Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 IBM Corporation |
| 3 | * |
| 4 | * Authors: |
| 5 | * Mimi Zohar <zohar@us.ibm.com> |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or |
| 8 | * modify it under the terms of the GNU General Public License as |
| 9 | * published by the Free Software Foundation, version 2 of the |
| 10 | * License. |
| 11 | * |
| 12 | * File: ima_iint.c |
| 13 | * - implements the IMA hooks: ima_inode_alloc, ima_inode_free |
| 14 | * - cache integrity information associated with an inode |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 15 | * using a rbtree tree. |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 16 | */ |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 17 | #include <linux/slab.h> |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 18 | #include <linux/module.h> |
| 19 | #include <linux/spinlock.h> |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 20 | #include <linux/rbtree.h> |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 21 | #include "ima.h" |
| 22 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 23 | static struct rb_root ima_iint_tree = RB_ROOT; |
| 24 | static DEFINE_SPINLOCK(ima_iint_lock); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 25 | static struct kmem_cache *iint_cache __read_mostly; |
| 26 | |
Mimi Zohar | e950598 | 2010-08-31 09:38:51 -0400 | [diff] [blame] | 27 | int iint_initialized = 0; |
| 28 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 29 | /* |
| 30 | * __ima_iint_find - return the iint associated with an inode |
| 31 | */ |
| 32 | static struct ima_iint_cache *__ima_iint_find(struct inode *inode) |
| 33 | { |
| 34 | struct ima_iint_cache *iint; |
| 35 | struct rb_node *n = ima_iint_tree.rb_node; |
| 36 | |
| 37 | assert_spin_locked(&ima_iint_lock); |
| 38 | |
| 39 | while (n) { |
| 40 | iint = rb_entry(n, struct ima_iint_cache, rb_node); |
| 41 | |
| 42 | if (inode < iint->inode) |
| 43 | n = n->rb_left; |
| 44 | else if (inode > iint->inode) |
| 45 | n = n->rb_right; |
| 46 | else |
| 47 | break; |
| 48 | } |
| 49 | if (!n) |
| 50 | return NULL; |
| 51 | |
| 52 | return iint; |
| 53 | } |
| 54 | |
| 55 | /* |
Eric Paris | 64c62f0 | 2010-10-25 14:42:12 -0400 | [diff] [blame] | 56 | * ima_iint_find - return the iint associated with an inode |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 57 | */ |
Eric Paris | 64c62f0 | 2010-10-25 14:42:12 -0400 | [diff] [blame] | 58 | struct ima_iint_cache *ima_iint_find(struct inode *inode) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 59 | { |
| 60 | struct ima_iint_cache *iint; |
| 61 | |
Eric Paris | 196f518 | 2010-10-25 14:42:19 -0400 | [diff] [blame] | 62 | if (!IS_IMA(inode)) |
| 63 | return NULL; |
| 64 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 65 | spin_lock(&ima_iint_lock); |
| 66 | iint = __ima_iint_find(inode); |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 67 | spin_unlock(&ima_iint_lock); |
| 68 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 69 | return iint; |
| 70 | } |
| 71 | |
Eric Paris | 64c62f0 | 2010-10-25 14:42:12 -0400 | [diff] [blame] | 72 | static void iint_free(struct ima_iint_cache *iint) |
| 73 | { |
| 74 | iint->version = 0; |
| 75 | iint->flags = 0UL; |
| 76 | kmem_cache_free(iint_cache, iint); |
| 77 | } |
| 78 | |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 79 | /** |
| 80 | * ima_inode_alloc - allocate an iint associated with an inode |
| 81 | * @inode: pointer to the inode |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 82 | */ |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 83 | int ima_inode_alloc(struct inode *inode) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 84 | { |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 85 | struct rb_node **p; |
| 86 | struct rb_node *new_node, *parent = NULL; |
| 87 | struct ima_iint_cache *new_iint, *test_iint; |
| 88 | int rc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 89 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 90 | new_iint = kmem_cache_alloc(iint_cache, GFP_NOFS); |
| 91 | if (!new_iint) |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 92 | return -ENOMEM; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 93 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 94 | new_iint->inode = inode; |
| 95 | new_node = &new_iint->rb_node; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 96 | |
Eric Paris | 196f518 | 2010-10-25 14:42:19 -0400 | [diff] [blame] | 97 | mutex_lock(&inode->i_mutex); /* i_flags */ |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 98 | spin_lock(&ima_iint_lock); |
Eric Paris | 9353384 | 2009-12-04 15:47:52 -0500 | [diff] [blame] | 99 | |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 100 | p = &ima_iint_tree.rb_node; |
| 101 | while (*p) { |
| 102 | parent = *p; |
| 103 | test_iint = rb_entry(parent, struct ima_iint_cache, rb_node); |
| 104 | |
| 105 | rc = -EEXIST; |
| 106 | if (inode < test_iint->inode) |
| 107 | p = &(*p)->rb_left; |
| 108 | else if (inode > test_iint->inode) |
| 109 | p = &(*p)->rb_right; |
| 110 | else |
| 111 | goto out_err; |
| 112 | } |
| 113 | |
Eric Paris | 196f518 | 2010-10-25 14:42:19 -0400 | [diff] [blame] | 114 | inode->i_flags |= S_IMA; |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 115 | rb_link_node(new_node, parent, p); |
| 116 | rb_insert_color(new_node, &ima_iint_tree); |
| 117 | |
| 118 | spin_unlock(&ima_iint_lock); |
Eric Paris | 196f518 | 2010-10-25 14:42:19 -0400 | [diff] [blame] | 119 | mutex_unlock(&inode->i_mutex); /* i_flags */ |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 120 | |
| 121 | return 0; |
| 122 | out_err: |
| 123 | spin_unlock(&ima_iint_lock); |
Eric Paris | 196f518 | 2010-10-25 14:42:19 -0400 | [diff] [blame] | 124 | mutex_unlock(&inode->i_mutex); /* i_flags */ |
Eric Paris | 64c62f0 | 2010-10-25 14:42:12 -0400 | [diff] [blame] | 125 | iint_free(new_iint); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 126 | |
Eric Paris | 64c62f0 | 2010-10-25 14:42:12 -0400 | [diff] [blame] | 127 | return rc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 128 | } |
| 129 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 130 | /** |
Eric Paris | 85a17f5 | 2009-12-04 15:48:08 -0500 | [diff] [blame] | 131 | * ima_inode_free - called on security_inode_free |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 132 | * @inode: pointer to the inode |
| 133 | * |
| 134 | * Free the integrity information(iint) associated with an inode. |
| 135 | */ |
Eric Paris | 85a17f5 | 2009-12-04 15:48:08 -0500 | [diff] [blame] | 136 | void ima_inode_free(struct inode *inode) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 137 | { |
| 138 | struct ima_iint_cache *iint; |
| 139 | |
Eric Paris | 196f518 | 2010-10-25 14:42:19 -0400 | [diff] [blame] | 140 | if (!IS_IMA(inode)) |
| 141 | return; |
| 142 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 143 | spin_lock(&ima_iint_lock); |
Eric Paris | 8549164 | 2010-10-25 14:41:18 -0400 | [diff] [blame] | 144 | iint = __ima_iint_find(inode); |
Eric Paris | 196f518 | 2010-10-25 14:42:19 -0400 | [diff] [blame] | 145 | rb_erase(&iint->rb_node, &ima_iint_tree); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 146 | spin_unlock(&ima_iint_lock); |
Eric Paris | 64c62f0 | 2010-10-25 14:42:12 -0400 | [diff] [blame] | 147 | |
Eric Paris | 64c62f0 | 2010-10-25 14:42:12 -0400 | [diff] [blame] | 148 | iint_free(iint); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 149 | } |
| 150 | |
| 151 | static void init_once(void *foo) |
| 152 | { |
| 153 | struct ima_iint_cache *iint = foo; |
| 154 | |
| 155 | memset(iint, 0, sizeof *iint); |
| 156 | iint->version = 0; |
| 157 | iint->flags = 0UL; |
| 158 | mutex_init(&iint->mutex); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 159 | } |
| 160 | |
Eric Paris | 54bb655 | 2009-12-09 15:29:01 -0500 | [diff] [blame] | 161 | static int __init ima_iintcache_init(void) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 162 | { |
| 163 | iint_cache = |
| 164 | kmem_cache_create("iint_cache", sizeof(struct ima_iint_cache), 0, |
| 165 | SLAB_PANIC, init_once); |
Mimi Zohar | e950598 | 2010-08-31 09:38:51 -0400 | [diff] [blame] | 166 | iint_initialized = 1; |
Eric Paris | 54bb655 | 2009-12-09 15:29:01 -0500 | [diff] [blame] | 167 | return 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 168 | } |
Eric Paris | 54bb655 | 2009-12-09 15:29:01 -0500 | [diff] [blame] | 169 | security_initcall(ima_iintcache_init); |