Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2005-2010 IBM Corporation |
| 3 | * |
| 4 | * Author: |
| 5 | * Mimi Zohar <zohar@us.ibm.com> |
| 6 | * Kylene Hall <kjhall@us.ibm.com> |
| 7 | * |
| 8 | * This program is free software; you can redistribute it and/or modify |
| 9 | * it under the terms of the GNU General Public License as published by |
| 10 | * the Free Software Foundation, version 2 of the License. |
| 11 | * |
| 12 | * File: evm_main.c |
| 13 | * implements evm_inode_setxattr, evm_inode_post_setxattr, |
| 14 | * evm_inode_removexattr, and evm_verifyxattr |
| 15 | */ |
| 16 | |
Joe Perches | 20ee451 | 2014-02-24 13:59:56 -0800 | [diff] [blame] | 17 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
| 18 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 19 | #include <linux/module.h> |
| 20 | #include <linux/crypto.h> |
Mimi Zohar | 9b97b6c | 2013-02-21 09:31:22 -0500 | [diff] [blame] | 21 | #include <linux/audit.h> |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 22 | #include <linux/xattr.h> |
| 23 | #include <linux/integrity.h> |
Mimi Zohar | 3e1be52 | 2011-03-09 14:38:26 -0500 | [diff] [blame] | 24 | #include <linux/evm.h> |
Dmitry Kasatkin | d46eb36 | 2011-03-09 15:07:36 -0500 | [diff] [blame] | 25 | #include <crypto/hash.h> |
Ryan Ware | 613317b | 2016-02-11 15:58:44 -0800 | [diff] [blame] | 26 | #include <crypto/algapi.h> |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 27 | #include "evm.h" |
| 28 | |
| 29 | int evm_initialized; |
| 30 | |
Mimi Zohar | 9b97b6c | 2013-02-21 09:31:22 -0500 | [diff] [blame] | 31 | static char *integrity_status_msg[] = { |
| 32 | "pass", "fail", "no_label", "no_xattrs", "unknown" |
| 33 | }; |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 34 | char *evm_hmac = "hmac(sha1)"; |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 35 | char *evm_hash = "sha1"; |
Dmitry Kasatkin | d3b3367 | 2014-03-28 14:31:04 +0200 | [diff] [blame] | 36 | int evm_hmac_attrs; |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 37 | |
| 38 | char *evm_config_xattrnames[] = { |
| 39 | #ifdef CONFIG_SECURITY_SELINUX |
| 40 | XATTR_NAME_SELINUX, |
| 41 | #endif |
| 42 | #ifdef CONFIG_SECURITY_SMACK |
| 43 | XATTR_NAME_SMACK, |
Dmitry Kasatkin | 3e38df5 | 2014-03-28 14:31:14 +0200 | [diff] [blame] | 44 | #ifdef CONFIG_EVM_EXTRA_SMACK_XATTRS |
| 45 | XATTR_NAME_SMACKEXEC, |
| 46 | XATTR_NAME_SMACKTRANSMUTE, |
| 47 | XATTR_NAME_SMACKMMAP, |
| 48 | #endif |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 49 | #endif |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 50 | #ifdef CONFIG_IMA_APPRAISE |
| 51 | XATTR_NAME_IMA, |
| 52 | #endif |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 53 | XATTR_NAME_CAPS, |
| 54 | NULL |
| 55 | }; |
| 56 | |
Mimi Zohar | 7102ebc | 2011-05-12 18:33:20 -0400 | [diff] [blame] | 57 | static int evm_fixmode; |
| 58 | static int __init evm_set_fixmode(char *str) |
| 59 | { |
| 60 | if (strncmp(str, "fix", 3) == 0) |
| 61 | evm_fixmode = 1; |
| 62 | return 0; |
| 63 | } |
| 64 | __setup("evm=", evm_set_fixmode); |
| 65 | |
Dmitry Kasatkin | d3b3367 | 2014-03-28 14:31:04 +0200 | [diff] [blame] | 66 | static void __init evm_init_config(void) |
| 67 | { |
| 68 | #ifdef CONFIG_EVM_ATTR_FSUUID |
| 69 | evm_hmac_attrs |= EVM_ATTR_FSUUID; |
| 70 | #endif |
| 71 | pr_info("HMAC attrs: 0x%x\n", evm_hmac_attrs); |
| 72 | } |
| 73 | |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 74 | static int evm_find_protected_xattrs(struct dentry *dentry) |
| 75 | { |
David Howells | c6f493d | 2015-03-17 22:26:22 +0000 | [diff] [blame] | 76 | struct inode *inode = d_backing_inode(dentry); |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 77 | char **xattr; |
| 78 | int error; |
| 79 | int count = 0; |
| 80 | |
Andreas Gruenbacher | 5d6c319 | 2016-09-29 17:48:42 +0200 | [diff] [blame] | 81 | if (!(inode->i_opflags & IOP_XATTR)) |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 82 | return -EOPNOTSUPP; |
| 83 | |
| 84 | for (xattr = evm_config_xattrnames; *xattr != NULL; xattr++) { |
Andreas Gruenbacher | 5d6c319 | 2016-09-29 17:48:42 +0200 | [diff] [blame] | 85 | error = __vfs_getxattr(dentry, inode, *xattr, NULL, 0); |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 86 | if (error < 0) { |
| 87 | if (error == -ENODATA) |
| 88 | continue; |
| 89 | return error; |
| 90 | } |
| 91 | count++; |
| 92 | } |
| 93 | |
| 94 | return count; |
| 95 | } |
| 96 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 97 | /* |
| 98 | * evm_verify_hmac - calculate and compare the HMAC with the EVM xattr |
| 99 | * |
| 100 | * Compute the HMAC on the dentry's protected set of extended attributes |
Mimi Zohar | 7102ebc | 2011-05-12 18:33:20 -0400 | [diff] [blame] | 101 | * and compare it against the stored security.evm xattr. |
| 102 | * |
| 103 | * For performance: |
| 104 | * - use the previoulsy retrieved xattr value and length to calculate the |
| 105 | * HMAC.) |
| 106 | * - cache the verification result in the iint, when available. |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 107 | * |
| 108 | * Returns integrity status |
| 109 | */ |
| 110 | static enum integrity_status evm_verify_hmac(struct dentry *dentry, |
| 111 | const char *xattr_name, |
| 112 | char *xattr_value, |
| 113 | size_t xattr_value_len, |
| 114 | struct integrity_iint_cache *iint) |
| 115 | { |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 116 | struct evm_ima_xattr_data *xattr_data = NULL; |
| 117 | struct evm_ima_xattr_data calc; |
Mimi Zohar | 566be59 | 2011-08-22 09:14:18 -0400 | [diff] [blame] | 118 | enum integrity_status evm_status = INTEGRITY_PASS; |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 119 | int rc, xattr_len; |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 120 | |
Mimi Zohar | 7102ebc | 2011-05-12 18:33:20 -0400 | [diff] [blame] | 121 | if (iint && iint->evm_status == INTEGRITY_PASS) |
Dmitry Kasatkin | 24e0198 | 2011-05-06 11:34:17 +0300 | [diff] [blame] | 122 | return iint->evm_status; |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 123 | |
Dmitry Kasatkin | 6d38ca01 | 2011-05-06 11:34:14 +0300 | [diff] [blame] | 124 | /* if status is not PASS, try to check again - against -ENOMEM */ |
| 125 | |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 126 | /* first need to know the sig type */ |
| 127 | rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0, |
| 128 | GFP_NOFS); |
| 129 | if (rc <= 0) { |
Dmitry Kasatkin | 1f10097 | 2014-08-15 13:49:22 +0300 | [diff] [blame] | 130 | evm_status = INTEGRITY_FAIL; |
| 131 | if (rc == -ENODATA) { |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 132 | rc = evm_find_protected_xattrs(dentry); |
| 133 | if (rc > 0) |
| 134 | evm_status = INTEGRITY_NOLABEL; |
| 135 | else if (rc == 0) |
| 136 | evm_status = INTEGRITY_NOXATTRS; /* new file */ |
Dmitry Kasatkin | 1f10097 | 2014-08-15 13:49:22 +0300 | [diff] [blame] | 137 | } else if (rc == -EOPNOTSUPP) { |
| 138 | evm_status = INTEGRITY_UNKNOWN; |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 139 | } |
Mimi Zohar | 566be59 | 2011-08-22 09:14:18 -0400 | [diff] [blame] | 140 | goto out; |
| 141 | } |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 142 | |
Dmitry Kasatkin | b1aaab2 | 2013-10-10 16:12:03 +0900 | [diff] [blame] | 143 | xattr_len = rc; |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 144 | |
| 145 | /* check value type */ |
| 146 | switch (xattr_data->type) { |
| 147 | case EVM_XATTR_HMAC: |
| 148 | rc = evm_calc_hmac(dentry, xattr_name, xattr_value, |
| 149 | xattr_value_len, calc.digest); |
| 150 | if (rc) |
| 151 | break; |
Ryan Ware | 613317b | 2016-02-11 15:58:44 -0800 | [diff] [blame] | 152 | rc = crypto_memneq(xattr_data->digest, calc.digest, |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 153 | sizeof(calc.digest)); |
| 154 | if (rc) |
| 155 | rc = -EINVAL; |
| 156 | break; |
| 157 | case EVM_IMA_XATTR_DIGSIG: |
| 158 | rc = evm_calc_hash(dentry, xattr_name, xattr_value, |
| 159 | xattr_value_len, calc.digest); |
| 160 | if (rc) |
| 161 | break; |
| 162 | rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM, |
Dmitry Kasatkin | b1aaab2 | 2013-10-10 16:12:03 +0900 | [diff] [blame] | 163 | (const char *)xattr_data, xattr_len, |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 164 | calc.digest, sizeof(calc.digest)); |
| 165 | if (!rc) { |
Dmitry Kasatkin | c2baec7 | 2014-10-01 21:43:08 +0300 | [diff] [blame] | 166 | /* Replace RSA with HMAC if not mounted readonly and |
| 167 | * not immutable |
| 168 | */ |
David Howells | c6f493d | 2015-03-17 22:26:22 +0000 | [diff] [blame] | 169 | if (!IS_RDONLY(d_backing_inode(dentry)) && |
| 170 | !IS_IMMUTABLE(d_backing_inode(dentry))) |
Dmitry Kasatkin | c2baec7 | 2014-10-01 21:43:08 +0300 | [diff] [blame] | 171 | evm_update_evmxattr(dentry, xattr_name, |
| 172 | xattr_value, |
| 173 | xattr_value_len); |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 174 | } |
| 175 | break; |
| 176 | default: |
| 177 | rc = -EINVAL; |
| 178 | break; |
| 179 | } |
| 180 | |
| 181 | if (rc) |
| 182 | evm_status = (rc == -ENODATA) ? |
| 183 | INTEGRITY_NOXATTRS : INTEGRITY_FAIL; |
Mimi Zohar | 7102ebc | 2011-05-12 18:33:20 -0400 | [diff] [blame] | 184 | out: |
| 185 | if (iint) |
| 186 | iint->evm_status = evm_status; |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 187 | kfree(xattr_data); |
Mimi Zohar | 7102ebc | 2011-05-12 18:33:20 -0400 | [diff] [blame] | 188 | return evm_status; |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 189 | } |
| 190 | |
| 191 | static int evm_protected_xattr(const char *req_xattr_name) |
| 192 | { |
| 193 | char **xattrname; |
| 194 | int namelen; |
| 195 | int found = 0; |
| 196 | |
| 197 | namelen = strlen(req_xattr_name); |
| 198 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { |
| 199 | if ((strlen(*xattrname) == namelen) |
| 200 | && (strncmp(req_xattr_name, *xattrname, namelen) == 0)) { |
| 201 | found = 1; |
| 202 | break; |
| 203 | } |
Mimi Zohar | cb72318 | 2011-03-09 14:40:44 -0500 | [diff] [blame] | 204 | if (strncmp(req_xattr_name, |
| 205 | *xattrname + XATTR_SECURITY_PREFIX_LEN, |
| 206 | strlen(req_xattr_name)) == 0) { |
| 207 | found = 1; |
| 208 | break; |
| 209 | } |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 210 | } |
| 211 | return found; |
| 212 | } |
| 213 | |
| 214 | /** |
| 215 | * evm_verifyxattr - verify the integrity of the requested xattr |
| 216 | * @dentry: object of the verify xattr |
| 217 | * @xattr_name: requested xattr |
| 218 | * @xattr_value: requested xattr value |
| 219 | * @xattr_value_len: requested xattr value length |
| 220 | * |
| 221 | * Calculate the HMAC for the given dentry and verify it against the stored |
| 222 | * security.evm xattr. For performance, use the xattr value and length |
| 223 | * previously retrieved to calculate the HMAC. |
| 224 | * |
| 225 | * Returns the xattr integrity status. |
| 226 | * |
| 227 | * This function requires the caller to lock the inode's i_mutex before it |
| 228 | * is executed. |
| 229 | */ |
| 230 | enum integrity_status evm_verifyxattr(struct dentry *dentry, |
| 231 | const char *xattr_name, |
Dmitry Kasatkin | 2960e6c | 2011-05-06 11:34:13 +0300 | [diff] [blame] | 232 | void *xattr_value, size_t xattr_value_len, |
| 233 | struct integrity_iint_cache *iint) |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 234 | { |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 235 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) |
| 236 | return INTEGRITY_UNKNOWN; |
| 237 | |
Dmitry Kasatkin | 2960e6c | 2011-05-06 11:34:13 +0300 | [diff] [blame] | 238 | if (!iint) { |
David Howells | c6f493d | 2015-03-17 22:26:22 +0000 | [diff] [blame] | 239 | iint = integrity_iint_find(d_backing_inode(dentry)); |
Dmitry Kasatkin | 2960e6c | 2011-05-06 11:34:13 +0300 | [diff] [blame] | 240 | if (!iint) |
| 241 | return INTEGRITY_UNKNOWN; |
| 242 | } |
| 243 | return evm_verify_hmac(dentry, xattr_name, xattr_value, |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 244 | xattr_value_len, iint); |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 245 | } |
| 246 | EXPORT_SYMBOL_GPL(evm_verifyxattr); |
| 247 | |
| 248 | /* |
Mimi Zohar | 7102ebc | 2011-05-12 18:33:20 -0400 | [diff] [blame] | 249 | * evm_verify_current_integrity - verify the dentry's metadata integrity |
| 250 | * @dentry: pointer to the affected dentry |
| 251 | * |
| 252 | * Verify and return the dentry's metadata integrity. The exceptions are |
| 253 | * before EVM is initialized or in 'fix' mode. |
| 254 | */ |
| 255 | static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) |
| 256 | { |
David Howells | c6f493d | 2015-03-17 22:26:22 +0000 | [diff] [blame] | 257 | struct inode *inode = d_backing_inode(dentry); |
Mimi Zohar | 7102ebc | 2011-05-12 18:33:20 -0400 | [diff] [blame] | 258 | |
| 259 | if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode) |
| 260 | return 0; |
| 261 | return evm_verify_hmac(dentry, NULL, NULL, 0, NULL); |
| 262 | } |
| 263 | |
Mimi Zohar | a924ce0 | 2011-08-11 01:22:30 -0400 | [diff] [blame] | 264 | /* |
| 265 | * evm_protect_xattr - protect the EVM extended attribute |
| 266 | * |
Mimi Zohar | bf6d0f5 | 2011-08-18 18:07:44 -0400 | [diff] [blame] | 267 | * Prevent security.evm from being modified or removed without the |
| 268 | * necessary permissions or when the existing value is invalid. |
| 269 | * |
| 270 | * The posix xattr acls are 'system' prefixed, which normally would not |
| 271 | * affect security.evm. An interesting side affect of writing posix xattr |
| 272 | * acls is their modifying of the i_mode, which is included in security.evm. |
| 273 | * For posix xattr acls only, permit security.evm, even if it currently |
| 274 | * doesn't exist, to be updated. |
Mimi Zohar | a924ce0 | 2011-08-11 01:22:30 -0400 | [diff] [blame] | 275 | */ |
| 276 | static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, |
| 277 | const void *xattr_value, size_t xattr_value_len) |
| 278 | { |
| 279 | enum integrity_status evm_status; |
| 280 | |
| 281 | if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { |
| 282 | if (!capable(CAP_SYS_ADMIN)) |
| 283 | return -EPERM; |
Mimi Zohar | bf6d0f5 | 2011-08-18 18:07:44 -0400 | [diff] [blame] | 284 | } else if (!evm_protected_xattr(xattr_name)) { |
| 285 | if (!posix_xattr_acl(xattr_name)) |
| 286 | return 0; |
| 287 | evm_status = evm_verify_current_integrity(dentry); |
| 288 | if ((evm_status == INTEGRITY_PASS) || |
Mimi Zohar | 566be59 | 2011-08-22 09:14:18 -0400 | [diff] [blame] | 289 | (evm_status == INTEGRITY_NOXATTRS)) |
Mimi Zohar | bf6d0f5 | 2011-08-18 18:07:44 -0400 | [diff] [blame] | 290 | return 0; |
Mimi Zohar | 9b97b6c | 2013-02-21 09:31:22 -0500 | [diff] [blame] | 291 | goto out; |
Mimi Zohar | bf6d0f5 | 2011-08-18 18:07:44 -0400 | [diff] [blame] | 292 | } |
Mimi Zohar | a924ce0 | 2011-08-11 01:22:30 -0400 | [diff] [blame] | 293 | evm_status = evm_verify_current_integrity(dentry); |
Dmitry Kasatkin | 3dcbad5 | 2014-09-02 16:31:43 +0300 | [diff] [blame] | 294 | if (evm_status == INTEGRITY_NOXATTRS) { |
| 295 | struct integrity_iint_cache *iint; |
| 296 | |
David Howells | c6f493d | 2015-03-17 22:26:22 +0000 | [diff] [blame] | 297 | iint = integrity_iint_find(d_backing_inode(dentry)); |
Dmitry Kasatkin | 3dcbad5 | 2014-09-02 16:31:43 +0300 | [diff] [blame] | 298 | if (iint && (iint->flags & IMA_NEW_FILE)) |
| 299 | return 0; |
Mimi Zohar | 5101a18 | 2015-04-21 13:59:31 -0400 | [diff] [blame] | 300 | |
| 301 | /* exception for pseudo filesystems */ |
Al Viro | fc64005 | 2016-04-10 01:33:30 -0400 | [diff] [blame] | 302 | if (dentry->d_sb->s_magic == TMPFS_MAGIC |
| 303 | || dentry->d_sb->s_magic == SYSFS_MAGIC) |
Mimi Zohar | 5101a18 | 2015-04-21 13:59:31 -0400 | [diff] [blame] | 304 | return 0; |
| 305 | |
| 306 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, |
| 307 | dentry->d_inode, dentry->d_name.name, |
| 308 | "update_metadata", |
| 309 | integrity_status_msg[evm_status], |
| 310 | -EPERM, 0); |
Dmitry Kasatkin | 3dcbad5 | 2014-09-02 16:31:43 +0300 | [diff] [blame] | 311 | } |
Mimi Zohar | 9b97b6c | 2013-02-21 09:31:22 -0500 | [diff] [blame] | 312 | out: |
| 313 | if (evm_status != INTEGRITY_PASS) |
David Howells | c6f493d | 2015-03-17 22:26:22 +0000 | [diff] [blame] | 314 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), |
Mimi Zohar | 9b97b6c | 2013-02-21 09:31:22 -0500 | [diff] [blame] | 315 | dentry->d_name.name, "appraise_metadata", |
| 316 | integrity_status_msg[evm_status], |
| 317 | -EPERM, 0); |
Mimi Zohar | a924ce0 | 2011-08-11 01:22:30 -0400 | [diff] [blame] | 318 | return evm_status == INTEGRITY_PASS ? 0 : -EPERM; |
| 319 | } |
| 320 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 321 | /** |
| 322 | * evm_inode_setxattr - protect the EVM extended attribute |
| 323 | * @dentry: pointer to the affected dentry |
| 324 | * @xattr_name: pointer to the affected extended attribute name |
| 325 | * @xattr_value: pointer to the new extended attribute value |
| 326 | * @xattr_value_len: pointer to the new extended attribute value length |
| 327 | * |
Mimi Zohar | 2fb1c9a | 2014-05-11 00:05:23 -0400 | [diff] [blame] | 328 | * Before allowing the 'security.evm' protected xattr to be updated, |
| 329 | * verify the existing value is valid. As only the kernel should have |
| 330 | * access to the EVM encrypted key needed to calculate the HMAC, prevent |
| 331 | * userspace from writing HMAC value. Writing 'security.evm' requires |
| 332 | * requires CAP_SYS_ADMIN privileges. |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 333 | */ |
| 334 | int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, |
| 335 | const void *xattr_value, size_t xattr_value_len) |
| 336 | { |
Mimi Zohar | 2fb1c9a | 2014-05-11 00:05:23 -0400 | [diff] [blame] | 337 | const struct evm_ima_xattr_data *xattr_data = xattr_value; |
| 338 | |
Dmitry Kasatkin | 3b1deef | 2014-10-28 14:28:49 +0200 | [diff] [blame] | 339 | if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { |
| 340 | if (!xattr_value_len) |
| 341 | return -EINVAL; |
| 342 | if (xattr_data->type != EVM_IMA_XATTR_DIGSIG) |
| 343 | return -EPERM; |
| 344 | } |
Mimi Zohar | a924ce0 | 2011-08-11 01:22:30 -0400 | [diff] [blame] | 345 | return evm_protect_xattr(dentry, xattr_name, xattr_value, |
| 346 | xattr_value_len); |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 347 | } |
| 348 | |
| 349 | /** |
| 350 | * evm_inode_removexattr - protect the EVM extended attribute |
| 351 | * @dentry: pointer to the affected dentry |
| 352 | * @xattr_name: pointer to the affected extended attribute name |
| 353 | * |
Mimi Zohar | 7102ebc | 2011-05-12 18:33:20 -0400 | [diff] [blame] | 354 | * Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that |
| 355 | * the current value is valid. |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 356 | */ |
| 357 | int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name) |
| 358 | { |
Mimi Zohar | a924ce0 | 2011-08-11 01:22:30 -0400 | [diff] [blame] | 359 | return evm_protect_xattr(dentry, xattr_name, NULL, 0); |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 360 | } |
| 361 | |
Dmitry Kasatkin | 523b74b | 2015-10-22 21:26:42 +0300 | [diff] [blame] | 362 | static void evm_reset_status(struct inode *inode) |
| 363 | { |
| 364 | struct integrity_iint_cache *iint; |
| 365 | |
| 366 | iint = integrity_iint_find(inode); |
| 367 | if (iint) |
| 368 | iint->evm_status = INTEGRITY_UNKNOWN; |
| 369 | } |
| 370 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 371 | /** |
| 372 | * evm_inode_post_setxattr - update 'security.evm' to reflect the changes |
| 373 | * @dentry: pointer to the affected dentry |
| 374 | * @xattr_name: pointer to the affected extended attribute name |
| 375 | * @xattr_value: pointer to the new extended attribute value |
| 376 | * @xattr_value_len: pointer to the new extended attribute value length |
| 377 | * |
| 378 | * Update the HMAC stored in 'security.evm' to reflect the change. |
| 379 | * |
| 380 | * No need to take the i_mutex lock here, as this function is called from |
| 381 | * __vfs_setxattr_noperm(). The caller of which has taken the inode's |
| 382 | * i_mutex lock. |
| 383 | */ |
| 384 | void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name, |
| 385 | const void *xattr_value, size_t xattr_value_len) |
| 386 | { |
Mimi Zohar | bf6d0f5 | 2011-08-18 18:07:44 -0400 | [diff] [blame] | 387 | if (!evm_initialized || (!evm_protected_xattr(xattr_name) |
| 388 | && !posix_xattr_acl(xattr_name))) |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 389 | return; |
| 390 | |
Dmitry Kasatkin | 523b74b | 2015-10-22 21:26:42 +0300 | [diff] [blame] | 391 | evm_reset_status(dentry->d_inode); |
| 392 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 393 | evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len); |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 394 | } |
| 395 | |
| 396 | /** |
| 397 | * evm_inode_post_removexattr - update 'security.evm' after removing the xattr |
| 398 | * @dentry: pointer to the affected dentry |
| 399 | * @xattr_name: pointer to the affected extended attribute name |
| 400 | * |
| 401 | * Update the HMAC stored in 'security.evm' to reflect removal of the xattr. |
Dmitry Kasatkin | 7c51bb0 | 2014-11-20 16:31:01 +0200 | [diff] [blame] | 402 | * |
| 403 | * No need to take the i_mutex lock here, as this function is called from |
| 404 | * vfs_removexattr() which takes the i_mutex. |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 405 | */ |
| 406 | void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name) |
| 407 | { |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 408 | if (!evm_initialized || !evm_protected_xattr(xattr_name)) |
| 409 | return; |
| 410 | |
Dmitry Kasatkin | 523b74b | 2015-10-22 21:26:42 +0300 | [diff] [blame] | 411 | evm_reset_status(dentry->d_inode); |
| 412 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 413 | evm_update_evmxattr(dentry, xattr_name, NULL, 0); |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 414 | } |
| 415 | |
| 416 | /** |
Mimi Zohar | 817b54a | 2011-05-13 12:53:38 -0400 | [diff] [blame] | 417 | * evm_inode_setattr - prevent updating an invalid EVM extended attribute |
| 418 | * @dentry: pointer to the affected dentry |
| 419 | */ |
| 420 | int evm_inode_setattr(struct dentry *dentry, struct iattr *attr) |
| 421 | { |
| 422 | unsigned int ia_valid = attr->ia_valid; |
| 423 | enum integrity_status evm_status; |
| 424 | |
Mimi Zohar | a924ce0 | 2011-08-11 01:22:30 -0400 | [diff] [blame] | 425 | if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))) |
Mimi Zohar | 817b54a | 2011-05-13 12:53:38 -0400 | [diff] [blame] | 426 | return 0; |
| 427 | evm_status = evm_verify_current_integrity(dentry); |
Mimi Zohar | 566be59 | 2011-08-22 09:14:18 -0400 | [diff] [blame] | 428 | if ((evm_status == INTEGRITY_PASS) || |
| 429 | (evm_status == INTEGRITY_NOXATTRS)) |
| 430 | return 0; |
David Howells | c6f493d | 2015-03-17 22:26:22 +0000 | [diff] [blame] | 431 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), |
Mimi Zohar | 9b97b6c | 2013-02-21 09:31:22 -0500 | [diff] [blame] | 432 | dentry->d_name.name, "appraise_metadata", |
| 433 | integrity_status_msg[evm_status], -EPERM, 0); |
Mimi Zohar | 566be59 | 2011-08-22 09:14:18 -0400 | [diff] [blame] | 434 | return -EPERM; |
Mimi Zohar | 817b54a | 2011-05-13 12:53:38 -0400 | [diff] [blame] | 435 | } |
| 436 | |
| 437 | /** |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 438 | * evm_inode_post_setattr - update 'security.evm' after modifying metadata |
| 439 | * @dentry: pointer to the affected dentry |
| 440 | * @ia_valid: for the UID and GID status |
| 441 | * |
| 442 | * For now, update the HMAC stored in 'security.evm' to reflect UID/GID |
| 443 | * changes. |
| 444 | * |
| 445 | * This function is called from notify_change(), which expects the caller |
| 446 | * to lock the inode's i_mutex. |
| 447 | */ |
| 448 | void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) |
| 449 | { |
| 450 | if (!evm_initialized) |
| 451 | return; |
| 452 | |
| 453 | if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)) |
| 454 | evm_update_evmxattr(dentry, NULL, NULL, 0); |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 455 | } |
| 456 | |
Mimi Zohar | cb72318 | 2011-03-09 14:40:44 -0500 | [diff] [blame] | 457 | /* |
| 458 | * evm_inode_init_security - initializes security.evm |
| 459 | */ |
| 460 | int evm_inode_init_security(struct inode *inode, |
| 461 | const struct xattr *lsm_xattr, |
| 462 | struct xattr *evm_xattr) |
| 463 | { |
| 464 | struct evm_ima_xattr_data *xattr_data; |
| 465 | int rc; |
| 466 | |
| 467 | if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name)) |
Mimi Zohar | 5a4730b | 2011-08-11 00:22:52 -0400 | [diff] [blame] | 468 | return 0; |
Mimi Zohar | cb72318 | 2011-03-09 14:40:44 -0500 | [diff] [blame] | 469 | |
| 470 | xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS); |
| 471 | if (!xattr_data) |
| 472 | return -ENOMEM; |
| 473 | |
| 474 | xattr_data->type = EVM_XATTR_HMAC; |
| 475 | rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest); |
| 476 | if (rc < 0) |
| 477 | goto out; |
| 478 | |
| 479 | evm_xattr->value = xattr_data; |
| 480 | evm_xattr->value_len = sizeof(*xattr_data); |
Tetsuo Handa | 9548906 | 2013-07-25 05:44:02 +0900 | [diff] [blame] | 481 | evm_xattr->name = XATTR_EVM_SUFFIX; |
Mimi Zohar | cb72318 | 2011-03-09 14:40:44 -0500 | [diff] [blame] | 482 | return 0; |
| 483 | out: |
| 484 | kfree(xattr_data); |
| 485 | return rc; |
| 486 | } |
| 487 | EXPORT_SYMBOL_GPL(evm_inode_init_security); |
| 488 | |
Dmitry Kasatkin | 2ce523e | 2015-10-22 21:26:21 +0300 | [diff] [blame] | 489 | #ifdef CONFIG_EVM_LOAD_X509 |
| 490 | void __init evm_load_x509(void) |
| 491 | { |
Dmitry Kasatkin | 26ddabf | 2015-10-22 21:26:26 +0300 | [diff] [blame] | 492 | int rc; |
| 493 | |
| 494 | rc = integrity_load_x509(INTEGRITY_KEYRING_EVM, CONFIG_EVM_X509_PATH); |
| 495 | if (!rc) |
| 496 | evm_initialized |= EVM_INIT_X509; |
Dmitry Kasatkin | 2ce523e | 2015-10-22 21:26:21 +0300 | [diff] [blame] | 497 | } |
| 498 | #endif |
| 499 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 500 | static int __init init_evm(void) |
| 501 | { |
| 502 | int error; |
| 503 | |
Dmitry Kasatkin | d3b3367 | 2014-03-28 14:31:04 +0200 | [diff] [blame] | 504 | evm_init_config(); |
| 505 | |
Dmitry Kasatkin | f4dc377 | 2015-10-22 21:26:10 +0300 | [diff] [blame] | 506 | error = integrity_init_keyring(INTEGRITY_KEYRING_EVM); |
| 507 | if (error) |
| 508 | return error; |
| 509 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 510 | error = evm_init_secfs(); |
| 511 | if (error < 0) { |
Joe Perches | 20ee451 | 2014-02-24 13:59:56 -0800 | [diff] [blame] | 512 | pr_info("Error registering secfs\n"); |
Dmitry Kasatkin | f4dc377 | 2015-10-22 21:26:10 +0300 | [diff] [blame] | 513 | return error; |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 514 | } |
Dmitry Kasatkin | 15647eb | 2011-09-01 14:41:40 +0300 | [diff] [blame] | 515 | |
| 516 | return 0; |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 517 | } |
| 518 | |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 519 | /* |
| 520 | * evm_display_config - list the EVM protected security extended attributes |
| 521 | */ |
| 522 | static int __init evm_display_config(void) |
| 523 | { |
| 524 | char **xattrname; |
| 525 | |
| 526 | for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) |
Joe Perches | 20ee451 | 2014-02-24 13:59:56 -0800 | [diff] [blame] | 527 | pr_info("%s\n", *xattrname); |
Mimi Zohar | 66dbc325 | 2011-03-15 16:12:09 -0400 | [diff] [blame] | 528 | return 0; |
| 529 | } |
| 530 | |
| 531 | pure_initcall(evm_display_config); |
| 532 | late_initcall(init_evm); |
| 533 | |
| 534 | MODULE_DESCRIPTION("Extended Verification Module"); |
| 535 | MODULE_LICENSE("GPL"); |