1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * Copyright (C) 2005,2006,2007,2008 IBM Corporation |
4 | * |
5 | * Authors: |
6 | * Kylene Hall <kjhall@us.ibm.com> |
7 | * Reiner Sailer <sailer@us.ibm.com> |
8 | * Mimi Zohar <zohar@us.ibm.com> |
9 | * |
10 | * File: ima_fs.c |
11 | * implemenents security file system for reporting |
12 | * current measurement list and IMA statistics |
13 | */ |
14 | |
15 | #include <linux/fcntl.h> |
16 | #include <linux/kernel_read_file.h> |
17 | #include <linux/slab.h> |
18 | #include <linux/init.h> |
19 | #include <linux/seq_file.h> |
20 | #include <linux/rculist.h> |
21 | #include <linux/rcupdate.h> |
22 | #include <linux/parser.h> |
23 | #include <linux/vmalloc.h> |
24 | |
25 | #include "ima.h" |
26 | |
27 | static DEFINE_MUTEX(ima_write_mutex); |
28 | |
29 | bool ima_canonical_fmt; |
30 | static int __init default_canonical_fmt_setup(char *str) |
31 | { |
32 | #ifdef __BIG_ENDIAN |
33 | ima_canonical_fmt = true; |
34 | #endif |
35 | return 1; |
36 | } |
37 | __setup("ima_canonical_fmt" , default_canonical_fmt_setup); |
38 | |
39 | static int valid_policy = 1; |
40 | |
41 | static ssize_t ima_show_htable_value(char __user *buf, size_t count, |
42 | loff_t *ppos, atomic_long_t *val) |
43 | { |
44 | char tmpbuf[32]; /* greater than largest 'long' string value */ |
45 | ssize_t len; |
46 | |
47 | len = scnprintf(buf: tmpbuf, size: sizeof(tmpbuf), fmt: "%li\n" , atomic_long_read(v: val)); |
48 | return simple_read_from_buffer(to: buf, count, ppos, from: tmpbuf, available: len); |
49 | } |
50 | |
51 | static ssize_t ima_show_htable_violations(struct file *filp, |
52 | char __user *buf, |
53 | size_t count, loff_t *ppos) |
54 | { |
55 | return ima_show_htable_value(buf, count, ppos, val: &ima_htable.violations); |
56 | } |
57 | |
58 | static const struct file_operations ima_htable_violations_ops = { |
59 | .read = ima_show_htable_violations, |
60 | .llseek = generic_file_llseek, |
61 | }; |
62 | |
63 | static ssize_t ima_show_measurements_count(struct file *filp, |
64 | char __user *buf, |
65 | size_t count, loff_t *ppos) |
66 | { |
67 | return ima_show_htable_value(buf, count, ppos, val: &ima_htable.len); |
68 | |
69 | } |
70 | |
71 | static const struct file_operations ima_measurements_count_ops = { |
72 | .read = ima_show_measurements_count, |
73 | .llseek = generic_file_llseek, |
74 | }; |
75 | |
76 | /* returns pointer to hlist_node */ |
77 | static void *ima_measurements_start(struct seq_file *m, loff_t *pos) |
78 | { |
79 | loff_t l = *pos; |
80 | struct ima_queue_entry *qe; |
81 | |
82 | /* we need a lock since pos could point beyond last element */ |
83 | rcu_read_lock(); |
84 | list_for_each_entry_rcu(qe, &ima_measurements, later) { |
85 | if (!l--) { |
86 | rcu_read_unlock(); |
87 | return qe; |
88 | } |
89 | } |
90 | rcu_read_unlock(); |
91 | return NULL; |
92 | } |
93 | |
94 | static void *ima_measurements_next(struct seq_file *m, void *v, loff_t *pos) |
95 | { |
96 | struct ima_queue_entry *qe = v; |
97 | |
98 | /* lock protects when reading beyond last element |
99 | * against concurrent list-extension |
100 | */ |
101 | rcu_read_lock(); |
102 | qe = list_entry_rcu(qe->later.next, struct ima_queue_entry, later); |
103 | rcu_read_unlock(); |
104 | (*pos)++; |
105 | |
106 | return (&qe->later == &ima_measurements) ? NULL : qe; |
107 | } |
108 | |
109 | static void ima_measurements_stop(struct seq_file *m, void *v) |
110 | { |
111 | } |
112 | |
113 | void ima_putc(struct seq_file *m, void *data, int datalen) |
114 | { |
115 | while (datalen--) |
116 | seq_putc(m, c: *(char *)data++); |
117 | } |
118 | |
119 | /* print format: |
120 | * 32bit-le=pcr# |
121 | * char[20]=template digest |
122 | * 32bit-le=template name size |
123 | * char[n]=template name |
124 | * [eventdata length] |
125 | * eventdata[n]=template specific data |
126 | */ |
127 | int ima_measurements_show(struct seq_file *m, void *v) |
128 | { |
129 | /* the list never shrinks, so we don't need a lock here */ |
130 | struct ima_queue_entry *qe = v; |
131 | struct ima_template_entry *e; |
132 | char *template_name; |
133 | u32 pcr, namelen, template_data_len; /* temporary fields */ |
134 | bool is_ima_template = false; |
135 | int i; |
136 | |
137 | /* get entry */ |
138 | e = qe->entry; |
139 | if (e == NULL) |
140 | return -1; |
141 | |
142 | template_name = (e->template_desc->name[0] != '\0') ? |
143 | e->template_desc->name : e->template_desc->fmt; |
144 | |
145 | /* |
146 | * 1st: PCRIndex |
147 | * PCR used defaults to the same (config option) in |
148 | * little-endian format, unless set in policy |
149 | */ |
150 | pcr = !ima_canonical_fmt ? e->pcr : (__force u32)cpu_to_le32(e->pcr); |
151 | ima_putc(m, data: &pcr, datalen: sizeof(e->pcr)); |
152 | |
153 | /* 2nd: template digest */ |
154 | ima_putc(m, data: e->digests[ima_sha1_idx].digest, TPM_DIGEST_SIZE); |
155 | |
156 | /* 3rd: template name size */ |
157 | namelen = !ima_canonical_fmt ? strlen(template_name) : |
158 | (__force u32)cpu_to_le32(strlen(template_name)); |
159 | ima_putc(m, data: &namelen, datalen: sizeof(namelen)); |
160 | |
161 | /* 4th: template name */ |
162 | ima_putc(m, data: template_name, strlen(template_name)); |
163 | |
164 | /* 5th: template length (except for 'ima' template) */ |
165 | if (strcmp(template_name, IMA_TEMPLATE_IMA_NAME) == 0) |
166 | is_ima_template = true; |
167 | |
168 | if (!is_ima_template) { |
169 | template_data_len = !ima_canonical_fmt ? e->template_data_len : |
170 | (__force u32)cpu_to_le32(e->template_data_len); |
171 | ima_putc(m, data: &template_data_len, datalen: sizeof(e->template_data_len)); |
172 | } |
173 | |
174 | /* 6th: template specific data */ |
175 | for (i = 0; i < e->template_desc->num_fields; i++) { |
176 | enum ima_show_type show = IMA_SHOW_BINARY; |
177 | const struct ima_template_field *field = |
178 | e->template_desc->fields[i]; |
179 | |
180 | if (is_ima_template && strcmp(field->field_id, "d" ) == 0) |
181 | show = IMA_SHOW_BINARY_NO_FIELD_LEN; |
182 | if (is_ima_template && strcmp(field->field_id, "n" ) == 0) |
183 | show = IMA_SHOW_BINARY_OLD_STRING_FMT; |
184 | field->field_show(m, show, &e->template_data[i]); |
185 | } |
186 | return 0; |
187 | } |
188 | |
189 | static const struct seq_operations ima_measurments_seqops = { |
190 | .start = ima_measurements_start, |
191 | .next = ima_measurements_next, |
192 | .stop = ima_measurements_stop, |
193 | .show = ima_measurements_show |
194 | }; |
195 | |
196 | static int ima_measurements_open(struct inode *inode, struct file *file) |
197 | { |
198 | return seq_open(file, &ima_measurments_seqops); |
199 | } |
200 | |
201 | static const struct file_operations ima_measurements_ops = { |
202 | .open = ima_measurements_open, |
203 | .read = seq_read, |
204 | .llseek = seq_lseek, |
205 | .release = seq_release, |
206 | }; |
207 | |
208 | void ima_print_digest(struct seq_file *m, u8 *digest, u32 size) |
209 | { |
210 | u32 i; |
211 | |
212 | for (i = 0; i < size; i++) |
213 | seq_printf(m, fmt: "%02x" , *(digest + i)); |
214 | } |
215 | |
216 | /* print in ascii */ |
217 | static int ima_ascii_measurements_show(struct seq_file *m, void *v) |
218 | { |
219 | /* the list never shrinks, so we don't need a lock here */ |
220 | struct ima_queue_entry *qe = v; |
221 | struct ima_template_entry *e; |
222 | char *template_name; |
223 | int i; |
224 | |
225 | /* get entry */ |
226 | e = qe->entry; |
227 | if (e == NULL) |
228 | return -1; |
229 | |
230 | template_name = (e->template_desc->name[0] != '\0') ? |
231 | e->template_desc->name : e->template_desc->fmt; |
232 | |
233 | /* 1st: PCR used (config option) */ |
234 | seq_printf(m, fmt: "%2d " , e->pcr); |
235 | |
236 | /* 2nd: SHA1 template hash */ |
237 | ima_print_digest(m, digest: e->digests[ima_sha1_idx].digest, TPM_DIGEST_SIZE); |
238 | |
239 | /* 3th: template name */ |
240 | seq_printf(m, fmt: " %s" , template_name); |
241 | |
242 | /* 4th: template specific data */ |
243 | for (i = 0; i < e->template_desc->num_fields; i++) { |
244 | seq_puts(m, s: " " ); |
245 | if (e->template_data[i].len == 0) |
246 | continue; |
247 | |
248 | e->template_desc->fields[i]->field_show(m, IMA_SHOW_ASCII, |
249 | &e->template_data[i]); |
250 | } |
251 | seq_puts(m, s: "\n" ); |
252 | return 0; |
253 | } |
254 | |
255 | static const struct seq_operations ima_ascii_measurements_seqops = { |
256 | .start = ima_measurements_start, |
257 | .next = ima_measurements_next, |
258 | .stop = ima_measurements_stop, |
259 | .show = ima_ascii_measurements_show |
260 | }; |
261 | |
262 | static int ima_ascii_measurements_open(struct inode *inode, struct file *file) |
263 | { |
264 | return seq_open(file, &ima_ascii_measurements_seqops); |
265 | } |
266 | |
267 | static const struct file_operations ima_ascii_measurements_ops = { |
268 | .open = ima_ascii_measurements_open, |
269 | .read = seq_read, |
270 | .llseek = seq_lseek, |
271 | .release = seq_release, |
272 | }; |
273 | |
274 | static ssize_t ima_read_policy(char *path) |
275 | { |
276 | void *data = NULL; |
277 | char *datap; |
278 | size_t size; |
279 | int rc, pathlen = strlen(path); |
280 | |
281 | char *p; |
282 | |
283 | /* remove \n */ |
284 | datap = path; |
285 | strsep(&datap, "\n" ); |
286 | |
287 | rc = kernel_read_file_from_path(path, offset: 0, buf: &data, INT_MAX, NULL, |
288 | id: READING_POLICY); |
289 | if (rc < 0) { |
290 | pr_err("Unable to open file: %s (%d)" , path, rc); |
291 | return rc; |
292 | } |
293 | size = rc; |
294 | rc = 0; |
295 | |
296 | datap = data; |
297 | while (size > 0 && (p = strsep(&datap, "\n" ))) { |
298 | pr_debug("rule: %s\n" , p); |
299 | rc = ima_parse_add_rule(p); |
300 | if (rc < 0) |
301 | break; |
302 | size -= rc; |
303 | } |
304 | |
305 | vfree(addr: data); |
306 | if (rc < 0) |
307 | return rc; |
308 | else if (size) |
309 | return -EINVAL; |
310 | else |
311 | return pathlen; |
312 | } |
313 | |
314 | static ssize_t ima_write_policy(struct file *file, const char __user *buf, |
315 | size_t datalen, loff_t *ppos) |
316 | { |
317 | char *data; |
318 | ssize_t result; |
319 | |
320 | if (datalen >= PAGE_SIZE) |
321 | datalen = PAGE_SIZE - 1; |
322 | |
323 | /* No partial writes. */ |
324 | result = -EINVAL; |
325 | if (*ppos != 0) |
326 | goto out; |
327 | |
328 | data = memdup_user_nul(buf, datalen); |
329 | if (IS_ERR(ptr: data)) { |
330 | result = PTR_ERR(ptr: data); |
331 | goto out; |
332 | } |
333 | |
334 | result = mutex_lock_interruptible(&ima_write_mutex); |
335 | if (result < 0) |
336 | goto out_free; |
337 | |
338 | if (data[0] == '/') { |
339 | result = ima_read_policy(path: data); |
340 | } else if (ima_appraise & IMA_APPRAISE_POLICY) { |
341 | pr_err("signed policy file (specified as an absolute pathname) required\n" ); |
342 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, |
343 | op: "policy_update" , cause: "signed policy required" , |
344 | result: 1, info: 0); |
345 | result = -EACCES; |
346 | } else { |
347 | result = ima_parse_add_rule(data); |
348 | } |
349 | mutex_unlock(lock: &ima_write_mutex); |
350 | out_free: |
351 | kfree(objp: data); |
352 | out: |
353 | if (result < 0) |
354 | valid_policy = 0; |
355 | |
356 | return result; |
357 | } |
358 | |
359 | static struct dentry *ima_dir; |
360 | static struct dentry *ima_symlink; |
361 | static struct dentry *binary_runtime_measurements; |
362 | static struct dentry *ascii_runtime_measurements; |
363 | static struct dentry *runtime_measurements_count; |
364 | static struct dentry *violations; |
365 | static struct dentry *ima_policy; |
366 | |
367 | enum ima_fs_flags { |
368 | IMA_FS_BUSY, |
369 | }; |
370 | |
371 | static unsigned long ima_fs_flags; |
372 | |
373 | #ifdef CONFIG_IMA_READ_POLICY |
374 | static const struct seq_operations ima_policy_seqops = { |
375 | .start = ima_policy_start, |
376 | .next = ima_policy_next, |
377 | .stop = ima_policy_stop, |
378 | .show = ima_policy_show, |
379 | }; |
380 | #endif |
381 | |
382 | /* |
383 | * ima_open_policy: sequentialize access to the policy file |
384 | */ |
385 | static int ima_open_policy(struct inode *inode, struct file *filp) |
386 | { |
387 | if (!(filp->f_flags & O_WRONLY)) { |
388 | #ifndef CONFIG_IMA_READ_POLICY |
389 | return -EACCES; |
390 | #else |
391 | if ((filp->f_flags & O_ACCMODE) != O_RDONLY) |
392 | return -EACCES; |
393 | if (!capable(CAP_SYS_ADMIN)) |
394 | return -EPERM; |
395 | return seq_open(filp, &ima_policy_seqops); |
396 | #endif |
397 | } |
398 | if (test_and_set_bit(nr: IMA_FS_BUSY, addr: &ima_fs_flags)) |
399 | return -EBUSY; |
400 | return 0; |
401 | } |
402 | |
403 | /* |
404 | * ima_release_policy - start using the new measure policy rules. |
405 | * |
406 | * Initially, ima_measure points to the default policy rules, now |
407 | * point to the new policy rules, and remove the securityfs policy file, |
408 | * assuming a valid policy. |
409 | */ |
410 | static int ima_release_policy(struct inode *inode, struct file *file) |
411 | { |
412 | const char *cause = valid_policy ? "completed" : "failed" ; |
413 | |
414 | if ((file->f_flags & O_ACCMODE) == O_RDONLY) |
415 | return seq_release(inode, file); |
416 | |
417 | if (valid_policy && ima_check_policy() < 0) { |
418 | cause = "failed" ; |
419 | valid_policy = 0; |
420 | } |
421 | |
422 | pr_info("policy update %s\n" , cause); |
423 | integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, |
424 | op: "policy_update" , cause, result: !valid_policy, info: 0); |
425 | |
426 | if (!valid_policy) { |
427 | ima_delete_rules(); |
428 | valid_policy = 1; |
429 | clear_bit(nr: IMA_FS_BUSY, addr: &ima_fs_flags); |
430 | return 0; |
431 | } |
432 | |
433 | ima_update_policy(); |
434 | #if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY) |
435 | securityfs_remove(ima_policy); |
436 | ima_policy = NULL; |
437 | #elif defined(CONFIG_IMA_WRITE_POLICY) |
438 | clear_bit(nr: IMA_FS_BUSY, addr: &ima_fs_flags); |
439 | #elif defined(CONFIG_IMA_READ_POLICY) |
440 | inode->i_mode &= ~S_IWUSR; |
441 | #endif |
442 | return 0; |
443 | } |
444 | |
445 | static const struct file_operations ima_measure_policy_ops = { |
446 | .open = ima_open_policy, |
447 | .write = ima_write_policy, |
448 | .read = seq_read, |
449 | .release = ima_release_policy, |
450 | .llseek = generic_file_llseek, |
451 | }; |
452 | |
453 | int __init ima_fs_init(void) |
454 | { |
455 | int ret; |
456 | |
457 | ima_dir = securityfs_create_dir(name: "ima" , parent: integrity_dir); |
458 | if (IS_ERR(ptr: ima_dir)) |
459 | return PTR_ERR(ptr: ima_dir); |
460 | |
461 | ima_symlink = securityfs_create_symlink(name: "ima" , NULL, target: "integrity/ima" , |
462 | NULL); |
463 | if (IS_ERR(ptr: ima_symlink)) { |
464 | ret = PTR_ERR(ptr: ima_symlink); |
465 | goto out; |
466 | } |
467 | |
468 | binary_runtime_measurements = |
469 | securityfs_create_file(name: "binary_runtime_measurements" , |
470 | S_IRUSR | S_IRGRP, parent: ima_dir, NULL, |
471 | fops: &ima_measurements_ops); |
472 | if (IS_ERR(ptr: binary_runtime_measurements)) { |
473 | ret = PTR_ERR(ptr: binary_runtime_measurements); |
474 | goto out; |
475 | } |
476 | |
477 | ascii_runtime_measurements = |
478 | securityfs_create_file(name: "ascii_runtime_measurements" , |
479 | S_IRUSR | S_IRGRP, parent: ima_dir, NULL, |
480 | fops: &ima_ascii_measurements_ops); |
481 | if (IS_ERR(ptr: ascii_runtime_measurements)) { |
482 | ret = PTR_ERR(ptr: ascii_runtime_measurements); |
483 | goto out; |
484 | } |
485 | |
486 | runtime_measurements_count = |
487 | securityfs_create_file(name: "runtime_measurements_count" , |
488 | S_IRUSR | S_IRGRP, parent: ima_dir, NULL, |
489 | fops: &ima_measurements_count_ops); |
490 | if (IS_ERR(ptr: runtime_measurements_count)) { |
491 | ret = PTR_ERR(ptr: runtime_measurements_count); |
492 | goto out; |
493 | } |
494 | |
495 | violations = |
496 | securityfs_create_file(name: "violations" , S_IRUSR | S_IRGRP, |
497 | parent: ima_dir, NULL, fops: &ima_htable_violations_ops); |
498 | if (IS_ERR(ptr: violations)) { |
499 | ret = PTR_ERR(ptr: violations); |
500 | goto out; |
501 | } |
502 | |
503 | ima_policy = securityfs_create_file(name: "policy" , POLICY_FILE_FLAGS, |
504 | parent: ima_dir, NULL, |
505 | fops: &ima_measure_policy_ops); |
506 | if (IS_ERR(ptr: ima_policy)) { |
507 | ret = PTR_ERR(ptr: ima_policy); |
508 | goto out; |
509 | } |
510 | |
511 | return 0; |
512 | out: |
513 | securityfs_remove(dentry: ima_policy); |
514 | securityfs_remove(dentry: violations); |
515 | securityfs_remove(dentry: runtime_measurements_count); |
516 | securityfs_remove(dentry: ascii_runtime_measurements); |
517 | securityfs_remove(dentry: binary_runtime_measurements); |
518 | securityfs_remove(dentry: ima_symlink); |
519 | securityfs_remove(dentry: ima_dir); |
520 | |
521 | return ret; |
522 | } |
523 | |