1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2013 Politecnico di Torino, Italy 4 * TORSEC group -- https://security.polito.it 5 * 6 * Author: Roberto Sassu <roberto.sassu@polito.it> 7 * 8 * File: ima_template_lib.c 9 * Library of supported template fields. 10 */ 11 12 #include "ima_template_lib.h" 13 #include <linux/xattr.h> 14 #include <linux/evm.h> 15 16 static bool ima_template_hash_algo_allowed(u8 algo) 17 { 18 if (algo == HASH_ALGO_SHA1 || algo == HASH_ALGO_MD5) 19 return true; 20 21 return false; 22 } 23 24 enum data_formats { 25 DATA_FMT_DIGEST = 0, 26 DATA_FMT_DIGEST_WITH_ALGO, 27 DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO, 28 DATA_FMT_STRING, 29 DATA_FMT_HEX, 30 DATA_FMT_UINT 31 }; 32 33 enum digest_type { 34 DIGEST_TYPE_IMA, 35 DIGEST_TYPE_VERITY, 36 DIGEST_TYPE__LAST 37 }; 38 39 #define DIGEST_TYPE_NAME_LEN_MAX 7 /* including NUL */ 40 static const char * const digest_type_name[DIGEST_TYPE__LAST] = { 41 [DIGEST_TYPE_IMA] = "ima", 42 [DIGEST_TYPE_VERITY] = "verity" 43 }; 44 45 static int ima_write_template_field_data(const void *data, const u32 datalen, 46 enum data_formats datafmt, 47 struct ima_field_data *field_data) 48 { 49 u8 *buf, *buf_ptr; 50 u32 buflen = datalen; 51 52 if (datafmt == DATA_FMT_STRING) 53 buflen = datalen + 1; 54 55 buf = kzalloc(buflen, GFP_KERNEL); 56 if (!buf) 57 return -ENOMEM; 58 59 memcpy(buf, data, datalen); 60 61 /* 62 * Replace all space characters with underscore for event names and 63 * strings. This avoid that, during the parsing of a measurements list, 64 * filenames with spaces or that end with the suffix ' (deleted)' are 65 * split into multiple template fields (the space is the delimitator 66 * character for measurements lists in ASCII format). 67 */ 68 if (datafmt == DATA_FMT_STRING) { 69 for (buf_ptr = buf; buf_ptr - buf < datalen; buf_ptr++) 70 if (*buf_ptr == ' ') 71 *buf_ptr = '_'; 72 } 73 74 field_data->data = buf; 75 field_data->len = buflen; 76 return 0; 77 } 78 79 static void ima_show_template_data_ascii(struct seq_file *m, 80 enum ima_show_type show, 81 enum data_formats datafmt, 82 struct ima_field_data *field_data) 83 { 84 u8 *buf_ptr = field_data->data; 85 u32 buflen = field_data->len; 86 87 switch (datafmt) { 88 case DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO: 89 case DATA_FMT_DIGEST_WITH_ALGO: 90 buf_ptr = strrchr(field_data->data, ':'); 91 if (buf_ptr != field_data->data) 92 seq_printf(m, "%s", field_data->data); 93 94 /* skip ':' and '\0' */ 95 buf_ptr += 2; 96 buflen -= buf_ptr - field_data->data; 97 fallthrough; 98 case DATA_FMT_DIGEST: 99 case DATA_FMT_HEX: 100 if (!buflen) 101 break; 102 ima_print_digest(m, buf_ptr, buflen); 103 break; 104 case DATA_FMT_STRING: 105 seq_printf(m, "%s", buf_ptr); 106 break; 107 case DATA_FMT_UINT: 108 switch (field_data->len) { 109 case sizeof(u8): 110 seq_printf(m, "%u", *(u8 *)buf_ptr); 111 break; 112 case sizeof(u16): 113 if (ima_canonical_fmt) 114 seq_printf(m, "%u", 115 le16_to_cpu(*(__le16 *)buf_ptr)); 116 else 117 seq_printf(m, "%u", *(u16 *)buf_ptr); 118 break; 119 case sizeof(u32): 120 if (ima_canonical_fmt) 121 seq_printf(m, "%u", 122 le32_to_cpu(*(__le32 *)buf_ptr)); 123 else 124 seq_printf(m, "%u", *(u32 *)buf_ptr); 125 break; 126 case sizeof(u64): 127 if (ima_canonical_fmt) 128 seq_printf(m, "%llu", 129 le64_to_cpu(*(__le64 *)buf_ptr)); 130 else 131 seq_printf(m, "%llu", *(u64 *)buf_ptr); 132 break; 133 default: 134 break; 135 } 136 break; 137 default: 138 break; 139 } 140 } 141 142 static void ima_show_template_data_binary(struct seq_file *m, 143 enum ima_show_type show, 144 enum data_formats datafmt, 145 struct ima_field_data *field_data) 146 { 147 u32 len = (show == IMA_SHOW_BINARY_OLD_STRING_FMT) ? 148 strlen(field_data->data) : field_data->len; 149 150 if (show != IMA_SHOW_BINARY_NO_FIELD_LEN) { 151 u32 field_len = !ima_canonical_fmt ? 152 len : (__force u32)cpu_to_le32(len); 153 154 ima_putc(m, &field_len, sizeof(field_len)); 155 } 156 157 if (!len) 158 return; 159 160 ima_putc(m, field_data->data, len); 161 } 162 163 static void ima_show_template_field_data(struct seq_file *m, 164 enum ima_show_type show, 165 enum data_formats datafmt, 166 struct ima_field_data *field_data) 167 { 168 switch (show) { 169 case IMA_SHOW_ASCII: 170 ima_show_template_data_ascii(m, show, datafmt, field_data); 171 break; 172 case IMA_SHOW_BINARY: 173 case IMA_SHOW_BINARY_NO_FIELD_LEN: 174 case IMA_SHOW_BINARY_OLD_STRING_FMT: 175 ima_show_template_data_binary(m, show, datafmt, field_data); 176 break; 177 default: 178 break; 179 } 180 } 181 182 void ima_show_template_digest(struct seq_file *m, enum ima_show_type show, 183 struct ima_field_data *field_data) 184 { 185 ima_show_template_field_data(m, show, DATA_FMT_DIGEST, field_data); 186 } 187 188 void ima_show_template_digest_ng(struct seq_file *m, enum ima_show_type show, 189 struct ima_field_data *field_data) 190 { 191 ima_show_template_field_data(m, show, DATA_FMT_DIGEST_WITH_ALGO, 192 field_data); 193 } 194 195 void ima_show_template_digest_ngv2(struct seq_file *m, enum ima_show_type show, 196 struct ima_field_data *field_data) 197 { 198 ima_show_template_field_data(m, show, 199 DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO, 200 field_data); 201 } 202 203 void ima_show_template_string(struct seq_file *m, enum ima_show_type show, 204 struct ima_field_data *field_data) 205 { 206 ima_show_template_field_data(m, show, DATA_FMT_STRING, field_data); 207 } 208 209 void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, 210 struct ima_field_data *field_data) 211 { 212 ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); 213 } 214 215 void ima_show_template_buf(struct seq_file *m, enum ima_show_type show, 216 struct ima_field_data *field_data) 217 { 218 ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); 219 } 220 221 void ima_show_template_uint(struct seq_file *m, enum ima_show_type show, 222 struct ima_field_data *field_data) 223 { 224 ima_show_template_field_data(m, show, DATA_FMT_UINT, field_data); 225 } 226 227 /** 228 * ima_parse_buf() - Parses lengths and data from an input buffer 229 * @bufstartp: Buffer start address. 230 * @bufendp: Buffer end address. 231 * @bufcurp: Pointer to remaining (non-parsed) data. 232 * @maxfields: Length of fields array. 233 * @fields: Array containing lengths and pointers of parsed data. 234 * @curfields: Number of array items containing parsed data. 235 * @len_mask: Bitmap (if bit is set, data length should not be parsed). 236 * @enforce_mask: Check if curfields == maxfields and/or bufcurp == bufendp. 237 * @bufname: String identifier of the input buffer. 238 * 239 * Return: 0 on success, -EINVAL on error. 240 */ 241 int ima_parse_buf(void *bufstartp, void *bufendp, void **bufcurp, 242 int maxfields, struct ima_field_data *fields, int *curfields, 243 unsigned long *len_mask, int enforce_mask, char *bufname) 244 { 245 void *bufp = bufstartp; 246 int i; 247 248 for (i = 0; i < maxfields; i++) { 249 if (len_mask == NULL || !test_bit(i, len_mask)) { 250 if (bufp > (bufendp - sizeof(u32))) 251 break; 252 253 if (ima_canonical_fmt) 254 fields[i].len = le32_to_cpu(*(__le32 *)bufp); 255 else 256 fields[i].len = *(u32 *)bufp; 257 258 bufp += sizeof(u32); 259 } 260 261 if (bufp > (bufendp - fields[i].len)) 262 break; 263 264 fields[i].data = bufp; 265 bufp += fields[i].len; 266 } 267 268 if ((enforce_mask & ENFORCE_FIELDS) && i != maxfields) { 269 pr_err("%s: nr of fields mismatch: expected: %d, current: %d\n", 270 bufname, maxfields, i); 271 return -EINVAL; 272 } 273 274 if ((enforce_mask & ENFORCE_BUFEND) && bufp != bufendp) { 275 pr_err("%s: buf end mismatch: expected: %p, current: %p\n", 276 bufname, bufendp, bufp); 277 return -EINVAL; 278 } 279 280 if (curfields) 281 *curfields = i; 282 283 if (bufcurp) 284 *bufcurp = bufp; 285 286 return 0; 287 } 288 289 static int ima_eventdigest_init_common(const u8 *digest, u32 digestsize, 290 u8 digest_type, u8 hash_algo, 291 struct ima_field_data *field_data) 292 { 293 /* 294 * digest formats: 295 * - DATA_FMT_DIGEST: digest 296 * - DATA_FMT_DIGEST_WITH_ALGO: <hash algo> + ':' + '\0' + digest, 297 * - DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO: 298 * <digest type> + ':' + <hash algo> + ':' + '\0' + digest, 299 * 300 * where 'DATA_FMT_DIGEST' is the original digest format ('d') 301 * with a hash size limitation of 20 bytes, 302 * where <digest type> is either "ima" or "verity", 303 * where <hash algo> is the hash_algo_name[] string. 304 */ 305 u8 buffer[DIGEST_TYPE_NAME_LEN_MAX + CRYPTO_MAX_ALG_NAME + 2 + 306 IMA_MAX_DIGEST_SIZE] = { 0 }; 307 enum data_formats fmt = DATA_FMT_DIGEST; 308 u32 offset = 0; 309 310 if (digest_type < DIGEST_TYPE__LAST && hash_algo < HASH_ALGO__LAST) { 311 fmt = DATA_FMT_DIGEST_WITH_TYPE_AND_ALGO; 312 offset += 1 + sprintf(buffer, "%s:%s:", 313 digest_type_name[digest_type], 314 hash_algo_name[hash_algo]); 315 } else if (hash_algo < HASH_ALGO__LAST) { 316 fmt = DATA_FMT_DIGEST_WITH_ALGO; 317 offset += 1 + sprintf(buffer, "%s:", 318 hash_algo_name[hash_algo]); 319 } 320 321 if (digest) { 322 memcpy(buffer + offset, digest, digestsize); 323 } else { 324 /* 325 * If digest is NULL, the event being recorded is a violation. 326 * Make room for the digest by increasing the offset by the 327 * hash algorithm digest size. If the hash algorithm is not 328 * specified increase the offset by IMA_DIGEST_SIZE which 329 * fits SHA1 or MD5 330 */ 331 if (hash_algo < HASH_ALGO__LAST) 332 offset += hash_digest_size[hash_algo]; 333 else 334 offset += IMA_DIGEST_SIZE; 335 } 336 337 return ima_write_template_field_data(buffer, offset + digestsize, 338 fmt, field_data); 339 } 340 341 /* 342 * This function writes the digest of an event (with size limit). 343 */ 344 int ima_eventdigest_init(struct ima_event_data *event_data, 345 struct ima_field_data *field_data) 346 { 347 struct ima_max_digest_data hash; 348 struct ima_digest_data *hash_hdr = container_of(&hash.hdr, 349 struct ima_digest_data, hdr); 350 u8 *cur_digest = NULL; 351 u32 cur_digestsize = 0; 352 struct inode *inode; 353 int result; 354 355 memset(&hash, 0, sizeof(hash)); 356 357 if (event_data->violation) /* recording a violation. */ 358 goto out; 359 360 if (ima_template_hash_algo_allowed(event_data->iint->ima_hash->algo)) { 361 cur_digest = event_data->iint->ima_hash->digest; 362 cur_digestsize = event_data->iint->ima_hash->length; 363 goto out; 364 } 365 366 if ((const char *)event_data->filename == boot_aggregate_name) { 367 if (ima_tpm_chip) { 368 hash.hdr.algo = HASH_ALGO_SHA1; 369 result = ima_calc_boot_aggregate(hash_hdr); 370 371 /* algo can change depending on available PCR banks */ 372 if (!result && hash.hdr.algo != HASH_ALGO_SHA1) 373 result = -EINVAL; 374 375 if (result < 0) 376 memset(&hash, 0, sizeof(hash)); 377 } 378 379 cur_digest = hash_hdr->digest; 380 cur_digestsize = hash_digest_size[HASH_ALGO_SHA1]; 381 goto out; 382 } 383 384 if (!event_data->file) /* missing info to re-calculate the digest */ 385 return -EINVAL; 386 387 inode = file_inode(event_data->file); 388 hash.hdr.algo = ima_template_hash_algo_allowed(ima_hash_algo) ? 389 ima_hash_algo : HASH_ALGO_SHA1; 390 result = ima_calc_file_hash(event_data->file, hash_hdr); 391 if (result) { 392 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, 393 event_data->filename, "collect_data", 394 "failed", result, 0); 395 return result; 396 } 397 cur_digest = hash_hdr->digest; 398 cur_digestsize = hash.hdr.length; 399 out: 400 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 401 DIGEST_TYPE__LAST, HASH_ALGO__LAST, 402 field_data); 403 } 404 405 /* 406 * This function writes the digest of an event (without size limit). 407 */ 408 int ima_eventdigest_ng_init(struct ima_event_data *event_data, 409 struct ima_field_data *field_data) 410 { 411 u8 *cur_digest = NULL, hash_algo = ima_hash_algo; 412 u32 cur_digestsize = 0; 413 414 if (event_data->violation) /* recording a violation. */ 415 goto out; 416 417 cur_digest = event_data->iint->ima_hash->digest; 418 cur_digestsize = event_data->iint->ima_hash->length; 419 420 hash_algo = event_data->iint->ima_hash->algo; 421 out: 422 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 423 DIGEST_TYPE__LAST, hash_algo, 424 field_data); 425 } 426 427 /* 428 * This function writes the digest of an event (without size limit), 429 * prefixed with both the digest type and hash algorithm. 430 */ 431 int ima_eventdigest_ngv2_init(struct ima_event_data *event_data, 432 struct ima_field_data *field_data) 433 { 434 u8 *cur_digest = NULL, hash_algo = ima_hash_algo; 435 u32 cur_digestsize = 0; 436 u8 digest_type = DIGEST_TYPE_IMA; 437 438 if (event_data->violation) /* recording a violation. */ 439 goto out; 440 441 cur_digest = event_data->iint->ima_hash->digest; 442 cur_digestsize = event_data->iint->ima_hash->length; 443 444 hash_algo = event_data->iint->ima_hash->algo; 445 if (event_data->iint->flags & IMA_VERITY_REQUIRED) 446 digest_type = DIGEST_TYPE_VERITY; 447 out: 448 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 449 digest_type, hash_algo, 450 field_data); 451 } 452 453 /* 454 * This function writes the digest of the file which is expected to match the 455 * digest contained in the file's appended signature. 456 */ 457 int ima_eventdigest_modsig_init(struct ima_event_data *event_data, 458 struct ima_field_data *field_data) 459 { 460 enum hash_algo hash_algo; 461 const u8 *cur_digest; 462 u32 cur_digestsize; 463 464 if (!event_data->modsig) 465 return 0; 466 467 if (event_data->violation) { 468 /* Recording a violation. */ 469 hash_algo = HASH_ALGO_SHA1; 470 cur_digest = NULL; 471 cur_digestsize = 0; 472 } else { 473 int rc; 474 475 rc = ima_get_modsig_digest(event_data->modsig, &hash_algo, 476 &cur_digest, &cur_digestsize); 477 if (rc) 478 return rc; 479 else if (hash_algo == HASH_ALGO__LAST || cur_digestsize == 0) 480 /* There was some error collecting the digest. */ 481 return -EINVAL; 482 } 483 484 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 485 DIGEST_TYPE__LAST, hash_algo, 486 field_data); 487 } 488 489 static int ima_eventname_init_common(struct ima_event_data *event_data, 490 struct ima_field_data *field_data, 491 bool size_limit) 492 { 493 const char *cur_filename = NULL; 494 struct name_snapshot filename; 495 u32 cur_filename_len = 0; 496 bool snapshot = false; 497 int ret; 498 499 BUG_ON(event_data->filename == NULL && event_data->file == NULL); 500 501 if (event_data->filename) { 502 cur_filename = event_data->filename; 503 cur_filename_len = strlen(event_data->filename); 504 505 if (!size_limit || cur_filename_len <= IMA_EVENT_NAME_LEN_MAX) 506 goto out; 507 } 508 509 if (event_data->file) { 510 take_dentry_name_snapshot(&filename, 511 event_data->file->f_path.dentry); 512 snapshot = true; 513 cur_filename = filename.name.name; 514 cur_filename_len = strlen(cur_filename); 515 } else 516 /* 517 * Truncate filename if the latter is too long and 518 * the file descriptor is not available. 519 */ 520 cur_filename_len = IMA_EVENT_NAME_LEN_MAX; 521 out: 522 ret = ima_write_template_field_data(cur_filename, cur_filename_len, 523 DATA_FMT_STRING, field_data); 524 525 if (snapshot) 526 release_dentry_name_snapshot(&filename); 527 528 return ret; 529 } 530 531 /* 532 * This function writes the name of an event (with size limit). 533 */ 534 int ima_eventname_init(struct ima_event_data *event_data, 535 struct ima_field_data *field_data) 536 { 537 return ima_eventname_init_common(event_data, field_data, true); 538 } 539 540 /* 541 * This function writes the name of an event (without size limit). 542 */ 543 int ima_eventname_ng_init(struct ima_event_data *event_data, 544 struct ima_field_data *field_data) 545 { 546 return ima_eventname_init_common(event_data, field_data, false); 547 } 548 549 /* 550 * ima_eventsig_init - include the file signature as part of the template data 551 */ 552 int ima_eventsig_init(struct ima_event_data *event_data, 553 struct ima_field_data *field_data) 554 { 555 struct evm_ima_xattr_data *xattr_value = event_data->xattr_value; 556 557 if (!xattr_value || 558 (xattr_value->type != EVM_IMA_XATTR_DIGSIG && 559 xattr_value->type != IMA_VERITY_DIGSIG)) 560 return ima_eventevmsig_init(event_data, field_data); 561 562 return ima_write_template_field_data(xattr_value, event_data->xattr_len, 563 DATA_FMT_HEX, field_data); 564 } 565 566 /* 567 * ima_eventbuf_init - include the buffer(kexec-cmldine) as part of the 568 * template data. 569 */ 570 int ima_eventbuf_init(struct ima_event_data *event_data, 571 struct ima_field_data *field_data) 572 { 573 if ((!event_data->buf) || (event_data->buf_len == 0)) 574 return 0; 575 576 return ima_write_template_field_data(event_data->buf, 577 event_data->buf_len, DATA_FMT_HEX, 578 field_data); 579 } 580 581 /* 582 * ima_eventmodsig_init - include the appended file signature as part of the 583 * template data 584 */ 585 int ima_eventmodsig_init(struct ima_event_data *event_data, 586 struct ima_field_data *field_data) 587 { 588 const void *data; 589 u32 data_len; 590 int rc; 591 592 if (!event_data->modsig) 593 return 0; 594 595 /* 596 * modsig is a runtime structure containing pointers. Get its raw data 597 * instead. 598 */ 599 rc = ima_get_raw_modsig(event_data->modsig, &data, &data_len); 600 if (rc) 601 return rc; 602 603 return ima_write_template_field_data(data, data_len, DATA_FMT_HEX, 604 field_data); 605 } 606 607 /* 608 * ima_eventevmsig_init - include the EVM portable signature as part of the 609 * template data 610 */ 611 int ima_eventevmsig_init(struct ima_event_data *event_data, 612 struct ima_field_data *field_data) 613 { 614 struct evm_ima_xattr_data *xattr_data = NULL; 615 int rc = 0; 616 617 if (!event_data->file) 618 return 0; 619 620 rc = vfs_getxattr_alloc(&nop_mnt_idmap, file_dentry(event_data->file), 621 XATTR_NAME_EVM, (char **)&xattr_data, 0, 622 GFP_NOFS); 623 if (rc <= 0 || xattr_data->type != EVM_XATTR_PORTABLE_DIGSIG) { 624 rc = 0; 625 goto out; 626 } 627 628 rc = ima_write_template_field_data((char *)xattr_data, rc, DATA_FMT_HEX, 629 field_data); 630 631 out: 632 kfree(xattr_data); 633 return rc; 634 } 635 636 static int ima_eventinodedac_init_common(struct ima_event_data *event_data, 637 struct ima_field_data *field_data, 638 bool get_uid) 639 { 640 unsigned int id; 641 642 if (!event_data->file) 643 return 0; 644 645 if (get_uid) 646 id = i_uid_read(file_inode(event_data->file)); 647 else 648 id = i_gid_read(file_inode(event_data->file)); 649 650 if (ima_canonical_fmt) { 651 if (sizeof(id) == sizeof(u16)) 652 id = (__force u16)cpu_to_le16(id); 653 else 654 id = (__force u32)cpu_to_le32(id); 655 } 656 657 return ima_write_template_field_data((void *)&id, sizeof(id), 658 DATA_FMT_UINT, field_data); 659 } 660 661 /* 662 * ima_eventinodeuid_init - include the inode UID as part of the template 663 * data 664 */ 665 int ima_eventinodeuid_init(struct ima_event_data *event_data, 666 struct ima_field_data *field_data) 667 { 668 return ima_eventinodedac_init_common(event_data, field_data, true); 669 } 670 671 /* 672 * ima_eventinodegid_init - include the inode GID as part of the template 673 * data 674 */ 675 int ima_eventinodegid_init(struct ima_event_data *event_data, 676 struct ima_field_data *field_data) 677 { 678 return ima_eventinodedac_init_common(event_data, field_data, false); 679 } 680 681 /* 682 * ima_eventinodemode_init - include the inode mode as part of the template 683 * data 684 */ 685 int ima_eventinodemode_init(struct ima_event_data *event_data, 686 struct ima_field_data *field_data) 687 { 688 struct inode *inode; 689 u16 mode; 690 691 if (!event_data->file) 692 return 0; 693 694 inode = file_inode(event_data->file); 695 mode = inode->i_mode; 696 if (ima_canonical_fmt) 697 mode = (__force u16)cpu_to_le16(mode); 698 699 return ima_write_template_field_data((char *)&mode, sizeof(mode), 700 DATA_FMT_UINT, field_data); 701 } 702 703 static int ima_eventinodexattrs_init_common(struct ima_event_data *event_data, 704 struct ima_field_data *field_data, 705 char type) 706 { 707 u8 *buffer = NULL; 708 int rc; 709 710 if (!event_data->file) 711 return 0; 712 713 rc = evm_read_protected_xattrs(file_dentry(event_data->file), NULL, 0, 714 type, ima_canonical_fmt); 715 if (rc < 0) 716 return 0; 717 718 buffer = kmalloc(rc, GFP_KERNEL); 719 if (!buffer) 720 return 0; 721 722 rc = evm_read_protected_xattrs(file_dentry(event_data->file), buffer, 723 rc, type, ima_canonical_fmt); 724 if (rc < 0) { 725 rc = 0; 726 goto out; 727 } 728 729 rc = ima_write_template_field_data((char *)buffer, rc, DATA_FMT_HEX, 730 field_data); 731 out: 732 kfree(buffer); 733 return rc; 734 } 735 736 /* 737 * ima_eventinodexattrnames_init - include a list of xattr names as part of the 738 * template data 739 */ 740 int ima_eventinodexattrnames_init(struct ima_event_data *event_data, 741 struct ima_field_data *field_data) 742 { 743 return ima_eventinodexattrs_init_common(event_data, field_data, 'n'); 744 } 745 746 /* 747 * ima_eventinodexattrlengths_init - include a list of xattr lengths as part of 748 * the template data 749 */ 750 int ima_eventinodexattrlengths_init(struct ima_event_data *event_data, 751 struct ima_field_data *field_data) 752 { 753 return ima_eventinodexattrs_init_common(event_data, field_data, 'l'); 754 } 755 756 /* 757 * ima_eventinodexattrvalues_init - include a list of xattr values as part of 758 * the template data 759 */ 760 int ima_eventinodexattrvalues_init(struct ima_event_data *event_data, 761 struct ima_field_data *field_data) 762 { 763 return ima_eventinodexattrs_init_common(event_data, field_data, 'v'); 764 } 765