xref: /linux/security/integrity/ima/ima_api.c (revision c34e9ab9a612ee8b18273398ef75c207b01f516d)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2008 IBM Corporation
4  *
5  * Author: Mimi Zohar <zohar@us.ibm.com>
6  *
7  * File: ima_api.c
8  *	Implements must_appraise_or_measure, collect_measurement,
9  *	appraise_measurement, store_measurement and store_template.
10  */
11 #include <linux/slab.h>
12 #include <linux/file.h>
13 #include <linux/fs.h>
14 #include <linux/xattr.h>
15 #include <linux/evm.h>
16 #include <linux/fsverity.h>
17 
18 #include "ima.h"
19 
20 /*
21  * ima_free_template_entry - free an existing template entry
22  */
23 void ima_free_template_entry(struct ima_template_entry *entry)
24 {
25 	int i;
26 
27 	for (i = 0; i < entry->template_desc->num_fields; i++)
28 		kfree(entry->template_data[i].data);
29 
30 	kfree(entry->digests);
31 	kfree(entry);
32 }
33 
34 /*
35  * ima_alloc_init_template - create and initialize a new template entry
36  */
37 int ima_alloc_init_template(struct ima_event_data *event_data,
38 			    struct ima_template_entry **entry,
39 			    struct ima_template_desc *desc)
40 {
41 	struct ima_template_desc *template_desc;
42 	struct tpm_digest *digests;
43 	int i, result = 0;
44 
45 	if (desc)
46 		template_desc = desc;
47 	else
48 		template_desc = ima_template_desc_current();
49 
50 	*entry = kzalloc(struct_size(*entry, template_data,
51 				     template_desc->num_fields), GFP_NOFS);
52 	if (!*entry)
53 		return -ENOMEM;
54 
55 	digests = kcalloc(NR_BANKS(ima_tpm_chip) + ima_extra_slots,
56 			  sizeof(*digests), GFP_NOFS);
57 	if (!digests) {
58 		kfree(*entry);
59 		*entry = NULL;
60 		return -ENOMEM;
61 	}
62 
63 	(*entry)->digests = digests;
64 	(*entry)->template_desc = template_desc;
65 	for (i = 0; i < template_desc->num_fields; i++) {
66 		const struct ima_template_field *field =
67 			template_desc->fields[i];
68 		u32 len;
69 
70 		result = field->field_init(event_data,
71 					   &((*entry)->template_data[i]));
72 		if (result != 0)
73 			goto out;
74 
75 		len = (*entry)->template_data[i].len;
76 		(*entry)->template_data_len += sizeof(len);
77 		(*entry)->template_data_len += len;
78 	}
79 	return 0;
80 out:
81 	ima_free_template_entry(*entry);
82 	*entry = NULL;
83 	return result;
84 }
85 
86 /*
87  * ima_store_template - store ima template measurements
88  *
89  * Calculate the hash of a template entry, add the template entry
90  * to an ordered list of measurement entries maintained inside the kernel,
91  * and also update the aggregate integrity value (maintained inside the
92  * configured TPM PCR) over the hashes of the current list of measurement
93  * entries.
94  *
95  * Applications retrieve the current kernel-held measurement list through
96  * the securityfs entries in /sys/kernel/security/ima. The signed aggregate
97  * TPM PCR (called quote) can be retrieved using a TPM user space library
98  * and is used to validate the measurement list.
99  *
100  * Returns 0 on success, error code otherwise
101  */
102 int ima_store_template(struct ima_template_entry *entry,
103 		       int violation, struct inode *inode,
104 		       const unsigned char *filename, int pcr)
105 {
106 	static const char op[] = "add_template_measure";
107 	static const char audit_cause[] = "hashing_error";
108 	char *template_name = entry->template_desc->name;
109 	int result;
110 
111 	if (!violation) {
112 		result = ima_calc_field_array_hash(&entry->template_data[0],
113 						   entry);
114 		if (result < 0) {
115 			integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
116 					    template_name, op,
117 					    audit_cause, result, 0);
118 			return result;
119 		}
120 	}
121 	entry->pcr = pcr;
122 	result = ima_add_template_entry(entry, violation, op, inode, filename);
123 	return result;
124 }
125 
126 /*
127  * ima_add_violation - add violation to measurement list.
128  *
129  * Violations are flagged in the measurement list with zero hash values.
130  * By extending the PCR with 0xFF's instead of with zeroes, the PCR
131  * value is invalidated.
132  */
133 void ima_add_violation(struct file *file, const unsigned char *filename,
134 		       struct ima_iint_cache *iint, const char *op,
135 		       const char *cause)
136 {
137 	struct ima_template_entry *entry;
138 	struct inode *inode = file_inode(file);
139 	struct ima_event_data event_data = { .iint = iint,
140 					     .file = file,
141 					     .filename = filename,
142 					     .violation = cause };
143 	int violation = 1;
144 	int result;
145 
146 	/* can overflow, only indicator */
147 	atomic_long_inc(&ima_htable.violations);
148 
149 	result = ima_alloc_init_template(&event_data, &entry, NULL);
150 	if (result < 0) {
151 		result = -ENOMEM;
152 		goto err_out;
153 	}
154 	result = ima_store_template(entry, violation, inode,
155 				    filename, CONFIG_IMA_MEASURE_PCR_IDX);
156 	if (result < 0)
157 		ima_free_template_entry(entry);
158 err_out:
159 	integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
160 			    op, cause, result, 0);
161 }
162 
163 /**
164  * ima_get_action - appraise & measure decision based on policy.
165  * @idmap: idmap of the mount the inode was found from
166  * @inode: pointer to the inode associated with the object being validated
167  * @cred: pointer to credentials structure to validate
168  * @prop: properties of the task being validated
169  * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
170  *        MAY_APPEND)
171  * @func: caller identifier
172  * @pcr: pointer filled in if matched measure policy sets pcr=
173  * @template_desc: pointer filled in if matched measure policy sets template=
174  * @func_data: func specific data, may be NULL
175  * @allowed_algos: allowlist of hash algorithms for the IMA xattr
176  *
177  * The policy is defined in terms of keypairs:
178  *		subj=, obj=, type=, func=, mask=, fsmagic=
179  *	subj,obj, and type: are LSM specific.
180  *	func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK
181  *	| KEXEC_CMDLINE | KEY_CHECK | CRITICAL_DATA | SETXATTR_CHECK
182  *	| MMAP_CHECK_REQPROT
183  *	mask: contains the permission mask
184  *	fsmagic: hex value
185  *
186  * Returns IMA_MEASURE, IMA_APPRAISE mask.
187  *
188  */
189 int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
190 		   const struct cred *cred, struct lsm_prop *prop, int mask,
191 		   enum ima_hooks func, int *pcr,
192 		   struct ima_template_desc **template_desc,
193 		   const char *func_data, unsigned int *allowed_algos)
194 {
195 	int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
196 
197 	flags &= ima_policy_flag;
198 
199 	return ima_match_policy(idmap, inode, cred, prop, func, mask,
200 				flags, pcr, template_desc, func_data,
201 				allowed_algos);
202 }
203 
204 static bool ima_get_verity_digest(struct ima_iint_cache *iint,
205 				  struct inode *inode,
206 				  struct ima_max_digest_data *hash)
207 {
208 	enum hash_algo alg;
209 	int digest_len;
210 
211 	/*
212 	 * On failure, 'measure' policy rules will result in a file data
213 	 * hash containing 0's.
214 	 */
215 	digest_len = fsverity_get_digest(inode, hash->digest, NULL, &alg);
216 	if (digest_len == 0)
217 		return false;
218 
219 	/*
220 	 * Unlike in the case of actually calculating the file hash, in
221 	 * the fsverity case regardless of the hash algorithm, return
222 	 * the verity digest to be included in the measurement list. A
223 	 * mismatch between the verity algorithm and the xattr signature
224 	 * algorithm, if one exists, will be detected later.
225 	 */
226 	hash->hdr.algo = alg;
227 	hash->hdr.length = digest_len;
228 	return true;
229 }
230 
231 /*
232  * ima_collect_measurement - collect file measurement
233  *
234  * Calculate the file hash, if it doesn't already exist,
235  * storing the measurement and i_version in the iint.
236  *
237  * Must be called with iint->mutex held.
238  *
239  * Return 0 on success, error code otherwise
240  */
241 int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
242 			    void *buf, loff_t size, enum hash_algo algo,
243 			    struct modsig *modsig)
244 {
245 	const char *audit_cause = "failed";
246 	struct inode *inode = file_inode(file);
247 	struct inode *real_inode = d_real_inode(file_dentry(file));
248 	struct ima_max_digest_data hash;
249 	struct ima_digest_data *hash_hdr = container_of(&hash.hdr,
250 						struct ima_digest_data, hdr);
251 	struct name_snapshot filename;
252 	struct kstat stat;
253 	int result = 0;
254 	int length;
255 	void *tmpbuf;
256 	u64 i_version = 0;
257 
258 	/*
259 	 * Always collect the modsig, because IMA might have already collected
260 	 * the file digest without collecting the modsig in a previous
261 	 * measurement rule.
262 	 */
263 	if (modsig)
264 		ima_collect_modsig(modsig, buf, size);
265 
266 	if (iint->flags & IMA_COLLECTED)
267 		goto out;
268 
269 	/*
270 	 * Detecting file change is based on i_version. On filesystems
271 	 * which do not support i_version, support was originally limited
272 	 * to an initial measurement/appraisal/audit, but was modified to
273 	 * assume the file changed.
274 	 */
275 	result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE,
276 				   AT_STATX_SYNC_AS_STAT);
277 	if (!result && (stat.result_mask & STATX_CHANGE_COOKIE))
278 		i_version = stat.change_cookie;
279 	hash.hdr.algo = algo;
280 	hash.hdr.length = hash_digest_size[algo];
281 
282 	/* Initialize hash digest to 0's in case of failure */
283 	memset(&hash.digest, 0, sizeof(hash.digest));
284 
285 	if (iint->flags & IMA_VERITY_REQUIRED) {
286 		if (!ima_get_verity_digest(iint, inode, &hash)) {
287 			audit_cause = "no-verity-digest";
288 			result = -ENODATA;
289 		}
290 	} else if (buf) {
291 		result = ima_calc_buffer_hash(buf, size, hash_hdr);
292 	} else {
293 		result = ima_calc_file_hash(file, hash_hdr);
294 	}
295 
296 	if (result && result != -EBADF && result != -EINVAL)
297 		goto out;
298 
299 	length = sizeof(hash.hdr) + hash.hdr.length;
300 	tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS);
301 	if (!tmpbuf) {
302 		result = -ENOMEM;
303 		goto out;
304 	}
305 
306 	iint->ima_hash = tmpbuf;
307 	memcpy(iint->ima_hash, &hash, length);
308 	if (real_inode == inode)
309 		iint->real_inode.version = i_version;
310 	else
311 		integrity_inode_attrs_store(&iint->real_inode, i_version,
312 					    real_inode);
313 
314 	/* Possibly temporary failure due to type of read (eg. O_DIRECT) */
315 	if (!result)
316 		iint->flags |= IMA_COLLECTED;
317 out:
318 	if (result) {
319 		if (file->f_flags & O_DIRECT)
320 			audit_cause = "failed(directio)";
321 
322 		take_dentry_name_snapshot(&filename, file->f_path.dentry);
323 
324 		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
325 				    filename.name.name, "collect_data",
326 				    audit_cause, result, 0);
327 
328 		release_dentry_name_snapshot(&filename);
329 	}
330 	return result;
331 }
332 
333 /*
334  * ima_store_measurement - store file measurement
335  *
336  * Create an "ima" template and then store the template by calling
337  * ima_store_template.
338  *
339  * We only get here if the inode has not already been measured,
340  * but the measurement could already exist:
341  *	- multiple copies of the same file on either the same or
342  *	  different filesystems.
343  *	- the inode was previously flushed as well as the iint info,
344  *	  containing the hashing info.
345  *
346  * Must be called with iint->mutex held.
347  */
348 void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
349 			   const unsigned char *filename,
350 			   struct evm_ima_xattr_data *xattr_value,
351 			   int xattr_len, const struct modsig *modsig, int pcr,
352 			   struct ima_template_desc *template_desc)
353 {
354 	static const char op[] = "add_template_measure";
355 	static const char audit_cause[] = "ENOMEM";
356 	int result = -ENOMEM;
357 	struct inode *inode = file_inode(file);
358 	struct ima_template_entry *entry;
359 	struct ima_event_data event_data = { .iint = iint,
360 					     .file = file,
361 					     .filename = filename,
362 					     .xattr_value = xattr_value,
363 					     .xattr_len = xattr_len,
364 					     .modsig = modsig };
365 	int violation = 0;
366 
367 	/*
368 	 * We still need to store the measurement in the case of MODSIG because
369 	 * we only have its contents to put in the list at the time of
370 	 * appraisal, but a file measurement from earlier might already exist in
371 	 * the measurement list.
372 	 */
373 	if (iint->measured_pcrs & (0x1 << pcr) && !modsig)
374 		return;
375 
376 	result = ima_alloc_init_template(&event_data, &entry, template_desc);
377 	if (result < 0) {
378 		integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
379 				    op, audit_cause, result, 0);
380 		return;
381 	}
382 
383 	result = ima_store_template(entry, violation, inode, filename, pcr);
384 	if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {
385 		iint->flags |= IMA_MEASURED;
386 		iint->measured_pcrs |= (0x1 << pcr);
387 	}
388 	if (result < 0)
389 		ima_free_template_entry(entry);
390 }
391 
392 void ima_audit_measurement(struct ima_iint_cache *iint,
393 			   const unsigned char *filename)
394 {
395 	struct audit_buffer *ab;
396 	char *hash;
397 	const char *algo_name = hash_algo_name[iint->ima_hash->algo];
398 	int i;
399 
400 	if (iint->flags & IMA_AUDITED)
401 		return;
402 
403 	hash = kzalloc((iint->ima_hash->length * 2) + 1, GFP_KERNEL);
404 	if (!hash)
405 		return;
406 
407 	for (i = 0; i < iint->ima_hash->length; i++)
408 		hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
409 	hash[i * 2] = '\0';
410 
411 	ab = audit_log_start(audit_context(), GFP_KERNEL,
412 			     AUDIT_INTEGRITY_RULE);
413 	if (!ab)
414 		goto out;
415 
416 	audit_log_format(ab, "file=");
417 	audit_log_untrustedstring(ab, filename);
418 	audit_log_format(ab, " hash=\"%s:%s\"", algo_name, hash);
419 
420 	audit_log_task_info(ab);
421 	audit_log_end(ab);
422 
423 	iint->flags |= IMA_AUDITED;
424 out:
425 	kfree(hash);
426 	return;
427 }
428 
429 /*
430  * ima_d_path - return a pointer to the full pathname
431  *
432  * Attempt to return a pointer to the full pathname for use in the
433  * IMA measurement list, IMA audit records, and auditing logs.
434  *
435  * On failure, return a pointer to a copy of the filename, not dname.
436  * Returning a pointer to dname, could result in using the pointer
437  * after the memory has been freed.
438  */
439 const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
440 {
441 	struct name_snapshot filename;
442 	char *pathname = NULL;
443 
444 	*pathbuf = __getname();
445 	if (*pathbuf) {
446 		pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
447 		if (IS_ERR(pathname)) {
448 			__putname(*pathbuf);
449 			*pathbuf = NULL;
450 			pathname = NULL;
451 		}
452 	}
453 
454 	if (!pathname) {
455 		take_dentry_name_snapshot(&filename, path->dentry);
456 		strscpy(namebuf, filename.name.name, NAME_MAX);
457 		release_dentry_name_snapshot(&filename);
458 
459 		pathname = namebuf;
460 	}
461 
462 	return pathname;
463 }
464