1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2005,2006,2007,2008 IBM Corporation 4 * 5 * Authors: 6 * Reiner Sailer <sailer@watson.ibm.com> 7 * Leendert van Doorn <leendert@watson.ibm.com> 8 * Mimi Zohar <zohar@us.ibm.com> 9 * 10 * File: ima_init.c 11 * initialization and cleanup functions 12 */ 13 14 #include <linux/init.h> 15 #include <linux/scatterlist.h> 16 #include <linux/slab.h> 17 #include <linux/err.h> 18 #include <linux/ima.h> 19 #include <generated/utsrelease.h> 20 21 #include "ima.h" 22 23 /* name for boot aggregate entry */ 24 const char boot_aggregate_name[] = "boot_aggregate"; 25 const char boot_aggregate_late_name[] = "boot_aggregate_late"; 26 struct tpm_chip *ima_tpm_chip; 27 28 /* Add the boot aggregate to the IMA measurement list and extend 29 * the PCR register. 30 * 31 * Calculate the boot aggregate, a hash over tpm registers 0-7, 32 * assuming a TPM chip exists, and zeroes if the TPM chip does not 33 * exist. Add the boot aggregate measurement to the measurement 34 * list and extend the PCR register. 35 * 36 * If a tpm chip does not exist, indicate the core root of trust is 37 * not hardware based by invalidating the aggregate PCR value. 38 * (The aggregate PCR value is invalidated by adding one value to 39 * the measurement list and extending the aggregate PCR value with 40 * a different value.) Violations add a zero entry to the measurement 41 * list and extend the aggregate PCR value with ff...ff's. 42 */ 43 static int __init ima_add_boot_aggregate(void) 44 { 45 static const char op[] = "add_boot_aggregate"; 46 const char *audit_cause = "ENOMEM"; 47 struct ima_template_entry *entry; 48 struct ima_iint_cache tmp_iint, *iint = &tmp_iint; 49 struct ima_event_data event_data = { .iint = iint }; 50 struct ima_max_digest_data hash; 51 struct ima_digest_data *hash_hdr = container_of(&hash.hdr, 52 struct ima_digest_data, hdr); 53 const char *filename; 54 int result = -ENOMEM; 55 int violation = 0; 56 57 memset(iint, 0, sizeof(*iint)); 58 memset(&hash, 0, sizeof(hash)); 59 iint->ima_hash = hash_hdr; 60 iint->ima_hash->algo = ima_hash_algo; 61 iint->ima_hash->length = hash_digest_size[ima_hash_algo]; 62 63 if (IS_ENABLED(CONFIG_IMA_INIT_LATE_SYNC)) 64 filename = boot_aggregate_late_name; 65 else 66 filename = boot_aggregate_name; 67 event_data.filename = filename; 68 69 /* 70 * With TPM 2.0 hash agility, TPM chips could support multiple TPM 71 * PCR banks, allowing firmware to configure and enable different 72 * banks. The SHA1 bank is not necessarily enabled. 73 * 74 * Use the same hash algorithm for reading the TPM PCRs as for 75 * calculating the boot aggregate digest. Preference is given to 76 * the configured IMA default hash algorithm. Otherwise, use the 77 * TCG required banks - SHA256 for TPM 2.0, SHA1 for TPM 1.2. 78 * Ultimately select SHA1 also for TPM 2.0 if the SHA256 PCR bank 79 * is not found. 80 */ 81 if (ima_tpm_chip) { 82 result = ima_calc_boot_aggregate(hash_hdr); 83 if (result < 0) { 84 audit_cause = "hashing_error"; 85 goto err_out; 86 } 87 } 88 89 result = ima_alloc_init_template(&event_data, &entry, NULL); 90 if (result < 0) { 91 audit_cause = "alloc_entry"; 92 goto err_out; 93 } 94 95 result = ima_store_template(entry, violation, NULL, 96 filename, 97 CONFIG_IMA_MEASURE_PCR_IDX); 98 if (result < 0) { 99 ima_free_template_entry(entry); 100 audit_cause = "store_entry"; 101 goto err_out; 102 } 103 return 0; 104 err_out: 105 integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, filename, op, 106 audit_cause, result, 0); 107 return result; 108 } 109 110 #ifdef CONFIG_IMA_LOAD_X509 111 void __init ima_load_x509(void) 112 { 113 int unset_flags = ima_policy_flag & IMA_APPRAISE; 114 115 ima_policy_flag &= ~unset_flags; 116 integrity_load_x509(INTEGRITY_KEYRING_IMA, CONFIG_IMA_X509_PATH); 117 118 /* load also EVM key to avoid appraisal */ 119 evm_load_x509(); 120 121 ima_policy_flag |= unset_flags; 122 } 123 #endif 124 125 int __init ima_init(void) 126 { 127 int rc; 128 129 ima_tpm_chip = tpm_default_chip(); 130 if (!ima_tpm_chip) 131 pr_info("No TPM chip found, activating TPM-bypass!\n"); 132 133 rc = integrity_init_keyring(INTEGRITY_KEYRING_IMA); 134 if (rc) 135 return rc; 136 137 rc = ima_init_crypto(); 138 if (rc) 139 return rc; 140 rc = ima_init_template(); 141 if (rc != 0) 142 return rc; 143 144 /* It can be called before ima_init_digests(), it does not use TPM. */ 145 ima_load_kexec_buffer(); 146 147 rc = ima_init_digests(); 148 if (rc != 0) 149 return rc; 150 151 rc = ima_init_htable(); 152 if (rc != 0) 153 return rc; 154 155 rc = ima_add_boot_aggregate(); /* boot aggregate must be first entry */ 156 if (rc != 0) 157 return rc; 158 159 ima_init_policy(); 160 161 rc = ima_fs_init(); 162 if (rc != 0) 163 return rc; 164 165 ima_init_key_queue(); 166 167 ima_init_reboot_notifier(); 168 169 ima_measure_critical_data("kernel_info", "kernel_version", 170 UTS_RELEASE, strlen(UTS_RELEASE), false, 171 NULL, 0); 172 173 return rc; 174 } 175