1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved. 4 */ 5 6 #include <linux/fs.h> 7 #include <linux/fs_struct.h> 8 #include <linux/types.h> 9 #include <linux/binfmts.h> 10 #include <linux/mman.h> 11 #include <linux/blk_types.h> 12 #include <linux/rcupdate.h> 13 14 #include "ipe.h" 15 #include "hooks.h" 16 #include "eval.h" 17 #include "digest.h" 18 19 /** 20 * ipe_bprm_check_security() - ipe security hook function for bprm check. 21 * @bprm: Supplies a pointer to a linux_binprm structure to source the file 22 * being evaluated. 23 * 24 * This LSM hook is called when a binary is loaded through the exec 25 * family of system calls. 26 * 27 * Return: 28 * * %0 - Success 29 * * %-EACCES - Did not pass IPE policy 30 */ 31 int ipe_bprm_check_security(struct linux_binprm *bprm) 32 { 33 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT; 34 35 ipe_build_eval_ctx(&ctx, bprm->file, IPE_OP_EXEC, IPE_HOOK_BPRM_CHECK); 36 return ipe_evaluate_event(&ctx); 37 } 38 39 /** 40 * ipe_bprm_creds_for_exec() - ipe security hook function for bprm creds check. 41 * @bprm: Supplies a pointer to a linux_binprm structure to source the file 42 * being evaluated. 43 * 44 * This LSM hook is called when userspace signals the kernel to check a file 45 * for execution through the execveat syscall with the AT_EXECVE_CHECK flag. 46 * The hook triggers IPE policy evaluation on the script file and returns 47 * the policy decision to userspace. The userspace program receives the 48 * return code and can decide whether to proceed with script execution. 49 * 50 * Return: 51 * * %0 - Success 52 * * %-EACCES - Did not pass IPE policy 53 */ 54 int ipe_bprm_creds_for_exec(struct linux_binprm *bprm) 55 { 56 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT; 57 58 if (!bprm->is_check) 59 return 0; 60 61 ipe_build_eval_ctx(&ctx, bprm->file, IPE_OP_EXEC, 62 IPE_HOOK_BPRM_CREDS_FOR_EXEC); 63 return ipe_evaluate_event(&ctx); 64 } 65 66 /** 67 * ipe_mmap_file() - ipe security hook function for mmap check. 68 * @f: File being mmap'd. Can be NULL in the case of anonymous memory. 69 * @reqprot: The requested protection on the mmap, passed from usermode. 70 * @prot: The effective protection on the mmap, resolved from reqprot and 71 * system configuration. 72 * @flags: Unused. 73 * 74 * This hook is called when a file is loaded through the mmap 75 * family of system calls. 76 * 77 * Return: 78 * * %0 - Success 79 * * %-EACCES - Did not pass IPE policy 80 */ 81 int ipe_mmap_file(struct file *f, unsigned long reqprot __always_unused, 82 unsigned long prot, unsigned long flags) 83 { 84 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT; 85 86 if (prot & PROT_EXEC) { 87 ipe_build_eval_ctx(&ctx, f, IPE_OP_EXEC, IPE_HOOK_MMAP); 88 return ipe_evaluate_event(&ctx); 89 } 90 91 return 0; 92 } 93 94 /** 95 * ipe_file_mprotect() - ipe security hook function for mprotect check. 96 * @vma: Existing virtual memory area created by mmap or similar. 97 * @reqprot: The requested protection on the mmap, passed from usermode. 98 * @prot: The effective protection on the mmap, resolved from reqprot and 99 * system configuration. 100 * 101 * This LSM hook is called when a mmap'd region of memory is changing 102 * its protections via mprotect. 103 * 104 * Return: 105 * * %0 - Success 106 * * %-EACCES - Did not pass IPE policy 107 */ 108 int ipe_file_mprotect(struct vm_area_struct *vma, 109 unsigned long reqprot __always_unused, 110 unsigned long prot) 111 { 112 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT; 113 114 /* Already Executable */ 115 if (vma->vm_flags & VM_EXEC) 116 return 0; 117 118 if (prot & PROT_EXEC) { 119 ipe_build_eval_ctx(&ctx, vma->vm_file, IPE_OP_EXEC, IPE_HOOK_MPROTECT); 120 return ipe_evaluate_event(&ctx); 121 } 122 123 return 0; 124 } 125 126 /** 127 * ipe_kernel_read_file() - ipe security hook function for kernel read. 128 * @file: Supplies a pointer to the file structure being read in from disk. 129 * @id: Supplies the enumeration identifying the purpose of the read. 130 * @contents: Unused. 131 * 132 * This LSM hook is called when a file is read from disk in the kernel. 133 * 134 * Return: 135 * * %0 - Success 136 * * %-EACCES - Did not pass IPE policy 137 */ 138 int ipe_kernel_read_file(struct file *file, enum kernel_read_file_id id, 139 bool contents) 140 { 141 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT; 142 enum ipe_op_type op; 143 144 switch (id) { 145 case READING_FIRMWARE: 146 op = IPE_OP_FIRMWARE; 147 break; 148 case READING_MODULE: 149 case READING_MODULE_COMPRESSED: 150 op = IPE_OP_KERNEL_MODULE; 151 break; 152 case READING_KEXEC_INITRAMFS: 153 op = IPE_OP_KEXEC_INITRAMFS; 154 break; 155 case READING_KEXEC_IMAGE: 156 op = IPE_OP_KEXEC_IMAGE; 157 break; 158 case READING_POLICY: 159 op = IPE_OP_POLICY; 160 break; 161 case READING_X509_CERTIFICATE: 162 op = IPE_OP_X509; 163 break; 164 default: 165 op = IPE_OP_INVALID; 166 WARN(1, "no rule setup for kernel_read_file enum %d", id); 167 } 168 169 ipe_build_eval_ctx(&ctx, file, op, IPE_HOOK_KERNEL_READ); 170 return ipe_evaluate_event(&ctx); 171 } 172 173 /** 174 * ipe_kernel_load_data() - ipe security hook function for kernel load data. 175 * @id: Supplies the enumeration identifying the purpose of the load. 176 * @contents: Unused. 177 * 178 * This LSM hook is called when a data buffer provided by userspace is loading 179 * into the kernel. 180 * 181 * Return: 182 * * %0 - Success 183 * * %-EACCES - Did not pass IPE policy 184 */ 185 int ipe_kernel_load_data(enum kernel_load_data_id id, bool contents) 186 { 187 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT; 188 enum ipe_op_type op; 189 190 switch (id) { 191 case LOADING_FIRMWARE: 192 op = IPE_OP_FIRMWARE; 193 break; 194 case LOADING_MODULE: 195 op = IPE_OP_KERNEL_MODULE; 196 break; 197 case LOADING_KEXEC_INITRAMFS: 198 op = IPE_OP_KEXEC_INITRAMFS; 199 break; 200 case LOADING_KEXEC_IMAGE: 201 op = IPE_OP_KEXEC_IMAGE; 202 break; 203 case LOADING_POLICY: 204 op = IPE_OP_POLICY; 205 break; 206 case LOADING_X509_CERTIFICATE: 207 op = IPE_OP_X509; 208 break; 209 default: 210 op = IPE_OP_INVALID; 211 WARN(1, "no rule setup for kernel_load_data enum %d", id); 212 } 213 214 ipe_build_eval_ctx(&ctx, NULL, op, IPE_HOOK_KERNEL_LOAD); 215 return ipe_evaluate_event(&ctx); 216 } 217 218 /** 219 * ipe_unpack_initramfs() - Mark the current rootfs as initramfs. 220 */ 221 void ipe_unpack_initramfs(void) 222 { 223 ipe_sb(current->fs->root.mnt->mnt_sb)->initramfs = true; 224 } 225 226 #ifdef CONFIG_IPE_PROP_DM_VERITY 227 /** 228 * ipe_bdev_free_security() - Free IPE's LSM blob of block_devices. 229 * @bdev: Supplies a pointer to a block_device that contains the structure 230 * to free. 231 */ 232 void ipe_bdev_free_security(struct block_device *bdev) 233 { 234 struct ipe_bdev *blob = ipe_bdev(bdev); 235 236 ipe_digest_free(rcu_access_pointer(blob->root_hash)); 237 } 238 239 static void ipe_set_dmverity_roothash(struct ipe_bdev *blob, 240 struct digest_info *info) 241 { 242 struct digest_info *old; 243 244 /* Protected by device-mapper's md->suspend_lock */ 245 old = rcu_replace_pointer(blob->root_hash, info, true); 246 if (old) { 247 synchronize_rcu(); 248 ipe_digest_free(old); 249 } 250 } 251 252 #ifdef CONFIG_IPE_PROP_DM_VERITY_SIGNATURE 253 static void ipe_set_dmverity_signature(struct ipe_bdev *blob, 254 const void *value, 255 size_t size) 256 { 257 blob->dm_verity_signed = size > 0 && value; 258 } 259 #else 260 static inline void ipe_set_dmverity_signature(struct ipe_bdev *blob, 261 const void *value, 262 size_t size) 263 { 264 } 265 #endif /* CONFIG_IPE_PROP_DM_VERITY_SIGNATURE */ 266 267 /** 268 * ipe_bdev_setintegrity() - Save integrity data from a bdev to IPE's LSM blob. 269 * @bdev: Supplies a pointer to a block_device that contains the LSM blob. 270 * @type: Supplies the integrity type. 271 * @value: Supplies the value to store. 272 * @size: The size of @value. 273 * 274 * This hook is currently used to save dm-verity's root hash or the existence 275 * of a validated signed dm-verity root hash into LSM blob. 276 * 277 * Return: %0 on success. If an error occurs, the function will return the 278 * -errno. 279 */ 280 int ipe_bdev_setintegrity(struct block_device *bdev, enum lsm_integrity_type type, 281 const void *value, size_t size) 282 { 283 const struct dm_verity_digest *digest = NULL; 284 struct ipe_bdev *blob = ipe_bdev(bdev); 285 struct digest_info *info = NULL; 286 287 if (type == LSM_INT_DMVERITY_SIG_VALID) { 288 ipe_set_dmverity_signature(blob, value, size); 289 290 return 0; 291 } 292 293 if (type != LSM_INT_DMVERITY_ROOTHASH) 294 return -EINVAL; 295 296 if (!value) { 297 ipe_set_dmverity_roothash(blob, NULL); 298 299 return 0; 300 } 301 digest = value; 302 303 info = kzalloc_obj(*info); 304 if (!info) 305 return -ENOMEM; 306 307 info->digest = kmemdup(digest->digest, digest->digest_len, GFP_KERNEL); 308 if (!info->digest) 309 goto err; 310 311 info->alg = kstrdup(digest->alg, GFP_KERNEL); 312 if (!info->alg) 313 goto err; 314 315 info->digest_len = digest->digest_len; 316 317 ipe_set_dmverity_roothash(blob, info); 318 319 return 0; 320 err: 321 ipe_digest_free(info); 322 323 return -ENOMEM; 324 } 325 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 326 327 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG 328 /** 329 * ipe_inode_setintegrity() - save integrity data from a inode to IPE's LSM blob. 330 * @inode: The inode to source the security blob from. 331 * @type: Supplies the integrity type. 332 * @value: The value to be stored. 333 * @size: The size of @value. 334 * 335 * This hook is currently used to save the existence of a validated fs-verity 336 * builtin signature into LSM blob. 337 * 338 * Return: %0 on success. If an error occurs, the function will return the 339 * -errno. 340 */ 341 int ipe_inode_setintegrity(const struct inode *inode, 342 enum lsm_integrity_type type, 343 const void *value, size_t size) 344 { 345 struct ipe_inode *inode_sec = ipe_inode(inode); 346 347 if (type == LSM_INT_FSVERITY_BUILTINSIG_VALID) { 348 inode_sec->fs_verity_signed = size > 0 && value; 349 return 0; 350 } 351 352 return -EINVAL; 353 } 354 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */ 355