1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2005,2006,2007,2008 IBM Corporation 4 * 5 * Authors: 6 * Reiner Sailer <sailer@watson.ibm.com> 7 * Leendert van Doorn <leendert@watson.ibm.com> 8 * Mimi Zohar <zohar@us.ibm.com> 9 * 10 * File: ima_init.c 11 * initialization and cleanup functions 12 */ 13 14 #include <linux/init.h> 15 #include <linux/scatterlist.h> 16 #include <linux/slab.h> 17 #include <linux/err.h> 18 19 #include "ima.h" 20 21 /* name for boot aggregate entry */ 22 const char boot_aggregate_name[] = "boot_aggregate"; 23 struct tpm_chip *ima_tpm_chip; 24 25 /* Add the boot aggregate to the IMA measurement list and extend 26 * the PCR register. 27 * 28 * Calculate the boot aggregate, a hash over tpm registers 0-7, 29 * assuming a TPM chip exists, and zeroes if the TPM chip does not 30 * exist. Add the boot aggregate measurement to the measurement 31 * list and extend the PCR register. 32 * 33 * If a tpm chip does not exist, indicate the core root of trust is 34 * not hardware based by invalidating the aggregate PCR value. 35 * (The aggregate PCR value is invalidated by adding one value to 36 * the measurement list and extending the aggregate PCR value with 37 * a different value.) Violations add a zero entry to the measurement 38 * list and extend the aggregate PCR value with ff...ff's. 39 */ 40 static int __init ima_add_boot_aggregate(void) 41 { 42 static const char op[] = "add_boot_aggregate"; 43 const char *audit_cause = "ENOMEM"; 44 struct ima_template_entry *entry; 45 struct integrity_iint_cache tmp_iint, *iint = &tmp_iint; 46 struct ima_event_data event_data = { .iint = iint, 47 .filename = boot_aggregate_name }; 48 int result = -ENOMEM; 49 int violation = 0; 50 struct { 51 struct ima_digest_data hdr; 52 char digest[TPM_MAX_DIGEST_SIZE]; 53 } hash; 54 55 memset(iint, 0, sizeof(*iint)); 56 memset(&hash, 0, sizeof(hash)); 57 iint->ima_hash = &hash.hdr; 58 iint->ima_hash->algo = ima_hash_algo; 59 iint->ima_hash->length = hash_digest_size[ima_hash_algo]; 60 61 /* 62 * With TPM 2.0 hash agility, TPM chips could support multiple TPM 63 * PCR banks, allowing firmware to configure and enable different 64 * banks. The SHA1 bank is not necessarily enabled. 65 * 66 * Use the same hash algorithm for reading the TPM PCRs as for 67 * calculating the boot aggregate digest. Preference is given to 68 * the configured IMA default hash algorithm. Otherwise, use the 69 * TCG required banks - SHA256 for TPM 2.0, SHA1 for TPM 1.2. 70 * Ultimately select SHA1 also for TPM 2.0 if the SHA256 PCR bank 71 * is not found. 72 */ 73 if (ima_tpm_chip) { 74 result = ima_calc_boot_aggregate(&hash.hdr); 75 if (result < 0) { 76 audit_cause = "hashing_error"; 77 goto err_out; 78 } 79 } 80 81 result = ima_alloc_init_template(&event_data, &entry, NULL); 82 if (result < 0) { 83 audit_cause = "alloc_entry"; 84 goto err_out; 85 } 86 87 result = ima_store_template(entry, violation, NULL, 88 boot_aggregate_name, 89 CONFIG_IMA_MEASURE_PCR_IDX); 90 if (result < 0) { 91 ima_free_template_entry(entry); 92 audit_cause = "store_entry"; 93 goto err_out; 94 } 95 return 0; 96 err_out: 97 integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op, 98 audit_cause, result, 0); 99 return result; 100 } 101 102 #ifdef CONFIG_IMA_LOAD_X509 103 void __init ima_load_x509(void) 104 { 105 int unset_flags = ima_policy_flag & IMA_APPRAISE; 106 107 ima_policy_flag &= ~unset_flags; 108 integrity_load_x509(INTEGRITY_KEYRING_IMA, CONFIG_IMA_X509_PATH); 109 ima_policy_flag |= unset_flags; 110 } 111 #endif 112 113 int __init ima_init(void) 114 { 115 int rc; 116 117 ima_tpm_chip = tpm_default_chip(); 118 if (!ima_tpm_chip) 119 pr_info("No TPM chip found, activating TPM-bypass!\n"); 120 121 rc = integrity_init_keyring(INTEGRITY_KEYRING_IMA); 122 if (rc) 123 return rc; 124 125 rc = ima_init_crypto(); 126 if (rc) 127 return rc; 128 rc = ima_init_template(); 129 if (rc != 0) 130 return rc; 131 132 /* It can be called before ima_init_digests(), it does not use TPM. */ 133 ima_load_kexec_buffer(); 134 135 rc = ima_init_digests(); 136 if (rc != 0) 137 return rc; 138 rc = ima_add_boot_aggregate(); /* boot aggregate must be first entry */ 139 if (rc != 0) 140 return rc; 141 142 ima_init_policy(); 143 144 rc = ima_fs_init(); 145 if (rc != 0) 146 return rc; 147 148 ima_init_key_queue(); 149 150 return rc; 151 } 152