Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2005,2006,2007,2008 IBM Corporation |
| 3 | * |
| 4 | * Authors: |
| 5 | * Mimi Zohar <zohar@us.ibm.com> |
| 6 | * Kylene Hall <kjhall@us.ibm.com> |
| 7 | * |
| 8 | * This program is free software; you can redistribute it and/or modify |
| 9 | * it under the terms of the GNU General Public License as published by |
| 10 | * the Free Software Foundation, version 2 of the License. |
| 11 | * |
| 12 | * File: ima_crypto.c |
| 13 | * Calculates md5/sha1 file hash, template hash, boot-aggreate hash |
| 14 | */ |
| 15 | |
Joe Perches | 20ee451 | 2014-02-24 13:59:56 -0800 | [diff] [blame^] | 16 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
| 17 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 18 | #include <linux/kernel.h> |
| 19 | #include <linux/file.h> |
| 20 | #include <linux/crypto.h> |
| 21 | #include <linux/scatterlist.h> |
| 22 | #include <linux/err.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 23 | #include <linux/slab.h> |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 24 | #include <crypto/hash.h> |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 25 | #include <crypto/hash_info.h> |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 26 | #include "ima.h" |
| 27 | |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 28 | static struct crypto_shash *ima_shash_tfm; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 29 | |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 30 | int ima_init_crypto(void) |
| 31 | { |
| 32 | long rc; |
| 33 | |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 34 | ima_shash_tfm = crypto_alloc_shash(hash_algo_name[ima_hash_algo], 0, 0); |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 35 | if (IS_ERR(ima_shash_tfm)) { |
| 36 | rc = PTR_ERR(ima_shash_tfm); |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 37 | pr_err("Can not allocate %s (reason: %ld)\n", |
| 38 | hash_algo_name[ima_hash_algo], rc); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 39 | return rc; |
| 40 | } |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 41 | return 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 42 | } |
| 43 | |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 44 | static struct crypto_shash *ima_alloc_tfm(enum hash_algo algo) |
| 45 | { |
| 46 | struct crypto_shash *tfm = ima_shash_tfm; |
| 47 | int rc; |
| 48 | |
| 49 | if (algo != ima_hash_algo && algo < HASH_ALGO__LAST) { |
| 50 | tfm = crypto_alloc_shash(hash_algo_name[algo], 0, 0); |
| 51 | if (IS_ERR(tfm)) { |
| 52 | rc = PTR_ERR(tfm); |
| 53 | pr_err("Can not allocate %s (reason: %d)\n", |
| 54 | hash_algo_name[algo], rc); |
| 55 | } |
| 56 | } |
| 57 | return tfm; |
| 58 | } |
| 59 | |
| 60 | static void ima_free_tfm(struct crypto_shash *tfm) |
| 61 | { |
| 62 | if (tfm != ima_shash_tfm) |
| 63 | crypto_free_shash(tfm); |
| 64 | } |
| 65 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 66 | /* |
| 67 | * Calculate the MD5/SHA1 file digest |
| 68 | */ |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 69 | static int ima_calc_file_hash_tfm(struct file *file, |
| 70 | struct ima_digest_data *hash, |
| 71 | struct crypto_shash *tfm) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 72 | { |
Mimi Zohar | 16bfa38 | 2009-08-21 14:32:49 -0400 | [diff] [blame] | 73 | loff_t i_size, offset = 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 74 | char *rbuf; |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 75 | int rc, read = 0; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 76 | struct { |
| 77 | struct shash_desc shash; |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 78 | char ctx[crypto_shash_descsize(tfm)]; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 79 | } desc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 80 | |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 81 | desc.shash.tfm = tfm; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 82 | desc.shash.flags = 0; |
| 83 | |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 84 | hash->length = crypto_shash_digestsize(tfm); |
| 85 | |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 86 | rc = crypto_shash_init(&desc.shash); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 87 | if (rc != 0) |
| 88 | return rc; |
| 89 | |
| 90 | rbuf = kzalloc(PAGE_SIZE, GFP_KERNEL); |
| 91 | if (!rbuf) { |
| 92 | rc = -ENOMEM; |
| 93 | goto out; |
| 94 | } |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 95 | if (!(file->f_mode & FMODE_READ)) { |
| 96 | file->f_mode |= FMODE_READ; |
| 97 | read = 1; |
| 98 | } |
Al Viro | 496ad9a | 2013-01-23 17:07:38 -0500 | [diff] [blame] | 99 | i_size = i_size_read(file_inode(file)); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 100 | while (offset < i_size) { |
| 101 | int rbuf_len; |
| 102 | |
| 103 | rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE); |
| 104 | if (rbuf_len < 0) { |
| 105 | rc = rbuf_len; |
| 106 | break; |
| 107 | } |
Mimi Zohar | 16bfa38 | 2009-08-21 14:32:49 -0400 | [diff] [blame] | 108 | if (rbuf_len == 0) |
| 109 | break; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 110 | offset += rbuf_len; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 111 | |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 112 | rc = crypto_shash_update(&desc.shash, rbuf, rbuf_len); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 113 | if (rc) |
| 114 | break; |
| 115 | } |
| 116 | kfree(rbuf); |
| 117 | if (!rc) |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 118 | rc = crypto_shash_final(&desc.shash, hash->digest); |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 119 | if (read) |
| 120 | file->f_mode &= ~FMODE_READ; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 121 | out: |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 122 | return rc; |
| 123 | } |
| 124 | |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 125 | int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) |
| 126 | { |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 127 | struct crypto_shash *tfm; |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 128 | int rc; |
| 129 | |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 130 | tfm = ima_alloc_tfm(hash->algo); |
| 131 | if (IS_ERR(tfm)) |
| 132 | return PTR_ERR(tfm); |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 133 | |
| 134 | rc = ima_calc_file_hash_tfm(file, hash, tfm); |
| 135 | |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 136 | ima_free_tfm(tfm); |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 137 | |
| 138 | return rc; |
| 139 | } |
| 140 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 141 | /* |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 142 | * Calculate the hash of template data |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 143 | */ |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 144 | static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data, |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 145 | struct ima_template_desc *td, |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 146 | int num_fields, |
| 147 | struct ima_digest_data *hash, |
| 148 | struct crypto_shash *tfm) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 149 | { |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 150 | struct { |
| 151 | struct shash_desc shash; |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 152 | char ctx[crypto_shash_descsize(tfm)]; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 153 | } desc; |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 154 | int rc, i; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 155 | |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 156 | desc.shash.tfm = tfm; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 157 | desc.shash.flags = 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 158 | |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 159 | hash->length = crypto_shash_digestsize(tfm); |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 160 | |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 161 | rc = crypto_shash_init(&desc.shash); |
| 162 | if (rc != 0) |
| 163 | return rc; |
| 164 | |
| 165 | for (i = 0; i < num_fields; i++) { |
Roberto Sassu | e3b64c2 | 2014-02-03 13:56:05 +0100 | [diff] [blame] | 166 | u8 buffer[IMA_EVENT_NAME_LEN_MAX + 1] = { 0 }; |
| 167 | u8 *data_to_hash = field_data[i].data; |
| 168 | u32 datalen = field_data[i].len; |
| 169 | |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 170 | if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) { |
| 171 | rc = crypto_shash_update(&desc.shash, |
| 172 | (const u8 *) &field_data[i].len, |
| 173 | sizeof(field_data[i].len)); |
| 174 | if (rc) |
| 175 | break; |
Roberto Sassu | e3b64c2 | 2014-02-03 13:56:05 +0100 | [diff] [blame] | 176 | } else if (strcmp(td->fields[i]->field_id, "n") == 0) { |
| 177 | memcpy(buffer, data_to_hash, datalen); |
| 178 | data_to_hash = buffer; |
| 179 | datalen = IMA_EVENT_NAME_LEN_MAX + 1; |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 180 | } |
Roberto Sassu | e3b64c2 | 2014-02-03 13:56:05 +0100 | [diff] [blame] | 181 | rc = crypto_shash_update(&desc.shash, data_to_hash, datalen); |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 182 | if (rc) |
| 183 | break; |
| 184 | } |
| 185 | |
| 186 | if (!rc) |
| 187 | rc = crypto_shash_final(&desc.shash, hash->digest); |
| 188 | |
| 189 | return rc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 190 | } |
| 191 | |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 192 | int ima_calc_field_array_hash(struct ima_field_data *field_data, |
| 193 | struct ima_template_desc *desc, int num_fields, |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 194 | struct ima_digest_data *hash) |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 195 | { |
| 196 | struct crypto_shash *tfm; |
| 197 | int rc; |
| 198 | |
| 199 | tfm = ima_alloc_tfm(hash->algo); |
| 200 | if (IS_ERR(tfm)) |
| 201 | return PTR_ERR(tfm); |
| 202 | |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 203 | rc = ima_calc_field_array_hash_tfm(field_data, desc, num_fields, |
| 204 | hash, tfm); |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 205 | |
| 206 | ima_free_tfm(tfm); |
| 207 | |
| 208 | return rc; |
| 209 | } |
| 210 | |
Eric Paris | 932995f | 2009-05-21 15:43:32 -0400 | [diff] [blame] | 211 | static void __init ima_pcrread(int idx, u8 *pcr) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 212 | { |
| 213 | if (!ima_used_chip) |
| 214 | return; |
| 215 | |
| 216 | if (tpm_pcr_read(TPM_ANY_NUM, idx, pcr) != 0) |
Joe Perches | 20ee451 | 2014-02-24 13:59:56 -0800 | [diff] [blame^] | 217 | pr_err("Error Communicating to TPM chip\n"); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 218 | } |
| 219 | |
| 220 | /* |
| 221 | * Calculate the boot aggregate hash |
| 222 | */ |
Dmitry Kasatkin | 09ef543 | 2013-06-07 12:16:25 +0200 | [diff] [blame] | 223 | static int __init ima_calc_boot_aggregate_tfm(char *digest, |
| 224 | struct crypto_shash *tfm) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 225 | { |
Mimi Zohar | 140d802 | 2013-03-11 20:29:47 -0400 | [diff] [blame] | 226 | u8 pcr_i[TPM_DIGEST_SIZE]; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 227 | int rc, i; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 228 | struct { |
| 229 | struct shash_desc shash; |
Dmitry Kasatkin | 09ef543 | 2013-06-07 12:16:25 +0200 | [diff] [blame] | 230 | char ctx[crypto_shash_descsize(tfm)]; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 231 | } desc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 232 | |
Dmitry Kasatkin | 09ef543 | 2013-06-07 12:16:25 +0200 | [diff] [blame] | 233 | desc.shash.tfm = tfm; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 234 | desc.shash.flags = 0; |
| 235 | |
| 236 | rc = crypto_shash_init(&desc.shash); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 237 | if (rc != 0) |
| 238 | return rc; |
| 239 | |
| 240 | /* cumulative sha1 over tpm registers 0-7 */ |
| 241 | for (i = TPM_PCR0; i < TPM_PCR8; i++) { |
| 242 | ima_pcrread(i, pcr_i); |
| 243 | /* now accumulate with current aggregate */ |
Mimi Zohar | 140d802 | 2013-03-11 20:29:47 -0400 | [diff] [blame] | 244 | rc = crypto_shash_update(&desc.shash, pcr_i, TPM_DIGEST_SIZE); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 245 | } |
| 246 | if (!rc) |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 247 | crypto_shash_final(&desc.shash, digest); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 248 | return rc; |
| 249 | } |
Dmitry Kasatkin | 09ef543 | 2013-06-07 12:16:25 +0200 | [diff] [blame] | 250 | |
| 251 | int __init ima_calc_boot_aggregate(struct ima_digest_data *hash) |
| 252 | { |
| 253 | struct crypto_shash *tfm; |
| 254 | int rc; |
| 255 | |
| 256 | tfm = ima_alloc_tfm(hash->algo); |
| 257 | if (IS_ERR(tfm)) |
| 258 | return PTR_ERR(tfm); |
| 259 | |
| 260 | hash->length = crypto_shash_digestsize(tfm); |
| 261 | rc = ima_calc_boot_aggregate_tfm(hash->digest, tfm); |
| 262 | |
| 263 | ima_free_tfm(tfm); |
| 264 | |
| 265 | return rc; |
| 266 | } |