Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 IBM Corporation |
| 3 | * |
| 4 | * Authors: |
| 5 | * Mimi Zohar <zohar@us.ibm.com> |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or |
| 8 | * modify it under the terms of the GNU General Public License as |
| 9 | * published by the Free Software Foundation, version 2 of the |
| 10 | * License. |
| 11 | * |
| 12 | * File: ima_iint.c |
| 13 | * - implements the IMA hooks: ima_inode_alloc, ima_inode_free |
| 14 | * - cache integrity information associated with an inode |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 15 | * using a rbtree tree. |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 16 | */ |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 17 | #include <linux/slab.h> |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 18 | #include <linux/module.h> |
| 19 | #include <linux/spinlock.h> |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 20 | #include <linux/rbtree.h> |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 21 | #include "ima.h" |
| 22 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 23 | static struct rb_root ima_iint_tree = RB_ROOT; |
| 24 | static DEFINE_SPINLOCK(ima_iint_lock); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 25 | static struct kmem_cache *iint_cache __read_mostly; |
| 26 | |
Mimi Zohar | e950598 | 2010-08-31 09:38:51 -0400 | [diff] [blame] | 27 | int iint_initialized = 0; |
| 28 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 29 | /* |
| 30 | * __ima_iint_find - return the iint associated with an inode |
| 31 | */ |
| 32 | static struct ima_iint_cache *__ima_iint_find(struct inode *inode) |
| 33 | { |
| 34 | struct ima_iint_cache *iint; |
| 35 | struct rb_node *n = ima_iint_tree.rb_node; |
| 36 | |
| 37 | assert_spin_locked(&ima_iint_lock); |
| 38 | |
| 39 | while (n) { |
| 40 | iint = rb_entry(n, struct ima_iint_cache, rb_node); |
| 41 | |
| 42 | if (inode < iint->inode) |
| 43 | n = n->rb_left; |
| 44 | else if (inode > iint->inode) |
| 45 | n = n->rb_right; |
| 46 | else |
| 47 | break; |
| 48 | } |
| 49 | if (!n) |
| 50 | return NULL; |
| 51 | |
| 52 | return iint; |
| 53 | } |
| 54 | |
| 55 | /* |
| 56 | * ima_iint_find_get - return the iint associated with an inode |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 57 | * |
| 58 | * ima_iint_find_get gets a reference to the iint. Caller must |
| 59 | * remember to put the iint reference. |
| 60 | */ |
| 61 | struct ima_iint_cache *ima_iint_find_get(struct inode *inode) |
| 62 | { |
| 63 | struct ima_iint_cache *iint; |
| 64 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 65 | spin_lock(&ima_iint_lock); |
| 66 | iint = __ima_iint_find(inode); |
| 67 | if (iint) |
| 68 | kref_get(&iint->refcount); |
| 69 | spin_unlock(&ima_iint_lock); |
| 70 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 71 | return iint; |
| 72 | } |
| 73 | |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 74 | /** |
| 75 | * ima_inode_alloc - allocate an iint associated with an inode |
| 76 | * @inode: pointer to the inode |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 77 | */ |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 78 | int ima_inode_alloc(struct inode *inode) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 79 | { |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 80 | struct rb_node **p; |
| 81 | struct rb_node *new_node, *parent = NULL; |
| 82 | struct ima_iint_cache *new_iint, *test_iint; |
| 83 | int rc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 84 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 85 | new_iint = kmem_cache_alloc(iint_cache, GFP_NOFS); |
| 86 | if (!new_iint) |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 87 | return -ENOMEM; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 88 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 89 | new_iint->inode = inode; |
| 90 | new_node = &new_iint->rb_node; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 91 | |
| 92 | spin_lock(&ima_iint_lock); |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 93 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 94 | p = &ima_iint_tree.rb_node; |
| 95 | while (*p) { |
| 96 | parent = *p; |
| 97 | test_iint = rb_entry(parent, struct ima_iint_cache, rb_node); |
| 98 | |
| 99 | rc = -EEXIST; |
| 100 | if (inode < test_iint->inode) |
| 101 | p = &(*p)->rb_left; |
| 102 | else if (inode > test_iint->inode) |
| 103 | p = &(*p)->rb_right; |
| 104 | else |
| 105 | goto out_err; |
| 106 | } |
| 107 | |
| 108 | rb_link_node(new_node, parent, p); |
| 109 | rb_insert_color(new_node, &ima_iint_tree); |
| 110 | |
| 111 | spin_unlock(&ima_iint_lock); |
| 112 | |
| 113 | return 0; |
| 114 | out_err: |
| 115 | spin_unlock(&ima_iint_lock); |
| 116 | kref_put(&new_iint->refcount, iint_free); |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 117 | return rc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 118 | } |
| 119 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 120 | /* iint_free - called when the iint refcount goes to zero */ |
| 121 | void iint_free(struct kref *kref) |
| 122 | { |
| 123 | struct ima_iint_cache *iint = container_of(kref, struct ima_iint_cache, |
| 124 | refcount); |
| 125 | iint->version = 0; |
| 126 | iint->flags = 0UL; |
Mimi Zohar | 1df9f0a | 2009-02-04 09:07:02 -0500 | [diff] [blame] | 127 | if (iint->readcount != 0) { |
H Hartley Sweeten | a19c5bb | 2010-03-09 17:59:59 -0600 | [diff] [blame] | 128 | printk(KERN_INFO "%s: readcount: %ld\n", __func__, |
Mimi Zohar | 1df9f0a | 2009-02-04 09:07:02 -0500 | [diff] [blame] | 129 | iint->readcount); |
| 130 | iint->readcount = 0; |
| 131 | } |
| 132 | if (iint->writecount != 0) { |
H Hartley Sweeten | a19c5bb | 2010-03-09 17:59:59 -0600 | [diff] [blame] | 133 | printk(KERN_INFO "%s: writecount: %ld\n", __func__, |
Mimi Zohar | 1df9f0a | 2009-02-04 09:07:02 -0500 | [diff] [blame] | 134 | iint->writecount); |
| 135 | iint->writecount = 0; |
| 136 | } |
| 137 | if (iint->opencount != 0) { |
H Hartley Sweeten | a19c5bb | 2010-03-09 17:59:59 -0600 | [diff] [blame] | 138 | printk(KERN_INFO "%s: opencount: %ld\n", __func__, |
Mimi Zohar | 1df9f0a | 2009-02-04 09:07:02 -0500 | [diff] [blame] | 139 | iint->opencount); |
| 140 | iint->opencount = 0; |
| 141 | } |
NeilBrown | db1afff | 2010-03-16 15:14:51 +1100 | [diff] [blame] | 142 | kref_init(&iint->refcount); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 143 | kmem_cache_free(iint_cache, iint); |
| 144 | } |
| 145 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 146 | /** |
Eric Paris | 85a17f5 | 2009-12-04 15:48:08 -0500 | [diff] [blame] | 147 | * ima_inode_free - called on security_inode_free |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 148 | * @inode: pointer to the inode |
| 149 | * |
| 150 | * Free the integrity information(iint) associated with an inode. |
| 151 | */ |
Eric Paris | 85a17f5 | 2009-12-04 15:48:08 -0500 | [diff] [blame] | 152 | void ima_inode_free(struct inode *inode) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 153 | { |
| 154 | struct ima_iint_cache *iint; |
| 155 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 156 | spin_lock(&ima_iint_lock); |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 157 | iint = __ima_iint_find(inode); |
| 158 | if (iint) |
| 159 | rb_erase(&iint->rb_node, &ima_iint_tree); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 160 | spin_unlock(&ima_iint_lock); |
| 161 | if (iint) |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame^] | 162 | kref_put(&iint->refcount, iint_free); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 163 | } |
| 164 | |
| 165 | static void init_once(void *foo) |
| 166 | { |
| 167 | struct ima_iint_cache *iint = foo; |
| 168 | |
| 169 | memset(iint, 0, sizeof *iint); |
| 170 | iint->version = 0; |
| 171 | iint->flags = 0UL; |
| 172 | mutex_init(&iint->mutex); |
| 173 | iint->readcount = 0; |
| 174 | iint->writecount = 0; |
Mimi Zohar | 1df9f0a | 2009-02-04 09:07:02 -0500 | [diff] [blame] | 175 | iint->opencount = 0; |
NeilBrown | db1afff | 2010-03-16 15:14:51 +1100 | [diff] [blame] | 176 | kref_init(&iint->refcount); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 177 | } |
| 178 | |
Eric Paris | 54bb655 | 2009-12-09 15:29:01 -0500 | [diff] [blame] | 179 | static int __init ima_iintcache_init(void) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 180 | { |
| 181 | iint_cache = |
| 182 | kmem_cache_create("iint_cache", sizeof(struct ima_iint_cache), 0, |
| 183 | SLAB_PANIC, init_once); |
Mimi Zohar | e950598 | 2010-08-31 09:38:51 -0400 | [diff] [blame] | 184 | iint_initialized = 1; |
Eric Paris | 54bb655 | 2009-12-09 15:29:01 -0500 | [diff] [blame] | 185 | return 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 186 | } |
Eric Paris | 54bb655 | 2009-12-09 15:29:01 -0500 | [diff] [blame] | 187 | security_initcall(ima_iintcache_init); |