1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2005,2006,2007,2008 IBM Corporation 4 * 5 * Authors: 6 * Reiner Sailer <sailer@watson.ibm.com> 7 * Leendert van Doorn <leendert@watson.ibm.com> 8 * Mimi Zohar <zohar@us.ibm.com> 9 * 10 * File: ima_init.c 11 * initialization and cleanup functions 12 */ 13 14 #include <linux/init.h> 15 #include <linux/scatterlist.h> 16 #include <linux/slab.h> 17 #include <linux/err.h> 18 #include <linux/ima.h> 19 #include <generated/utsrelease.h> 20 21 #include "ima.h" 22 23 /* name for boot aggregate entry */ 24 const char boot_aggregate_name[] = "boot_aggregate"; 25 struct tpm_chip *ima_tpm_chip; 26 27 /* Add the boot aggregate to the IMA measurement list and extend 28 * the PCR register. 29 * 30 * Calculate the boot aggregate, a hash over tpm registers 0-7, 31 * assuming a TPM chip exists, and zeroes if the TPM chip does not 32 * exist. Add the boot aggregate measurement to the measurement 33 * list and extend the PCR register. 34 * 35 * If a tpm chip does not exist, indicate the core root of trust is 36 * not hardware based by invalidating the aggregate PCR value. 37 * (The aggregate PCR value is invalidated by adding one value to 38 * the measurement list and extending the aggregate PCR value with 39 * a different value.) Violations add a zero entry to the measurement 40 * list and extend the aggregate PCR value with ff...ff's. 41 */ 42 static int __init ima_add_boot_aggregate(void) 43 { 44 static const char op[] = "add_boot_aggregate"; 45 const char *audit_cause = "ENOMEM"; 46 struct ima_template_entry *entry; 47 struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; 48 struct ima_event_data event_data = { .iint = iint, 49 .filename = boot_aggregate_name }; 50 struct ima_max_digest_data hash; 51 int result = -ENOMEM; 52 int violation = 0; 53 54 memset(iint, 0, sizeof(*iint)); 55 memset(&hash, 0, sizeof(hash)); 56 iint->ima_hash = &hash.hdr; 57 iint->ima_hash->algo = ima_hash_algo; 58 iint->ima_hash->length = hash_digest_size[ima_hash_algo]; 59 60 /* 61 * With TPM 2.0 hash agility, TPM chips could support multiple TPM 62 * PCR banks, allowing firmware to configure and enable different 63 * banks. The SHA1 bank is not necessarily enabled. 64 * 65 * Use the same hash algorithm for reading the TPM PCRs as for 66 * calculating the boot aggregate digest. Preference is given to 67 * the configured IMA default hash algorithm. Otherwise, use the 68 * TCG required banks - SHA256 for TPM 2.0, SHA1 for TPM 1.2. 69 * Ultimately select SHA1 also for TPM 2.0 if the SHA256 PCR bank 70 * is not found. 71 */ 72 if (ima_tpm_chip) { 73 result = ima_calc_boot_aggregate(&hash.hdr); 74 if (result < 0) { 75 audit_cause = "hashing_error"; 76 goto err_out; 77 } 78 } 79 80 result = ima_alloc_init_template(&event_data, &entry, NULL); 81 if (result < 0) { 82 audit_cause = "alloc_entry"; 83 goto err_out; 84 } 85 86 result = ima_store_template(entry, violation, NULL, 87 boot_aggregate_name, 88 CONFIG_IMA_MEASURE_PCR_IDX); 89 if (result < 0) { 90 ima_free_template_entry(entry); 91 audit_cause = "store_entry"; 92 goto err_out; 93 } 94 return 0; 95 err_out: 96 integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op, 97 audit_cause, result, 0); 98 return result; 99 } 100 101 #ifdef CONFIG_IMA_LOAD_X509 102 void __init ima_load_x509(void) 103 { 104 int unset_flags = ima_policy_flag & IMA_APPRAISE; 105 106 ima_policy_flag &= ~unset_flags; 107 integrity_load_x509(INTEGRITY_KEYRING_IMA, CONFIG_IMA_X509_PATH); 108 109 /* load also EVM key to avoid appraisal */ 110 evm_load_x509(); 111 112 ima_policy_flag |= unset_flags; 113 } 114 #endif 115 116 int __init ima_init(void) 117 { 118 int rc; 119 120 ima_tpm_chip = tpm_default_chip(); 121 if (!ima_tpm_chip) 122 pr_info("No TPM chip found, activating TPM-bypass!\n"); 123 124 rc = integrity_init_keyring(INTEGRITY_KEYRING_IMA); 125 if (rc) 126 return rc; 127 128 rc = ima_init_crypto(); 129 if (rc) 130 return rc; 131 rc = ima_init_template(); 132 if (rc != 0) 133 return rc; 134 135 /* It can be called before ima_init_digests(), it does not use TPM. */ 136 ima_load_kexec_buffer(); 137 138 rc = ima_init_digests(); 139 if (rc != 0) 140 return rc; 141 rc = ima_add_boot_aggregate(); /* boot aggregate must be first entry */ 142 if (rc != 0) 143 return rc; 144 145 ima_init_policy(); 146 147 rc = ima_fs_init(); 148 if (rc != 0) 149 return rc; 150 151 ima_init_key_queue(); 152 153 ima_measure_critical_data("kernel_info", "kernel_version", 154 UTS_RELEASE, strlen(UTS_RELEASE), false, 155 NULL, 0); 156 157 return rc; 158 } 159