Release 4.7 security/integrity/ima/ima_fs.c

/*
 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
 *
 * Authors:
 * Kylene Hall <kjhall@us.ibm.com>
 * Reiner Sailer <sailer@us.ibm.com>
 * Mimi Zohar <zohar@us.ibm.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation, version 2 of the
 * License.
 *
 * File: ima_fs.c
 *      implemenents security file system for reporting
 *      current measurement list and IMA statistics
 */
#include <linux/fcntl.h>
#include <linux/slab.h>
#include <linux/module.h>
#include <linux/seq_file.h>
#include <linux/rculist.h>
#include <linux/rcupdate.h>
#include <linux/parser.h>
#include <linux/vmalloc.h>

#include "ima.h"

static DEFINE_MUTEX(ima_write_mutex);


static int valid_policy = 1;

#define TMPBUFLEN 12


static ssize_t ima_show_htable_value(char __user *buf, size_t count,
				     loff_t *ppos, atomic_long_t *val)
{
	char tmpbuf[TMPBUFLEN];
	ssize_t len;

	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
61
100.00%
1
100.00%
Total
61
100.00%
1
100.00%



static ssize_t ima_show_htable_violations(struct file *filp,
					  char __user *buf,
					  size_t count, loff_t *ppos)
{
	return ima_show_htable_value(buf, count, ppos, &ima_htable.violations);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
38
100.00%
1
100.00%
Total
38
100.00%
1
100.00%


static const struct file_operations ima_htable_violations_ops = {
	.read = ima_show_htable_violations,
	.llseek = generic_file_llseek,
};



static ssize_t ima_show_measurements_count(struct file *filp,
					   char __user *buf,
					   size_t count, loff_t *ppos)
{
	return ima_show_htable_value(buf, count, ppos, &ima_htable.len);

}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
38
100.00%
1
100.00%
Total
38
100.00%
1
100.00%


static const struct file_operations ima_measurements_count_ops = {
	.read = ima_show_measurements_count,
	.llseek = generic_file_llseek,
};

/* returns pointer to hlist_node */


static void *ima_measurements_start(struct seq_file *m, loff_t *pos)
{
	loff_t l = *pos;
	struct ima_queue_entry *qe;

	/* we need a lock since pos could point beyond last element */
	rcu_read_lock();
	list_for_each_entry_rcu(qe, &ima_measurements, later) {
		if (!l--) {
			rcu_read_unlock();
			return qe;
		}
	}
	rcu_read_unlock();
	return NULL;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
61
100.00%
1
100.00%
Total
61
100.00%
1
100.00%



static void *ima_measurements_next(struct seq_file *m, void *v, loff_t *pos)
{
	struct ima_queue_entry *qe = v;

	/* lock protects when reading beyond last element
         * against concurrent list-extension
         */
	rcu_read_lock();
	qe = list_entry_rcu(qe->later.next, struct ima_queue_entry, later);
	rcu_read_unlock();
	(*pos)++;

	return (&qe->later == &ima_measurements) ? NULL : qe;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
70
98.59%
1
50.00%
jiri pirko
jiri pirko
1
1.41%
1
50.00%
Total
71
100.00%
2
100.00%



static void ima_measurements_stop(struct seq_file *m, void *v)
{
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
14
100.00%
1
100.00%
Total
14
100.00%
1
100.00%



void ima_putc(struct seq_file *m, void *data, int datalen)
{
	while (datalen--)
		seq_putc(m, *(char *)data++);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
35
100.00%
1
100.00%
Total
35
100.00%
1
100.00%

/* print format:
 *       32bit-le=pcr#
 *       char[20]=template digest
 *       32bit-le=template name size
 *       char[n]=template name
 *       [eventdata length]
 *       eventdata[n]=template specific data
 */


static int ima_measurements_show(struct seq_file *m, void *v)
{
	/* the list never shrinks, so we don't need a lock here */
	struct ima_queue_entry *qe = v;
	struct ima_template_entry *e;
	char *template_name;
	int namelen;
	u32 pcr = CONFIG_IMA_MEASURE_PCR_IDX;
	bool is_ima_template = false;
	int i;

	/* get entry */
	e = qe->entry;
	if (e == NULL)
		return -1;

	template_name = (e->template_desc->name[0] != '\0') ?
	    e->template_desc->name : e->template_desc->fmt;

	/*
         * 1st: PCRIndex
         * PCR used is always the same (config option) in
         * little-endian format
         */
	ima_putc(m, &pcr, sizeof(pcr));

	/* 2nd: template digest */
	ima_putc(m, e->digest, TPM_DIGEST_SIZE);

	/* 3rd: template name size */
	namelen = strlen(template_name);
	ima_putc(m, &namelen, sizeof(namelen));

	/* 4th:  template name */
	ima_putc(m, template_name, namelen);

	/* 5th:  template length (except for 'ima' template) */
	if (strcmp(template_name, IMA_TEMPLATE_IMA_NAME) == 0)
		is_ima_template = true;

	if (!is_ima_template)
		ima_putc(m, &e->template_data_len,
			 sizeof(e->template_data_len));

	/* 6th:  template specific data */
	for (i = 0; i < e->template_desc->num_fields; i++) {
		enum ima_show_type show = IMA_SHOW_BINARY;
		struct ima_template_field *field = e->template_desc->fields[i];

		if (is_ima_template && strcmp(field->field_id, "d") == 0)
			show = IMA_SHOW_BINARY_NO_FIELD_LEN;
		if (is_ima_template && strcmp(field->field_id, "n") == 0)
			show = IMA_SHOW_BINARY_OLD_STRING_FMT;
		field->field_show(m, show, &e->template_data[i]);
	}
	return 0;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
roberto sassu
roberto sassu
165
57.89%
4
57.14%
mimi zohar
mimi zohar
116
40.70%
2
28.57%
dmitry kasatkin
dmitry kasatkin
4
1.40%
1
14.29%
Total
285
100.00%
7
100.00%


static const struct seq_operations ima_measurments_seqops = {
	.start = ima_measurements_start,
	.next = ima_measurements_next,
	.stop = ima_measurements_stop,
	.show = ima_measurements_show
};



static int ima_measurements_open(struct inode *inode, struct file *file)
{
	return seq_open(file, &ima_measurments_seqops);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
25
100.00%
1
100.00%
Total
25
100.00%
1
100.00%


static const struct file_operations ima_measurements_ops = {
	.open = ima_measurements_open,
	.read = seq_read,
	.llseek = seq_lseek,
	.release = seq_release,
};



void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
{
	u32 i;

	for (i = 0; i < size; i++)
		seq_printf(m, "%02x", *(digest + i));
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
47
100.00%
3
100.00%
Total
47
100.00%
3
100.00%

/* print in ascii */


static int ima_ascii_measurements_show(struct seq_file *m, void *v)
{
	/* the list never shrinks, so we don't need a lock here */
	struct ima_queue_entry *qe = v;
	struct ima_template_entry *e;
	char *template_name;
	int i;

	/* get entry */
	e = qe->entry;
	if (e == NULL)
		return -1;

	template_name = (e->template_desc->name[0] != '\0') ?
	    e->template_desc->name : e->template_desc->fmt;

	/* 1st: PCR used (config option) */
	seq_printf(m, "%2d ", CONFIG_IMA_MEASURE_PCR_IDX);

	/* 2nd: SHA1 template hash */
	ima_print_digest(m, e->digest, TPM_DIGEST_SIZE);

	/* 3th:  template name */
	seq_printf(m, " %s", template_name);

	/* 4th:  template specific data */
	for (i = 0; i < e->template_desc->num_fields; i++) {
		seq_puts(m, " ");
		if (e->template_data[i].len == 0)
			continue;

		e->template_desc->fields[i]->field_show(m, IMA_SHOW_ASCII,
							&e->template_data[i]);
	}
	seq_puts(m, "\n");
	return 0;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
roberto sassu
roberto sassu
98
52.69%
2
50.00%
mimi zohar
mimi zohar
88
47.31%
2
50.00%
Total
186
100.00%
4
100.00%


static const struct seq_operations ima_ascii_measurements_seqops = {
	.start = ima_measurements_start,
	.next = ima_measurements_next,
	.stop = ima_measurements_stop,
	.show = ima_ascii_measurements_show
};



static int ima_ascii_measurements_open(struct inode *inode, struct file *file)
{
	return seq_open(file, &ima_ascii_measurements_seqops);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
25
100.00%
1
100.00%
Total
25
100.00%
1
100.00%


static const struct file_operations ima_ascii_measurements_ops = {
	.open = ima_ascii_measurements_open,
	.read = seq_read,
	.llseek = seq_lseek,
	.release = seq_release,
};



static ssize_t ima_read_policy(char *path)
{
	void *data;
	char *datap;
	loff_t size;
	int rc, pathlen = strlen(path);

	char *p;

	/* remove \n */
	datap = path;
	strsep(&datap, "\n");

	rc = kernel_read_file_from_path(path, &data, &size, 0, READING_POLICY);
	if (rc < 0) {
		pr_err("Unable to open file: %s (%d)", path, rc);
		return rc;
	}

	datap = data;
	while (size > 0 && (p = strsep(&datap, "\n"))) {
		pr_debug("rule: %s\n", p);
		rc = ima_parse_add_rule(p);
		if (rc < 0)
			break;
		size -= rc;
	}

	vfree(data);
	if (rc < 0)
		return rc;
	else if (size)
		return -EINVAL;
	else
		return pathlen;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
dmitry kasatkin
dmitry kasatkin
161
100.00%
1
100.00%
Total
161
100.00%
1
100.00%



static ssize_t ima_write_policy(struct file *file, const char __user *buf,
				size_t datalen, loff_t *ppos)
{
	char *data;
	ssize_t result;

	if (datalen >= PAGE_SIZE)
		datalen = PAGE_SIZE - 1;

	/* No partial writes. */
	result = -EINVAL;
	if (*ppos != 0)
		goto out;

	result = -ENOMEM;
	data = kmalloc(datalen + 1, GFP_KERNEL);
	if (!data)
		goto out;

	*(data + datalen) = '\0';

	result = -EFAULT;
	if (copy_from_user(data, buf, datalen))
		goto out_free;

	result = mutex_lock_interruptible(&ima_write_mutex);
	if (result < 0)
		goto out_free;

	if (data[0] == '/') {
		result = ima_read_policy(data);
	} else if (ima_appraise & IMA_APPRAISE_POLICY) {
		pr_err("IMA: signed policy file (specified as an absolute pathname) required\n");
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
				    "policy_update", "signed policy required",
				    1, 0);
		if (ima_appraise & IMA_APPRAISE_ENFORCE)
			result = -EACCES;
	} else {
		result = ima_parse_add_rule(data);
	}
	mutex_unlock(&ima_write_mutex);
out_free:
	kfree(data);
out:
	if (result < 0)
		valid_policy = 0;

	return result;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
134
59.29%
2
33.33%
eric paris
eric paris
41
18.14%
1
16.67%
petko manolov
petko manolov
34
15.04%
2
33.33%
dmitry kasatkin
dmitry kasatkin
17
7.52%
1
16.67%
Total
226
100.00%
6
100.00%


static struct dentry *ima_dir;

static struct dentry *binary_runtime_measurements;

static struct dentry *ascii_runtime_measurements;

static struct dentry *runtime_measurements_count;

static struct dentry *violations;

static struct dentry *ima_policy;


enum ima_fs_flags {
	
IMA_FS_BUSY,
};


static unsigned long ima_fs_flags;

#ifdef	CONFIG_IMA_READ_POLICY

static const struct seq_operations ima_policy_seqops = {
		.start = ima_policy_start,
		.next = ima_policy_next,
		.stop = ima_policy_stop,
		.show = ima_policy_show,
};
#endif

/*
 * ima_open_policy: sequentialize access to the policy file
 */


static int ima_open_policy(struct inode *inode, struct file *filp)
{
	if (!(filp->f_flags & O_WRONLY)) {
#ifndef	CONFIG_IMA_READ_POLICY
		return -EACCES;
#else
		if ((filp->f_flags & O_ACCMODE) != O_RDONLY)
			return -EACCES;
		if (!capable(CAP_SYS_ADMIN))
			return -EPERM;
		return seq_open(filp, &ima_policy_seqops);
#endif
	}
	if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags))
		return -EBUSY;
	return 0;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
petko manolov
petko manolov
46
48.94%
1
20.00%
mimi zohar
mimi zohar
25
26.60%
1
20.00%
eric paris
eric paris
15
15.96%
1
20.00%
dmitry kasatkin
dmitry kasatkin
7
7.45%
1
20.00%
james morris
james morris
1
1.06%
1
20.00%
Total
94
100.00%
5
100.00%

/*
 * ima_release_policy - start using the new measure policy rules.
 *
 * Initially, ima_measure points to the default policy rules, now
 * point to the new policy rules, and remove the securityfs policy file,
 * assuming a valid policy.
 */


static int ima_release_policy(struct inode *inode, struct file *file)
{
	const char *cause = valid_policy ? "completed" : "failed";

	if ((file->f_flags & O_ACCMODE) == O_RDONLY)
		return 0;

	if (valid_policy && ima_check_policy() < 0) {
		cause = "failed";
		valid_policy = 0;
	}

	pr_info("IMA: policy update %s\n", cause);
	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
			    "policy_update", cause, !valid_policy, 0);

	if (!valid_policy) {
		ima_delete_rules();
		valid_policy = 1;
		clear_bit(IMA_FS_BUSY, &ima_fs_flags);
		return 0;
	}

	ima_update_policy();
#ifndef	CONFIG_IMA_WRITE_POLICY
	securityfs_remove(ima_policy);
	ima_policy = NULL;
#else
	clear_bit(IMA_FS_BUSY, &ima_fs_flags);
#endif
	return 0;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
52
36.88%
2
28.57%
dmitry kasatkin
dmitry kasatkin
40
28.37%
2
28.57%
petko manolov
petko manolov
30
21.28%
2
28.57%
sasha levin
sasha levin
19
13.48%
1
14.29%
Total
141
100.00%
7
100.00%


static const struct file_operations ima_measure_policy_ops = {
	.open = ima_open_policy,
	.write = ima_write_policy,
	.read = seq_read,
	.release = ima_release_policy,
	.llseek = generic_file_llseek,
};



int __init ima_fs_init(void)
{
	ima_dir = securityfs_create_dir("ima", NULL);
	if (IS_ERR(ima_dir))
		return -1;

	binary_runtime_measurements =
	    securityfs_create_file("binary_runtime_measurements",
				   S_IRUSR | S_IRGRP, ima_dir, NULL,
				   &ima_measurements_ops);
	if (IS_ERR(binary_runtime_measurements))
		goto out;

	ascii_runtime_measurements =
	    securityfs_create_file("ascii_runtime_measurements",
				   S_IRUSR | S_IRGRP, ima_dir, NULL,
				   &ima_ascii_measurements_ops);
	if (IS_ERR(ascii_runtime_measurements))
		goto out;

	runtime_measurements_count =
	    securityfs_create_file("runtime_measurements_count",
				   S_IRUSR | S_IRGRP, ima_dir, NULL,
				   &ima_measurements_count_ops);
	if (IS_ERR(runtime_measurements_count))
		goto out;

	violations =
	    securityfs_create_file("violations", S_IRUSR | S_IRGRP,
				   ima_dir, NULL, &ima_htable_violations_ops);
	if (IS_ERR(violations))
		goto out;

	ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS,
					    ima_dir, NULL,
					    &ima_measure_policy_ops);
	if (IS_ERR(ima_policy))
		goto out;

	return 0;
out:
	securityfs_remove(violations);
	securityfs_remove(runtime_measurements_count);
	securityfs_remove(ascii_runtime_measurements);
	securityfs_remove(binary_runtime_measurements);
	securityfs_remove(ima_dir);
	securityfs_remove(ima_policy);
	return -1;
}
Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
198
96.59%
2
40.00%
dmitry kasatkin
dmitry kasatkin
5
2.44%
1
20.00%
petko manolov
petko manolov
1
0.49%
1
20.00%
eric paris
eric paris
1
0.49%
1
20.00%
Total
205
100.00%
5
100.00%

Overall Contributors
Person
Tokens
Prop
Commits
CommitProp
mimi zohar
mimi zohar
1249
61.74%
6
21.43%
roberto sassu
roberto sassu
264
13.05%
4
14.29%
dmitry kasatkin
dmitry kasatkin
246
12.16%
5
17.86%
petko manolov
petko manolov
155
7.66%
3
10.71%
eric paris
eric paris
60
2.97%
3
10.71%
sasha levin
sasha levin
19
0.94%
1
3.57%
arnd bergmann
arnd bergmann
18
0.89%
1
3.57%
alexey dobriyan
alexey dobriyan
5
0.25%
1
3.57%
tejun heo
tejun heo
3
0.15%
1
3.57%
james morris
james morris
3
0.15%
2
7.14%
jiri pirko
jiri pirko
1
0.05%
1
3.57%
Total
2023
100.00%
28
100.00%
  
Directory: security/integrity/ima

Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.