void *v)
150 {
151 /* the list never shrinks, so we don't need a lock here */
152 struct ima_queue_entry *qe = v;
153 struct ima_template_entry *e;
154 char *template_name;
155 u32 pcr, namelen, template_data_len; /* temporary fields */
156 bool is_ima_template = false;
157 enum hash_algo algo;
158 int i, algo_idx;
159
160 algo_idx = ima_sha1_idx;
161 algo = HASH_ALGO_SHA1;
162
163 if (m->file != NULL)
164 lookup_template_data_hash_algo(&algo_idx, &algo, m,
165 binary_securityfs_measurement_lists);
166
167 /* get entry */
168 e = qe->entry;
169 if (e == NULL)
170 return -1;
171
172 template_name = (e->template_desc->name[0] != '\0') ?
173 e->template_desc->name : e->template_desc->fmt;
174
175 /*
176 * 1st: PCRIndex
177 * PCR used defaults to the same (config option) in
178 * little-endian format, unless set in policy
179 */
180 pcr = !ima_canonical_fmt ? e->pcr : (__force u32)cpu_to_le32(e->pcr);
181 ima_putc(m, &pcr, sizeof(e->pcr));
182
183 /* 2nd: template digest */
184 ima_putc(m, e->digests[algo_idx].digest, hash_digest_size[algo]);
185
186 /* 3rd: template name size */
187 namelen = !ima_canonical_fmt ? strlen(template_name) :
188 (__force u32)cpu_to_le32(strlen(template_name));
189 ima_putc(m, &namelen, sizeof(namelen));
190
191 /* 4th: template name */
192 ima_putc(m, template_name, strlen(template_name));
193
194 /* 5th: template length (except for 'ima' template) */
195 if (strcmp(template_name, IMA_TEMPLATE_IMA_NAME) == 0)
196 is_ima_template = true;
197
198 if (!is_ima_template) {
199 template_data_len = !ima_canonical_fmt ? e->template_data_len :
200 (__force u32)cpu_to_le32(e->template_data_len);
201 ima_putc(m, &template_data_len, sizeof(e->template_data_len));
202 }
203
204 /* 6th: template specific data */
205 for (i = 0; i < e->template_desc->num_fields; i++) {
206 enum ima_show_type show = IMA_SHOW_BINARY;
207 const struct ima_template_field *field =
208 e->template_desc->fields[i];
209
210 if (is_ima_template && strcmp(field->field_id, "d") == 0)
211 show = IMA_SHOW_BINARY_NO_FIELD_LEN;
212 if (is_ima_template && strcmp(field->field_id, "n") == 0)
213 show = IMA_SHOW_BINARY_OLD_STRING_FMT;
214 field->field_show(m, show, &e->template_data[i]);
215 }
216 return 0;
217 }
218
219 static const struct seq_operations ima_measurments_seqops = {
220 .start = ima_measurements_start,
221 .next = ima_measurements_next,
222 .stop = ima_measurements_stop,
223 .show = ima_measurements_show
224 };
225
ima_measurements_open(struct inode * inode,struct file * file)226 static int ima_measurements_open(struct inode *inode, struct file *file)
227 {
228 return seq_open(file, &ima_measurments_seqops);
229 }
230
231 static const struct file_operations ima_measurements_ops = {
232 .open = ima_measurements_open,
233 .read = seq_read,
234 .llseek = seq_lseek,
235 .release = seq_release,
236 };
237
ima_print_digest(struct seq_file * m,u8 * digest,u32 size)238 void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
239 {
240 u32 i;
241
242 for (i = 0; i < size; i++)
243 seq_printf(m, "%02x", *(digest + i));
244 }
245
246 /* print in ascii */
ima_ascii_measurements_show(struct seq_file * m,void * v)247 static int ima_ascii_measurements_show(struct seq_file *m, void *v)
248 {
249 /* the list never shrinks, so we don't need a lock here */
250 struct ima_queue_entry *qe = v;
251 struct ima_template_entry *e;
252 char *template_name;
253 enum hash_algo algo;
254 int i, algo_idx;
255
256 algo_idx = ima_sha1_idx;
257 algo = HASH_ALGO_SHA1;
258
259 if (m->file != NULL)
260 lookup_template_data_hash_algo(&algo_idx, &algo, m,
261 ascii_securityfs_measurement_lists);
262
263 /* get entry */
264 e = qe->entry;
265 if (e == NULL)
266 return -1;
267
268 template_name = (e->template_desc->name[0] != '\0') ?
269 e->template_desc->name : e->template_desc->fmt;
270
271 /* 1st: PCR used (config option) */
272 seq_printf(m, "%2d ", e->pcr);
273
274 /* 2nd: template hash */
275 ima_print_digest(m, e->digests[algo_idx].digest, hash_digest_size[algo]);
276
277 /* 3th: template name */
278 seq_printf(m, " %s", template_name);
279
280 /* 4th: template specific data */
281 for (i = 0; i < e->template_desc->num_fields; i++) {
282 seq_puts(m, " ");
283 if (e->template_data[i].len == 0)
284 continue;
285
286 e->template_desc->fields[i]->field_show(m, IMA_SHOW_ASCII,
287 &e->template_data[i]);
288 }
289 seq_puts(m, "\n");
290 return 0;
291 }
292
293 static const struct seq_operations ima_ascii_measurements_seqops = {
294 .start = ima_measurements_start,
295 .next = ima_measurements_next,
296 .stop = ima_measurements_stop,
297 .show = ima_ascii_measurements_show
298 };
299
ima_ascii_measurements_open(struct inode * inode,struct file * file)300 static int ima_ascii_measurements_open(struct inode *inode, struct file *file)
301 {
302 return seq_open(file, &ima_ascii_measurements_seqops);
303 }
304
305 static const struct file_operations ima_ascii_measurements_ops = {
306 .open = ima_ascii_measurements_open,
307 .read = seq_read,
308 .llseek = seq_lseek,
309 .release = seq_release,
310 };
311
ima_read_policy(char * path)312 static ssize_t ima_read_policy(char *path)
313 {
314 void *data = NULL;
315 char *datap;
316 size_t size;
317 int rc, pathlen = strlen(path);
318
319 char *p;
320
321 /* remove \n */
322 datap = path;
323 strsep(&datap, "\n");
324
325 rc = kernel_read_file_from_path(path, 0, &data, INT_MAX, NULL,
326 READING_POLICY);
327 if (rc < 0) {
328 pr_err("Unable to open file: %s (%d)", path, rc);
329 return rc;
330 }
331 size = rc;
332 rc = 0;
333
334 datap = data;
335 while (size > 0 && (p = strsep(&datap, "\n"))) {
336 pr_debug("rule: %s\n", p);
337 rc = ima_parse_add_rule(p);
338 if (rc < 0)
339 break;
340 size -= rc;
341 }
342
343 vfree(data);
344 if (rc < 0)
345 return rc;
346 else if (size)
347 return -EINVAL;
348 else
349 return pathlen;
350 }
351
ima_write_policy(struct file * file,const char __user * buf,size_t datalen,loff_t * ppos)352 static ssize_t ima_write_policy(struct file *file, const char __user *buf,
353 size_t datalen, loff_t *ppos)
354 {
355 char *data;
356 ssize_t result;
357
358 if (datalen >= PAGE_SIZE)
359 datalen = PAGE_SIZE - 1;
360
361 /* No partial writes. */
362 result = -EINVAL;
363 if (*ppos != 0)
364 goto out;
365
366 data = memdup_user_nul(buf, datalen);
367 if (IS_ERR(data)) {
368 result = PTR_ERR(data);
369 goto out;
370 }
371
372 result = mutex_lock_interruptible(&ima_write_mutex);
373 if (result < 0)
374 goto out_free;
375
376 if (data[0] == '/') {
377 result = ima_read_policy(data);
378 } else if (ima_appraise & IMA_APPRAISE_POLICY) {
379 pr_err("signed policy file (specified as an absolute pathname) required\n");
380 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
381 "policy_update", "signed policy required",
382 1, 0);
383 result = -EACCES;
384 } else {
385 result = ima_parse_add_rule(data);
386 }
387 mutex_unlock(&ima_write_mutex);
388 out_free:
389 kfree(data);
390 out:
391 if (result < 0)
392 valid_policy = 0;
393
394 return result;
395 }
396
397 static struct dentry *ima_dir;
398 static struct dentry *ima_symlink;
399 static struct dentry *binary_runtime_measurements;
400 static struct dentry *ascii_runtime_measurements;
401 static struct dentry *runtime_measurements_count;
402 static struct dentry *violations;
403 static struct dentry *ima_policy;
404
405 enum ima_fs_flags {
406 IMA_FS_BUSY,
407 };
408
409 static unsigned long ima_fs_flags;
410
411 #ifdef CONFIG_IMA_READ_POLICY
412 static const struct seq_operations ima_policy_seqops = {
413 .start = ima_policy_start,
414 .next = ima_policy_next,
415 .stop = ima_policy_stop,
416 .show = ima_policy_show,
417 };
418 #endif
419
remove_securityfs_measurement_lists(struct dentry ** lists)420 static void __init remove_securityfs_measurement_lists(struct dentry **lists)
421 {
422 int i;
423
424 if (lists) {
425 for (i = 0; i < securityfs_measurement_list_count; i++)
426 securityfs_remove(lists[i]);
427
428 kfree(lists);
429 }
430 }
431
create_securityfs_measurement_lists(void)432 static int __init create_securityfs_measurement_lists(void)
433 {
434 char file_name[NAME_MAX + 1];
435 struct dentry *dentry;
436 u16 algo;
437 int i;
438
439 securityfs_measurement_list_count = NR_BANKS(ima_tpm_chip);
440
441 if (ima_sha1_idx >= NR_BANKS(ima_tpm_chip))
442 securityfs_measurement_list_count++;
443
444 ascii_securityfs_measurement_lists =
445 kcalloc(securityfs_measurement_list_count, sizeof(struct dentry *),
446 GFP_KERNEL);
447 if (!ascii_securityfs_measurement_lists)
448 return -ENOMEM;
449
450 binary_securityfs_measurement_lists =
451 kcalloc(securityfs_measurement_list_count, sizeof(struct dentry *),
452 GFP_KERNEL);
453 if (!binary_securityfs_measurement_lists)
454 return -ENOMEM;
455
456 for (i = 0; i < securityfs_measurement_list_count; i++) {
457 algo = ima_algo_array[i].algo;
458
459 sprintf(file_name, "ascii_runtime_measurements_%s",
460 hash_algo_name[algo]);
461 dentry = securityfs_create_file(file_name, S_IRUSR | S_IRGRP,
462 ima_dir, NULL,
463 &ima_ascii_measurements_ops);
464 if (IS_ERR(dentry))
465 return PTR_ERR(dentry);
466
467 ascii_securityfs_measurement_lists[i] = dentry;
468
469 sprintf(file_name, "binary_runtime_measurements_%s",
470 hash_algo_name[algo]);
471 dentry = securityfs_create_file(file_name, S_IRUSR | S_IRGRP,
472 ima_dir, NULL,
473 &ima_measurements_ops);
474 if (IS_ERR(dentry))
475 return PTR_ERR(dentry);
476
477 binary_securityfs_measurement_lists[i] = dentry;
478 }
479
480 return 0;
481 }
482
483 /*
484 * ima_open_policy: sequentialize access to the policy file
485 */
ima_open_policy(struct inode * inode,struct file * filp)486 static int ima_open_policy(struct inode *inode, struct file *filp)
487 {
488 if (!(filp->f_flags & O_WRONLY)) {
489 #ifndef CONFIG_IMA_READ_POLICY
490 return -EACCES;
491 #else
492 if ((filp->f_flags & O_ACCMODE) != O_RDONLY)
493 return -EACCES;
494 if (!capable(CAP_SYS_ADMIN))
495 return -EPERM;
496 return seq_open(filp, &ima_policy_seqops);
497 #endif
498 }
499 if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags))
500 return -EBUSY;
501 return 0;
502 }
503
504 /*
505 * ima_release_policy - start using the new measure policy rules.
506 *
507 * Initially, ima_measure points to the default policy rules, now
508 * point to the new policy rules, and remove the securityfs policy file,
509 * assuming a valid policy.
510 */
ima_release_policy(struct inode * inode,struct file * file)511 static int ima_release_policy(struct inode *inode, struct file *file)
512 {
513 const char *cause = valid_policy ? "completed" : "failed";
514
515 if ((file->f_flags & O_ACCMODE) == O_RDONLY)
516 return seq_release(inode, file);
517
518 if (valid_policy && ima_check_policy() < 0) {
519 cause = "failed";
520 valid_policy = 0;
521 }
522
523 pr_info("policy update %s\n", cause);
524 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
525 "policy_update", cause, !valid_policy, 0);
526
527 if (!valid_policy) {
528 ima_delete_rules();
529 valid_policy = 1;
530 clear_bit(IMA_FS_BUSY, &ima_fs_flags);
531 return 0;
532 }
533
534 ima_update_policy();
535 #if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY)
536 securityfs_remove(ima_policy);
537 ima_policy = NULL;
538 #elif defined(CONFIG_IMA_WRITE_POLICY)
539 clear_bit(IMA_FS_BUSY, &ima_fs_flags);
540 #elif defined(CONFIG_IMA_READ_POLICY)
541 inode->i_mode &= ~S_IWUSR;
542 #endif
543 return 0;
544 }
545
546 static const struct file_operations ima_measure_policy_ops = {
547 .open = ima_open_policy,
548 .write = ima_write_policy,
549 .read = seq_read,
550 .release = ima_release_policy,
551 .llseek = generic_file_llseek,
552 };
553
ima_fs_init(void)554 int __init ima_fs_init(void)
555 {
556 int ret;
557
558 ascii_securityfs_measurement_lists = NULL;
559 binary_securityfs_measurement_lists = NULL;
560
561 ima_dir = securityfs_create_dir("ima", integrity_dir);
562 if (IS_ERR(ima_dir))
563 return PTR_ERR(ima_dir);
564
565 ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima",
566 NULL);
567 if (IS_ERR(ima_symlink)) {
568 ret = PTR_ERR(ima_symlink);
569 goto out;
570 }
571
572 ret = create_securityfs_measurement_lists();
573 if (ret != 0)
574 goto out;
575
576 binary_runtime_measurements =
577 securityfs_create_symlink("binary_runtime_measurements", ima_dir,
578 "binary_runtime_measurements_sha1", NULL);
579 if (IS_ERR(binary_runtime_measurements)) {
580 ret = PTR_ERR(binary_runtime_measurements);
581 goto out;
582 }
583
584 ascii_runtime_measurements =
585 securityfs_create_symlink("ascii_runtime_measurements", ima_dir,
586 "ascii_runtime_measurements_sha1", NULL);
587 if (IS_ERR(ascii_runtime_measurements)) {
588 ret = PTR_ERR(ascii_runtime_measurements);
589 goto out;
590 }
591
592 runtime_measurements_count =
593 securityfs_create_file("runtime_measurements_count",
594 S_IRUSR | S_IRGRP, ima_dir, NULL,
595 &ima_measurements_count_ops);
596 if (IS_ERR(runtime_measurements_count)) {
597 ret = PTR_ERR(runtime_measurements_count);
598 goto out;
599 }
600
601 violations =
602 securityfs_create_file("violations", S_IRUSR | S_IRGRP,
603 ima_dir, NULL, &ima_htable_violations_ops);
604 if (IS_ERR(violations)) {
605 ret = PTR_ERR(violations);
606 goto out;
607 }
608
609 ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS,
610 ima_dir, NULL,
611 &ima_measure_policy_ops);
612 if (IS_ERR(ima_policy)) {
613 ret = PTR_ERR(ima_policy);
614 goto out;
615 }
616
617 return 0;
618 out:
619 securityfs_remove(ima_policy);
620 securityfs_remove(violations);
621 securityfs_remove(runtime_measurements_count);
622 securityfs_remove(ascii_runtime_measurements);
623 securityfs_remove(binary_runtime_measurements);
624 remove_securityfs_measurement_lists(ascii_securityfs_measurement_lists);
625 remove_securityfs_measurement_lists(binary_securityfs_measurement_lists);
626 securityfs_measurement_list_count = 0;
627 securityfs_remove(ima_symlink);
628 securityfs_remove(ima_dir);
629
630 return ret;
631 }
632