cregit-Linux how code gets into the kernel

Release 4.15 security/integrity/iint.c

/*
 * Copyright (C) 2008 IBM Corporation
 *
 * Authors:
 * Mimi Zohar <zohar@us.ibm.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation, version 2 of the
 * License.
 *
 * File: integrity_iint.c
 *      - implements the integrity hooks: integrity_inode_alloc,
 *        integrity_inode_free
 *      - cache integrity information associated with an inode
 *        using a rbtree tree.
 */
#include <linux/slab.h>
#include <linux/module.h>
#include <linux/spinlock.h>
#include <linux/rbtree.h>
#include <linux/file.h>
#include <linux/uaccess.h>
#include "integrity.h"


static struct rb_root integrity_iint_tree = RB_ROOT;
static DEFINE_RWLOCK(integrity_iint_lock);

static struct kmem_cache *iint_cache __read_mostly;

/*
 * __integrity_iint_find - return the iint associated with an inode
 */

static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) { struct integrity_iint_cache *iint; struct rb_node *n = integrity_iint_tree.rb_node; while (n) { iint = rb_entry(n, struct integrity_iint_cache, rb_node); if (inode < iint->inode) n = n->rb_left; else if (inode > iint->inode) n = n->rb_right; else break; } if (!n) return NULL; return iint; }

Contributors

PersonTokensPropCommitsCommitProp
Eric Paris8294.25%150.00%
Mimi Zohar55.75%150.00%
Total87100.00%2100.00%

/* * integrity_iint_find - return the iint associated with an inode */
struct integrity_iint_cache *integrity_iint_find(struct inode *inode) { struct integrity_iint_cache *iint; if (!IS_IMA(inode)) return NULL; read_lock(&integrity_iint_lock); iint = __integrity_iint_find(inode); read_unlock(&integrity_iint_lock); return iint; }

Contributors

PersonTokensPropCommitsCommitProp
Mimi Zohar3162.00%240.00%
Eric Paris1734.00%240.00%
Dmitry Kasatkin24.00%120.00%
Total50100.00%5100.00%


static void iint_free(struct integrity_iint_cache *iint) { kfree(iint->ima_hash); iint->ima_hash = NULL; iint->version = 0; iint->flags = 0UL; iint->ima_file_status = INTEGRITY_UNKNOWN; iint->ima_mmap_status = INTEGRITY_UNKNOWN; iint->ima_bprm_status = INTEGRITY_UNKNOWN; iint->ima_read_status = INTEGRITY_UNKNOWN; iint->evm_status = INTEGRITY_UNKNOWN; iint->measured_pcrs = 0; kmem_cache_free(iint_cache, iint); }

Contributors

PersonTokensPropCommitsCommitProp
Eric Paris2936.71%112.50%
Mimi Zohar2531.65%450.00%
Dmitry Kasatkin1924.05%225.00%
Eric Richter67.59%112.50%
Total79100.00%8100.00%

/** * integrity_inode_get - find or allocate an iint associated with an inode * @inode: pointer to the inode * @return: allocated iint * * Caller must lock i_mutex */
struct integrity_iint_cache *integrity_inode_get(struct inode *inode) { struct rb_node **p; struct rb_node *node, *parent = NULL; struct integrity_iint_cache *iint, *test_iint; iint = integrity_iint_find(inode); if (iint) return iint; iint = kmem_cache_alloc(iint_cache, GFP_NOFS); if (!iint) return NULL; write_lock(&integrity_iint_lock); p = &integrity_iint_tree.rb_node; while (*p) { parent = *p; test_iint = rb_entry(parent, struct integrity_iint_cache, rb_node); if (inode < test_iint->inode) p = &(*p)->rb_left; else p = &(*p)->rb_right; } iint->inode = inode; node = &iint->rb_node; inode->i_flags |= S_IMA; rb_link_node(node, parent, p); rb_insert_color(node, &integrity_iint_tree); write_unlock(&integrity_iint_lock); return iint; }

Contributors

PersonTokensPropCommitsCommitProp
Eric Paris8346.63%228.57%
Mimi Zohar5329.78%342.86%
Dmitry Kasatkin4223.60%228.57%
Total178100.00%7100.00%

/** * integrity_inode_free - called on security_inode_free * @inode: pointer to the inode * * Free the integrity information(iint) associated with an inode. */
void integrity_inode_free(struct inode *inode) { struct integrity_iint_cache *iint; if (!IS_IMA(inode)) return; write_lock(&integrity_iint_lock); iint = __integrity_iint_find(inode); rb_erase(&iint->rb_node, &integrity_iint_tree); write_unlock(&integrity_iint_lock); iint_free(iint); }

Contributors

PersonTokensPropCommitsCommitProp
Mimi Zohar3864.41%228.57%
Eric Paris1932.20%457.14%
Dmitry Kasatkin23.39%114.29%
Total59100.00%7100.00%


static void init_once(void *foo) { struct integrity_iint_cache *iint = foo; memset(iint, 0, sizeof(*iint)); iint->version = 0; iint->flags = 0UL; iint->ima_file_status = INTEGRITY_UNKNOWN; iint->ima_mmap_status = INTEGRITY_UNKNOWN; iint->ima_bprm_status = INTEGRITY_UNKNOWN; iint->ima_read_status = INTEGRITY_UNKNOWN; iint->evm_status = INTEGRITY_UNKNOWN; iint->measured_pcrs = 0; }

Contributors

PersonTokensPropCommitsCommitProp
Mimi Zohar6887.18%666.67%
Eric Richter67.69%111.11%
Dmitry Kasatkin45.13%222.22%
Total78100.00%9100.00%


static int __init integrity_iintcache_init(void) { iint_cache = kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache), 0, SLAB_PANIC, init_once); return 0; }

Contributors

PersonTokensPropCommitsCommitProp
Mimi Zohar2580.65%250.00%
Eric Paris619.35%250.00%
Total31100.00%4100.00%

security_initcall(integrity_iintcache_init); /* * integrity_kernel_read - read data from the file * * This is a function for reading file content instead of kernel_read(). * It does not perform locking checks to ensure it cannot be blocked. * It does not perform security checks because it is irrelevant for IMA. * */
int integrity_kernel_read(struct file *file, loff_t offset, void *addr, unsigned long count) { mm_segment_t old_fs; char __user *buf = (char __user *)addr; ssize_t ret; if (!(file->f_mode & FMODE_READ)) return -EBADF; old_fs = get_fs(); set_fs(get_ds()); ret = __vfs_read(file, buf, count, &offset); set_fs(old_fs); return ret; }

Contributors

PersonTokensPropCommitsCommitProp
Dmitry Kasatkin8698.85%266.67%
Thiago Jung Bauermann11.15%133.33%
Total87100.00%3100.00%

/* * integrity_load_keys - load integrity keys hook * * Hooks is called from init/main.c:kernel_init_freeable() * when rootfs is ready */
void __init integrity_load_keys(void) { ima_load_x509(); evm_load_x509(); }

Contributors

PersonTokensPropCommitsCommitProp
Dmitry Kasatkin14100.00%2100.00%
Total14100.00%2100.00%


Overall Contributors

PersonTokensPropCommitsCommitProp
Mimi Zohar27338.13%726.92%
Eric Paris24834.64%623.08%
Dmitry Kasatkin17925.00%1038.46%
Eric Richter121.68%13.85%
Tejun Heo30.42%13.85%
Thiago Jung Bauermann10.14%13.85%
Total716100.00%26100.00%
Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
Created with cregit.