security/integrity/ima/ima_main.c

   1 /*
   2  * Copyright (C) 2005,2006,2007,2008 IBM Corporation
   3  *
   4  * Authors:
   5  * Reiner Sailer <sailer@watson.ibm.com>
   6  * Serge Hallyn <serue@us.ibm.com>
   7  * Kylene Hall <kylene@us.ibm.com>
   8  * Mimi Zohar <zohar@us.ibm.com>
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License as
  12  * published by the Free Software Foundation, version 2 of the
  13  * License.
  14  *
  15  * File: ima_main.c
  16  *      implements the IMA hooks: ima_bprm_check, ima_file_mmap,
  17  *      and ima_file_check.
  18  */
  19 #include <linux/module.h>
  20 #include <linux/file.h>
  21 #include <linux/binfmts.h>
  22 #include <linux/mount.h>
  23 #include <linux/mman.h>
  24 #include <linux/slab.h>
  25 #include <linux/xattr.h>
  26 #include <linux/ima.h>
  27
  28 #include "ima.h"
  29
  30 int ima_initialized;
  31
  32 #ifdef CONFIG_IMA_APPRAISE
  33 int ima_appraise = IMA_APPRAISE_ENFORCE;
  34 #else
  35 int ima_appraise;
  36 #endif
  37
  38 char *ima_hash = "sha1";
  39 static int __init hash_setup(char *str)
  40 {
  41         if (strncmp(str, "md5", 3) == 0)
  42                 ima_hash = "md5";
  43         return 1;
  44 }
  45 __setup("ima_hash=", hash_setup);
  46
  47 /*
  48  * ima_rdwr_violation_check
  49  *
  50  * Only invalidate the PCR for measured files:
  51  *      - Opening a file for write when already open for read,
  52  *        results in a time of measure, time of use (ToMToU) error.
  53  *      - Opening a file for read when already open for write,
  54  *        could result in a file measurement error.
  55  *
  56  */
  57 static void ima_rdwr_violation_check(struct file *file)
  58 {
  59         struct dentry *dentry = file->f_path.dentry;
  60         struct inode *inode = dentry->d_inode;
  61         fmode_t mode = file->f_mode;
  62         int must_measure;
  63         bool send_tomtou = false, send_writers = false;
  64         char *pathbuf = NULL;
  65         const char *pathname;
  66
  67         if (!S_ISREG(inode->i_mode) || !ima_initialized)
  68                 return;
  69
  70         mutex_lock(&inode->i_mutex);    /* file metadata: permissions, xattr */
  71
  72         if (mode & FMODE_WRITE) {
  73                 if (atomic_read(&inode->i_readcount) && IS_IMA(inode))
  74                         send_tomtou = true;
  75                 goto out;
  76         }
  77
  78         must_measure = ima_must_measure(inode, MAY_READ, FILE_CHECK);
  79         if (!must_measure)
  80                 goto out;
  81
  82         if (atomic_read(&inode->i_writecount) > 0)
  83                 send_writers = true;
  84 out:
  85         mutex_unlock(&inode->i_mutex);
  86
  87         if (!send_tomtou && !send_writers)
  88                 return;
  89
  90         pathname = ima_d_path(&file->f_path, &pathbuf);
  91         if (!pathname || strlen(pathname) > IMA_EVENT_NAME_LEN_MAX)
  92                 pathname = dentry->d_name.name;
  93
  94         if (send_tomtou)
  95                 ima_add_violation(inode, pathname,
  96                                   "invalid_pcr", "ToMToU");
  97         if (send_writers)
  98                 ima_add_violation(inode, pathname,
  99                                   "invalid_pcr", "open_writers");
 100         kfree(pathbuf);
 101 }
 102
 103 static void ima_check_last_writer(struct integrity_iint_cache *iint,
 104                                   struct inode *inode, struct file *file)
 105 {
 106         fmode_t mode = file->f_mode;
 107
 108         if (!(mode & FMODE_WRITE))
 109                 return;
 110
 111         mutex_lock(&inode->i_mutex);
 112         if (atomic_read(&inode->i_writecount) == 1 &&
 113             iint->version != inode->i_version) {
 114                 iint->flags &= ~IMA_DONE_MASK;
 115                 if (iint->flags & IMA_APPRAISE)
 116                         ima_update_xattr(iint, file);
 117         }
 118         mutex_unlock(&inode->i_mutex);
 119 }
 120
 121 /**
 122  * ima_file_free - called on __fput()
 123  * @file: pointer to file structure being freed
 124  *
 125  * Flag files that changed, based on i_version
 126  */
 127 void ima_file_free(struct file *file)
 128 {
 129         struct inode *inode = file_inode(file);
 130         struct integrity_iint_cache *iint;
 131
 132         if (!iint_initialized || !S_ISREG(inode->i_mode))
 133                 return;
 134
 135         iint = integrity_iint_find(inode);
 136         if (!iint)
 137                 return;
 138
 139         ima_check_last_writer(iint, inode, file);
 140 }
 141
 142 static int process_measurement(struct file *file, const char *filename,
 143                                int mask, int function)
 144 {
 145         struct inode *inode = file_inode(file);
 146         struct integrity_iint_cache *iint;
 147         char *pathbuf = NULL;
 148         const char *pathname = NULL;
 149         int rc = -ENOMEM, action, must_appraise, _func;
 150
 151         if (!ima_initialized || !S_ISREG(inode->i_mode))
 152                 return 0;
 153
 154         /* Return an IMA_MEASURE, IMA_APPRAISE, IMA_AUDIT action
 155          * bitmask based on the appraise/audit/measurement policy.
 156          * Included is the appraise submask.
 157          */
 158         action = ima_get_action(inode, mask, function);
 159         if (!action)
 160                 return 0;
 161
 162         must_appraise = action & IMA_APPRAISE;
 163
 164         /*  Is the appraise rule hook specific?  */
 165         _func = (action & IMA_FILE_APPRAISE) ? FILE_CHECK : function;
 166
 167         mutex_lock(&inode->i_mutex);
 168
 169         iint = integrity_inode_get(inode);
 170         if (!iint)
 171                 goto out;
 172
 173         /* Determine if already appraised/measured based on bitmask
 174          * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,
 175          *  IMA_AUDIT, IMA_AUDITED)
 176          */
 177         iint->flags |= action;
 178         action &= IMA_DO_MASK;
 179         action &= ~((iint->flags & IMA_DONE_MASK) >> 1);
 180
 181         /* Nothing to do, just return existing appraised status */
 182         if (!action) {
 183                 if (must_appraise)
 184                         rc = ima_get_cache_status(iint, _func);
 185                 goto out_digsig;
 186         }
 187
 188         rc = ima_collect_measurement(iint, file);
 189         if (rc != 0)
 190                 goto out_digsig;
 191
 192         pathname = !filename ? ima_d_path(&file->f_path, &pathbuf) : filename;
 193         if (!pathname)
 194                 pathname = (const char *)file->f_dentry->d_name.name;
 195
 196         if (action & IMA_MEASURE)
 197                 ima_store_measurement(iint, file, pathname);
 198         if (action & IMA_APPRAISE_SUBMASK)
 199                 rc = ima_appraise_measurement(_func, iint, file, pathname);
 200         if (action & IMA_AUDIT)
 201                 ima_audit_measurement(iint, pathname);
 202         kfree(pathbuf);
 203 out_digsig:
 204         if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG))
 205                 rc = -EACCES;
 206 out:
 207         mutex_unlock(&inode->i_mutex);
 208         if ((rc && must_appraise) && (ima_appraise & IMA_APPRAISE_ENFORCE))
 209                 return -EACCES;
 210         return 0;
 211 }
 212
 213 /**
 214  * ima_file_mmap - based on policy, collect/store measurement.
 215  * @file: pointer to the file to be measured (May be NULL)
 216  * @prot: contains the protection that will be applied by the kernel.
 217  *
 218  * Measure files being mmapped executable based on the ima_must_measure()
 219  * policy decision.
 220  *
 221  * On success return 0.  On integrity appraisal error, assuming the file
 222  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
 223  */
 224 int ima_file_mmap(struct file *file, unsigned long prot)
 225 {
 226         if (file && (prot & PROT_EXEC))
 227                 return process_measurement(file, NULL, MAY_EXEC, MMAP_CHECK);
 228         return 0;
 229 }
 230
 231 /**
 232  * ima_bprm_check - based on policy, collect/store measurement.
 233  * @bprm: contains the linux_binprm structure
 234  *
 235  * The OS protects against an executable file, already open for write,
 236  * from being executed in deny_write_access() and an executable file,
 237  * already open for execute, from being modified in get_write_access().
 238  * So we can be certain that what we verify and measure here is actually
 239  * what is being executed.
 240  *
 241  * On success return 0.  On integrity appraisal error, assuming the file
 242  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
 243  */
 244 int ima_bprm_check(struct linux_binprm *bprm)
 245 {
 246         return process_measurement(bprm->file,
 247                                  (strcmp(bprm->filename, bprm->interp) == 0) ?
 248                                  bprm->filename : bprm->interp,
 249                                  MAY_EXEC, BPRM_CHECK);
 250 }
 251
 252 /**
 253  * ima_path_check - based on policy, collect/store measurement.
 254  * @file: pointer to the file to be measured
 255  * @mask: contains MAY_READ, MAY_WRITE or MAY_EXECUTE
 256  *
 257  * Measure files based on the ima_must_measure() policy decision.
 258  *
 259  * On success return 0.  On integrity appraisal error, assuming the file
 260  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
 261  */
 262 int ima_file_check(struct file *file, int mask)
 263 {
 264         ima_rdwr_violation_check(file);
 265         return process_measurement(file, NULL,
 266                                  mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
 267                                  FILE_CHECK);
 268 }
 269 EXPORT_SYMBOL_GPL(ima_file_check);
 270
 271 /**
 272  * ima_module_check - based on policy, collect/store/appraise measurement.
 273  * @file: pointer to the file to be measured/appraised
 274  *
 275  * Measure/appraise kernel modules based on policy.
 276  *
 277  * On success return 0.  On integrity appraisal error, assuming the file
 278  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
 279  */
 280 int ima_module_check(struct file *file)
 281 {
 282         if (!file) {
 283 #ifndef CONFIG_MODULE_SIG_FORCE
 284                 if ((ima_appraise & IMA_APPRAISE_MODULES) &&
 285                     (ima_appraise & IMA_APPRAISE_ENFORCE))
 286                         return -EACCES; /* INTEGRITY_UNKNOWN */
 287 #endif
 288                 return 0;       /* We rely on module signature checking */
 289         }
 290         return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK);
 291 }
 292
 293 static int __init init_ima(void)
 294 {
 295         int error;
 296
 297         error = ima_init();
 298         if (!error)
 299                 ima_initialized = 1;
 300         return error;
 301 }
 302
 303 late_initcall(init_ima);        /* Start IMA after the TPM is available */
 304
 305 MODULE_DESCRIPTION("Integrity Measurement Architecture");
 306 MODULE_LICENSE("GPL");