1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2011 IBM Corporation 4 * 5 * Author: 6 * Mimi Zohar <zohar@us.ibm.com> 7 */ 8 #include <linux/init.h> 9 #include <linux/file.h> 10 #include <linux/fs.h> 11 #include <linux/xattr.h> 12 #include <linux/magic.h> 13 #include <linux/ima.h> 14 #include <linux/evm.h> 15 16 #include "ima.h" 17 18 static int __init default_appraise_setup(char *str) 19 { 20 #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM 21 if (strncmp(str, "off", 3) == 0) 22 ima_appraise = 0; 23 else if (strncmp(str, "log", 3) == 0) 24 ima_appraise = IMA_APPRAISE_LOG; 25 else if (strncmp(str, "fix", 3) == 0) 26 ima_appraise = IMA_APPRAISE_FIX; 27 #endif 28 return 1; 29 } 30 31 __setup("ima_appraise=", default_appraise_setup); 32 33 /* 34 * is_ima_appraise_enabled - return appraise status 35 * 36 * Only return enabled, if not in ima_appraise="fix" or "log" modes. 37 */ 38 bool is_ima_appraise_enabled(void) 39 { 40 return ima_appraise & IMA_APPRAISE_ENFORCE; 41 } 42 43 /* 44 * ima_must_appraise - set appraise flag 45 * 46 * Return 1 to appraise or hash 47 */ 48 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func) 49 { 50 u32 secid; 51 52 if (!ima_appraise) 53 return 0; 54 55 security_task_getsecid(current, &secid); 56 return ima_match_policy(inode, current_cred(), secid, func, mask, 57 IMA_APPRAISE | IMA_HASH, NULL); 58 } 59 60 static int ima_fix_xattr(struct dentry *dentry, 61 struct integrity_iint_cache *iint) 62 { 63 int rc, offset; 64 u8 algo = iint->ima_hash->algo; 65 66 if (algo <= HASH_ALGO_SHA1) { 67 offset = 1; 68 iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST; 69 } else { 70 offset = 0; 71 iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG; 72 iint->ima_hash->xattr.ng.algo = algo; 73 } 74 rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA, 75 &iint->ima_hash->xattr.data[offset], 76 (sizeof(iint->ima_hash->xattr) - offset) + 77 iint->ima_hash->length, 0); 78 return rc; 79 } 80 81 /* Return specific func appraised cached result */ 82 enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint, 83 enum ima_hooks func) 84 { 85 switch (func) { 86 case MMAP_CHECK: 87 return iint->ima_mmap_status; 88 case BPRM_CHECK: 89 return iint->ima_bprm_status; 90 case CREDS_CHECK: 91 return iint->ima_creds_status; 92 case FILE_CHECK: 93 case POST_SETATTR: 94 return iint->ima_file_status; 95 case MODULE_CHECK ... MAX_CHECK - 1: 96 default: 97 return iint->ima_read_status; 98 } 99 } 100 101 static void ima_set_cache_status(struct integrity_iint_cache *iint, 102 enum ima_hooks func, 103 enum integrity_status status) 104 { 105 switch (func) { 106 case MMAP_CHECK: 107 iint->ima_mmap_status = status; 108 break; 109 case BPRM_CHECK: 110 iint->ima_bprm_status = status; 111 break; 112 case CREDS_CHECK: 113 iint->ima_creds_status = status; 114 break; 115 case FILE_CHECK: 116 case POST_SETATTR: 117 iint->ima_file_status = status; 118 break; 119 case MODULE_CHECK ... MAX_CHECK - 1: 120 default: 121 iint->ima_read_status = status; 122 break; 123 } 124 } 125 126 static void ima_cache_flags(struct integrity_iint_cache *iint, 127 enum ima_hooks func) 128 { 129 switch (func) { 130 case MMAP_CHECK: 131 iint->flags |= (IMA_MMAP_APPRAISED | IMA_APPRAISED); 132 break; 133 case BPRM_CHECK: 134 iint->flags |= (IMA_BPRM_APPRAISED | IMA_APPRAISED); 135 break; 136 case CREDS_CHECK: 137 iint->flags |= (IMA_CREDS_APPRAISED | IMA_APPRAISED); 138 break; 139 case FILE_CHECK: 140 case POST_SETATTR: 141 iint->flags |= (IMA_FILE_APPRAISED | IMA_APPRAISED); 142 break; 143 case MODULE_CHECK ... MAX_CHECK - 1: 144 default: 145 iint->flags |= (IMA_READ_APPRAISED | IMA_APPRAISED); 146 break; 147 } 148 } 149 150 enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, 151 int xattr_len) 152 { 153 struct signature_v2_hdr *sig; 154 enum hash_algo ret; 155 156 if (!xattr_value || xattr_len < 2) 157 /* return default hash algo */ 158 return ima_hash_algo; 159 160 switch (xattr_value->type) { 161 case EVM_IMA_XATTR_DIGSIG: 162 sig = (typeof(sig))xattr_value; 163 if (sig->version != 2 || xattr_len <= sizeof(*sig)) 164 return ima_hash_algo; 165 return sig->hash_algo; 166 break; 167 case IMA_XATTR_DIGEST_NG: 168 ret = xattr_value->digest[0]; 169 if (ret < HASH_ALGO__LAST) 170 return ret; 171 break; 172 case IMA_XATTR_DIGEST: 173 /* this is for backward compatibility */ 174 if (xattr_len == 21) { 175 unsigned int zero = 0; 176 if (!memcmp(&xattr_value->digest[16], &zero, 4)) 177 return HASH_ALGO_MD5; 178 else 179 return HASH_ALGO_SHA1; 180 } else if (xattr_len == 17) 181 return HASH_ALGO_MD5; 182 break; 183 } 184 185 /* return default hash algo */ 186 return ima_hash_algo; 187 } 188 189 int ima_read_xattr(struct dentry *dentry, 190 struct evm_ima_xattr_data **xattr_value) 191 { 192 ssize_t ret; 193 194 ret = vfs_getxattr_alloc(dentry, XATTR_NAME_IMA, (char **)xattr_value, 195 0, GFP_NOFS); 196 if (ret == -EOPNOTSUPP) 197 ret = 0; 198 return ret; 199 } 200 201 /* 202 * ima_appraise_measurement - appraise file measurement 203 * 204 * Call evm_verifyxattr() to verify the integrity of 'security.ima'. 205 * Assuming success, compare the xattr hash with the collected measurement. 206 * 207 * Return 0 on success, error code otherwise 208 */ 209 int ima_appraise_measurement(enum ima_hooks func, 210 struct integrity_iint_cache *iint, 211 struct file *file, const unsigned char *filename, 212 struct evm_ima_xattr_data *xattr_value, 213 int xattr_len) 214 { 215 static const char op[] = "appraise_data"; 216 const char *cause = "unknown"; 217 struct dentry *dentry = file_dentry(file); 218 struct inode *inode = d_backing_inode(dentry); 219 enum integrity_status status = INTEGRITY_UNKNOWN; 220 int rc = xattr_len, hash_start = 0; 221 222 if (!(inode->i_opflags & IOP_XATTR)) 223 return INTEGRITY_UNKNOWN; 224 225 if (rc <= 0) { 226 if (rc && rc != -ENODATA) 227 goto out; 228 229 cause = iint->flags & IMA_DIGSIG_REQUIRED ? 230 "IMA-signature-required" : "missing-hash"; 231 status = INTEGRITY_NOLABEL; 232 if (file->f_mode & FMODE_CREATED) 233 iint->flags |= IMA_NEW_FILE; 234 if ((iint->flags & IMA_NEW_FILE) && 235 (!(iint->flags & IMA_DIGSIG_REQUIRED) || 236 (inode->i_size == 0))) 237 status = INTEGRITY_PASS; 238 goto out; 239 } 240 241 status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint); 242 switch (status) { 243 case INTEGRITY_PASS: 244 case INTEGRITY_PASS_IMMUTABLE: 245 case INTEGRITY_UNKNOWN: 246 break; 247 case INTEGRITY_NOXATTRS: /* No EVM protected xattrs. */ 248 case INTEGRITY_NOLABEL: /* No security.evm xattr. */ 249 cause = "missing-HMAC"; 250 goto out; 251 case INTEGRITY_FAIL: /* Invalid HMAC/signature. */ 252 cause = "invalid-HMAC"; 253 goto out; 254 default: 255 WARN_ONCE(true, "Unexpected integrity status %d\n", status); 256 } 257 258 switch (xattr_value->type) { 259 case IMA_XATTR_DIGEST_NG: 260 /* first byte contains algorithm id */ 261 hash_start = 1; 262 /* fall through */ 263 case IMA_XATTR_DIGEST: 264 if (iint->flags & IMA_DIGSIG_REQUIRED) { 265 cause = "IMA-signature-required"; 266 status = INTEGRITY_FAIL; 267 break; 268 } 269 clear_bit(IMA_DIGSIG, &iint->atomic_flags); 270 if (xattr_len - sizeof(xattr_value->type) - hash_start >= 271 iint->ima_hash->length) 272 /* xattr length may be longer. md5 hash in previous 273 version occupied 20 bytes in xattr, instead of 16 274 */ 275 rc = memcmp(&xattr_value->digest[hash_start], 276 iint->ima_hash->digest, 277 iint->ima_hash->length); 278 else 279 rc = -EINVAL; 280 if (rc) { 281 cause = "invalid-hash"; 282 status = INTEGRITY_FAIL; 283 break; 284 } 285 status = INTEGRITY_PASS; 286 break; 287 case EVM_IMA_XATTR_DIGSIG: 288 set_bit(IMA_DIGSIG, &iint->atomic_flags); 289 rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA, 290 (const char *)xattr_value, 291 xattr_len, 292 iint->ima_hash->digest, 293 iint->ima_hash->length); 294 if (rc == -EOPNOTSUPP) { 295 status = INTEGRITY_UNKNOWN; 296 break; 297 } 298 if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc && 299 func == KEXEC_KERNEL_CHECK) 300 rc = integrity_digsig_verify(INTEGRITY_KEYRING_PLATFORM, 301 (const char *)xattr_value, 302 xattr_len, 303 iint->ima_hash->digest, 304 iint->ima_hash->length); 305 if (rc) { 306 cause = "invalid-signature"; 307 status = INTEGRITY_FAIL; 308 } else { 309 status = INTEGRITY_PASS; 310 } 311 break; 312 default: 313 status = INTEGRITY_UNKNOWN; 314 cause = "unknown-ima-data"; 315 break; 316 } 317 318 out: 319 /* 320 * File signatures on some filesystems can not be properly verified. 321 * When such filesystems are mounted by an untrusted mounter or on a 322 * system not willing to accept such a risk, fail the file signature 323 * verification. 324 */ 325 if ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) && 326 ((inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER) || 327 (iint->flags & IMA_FAIL_UNVERIFIABLE_SIGS))) { 328 status = INTEGRITY_FAIL; 329 cause = "unverifiable-signature"; 330 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, 331 op, cause, rc, 0); 332 } else if (status != INTEGRITY_PASS) { 333 /* Fix mode, but don't replace file signatures. */ 334 if ((ima_appraise & IMA_APPRAISE_FIX) && 335 (!xattr_value || 336 xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { 337 if (!ima_fix_xattr(dentry, iint)) 338 status = INTEGRITY_PASS; 339 } 340 341 /* Permit new files with file signatures, but without data. */ 342 if (inode->i_size == 0 && iint->flags & IMA_NEW_FILE && 343 xattr_value && xattr_value->type == EVM_IMA_XATTR_DIGSIG) { 344 status = INTEGRITY_PASS; 345 } 346 347 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, 348 op, cause, rc, 0); 349 } else { 350 ima_cache_flags(iint, func); 351 } 352 353 ima_set_cache_status(iint, func, status); 354 return status; 355 } 356 357 /* 358 * ima_update_xattr - update 'security.ima' hash value 359 */ 360 void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file) 361 { 362 struct dentry *dentry = file_dentry(file); 363 int rc = 0; 364 365 /* do not collect and update hash for digital signatures */ 366 if (test_bit(IMA_DIGSIG, &iint->atomic_flags)) 367 return; 368 369 if ((iint->ima_file_status != INTEGRITY_PASS) && 370 !(iint->flags & IMA_HASH)) 371 return; 372 373 rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo); 374 if (rc < 0) 375 return; 376 377 inode_lock(file_inode(file)); 378 ima_fix_xattr(dentry, iint); 379 inode_unlock(file_inode(file)); 380 } 381 382 /** 383 * ima_inode_post_setattr - reflect file metadata changes 384 * @dentry: pointer to the affected dentry 385 * 386 * Changes to a dentry's metadata might result in needing to appraise. 387 * 388 * This function is called from notify_change(), which expects the caller 389 * to lock the inode's i_mutex. 390 */ 391 void ima_inode_post_setattr(struct dentry *dentry) 392 { 393 struct inode *inode = d_backing_inode(dentry); 394 struct integrity_iint_cache *iint; 395 int action; 396 397 if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode) 398 || !(inode->i_opflags & IOP_XATTR)) 399 return; 400 401 action = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR); 402 if (!action) 403 __vfs_removexattr(dentry, XATTR_NAME_IMA); 404 iint = integrity_iint_find(inode); 405 if (iint) { 406 set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags); 407 if (!action) 408 clear_bit(IMA_UPDATE_XATTR, &iint->atomic_flags); 409 } 410 } 411 412 /* 413 * ima_protect_xattr - protect 'security.ima' 414 * 415 * Ensure that not just anyone can modify or remove 'security.ima'. 416 */ 417 static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name, 418 const void *xattr_value, size_t xattr_value_len) 419 { 420 if (strcmp(xattr_name, XATTR_NAME_IMA) == 0) { 421 if (!capable(CAP_SYS_ADMIN)) 422 return -EPERM; 423 return 1; 424 } 425 return 0; 426 } 427 428 static void ima_reset_appraise_flags(struct inode *inode, int digsig) 429 { 430 struct integrity_iint_cache *iint; 431 432 if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)) 433 return; 434 435 iint = integrity_iint_find(inode); 436 if (!iint) 437 return; 438 iint->measured_pcrs = 0; 439 set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags); 440 if (digsig) 441 set_bit(IMA_DIGSIG, &iint->atomic_flags); 442 else 443 clear_bit(IMA_DIGSIG, &iint->atomic_flags); 444 } 445 446 int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, 447 const void *xattr_value, size_t xattr_value_len) 448 { 449 const struct evm_ima_xattr_data *xvalue = xattr_value; 450 int result; 451 452 result = ima_protect_xattr(dentry, xattr_name, xattr_value, 453 xattr_value_len); 454 if (result == 1) { 455 if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST)) 456 return -EINVAL; 457 ima_reset_appraise_flags(d_backing_inode(dentry), 458 xvalue->type == EVM_IMA_XATTR_DIGSIG); 459 result = 0; 460 } 461 return result; 462 } 463 464 int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name) 465 { 466 int result; 467 468 result = ima_protect_xattr(dentry, xattr_name, NULL, 0); 469 if (result == 1) { 470 ima_reset_appraise_flags(d_backing_inode(dentry), 0); 471 result = 0; 472 } 473 return result; 474 } 475