blob: 90bc57d796ec1e23495a27a76104f64e8d664e11 [file] [log] [blame]
Mimi Zoharf381c272011-03-09 14:13:22 -05001/*
2 * Copyright (C) 2009-2010 IBM Corporation
3 *
4 * Authors:
5 * Mimi Zohar <zohar@us.ibm.com>
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation, version 2 of the
10 * License.
11 *
12 */
13
14#include <linux/types.h>
15#include <linux/integrity.h>
16#include <crypto/sha.h>
Dmitry Kasatkine0751252013-02-07 00:12:08 +020017#include <linux/key.h>
Mimi Zoharf381c272011-03-09 14:13:22 -050018
Dmitry Kasatkin45e24722012-09-12 20:51:32 +030019/* iint action cache flags */
Mimi Zoharf578c082012-12-05 09:29:09 -050020#define IMA_MEASURE 0x00000001
21#define IMA_MEASURED 0x00000002
22#define IMA_APPRAISE 0x00000004
23#define IMA_APPRAISED 0x00000008
24/*#define IMA_COLLECT 0x00000010 do not use this flag */
25#define IMA_COLLECTED 0x00000020
26#define IMA_AUDIT 0x00000040
27#define IMA_AUDITED 0x00000080
Dmitry Kasatkin45e24722012-09-12 20:51:32 +030028
Mimi Zoharf381c272011-03-09 14:13:22 -050029/* iint cache flags */
Mimi Zoharf578c082012-12-05 09:29:09 -050030#define IMA_ACTION_FLAGS 0xff000000
Mimi Zohar42a4c602016-02-29 08:30:12 -050031#define IMA_ACTION_RULE_FLAGS 0x06000000
Mimi Zoharf578c082012-12-05 09:29:09 -050032#define IMA_DIGSIG 0x01000000
33#define IMA_DIGSIG_REQUIRED 0x02000000
Mimi Zoharf9b2a732014-05-12 09:28:11 -040034#define IMA_PERMIT_DIRECTIO 0x04000000
Dmitry Kasatkinb151d6b2014-06-27 18:04:27 +030035#define IMA_NEW_FILE 0x08000000
Dmitry Kasatkin45e24722012-09-12 20:51:32 +030036
Mimi Zohard79d72e2012-12-03 17:08:11 -050037#define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
38 IMA_APPRAISE_SUBMASK)
39#define IMA_DONE_MASK (IMA_MEASURED | IMA_APPRAISED | IMA_AUDITED | \
40 IMA_COLLECTED | IMA_APPRAISED_SUBMASK)
41
42/* iint subaction appraise cache flags */
43#define IMA_FILE_APPRAISE 0x00000100
44#define IMA_FILE_APPRAISED 0x00000200
45#define IMA_MMAP_APPRAISE 0x00000400
46#define IMA_MMAP_APPRAISED 0x00000800
47#define IMA_BPRM_APPRAISE 0x00001000
48#define IMA_BPRM_APPRAISED 0x00002000
Mimi Zoharc6af8ef2015-11-19 12:39:22 -050049#define IMA_READ_APPRAISE 0x00004000
50#define IMA_READ_APPRAISED 0x00008000
Mimi Zohard79d72e2012-12-03 17:08:11 -050051#define IMA_APPRAISE_SUBMASK (IMA_FILE_APPRAISE | IMA_MMAP_APPRAISE | \
Mimi Zoharc6af8ef2015-11-19 12:39:22 -050052 IMA_BPRM_APPRAISE | IMA_READ_APPRAISE)
Mimi Zohard79d72e2012-12-03 17:08:11 -050053#define IMA_APPRAISED_SUBMASK (IMA_FILE_APPRAISED | IMA_MMAP_APPRAISED | \
Mimi Zoharc6af8ef2015-11-19 12:39:22 -050054 IMA_BPRM_APPRAISED | IMA_READ_APPRAISED)
Mimi Zoharf381c272011-03-09 14:13:22 -050055
Dmitry Kasatkin6be5cc52011-03-09 14:28:20 -050056enum evm_ima_xattr_type {
57 IMA_XATTR_DIGEST = 0x01,
58 EVM_XATTR_HMAC,
59 EVM_IMA_XATTR_DIGSIG,
Dmitry Kasatkin3ea7a562013-08-12 11:22:51 +030060 IMA_XATTR_DIGEST_NG,
Dmitry Kasatkina48fda92014-10-28 13:31:22 +020061 IMA_XATTR_LAST
Dmitry Kasatkin6be5cc52011-03-09 14:28:20 -050062};
63
64struct evm_ima_xattr_data {
65 u8 type;
66 u8 digest[SHA1_DIGEST_SIZE];
Dmitry Kasatkinc7c8bb22013-04-25 10:43:56 +030067} __packed;
68
69#define IMA_MAX_DIGEST_SIZE 64
70
71struct ima_digest_data {
72 u8 algo;
73 u8 length;
Dmitry Kasatkin3ea7a562013-08-12 11:22:51 +030074 union {
75 struct {
76 u8 unused;
77 u8 type;
78 } sha1;
79 struct {
80 u8 type;
81 u8 algo;
82 } ng;
83 u8 data[2];
84 } xattr;
Dmitry Kasatkina35c3fb2013-04-25 10:44:04 +030085 u8 digest[0];
Dmitry Kasatkinc7c8bb22013-04-25 10:43:56 +030086} __packed;
Dmitry Kasatkin6be5cc52011-03-09 14:28:20 -050087
Dmitry Kasatkind3634d02013-04-25 10:44:04 +030088/*
89 * signature format v2 - for using with asymmetric keys
90 */
91struct signature_v2_hdr {
Dmitry Kasatkinb1aaab22013-10-10 16:12:03 +090092 uint8_t type; /* xattr type */
Dmitry Kasatkind3634d02013-04-25 10:44:04 +030093 uint8_t version; /* signature format version */
David Howells4e8ae722016-03-03 21:49:27 +000094 uint8_t hash_algo; /* Digest algorithm [enum hash_algo] */
Dmitry Kasatkind3634d02013-04-25 10:44:04 +030095 uint32_t keyid; /* IMA key identifier - not X509/PGP specific */
96 uint16_t sig_size; /* signature size */
97 uint8_t sig[0]; /* signature payload */
98} __packed;
99
Mimi Zoharf381c272011-03-09 14:13:22 -0500100/* integrity data associated with an inode */
101struct integrity_iint_cache {
Dmitry Kasatkinc7c8bb22013-04-25 10:43:56 +0300102 struct rb_node rb_node; /* rooted in integrity_iint_tree */
Mimi Zoharf381c272011-03-09 14:13:22 -0500103 struct inode *inode; /* back pointer to inode in question */
104 u64 version; /* track inode changes */
Mimi Zoharf578c082012-12-05 09:29:09 -0500105 unsigned long flags;
Mimi Zohard79d72e2012-12-03 17:08:11 -0500106 enum integrity_status ima_file_status:4;
107 enum integrity_status ima_mmap_status:4;
108 enum integrity_status ima_bprm_status:4;
Mimi Zoharcf222212016-01-14 17:57:47 -0500109 enum integrity_status ima_read_status:4;
Dmitry Kasatkinee866332012-09-21 17:00:43 +0300110 enum integrity_status evm_status:4;
Dmitry Kasatkina35c3fb2013-04-25 10:44:04 +0300111 struct ima_digest_data *ima_hash;
Mimi Zoharf381c272011-03-09 14:13:22 -0500112};
113
114/* rbtree tree calls to lookup, insert, delete
115 * integrity data associated with an inode.
116 */
Mimi Zoharf381c272011-03-09 14:13:22 -0500117struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
James Morris48927222011-08-17 10:34:33 +1000118
Dmitry Kasatkine3c4abb2014-11-05 17:01:12 +0200119int integrity_kernel_read(struct file *file, loff_t offset,
120 char *addr, unsigned long count);
121int __init integrity_read_file(const char *path, char **data);
122
Dmitry Kasatkin8607c502011-10-05 11:54:46 +0300123#define INTEGRITY_KEYRING_EVM 0
Dmitry Kasatkinf4dc3772015-10-22 21:26:10 +0300124#define INTEGRITY_KEYRING_IMA 1
125#define INTEGRITY_KEYRING_MODULE 2
Dmitry Kasatkin8607c502011-10-05 11:54:46 +0300126#define INTEGRITY_KEYRING_MAX 3
127
Dmitry Kasatkinf1be2422012-01-17 17:12:07 +0200128#ifdef CONFIG_INTEGRITY_SIGNATURE
Dmitry Kasatkin8607c502011-10-05 11:54:46 +0300129
130int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
Dmitry Kasatkin089bc8e2013-10-10 15:56:13 +0900131 const char *digest, int digestlen);
Dmitry Kasatkin8607c502011-10-05 11:54:46 +0300132
Dmitry Kasatkind16a8582014-10-01 21:43:07 +0300133int __init integrity_init_keyring(const unsigned int id);
Dmitry Kasatkin9d03a722014-11-26 16:55:00 +0200134int __init integrity_load_x509(const unsigned int id, const char *path);
Dmitry Kasatkin8607c502011-10-05 11:54:46 +0300135#else
136
137static inline int integrity_digsig_verify(const unsigned int id,
138 const char *sig, int siglen,
139 const char *digest, int digestlen)
140{
141 return -EOPNOTSUPP;
142}
143
Mimi Zohar7d2ce232013-08-13 08:47:43 -0400144static inline int integrity_init_keyring(const unsigned int id)
145{
146 return 0;
147}
Dmitry Kasatkinf1be2422012-01-17 17:12:07 +0200148#endif /* CONFIG_INTEGRITY_SIGNATURE */
Dmitry Kasatkin8607c502011-10-05 11:54:46 +0300149
Dmitry Kasatkine0751252013-02-07 00:12:08 +0200150#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
151int asymmetric_verify(struct key *keyring, const char *sig,
152 int siglen, const char *data, int datalen);
153#else
154static inline int asymmetric_verify(struct key *keyring, const char *sig,
155 int siglen, const char *data, int datalen)
156{
157 return -EOPNOTSUPP;
158}
159#endif
160
Dmitry Kasatkinfd5f4e902014-11-05 17:01:14 +0200161#ifdef CONFIG_IMA_LOAD_X509
162void __init ima_load_x509(void);
163#else
164static inline void ima_load_x509(void)
165{
166}
167#endif
168
Dmitry Kasatkin2ce523e2015-10-22 21:26:21 +0300169#ifdef CONFIG_EVM_LOAD_X509
170void __init evm_load_x509(void);
171#else
172static inline void evm_load_x509(void)
173{
174}
175#endif
176
Mimi Zohard726d8d2013-03-18 14:48:02 -0400177#ifdef CONFIG_INTEGRITY_AUDIT
178/* declarations */
179void integrity_audit_msg(int audit_msgno, struct inode *inode,
180 const unsigned char *fname, const char *op,
181 const char *cause, int result, int info);
182#else
183static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
184 const unsigned char *fname,
185 const char *op, const char *cause,
186 int result, int info)
187{
188}
189#endif