Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2005,2006,2007,2008 IBM Corporation |
| 3 | * |
| 4 | * Authors: |
| 5 | * Reiner Sailer <sailer@watson.ibm.com> |
| 6 | * Serge Hallyn <serue@us.ibm.com> |
| 7 | * Kylene Hall <kylene@us.ibm.com> |
| 8 | * Mimi Zohar <zohar@us.ibm.com> |
| 9 | * |
| 10 | * This program is free software; you can redistribute it and/or |
| 11 | * modify it under the terms of the GNU General Public License as |
| 12 | * published by the Free Software Foundation, version 2 of the |
| 13 | * License. |
| 14 | * |
| 15 | * File: ima_main.c |
Eric Paris | e0d5bd2 | 2009-12-04 15:48:00 -0500 | [diff] [blame] | 16 | * implements the IMA hooks: ima_bprm_check, ima_file_mmap, |
Mimi Zohar | 9bbb6ca | 2010-01-26 17:02:40 -0500 | [diff] [blame] | 17 | * and ima_file_check. |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 18 | */ |
| 19 | #include <linux/module.h> |
| 20 | #include <linux/file.h> |
| 21 | #include <linux/binfmts.h> |
| 22 | #include <linux/mount.h> |
| 23 | #include <linux/mman.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 24 | #include <linux/slab.h> |
James Morris | d5813a5 | 2011-08-30 10:19:50 +1000 | [diff] [blame] | 25 | #include <linux/ima.h> |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 26 | |
| 27 | #include "ima.h" |
| 28 | |
| 29 | int ima_initialized; |
| 30 | |
| 31 | char *ima_hash = "sha1"; |
| 32 | static int __init hash_setup(char *str) |
| 33 | { |
Mimi Zohar | 07ff7a0 | 2009-05-05 13:13:10 -0400 | [diff] [blame] | 34 | if (strncmp(str, "md5", 3) == 0) |
| 35 | ima_hash = "md5"; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 36 | return 1; |
| 37 | } |
| 38 | __setup("ima_hash=", hash_setup); |
| 39 | |
Eric Paris | e0d5bd2 | 2009-12-04 15:48:00 -0500 | [diff] [blame] | 40 | /* |
Mimi Zohar | 890275b5 | 2010-11-02 10:13:07 -0400 | [diff] [blame] | 41 | * ima_rdwr_violation_check |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 42 | * |
Mimi Zohar | 890275b5 | 2010-11-02 10:13:07 -0400 | [diff] [blame] | 43 | * Only invalidate the PCR for measured files: |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 44 | * - Opening a file for write when already open for read, |
| 45 | * results in a time of measure, time of use (ToMToU) error. |
| 46 | * - Opening a file for read when already open for write, |
| 47 | * could result in a file measurement error. |
| 48 | * |
| 49 | */ |
Mimi Zohar | 890275b5 | 2010-11-02 10:13:07 -0400 | [diff] [blame] | 50 | static void ima_rdwr_violation_check(struct file *file) |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 51 | { |
| 52 | struct dentry *dentry = file->f_path.dentry; |
| 53 | struct inode *inode = dentry->d_inode; |
| 54 | fmode_t mode = file->f_mode; |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 55 | int rc; |
Eric Paris | ad16ad0 | 2010-10-25 14:41:45 -0400 | [diff] [blame] | 56 | bool send_tomtou = false, send_writers = false; |
Mimi Zohar | 08e1b76 | 2012-06-20 09:32:55 -0400 | [diff] [blame] | 57 | unsigned char *pathname = NULL, *pathbuf = NULL; |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 58 | |
Mimi Zohar | 890275b5 | 2010-11-02 10:13:07 -0400 | [diff] [blame] | 59 | if (!S_ISREG(inode->i_mode) || !ima_initialized) |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 60 | return; |
Eric Paris | a178d20 | 2010-10-25 14:41:59 -0400 | [diff] [blame] | 61 | |
Mimi Zohar | 890275b5 | 2010-11-02 10:13:07 -0400 | [diff] [blame] | 62 | mutex_lock(&inode->i_mutex); /* file metadata: permissions, xattr */ |
Eric Paris | ad16ad0 | 2010-10-25 14:41:45 -0400 | [diff] [blame] | 63 | |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 64 | if (mode & FMODE_WRITE) { |
Mimi Zohar | a68a27b | 2010-11-02 10:10:56 -0400 | [diff] [blame] | 65 | if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) |
Eric Paris | ad16ad0 | 2010-10-25 14:41:45 -0400 | [diff] [blame] | 66 | send_tomtou = true; |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 67 | goto out; |
| 68 | } |
Eric Paris | ad16ad0 | 2010-10-25 14:41:45 -0400 | [diff] [blame] | 69 | |
Mimi Zohar | 1adace9 | 2011-02-22 10:19:43 -0500 | [diff] [blame] | 70 | rc = ima_must_measure(inode, MAY_READ, FILE_CHECK); |
Eric Paris | bade72d | 2010-10-25 14:42:25 -0400 | [diff] [blame] | 71 | if (rc < 0) |
| 72 | goto out; |
| 73 | |
Eric Paris | ad16ad0 | 2010-10-25 14:41:45 -0400 | [diff] [blame] | 74 | if (atomic_read(&inode->i_writecount) > 0) |
| 75 | send_writers = true; |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 76 | out: |
Mimi Zohar | 890275b5 | 2010-11-02 10:13:07 -0400 | [diff] [blame] | 77 | mutex_unlock(&inode->i_mutex); |
Eric Paris | ad16ad0 | 2010-10-25 14:41:45 -0400 | [diff] [blame] | 78 | |
Mimi Zohar | 08e1b76 | 2012-06-20 09:32:55 -0400 | [diff] [blame] | 79 | if (!send_tomtou && !send_writers) |
| 80 | return; |
| 81 | |
| 82 | /* We will allow 11 spaces for ' (deleted)' to be appended */ |
| 83 | pathbuf = kmalloc(PATH_MAX + 11, GFP_KERNEL); |
| 84 | if (pathbuf) { |
| 85 | pathname = d_path(&file->f_path, pathbuf, PATH_MAX + 11); |
| 86 | if (IS_ERR(pathname)) |
| 87 | pathname = NULL; |
| 88 | else if (strlen(pathname) > IMA_EVENT_NAME_LEN_MAX) |
| 89 | pathname = NULL; |
| 90 | } |
Eric Paris | ad16ad0 | 2010-10-25 14:41:45 -0400 | [diff] [blame] | 91 | if (send_tomtou) |
Mimi Zohar | 08e1b76 | 2012-06-20 09:32:55 -0400 | [diff] [blame] | 92 | ima_add_violation(inode, |
| 93 | !pathname ? dentry->d_name.name : pathname, |
| 94 | "invalid_pcr", "ToMToU"); |
Eric Paris | ad16ad0 | 2010-10-25 14:41:45 -0400 | [diff] [blame] | 95 | if (send_writers) |
Mimi Zohar | 08e1b76 | 2012-06-20 09:32:55 -0400 | [diff] [blame] | 96 | ima_add_violation(inode, |
| 97 | !pathname ? dentry->d_name.name : pathname, |
| 98 | "invalid_pcr", "open_writers"); |
| 99 | kfree(pathbuf); |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 100 | } |
| 101 | |
Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 102 | static void ima_check_last_writer(struct integrity_iint_cache *iint, |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 103 | struct inode *inode, |
| 104 | struct file *file) |
| 105 | { |
Al Viro | 4b2a2c6 | 2011-07-26 04:30:35 -0400 | [diff] [blame] | 106 | fmode_t mode = file->f_mode; |
Eric Paris | 497f323 | 2010-10-25 14:41:32 -0400 | [diff] [blame] | 107 | |
Mimi Zohar | 854fdd5 | 2010-11-02 10:14:22 -0400 | [diff] [blame] | 108 | mutex_lock(&iint->mutex); |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 109 | if (mode & FMODE_WRITE && |
| 110 | atomic_read(&inode->i_writecount) == 1 && |
| 111 | iint->version != inode->i_version) |
| 112 | iint->flags &= ~IMA_MEASURED; |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 113 | mutex_unlock(&iint->mutex); |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 114 | } |
| 115 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 116 | /** |
| 117 | * ima_file_free - called on __fput() |
| 118 | * @file: pointer to file structure being freed |
| 119 | * |
Mimi Zohar | 890275b5 | 2010-11-02 10:13:07 -0400 | [diff] [blame] | 120 | * Flag files that changed, based on i_version |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 121 | */ |
| 122 | void ima_file_free(struct file *file) |
| 123 | { |
| 124 | struct inode *inode = file->f_dentry->d_inode; |
Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 125 | struct integrity_iint_cache *iint; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 126 | |
Mimi Zohar | e950598 | 2010-08-31 09:38:51 -0400 | [diff] [blame] | 127 | if (!iint_initialized || !S_ISREG(inode->i_mode)) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 128 | return; |
Eric Paris | 196f518 | 2010-10-25 14:42:19 -0400 | [diff] [blame] | 129 | |
Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 130 | iint = integrity_iint_find(inode); |
Mimi Zohar | 854fdd5 | 2010-11-02 10:14:22 -0400 | [diff] [blame] | 131 | if (!iint) |
| 132 | return; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 133 | |
Mimi Zohar | 854fdd5 | 2010-11-02 10:14:22 -0400 | [diff] [blame] | 134 | ima_check_last_writer(iint, inode, file); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 135 | } |
| 136 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 137 | static int process_measurement(struct file *file, const unsigned char *filename, |
| 138 | int mask, int function) |
| 139 | { |
| 140 | struct inode *inode = file->f_dentry->d_inode; |
Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 141 | struct integrity_iint_cache *iint; |
Mimi Zohar | 08e1b76 | 2012-06-20 09:32:55 -0400 | [diff] [blame] | 142 | unsigned char *pathname = NULL, *pathbuf = NULL; |
Mimi Zohar | e950598 | 2010-08-31 09:38:51 -0400 | [diff] [blame] | 143 | int rc = 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 144 | |
| 145 | if (!ima_initialized || !S_ISREG(inode->i_mode)) |
| 146 | return 0; |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 147 | |
Mimi Zohar | 1adace9 | 2011-02-22 10:19:43 -0500 | [diff] [blame] | 148 | rc = ima_must_measure(inode, mask, function); |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 149 | if (rc != 0) |
| 150 | return rc; |
| 151 | retry: |
Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 152 | iint = integrity_iint_find(inode); |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 153 | if (!iint) { |
Mimi Zohar | f381c27 | 2011-03-09 14:13:22 -0500 | [diff] [blame] | 154 | rc = integrity_inode_alloc(inode); |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 155 | if (!rc || rc == -EEXIST) |
| 156 | goto retry; |
| 157 | return rc; |
| 158 | } |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 159 | |
| 160 | mutex_lock(&iint->mutex); |
Eric Paris | bc7d2a3 | 2010-10-25 14:42:05 -0400 | [diff] [blame] | 161 | |
Mimi Zohar | 1adace9 | 2011-02-22 10:19:43 -0500 | [diff] [blame] | 162 | rc = iint->flags & IMA_MEASURED ? 1 : 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 163 | if (rc != 0) |
| 164 | goto out; |
| 165 | |
| 166 | rc = ima_collect_measurement(iint, file); |
Mimi Zohar | 08e1b76 | 2012-06-20 09:32:55 -0400 | [diff] [blame] | 167 | if (rc != 0) |
| 168 | goto out; |
| 169 | |
| 170 | if (function != BPRM_CHECK) { |
| 171 | /* We will allow 11 spaces for ' (deleted)' to be appended */ |
| 172 | pathbuf = kmalloc(PATH_MAX + 11, GFP_KERNEL); |
| 173 | if (pathbuf) { |
| 174 | pathname = |
| 175 | d_path(&file->f_path, pathbuf, PATH_MAX + 11); |
| 176 | if (IS_ERR(pathname)) |
| 177 | pathname = NULL; |
| 178 | } |
| 179 | } |
| 180 | ima_store_measurement(iint, file, !pathname ? filename : pathname); |
| 181 | kfree(pathbuf); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 182 | out: |
| 183 | mutex_unlock(&iint->mutex); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 184 | return rc; |
| 185 | } |
| 186 | |
| 187 | /** |
| 188 | * ima_file_mmap - based on policy, collect/store measurement. |
| 189 | * @file: pointer to the file to be measured (May be NULL) |
| 190 | * @prot: contains the protection that will be applied by the kernel. |
| 191 | * |
| 192 | * Measure files being mmapped executable based on the ima_must_measure() |
| 193 | * policy decision. |
| 194 | * |
| 195 | * Return 0 on success, an error code on failure. |
| 196 | * (Based on the results of appraise_measurement().) |
| 197 | */ |
| 198 | int ima_file_mmap(struct file *file, unsigned long prot) |
| 199 | { |
| 200 | int rc; |
| 201 | |
| 202 | if (!file) |
| 203 | return 0; |
| 204 | if (prot & PROT_EXEC) |
| 205 | rc = process_measurement(file, file->f_dentry->d_name.name, |
| 206 | MAY_EXEC, FILE_MMAP); |
| 207 | return 0; |
| 208 | } |
| 209 | |
| 210 | /** |
| 211 | * ima_bprm_check - based on policy, collect/store measurement. |
| 212 | * @bprm: contains the linux_binprm structure |
| 213 | * |
| 214 | * The OS protects against an executable file, already open for write, |
| 215 | * from being executed in deny_write_access() and an executable file, |
| 216 | * already open for execute, from being modified in get_write_access(). |
| 217 | * So we can be certain that what we verify and measure here is actually |
| 218 | * what is being executed. |
| 219 | * |
| 220 | * Return 0 on success, an error code on failure. |
| 221 | * (Based on the results of appraise_measurement().) |
| 222 | */ |
| 223 | int ima_bprm_check(struct linux_binprm *bprm) |
| 224 | { |
| 225 | int rc; |
| 226 | |
Mimi Zohar | fbbb456 | 2012-05-14 21:50:11 -0400 | [diff] [blame] | 227 | rc = process_measurement(bprm->file, |
| 228 | (strcmp(bprm->filename, bprm->interp) == 0) ? |
| 229 | bprm->filename : bprm->interp, |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 230 | MAY_EXEC, BPRM_CHECK); |
| 231 | return 0; |
| 232 | } |
| 233 | |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 234 | /** |
| 235 | * ima_path_check - based on policy, collect/store measurement. |
| 236 | * @file: pointer to the file to be measured |
| 237 | * @mask: contains MAY_READ, MAY_WRITE or MAY_EXECUTE |
| 238 | * |
| 239 | * Measure files based on the ima_must_measure() policy decision. |
| 240 | * |
| 241 | * Always return 0 and audit dentry_open failures. |
| 242 | * (Return code will be based upon measurement appraisal.) |
| 243 | */ |
Mimi Zohar | 9bbb6ca | 2010-01-26 17:02:40 -0500 | [diff] [blame] | 244 | int ima_file_check(struct file *file, int mask) |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 245 | { |
| 246 | int rc; |
| 247 | |
Mimi Zohar | 890275b5 | 2010-11-02 10:13:07 -0400 | [diff] [blame] | 248 | ima_rdwr_violation_check(file); |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 249 | rc = process_measurement(file, file->f_dentry->d_name.name, |
| 250 | mask & (MAY_READ | MAY_WRITE | MAY_EXEC), |
Mimi Zohar | 1e93d00 | 2010-01-26 17:02:41 -0500 | [diff] [blame] | 251 | FILE_CHECK); |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 252 | return 0; |
| 253 | } |
Mimi Zohar | 9bbb6ca | 2010-01-26 17:02:40 -0500 | [diff] [blame] | 254 | EXPORT_SYMBOL_GPL(ima_file_check); |
Mimi Zohar | 8eb988c | 2010-01-20 15:35:41 -0500 | [diff] [blame] | 255 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 256 | static int __init init_ima(void) |
| 257 | { |
| 258 | int error; |
| 259 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 260 | error = ima_init(); |
Dmitry Kasatkin | 7ff2267 | 2012-06-25 12:18:11 +0300 | [diff] [blame] | 261 | if (!error) |
| 262 | ima_initialized = 1; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 263 | return error; |
| 264 | } |
| 265 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 266 | late_initcall(init_ima); /* Start IMA after the TPM is available */ |
| 267 | |
| 268 | MODULE_DESCRIPTION("Integrity Measurement Architecture"); |
| 269 | MODULE_LICENSE("GPL"); |