1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
4 *
5 * Authors:
6 * Reiner Sailer <sailer@watson.ibm.com>
7 * Mimi Zohar <zohar@us.ibm.com>
8 *
9 * File: ima.h
10 * internal Integrity Measurement Architecture (IMA) definitions
11 */
12
13 #ifndef __LINUX_IMA_H
14 #define __LINUX_IMA_H
15
16 #include <linux/types.h>
17 #include <linux/crypto.h>
18 #include <linux/fs.h>
19 #include <linux/security.h>
20 #include <linux/hash.h>
21 #include <linux/tpm.h>
22 #include <linux/audit.h>
23 #include <crypto/hash_info.h>
24
25 #include "../integrity.h"
26
27 #ifdef CONFIG_HAVE_IMA_KEXEC
28 #include <asm/ima.h>
29 #endif
30
31 enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
32 IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
33 enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };
34
35 /* digest size for IMA, fits SHA1 or MD5 */
36 #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
37 #define IMA_EVENT_NAME_LEN_MAX 255
38
39 #define IMA_HASH_BITS 10
40 #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
41
42 #define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16
43 #define IMA_TEMPLATE_NUM_FIELDS_MAX 15
44
45 #define IMA_TEMPLATE_IMA_NAME "ima"
46 #define IMA_TEMPLATE_IMA_FMT "d|n"
47
48 #define NR_BANKS(chip) ((chip != NULL) ? chip->nr_allocated_banks : 0)
49
50 /* current content of the policy */
51 extern int ima_policy_flag;
52
53 /* set during initialization */
54 extern int ima_hash_algo;
55 extern int ima_sha1_idx __ro_after_init;
56 extern int ima_hash_algo_idx __ro_after_init;
57 extern int ima_extra_slots __ro_after_init;
58 extern int ima_appraise;
59 extern struct tpm_chip *ima_tpm_chip;
60 extern const char boot_aggregate_name[];
61
62 /* IMA event related data */
63 struct ima_event_data {
64 struct integrity_iint_cache *iint;
65 struct file *file;
66 const unsigned char *filename;
67 struct evm_ima_xattr_data *xattr_value;
68 int xattr_len;
69 const struct modsig *modsig;
70 const char *violation;
71 const void *buf;
72 int buf_len;
73 };
74
75 /* IMA template field data definition */
76 struct ima_field_data {
77 u8 *data;
78 u32 len;
79 };
80
81 /* IMA template field definition */
82 struct ima_template_field {
83 const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
84 int (*field_init)(struct ima_event_data *event_data,
85 struct ima_field_data *field_data);
86 void (*field_show)(struct seq_file *m, enum ima_show_type show,
87 struct ima_field_data *field_data);
88 };
89
90 /* IMA template descriptor definition */
91 struct ima_template_desc {
92 struct list_head list;
93 char *name;
94 char *fmt;
95 int num_fields;
96 const struct ima_template_field **fields;
97 };
98
99 struct ima_template_entry {
100 int pcr;
101 struct tpm_digest *digests;
102 struct ima_template_desc *template_desc; /* template descriptor */
103 u32 template_data_len;
104 struct ima_field_data template_data[]; /* template related data */
105 };
106
107 struct ima_queue_entry {
108 struct hlist_node hnext; /* place in hash collision list */
109 struct list_head later; /* place in ima_measurements list */
110 struct ima_template_entry *entry;
111 };
112 extern struct list_head ima_measurements; /* list of all measurements */
113
114 /* Some details preceding the binary serialized measurement list */
115 struct ima_kexec_hdr {
116 u16 version;
117 u16 _reserved0;
118 u32 _reserved1;
119 u64 buffer_size;
120 u64 count;
121 };
122
123 extern const int read_idmap[];
124
125 #ifdef CONFIG_HAVE_IMA_KEXEC
126 void ima_load_kexec_buffer(void);
127 #else
ima_load_kexec_buffer(void)128 static inline void ima_load_kexec_buffer(void) {}
129 #endif /* CONFIG_HAVE_IMA_KEXEC */
130
131 /*
132 * The default binary_runtime_measurements list format is defined as the
133 * platform native format. The canonical format is defined as little-endian.
134 */
135 extern bool ima_canonical_fmt;
136
137 /* Internal IMA function definitions */
138 int ima_init(void);
139 int ima_fs_init(void);
140 int ima_add_template_entry(struct ima_template_entry *entry, int violation,
141 const char *op, struct inode *inode,
142 const unsigned char *filename);
143 int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
144 int ima_calc_buffer_hash(const void *buf, loff_t len,
145 struct ima_digest_data *hash);
146 int ima_calc_field_array_hash(struct ima_field_data *field_data,
147 struct ima_template_entry *entry);
148 int ima_calc_boot_aggregate(struct ima_digest_data *hash);
149 void ima_add_violation(struct file *file, const unsigned char *filename,
150 struct integrity_iint_cache *iint,
151 const char *op, const char *cause);
152 int ima_init_crypto(void);
153 void ima_putc(struct seq_file *m, void *data, int datalen);
154 void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
155 int template_desc_init_fields(const char *template_fmt,
156 const struct ima_template_field ***fields,
157 int *num_fields);
158 struct ima_template_desc *ima_template_desc_current(void);
159 struct ima_template_desc *lookup_template_desc(const char *name);
160 bool ima_template_has_modsig(const struct ima_template_desc *ima_template);
161 int ima_restore_measurement_entry(struct ima_template_entry *entry);
162 int ima_restore_measurement_list(loff_t bufsize, void *buf);
163 int ima_measurements_show(struct seq_file *m, void *v);
164 unsigned long ima_get_binary_runtime_size(void);
165 int ima_init_template(void);
166 void ima_init_template_list(void);
167 int __init ima_init_digests(void);
168 int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
169 void *lsm_data);
170
171 /*
172 * used to protect h_table and sha_table
173 */
174 extern spinlock_t ima_queue_lock;
175
176 struct ima_h_table {
177 atomic_long_t len; /* number of stored measurements in the list */
178 atomic_long_t violations;
179 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
180 };
181 extern struct ima_h_table ima_htable;
182
ima_hash_key(u8 * digest)183 static inline unsigned int ima_hash_key(u8 *digest)
184 {
185 /* there is no point in taking a hash of part of a digest */
186 return (digest[0] | digest[1] << 8) % IMA_MEASURE_HTABLE_SIZE;
187 }
188
189 #define __ima_hooks(hook) \
190 hook(NONE, none) \
191 hook(FILE_CHECK, file) \
192 hook(MMAP_CHECK, mmap) \
193 hook(BPRM_CHECK, bprm) \
194 hook(CREDS_CHECK, creds) \
195 hook(POST_SETATTR, post_setattr) \
196 hook(MODULE_CHECK, module) \
197 hook(FIRMWARE_CHECK, firmware) \
198 hook(KEXEC_KERNEL_CHECK, kexec_kernel) \
199 hook(KEXEC_INITRAMFS_CHECK, kexec_initramfs) \
200 hook(POLICY_CHECK, policy) \
201 hook(KEXEC_CMDLINE, kexec_cmdline) \
202 hook(KEY_CHECK, key) \
203 hook(MAX_CHECK, none)
204
205 #define __ima_hook_enumify(ENUM, str) ENUM,
206 #define __ima_stringify(arg) (#arg)
207 #define __ima_hook_measuring_stringify(ENUM, str) \
208 (__ima_stringify(measuring_ ##str)),
209
210 enum ima_hooks {
211 __ima_hooks(__ima_hook_enumify)
212 };
213
214 static const char * const ima_hooks_measure_str[] = {
215 __ima_hooks(__ima_hook_measuring_stringify)
216 };
217
func_measure_str(enum ima_hooks func)218 static inline const char *func_measure_str(enum ima_hooks func)
219 {
220 if (func >= MAX_CHECK)
221 return ima_hooks_measure_str[NONE];
222
223 return ima_hooks_measure_str[func];
224 }
225
226 extern const char *const func_tokens[];
227
228 struct modsig;
229
230 #ifdef CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS
231 /*
232 * To track keys that need to be measured.
233 */
234 struct ima_key_entry {
235 struct list_head list;
236 void *payload;
237 size_t payload_len;
238 char *keyring_name;
239 };
240 void ima_init_key_queue(void);
241 bool ima_should_queue_key(void);
242 bool ima_queue_key(struct key *keyring, const void *payload,
243 size_t payload_len);
244 void ima_process_queued_keys(void);
245 #else
ima_init_key_queue(void)246 static inline void ima_init_key_queue(void) {}
ima_should_queue_key(void)247 static inline bool ima_should_queue_key(void) { return false; }
ima_queue_key(struct key * keyring,const void * payload,size_t payload_len)248 static inline bool ima_queue_key(struct key *keyring,
249 const void *payload,
250 size_t payload_len) { return false; }
ima_process_queued_keys(void)251 static inline void ima_process_queued_keys(void) {}
252 #endif /* CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS */
253
254 /* LIM API function definitions */
255 int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
256 int mask, enum ima_hooks func, int *pcr,
257 struct ima_template_desc **template_desc,
258 const char *keyring);
259 int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
260 int ima_collect_measurement(struct integrity_iint_cache *iint,
261 struct file *file, void *buf, loff_t size,
262 enum hash_algo algo, struct modsig *modsig);
263 void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
264 const unsigned char *filename,
265 struct evm_ima_xattr_data *xattr_value,
266 int xattr_len, const struct modsig *modsig, int pcr,
267 struct ima_template_desc *template_desc);
268 void process_buffer_measurement(struct inode *inode, const void *buf, int size,
269 const char *eventname, enum ima_hooks func,
270 int pcr, const char *keyring);
271 void ima_audit_measurement(struct integrity_iint_cache *iint,
272 const unsigned char *filename);
273 int ima_alloc_init_template(struct ima_event_data *event_data,
274 struct ima_template_entry **entry,
275 struct ima_template_desc *template_desc);
276 int ima_store_template(struct ima_template_entry *entry, int violation,
277 struct inode *inode,
278 const unsigned char *filename, int pcr);
279 void ima_free_template_entry(struct ima_template_entry *entry);
280 const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
281
282 /* IMA policy related functions */
283 int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
284 enum ima_hooks func, int mask, int flags, int *pcr,
285 struct ima_template_desc **template_desc,
286 const char *keyring);
287 void ima_init_policy(void);
288 void ima_update_policy(void);
289 void ima_update_policy_flag(void);
290 ssize_t ima_parse_add_rule(char *);
291 void ima_delete_rules(void);
292 int ima_check_policy(void);
293 void *ima_policy_start(struct seq_file *m, loff_t *pos);
294 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos);
295 void ima_policy_stop(struct seq_file *m, void *v);
296 int ima_policy_show(struct seq_file *m, void *v);
297
298 /* Appraise integrity measurements */
299 #define IMA_APPRAISE_ENFORCE 0x01
300 #define IMA_APPRAISE_FIX 0x02
301 #define IMA_APPRAISE_LOG 0x04
302 #define IMA_APPRAISE_MODULES 0x08
303 #define IMA_APPRAISE_FIRMWARE 0x10
304 #define IMA_APPRAISE_POLICY 0x20
305 #define IMA_APPRAISE_KEXEC 0x40
306
307 #ifdef CONFIG_IMA_APPRAISE
308 int ima_check_blacklist(struct integrity_iint_cache *iint,
309 const struct modsig *modsig, int pcr);
310 int ima_appraise_measurement(enum ima_hooks func,
311 struct integrity_iint_cache *iint,
312 struct file *file, const unsigned char *filename,
313 struct evm_ima_xattr_data *xattr_value,
314 int xattr_len, const struct modsig *modsig);
315 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
316 void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
317 enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
318 enum ima_hooks func);
319 enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
320 int xattr_len);
321 int ima_read_xattr(struct dentry *dentry,
322 struct evm_ima_xattr_data **xattr_value);
323
324 #else
ima_check_blacklist(struct integrity_iint_cache * iint,const struct modsig * modsig,int pcr)325 static inline int ima_check_blacklist(struct integrity_iint_cache *iint,
326 const struct modsig *modsig, int pcr)
327 {
328 return 0;
329 }
330
ima_appraise_measurement(enum ima_hooks func,struct integrity_iint_cache * iint,struct file * file,const unsigned char * filename,struct evm_ima_xattr_data * xattr_value,int xattr_len,const struct modsig * modsig)331 static inline int ima_appraise_measurement(enum ima_hooks func,
332 struct integrity_iint_cache *iint,
333 struct file *file,
334 const unsigned char *filename,
335 struct evm_ima_xattr_data *xattr_value,
336 int xattr_len,
337 const struct modsig *modsig)
338 {
339 return INTEGRITY_UNKNOWN;
340 }
341
ima_must_appraise(struct inode * inode,int mask,enum ima_hooks func)342 static inline int ima_must_appraise(struct inode *inode, int mask,
343 enum ima_hooks func)
344 {
345 return 0;
346 }
347
ima_update_xattr(struct integrity_iint_cache * iint,struct file * file)348 static inline void ima_update_xattr(struct integrity_iint_cache *iint,
349 struct file *file)
350 {
351 }
352
ima_get_cache_status(struct integrity_iint_cache * iint,enum ima_hooks func)353 static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache
354 *iint,
355 enum ima_hooks func)
356 {
357 return INTEGRITY_UNKNOWN;
358 }
359
360 static inline enum hash_algo
ima_get_hash_algo(struct evm_ima_xattr_data * xattr_value,int xattr_len)361 ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len)
362 {
363 return ima_hash_algo;
364 }
365
ima_read_xattr(struct dentry * dentry,struct evm_ima_xattr_data ** xattr_value)366 static inline int ima_read_xattr(struct dentry *dentry,
367 struct evm_ima_xattr_data **xattr_value)
368 {
369 return 0;
370 }
371
372 #endif /* CONFIG_IMA_APPRAISE */
373
374 #ifdef CONFIG_IMA_APPRAISE_MODSIG
375 int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len,
376 struct modsig **modsig);
377 void ima_collect_modsig(struct modsig *modsig, const void *buf, loff_t size);
378 int ima_get_modsig_digest(const struct modsig *modsig, enum hash_algo *algo,
379 const u8 **digest, u32 *digest_size);
380 int ima_get_raw_modsig(const struct modsig *modsig, const void **data,
381 u32 *data_len);
382 void ima_free_modsig(struct modsig *modsig);
383 #else
ima_read_modsig(enum ima_hooks func,const void * buf,loff_t buf_len,struct modsig ** modsig)384 static inline int ima_read_modsig(enum ima_hooks func, const void *buf,
385 loff_t buf_len, struct modsig **modsig)
386 {
387 return -EOPNOTSUPP;
388 }
389
ima_collect_modsig(struct modsig * modsig,const void * buf,loff_t size)390 static inline void ima_collect_modsig(struct modsig *modsig, const void *buf,
391 loff_t size)
392 {
393 }
394
ima_get_modsig_digest(const struct modsig * modsig,enum hash_algo * algo,const u8 ** digest,u32 * digest_size)395 static inline int ima_get_modsig_digest(const struct modsig *modsig,
396 enum hash_algo *algo, const u8 **digest,
397 u32 *digest_size)
398 {
399 return -EOPNOTSUPP;
400 }
401
ima_get_raw_modsig(const struct modsig * modsig,const void ** data,u32 * data_len)402 static inline int ima_get_raw_modsig(const struct modsig *modsig,
403 const void **data, u32 *data_len)
404 {
405 return -EOPNOTSUPP;
406 }
407
ima_free_modsig(struct modsig * modsig)408 static inline void ima_free_modsig(struct modsig *modsig)
409 {
410 }
411 #endif /* CONFIG_IMA_APPRAISE_MODSIG */
412
413 /* LSM based policy rules require audit */
414 #ifdef CONFIG_IMA_LSM_RULES
415
416 #define ima_filter_rule_init security_audit_rule_init
417 #define ima_filter_rule_free security_audit_rule_free
418 #define ima_filter_rule_match security_audit_rule_match
419
420 #else
421
ima_filter_rule_init(u32 field,u32 op,char * rulestr,void ** lsmrule)422 static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr,
423 void **lsmrule)
424 {
425 return -EINVAL;
426 }
427
ima_filter_rule_free(void * lsmrule)428 static inline void ima_filter_rule_free(void *lsmrule)
429 {
430 }
431
ima_filter_rule_match(u32 secid,u32 field,u32 op,void * lsmrule)432 static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
433 void *lsmrule)
434 {
435 return -EINVAL;
436 }
437 #endif /* CONFIG_IMA_LSM_RULES */
438
439 #ifdef CONFIG_IMA_READ_POLICY
440 #define POLICY_FILE_FLAGS (S_IWUSR | S_IRUSR)
441 #else
442 #define POLICY_FILE_FLAGS S_IWUSR
443 #endif /* CONFIG_IMA_READ_POLICY */
444
445 #endif /* __LINUX_IMA_H */
446
