Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2005,2006,2007,2008 IBM Corporation |
| 3 | * |
| 4 | * Authors: |
| 5 | * Mimi Zohar <zohar@us.ibm.com> |
| 6 | * Kylene Hall <kjhall@us.ibm.com> |
| 7 | * |
| 8 | * This program is free software; you can redistribute it and/or modify |
| 9 | * it under the terms of the GNU General Public License as published by |
| 10 | * the Free Software Foundation, version 2 of the License. |
| 11 | * |
| 12 | * File: ima_crypto.c |
Dmitry Kasatkin | 2bb930a | 2014-03-04 18:04:20 +0200 | [diff] [blame] | 13 | * Calculates md5/sha1 file hash, template hash, boot-aggreate hash |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 14 | */ |
| 15 | |
Joe Perches | 20ee451 | 2014-02-24 13:59:56 -0800 | [diff] [blame] | 16 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
| 17 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 18 | #include <linux/kernel.h> |
| 19 | #include <linux/file.h> |
| 20 | #include <linux/crypto.h> |
| 21 | #include <linux/scatterlist.h> |
| 22 | #include <linux/err.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 23 | #include <linux/slab.h> |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 24 | #include <crypto/hash.h> |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 25 | #include <crypto/hash_info.h> |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 26 | #include "ima.h" |
| 27 | |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 28 | static struct crypto_shash *ima_shash_tfm; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 29 | |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 30 | int ima_init_crypto(void) |
| 31 | { |
| 32 | long rc; |
| 33 | |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 34 | ima_shash_tfm = crypto_alloc_shash(hash_algo_name[ima_hash_algo], 0, 0); |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 35 | if (IS_ERR(ima_shash_tfm)) { |
| 36 | rc = PTR_ERR(ima_shash_tfm); |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 37 | pr_err("Can not allocate %s (reason: %ld)\n", |
| 38 | hash_algo_name[ima_hash_algo], rc); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 39 | return rc; |
| 40 | } |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 41 | return 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 42 | } |
| 43 | |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 44 | static struct crypto_shash *ima_alloc_tfm(enum hash_algo algo) |
| 45 | { |
| 46 | struct crypto_shash *tfm = ima_shash_tfm; |
| 47 | int rc; |
| 48 | |
| 49 | if (algo != ima_hash_algo && algo < HASH_ALGO__LAST) { |
| 50 | tfm = crypto_alloc_shash(hash_algo_name[algo], 0, 0); |
| 51 | if (IS_ERR(tfm)) { |
| 52 | rc = PTR_ERR(tfm); |
| 53 | pr_err("Can not allocate %s (reason: %d)\n", |
| 54 | hash_algo_name[algo], rc); |
| 55 | } |
| 56 | } |
| 57 | return tfm; |
| 58 | } |
| 59 | |
| 60 | static void ima_free_tfm(struct crypto_shash *tfm) |
| 61 | { |
| 62 | if (tfm != ima_shash_tfm) |
| 63 | crypto_free_shash(tfm); |
| 64 | } |
| 65 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 66 | /* |
| 67 | * Calculate the MD5/SHA1 file digest |
| 68 | */ |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 69 | static int ima_calc_file_hash_tfm(struct file *file, |
| 70 | struct ima_digest_data *hash, |
| 71 | struct crypto_shash *tfm) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 72 | { |
Mimi Zohar | 16bfa38 | 2009-08-21 14:32:49 -0400 | [diff] [blame] | 73 | loff_t i_size, offset = 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 74 | char *rbuf; |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 75 | int rc, read = 0; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 76 | struct { |
| 77 | struct shash_desc shash; |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 78 | char ctx[crypto_shash_descsize(tfm)]; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 79 | } desc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 80 | |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 81 | desc.shash.tfm = tfm; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 82 | desc.shash.flags = 0; |
| 83 | |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 84 | hash->length = crypto_shash_digestsize(tfm); |
| 85 | |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 86 | rc = crypto_shash_init(&desc.shash); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 87 | if (rc != 0) |
| 88 | return rc; |
| 89 | |
Dmitry Kasatkin | 1d91ac6 | 2014-02-27 20:16:47 +0200 | [diff] [blame] | 90 | i_size = i_size_read(file_inode(file)); |
| 91 | |
| 92 | if (i_size == 0) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 93 | goto out; |
Dmitry Kasatkin | 1d91ac6 | 2014-02-27 20:16:47 +0200 | [diff] [blame] | 94 | |
| 95 | rbuf = kzalloc(PAGE_SIZE, GFP_KERNEL); |
| 96 | if (!rbuf) |
| 97 | return -ENOMEM; |
| 98 | |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 99 | if (!(file->f_mode & FMODE_READ)) { |
| 100 | file->f_mode |= FMODE_READ; |
| 101 | read = 1; |
| 102 | } |
Dmitry Kasatkin | 1d91ac6 | 2014-02-27 20:16:47 +0200 | [diff] [blame] | 103 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 104 | while (offset < i_size) { |
| 105 | int rbuf_len; |
| 106 | |
| 107 | rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE); |
| 108 | if (rbuf_len < 0) { |
| 109 | rc = rbuf_len; |
| 110 | break; |
| 111 | } |
Mimi Zohar | 16bfa38 | 2009-08-21 14:32:49 -0400 | [diff] [blame] | 112 | if (rbuf_len == 0) |
| 113 | break; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 114 | offset += rbuf_len; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 115 | |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 116 | rc = crypto_shash_update(&desc.shash, rbuf, rbuf_len); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 117 | if (rc) |
| 118 | break; |
| 119 | } |
Mimi Zohar | 2fe5d6d | 2012-02-13 10:15:05 -0500 | [diff] [blame] | 120 | if (read) |
| 121 | file->f_mode &= ~FMODE_READ; |
Dmitry Kasatkin | 1d91ac6 | 2014-02-27 20:16:47 +0200 | [diff] [blame] | 122 | kfree(rbuf); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 123 | out: |
Dmitry Kasatkin | 1d91ac6 | 2014-02-27 20:16:47 +0200 | [diff] [blame] | 124 | if (!rc) |
| 125 | rc = crypto_shash_final(&desc.shash, hash->digest); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 126 | return rc; |
| 127 | } |
| 128 | |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 129 | int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) |
| 130 | { |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 131 | struct crypto_shash *tfm; |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 132 | int rc; |
| 133 | |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 134 | tfm = ima_alloc_tfm(hash->algo); |
| 135 | if (IS_ERR(tfm)) |
| 136 | return PTR_ERR(tfm); |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 137 | |
| 138 | rc = ima_calc_file_hash_tfm(file, hash, tfm); |
| 139 | |
Dmitry Kasatkin | 723326b | 2013-07-04 17:40:01 +0300 | [diff] [blame] | 140 | ima_free_tfm(tfm); |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 141 | |
| 142 | return rc; |
| 143 | } |
| 144 | |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 145 | /* |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 146 | * Calculate the hash of template data |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 147 | */ |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 148 | static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data, |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 149 | struct ima_template_desc *td, |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 150 | int num_fields, |
| 151 | struct ima_digest_data *hash, |
| 152 | struct crypto_shash *tfm) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 153 | { |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 154 | struct { |
| 155 | struct shash_desc shash; |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 156 | char ctx[crypto_shash_descsize(tfm)]; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 157 | } desc; |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 158 | int rc, i; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 159 | |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 160 | desc.shash.tfm = tfm; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 161 | desc.shash.flags = 0; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 162 | |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 163 | hash->length = crypto_shash_digestsize(tfm); |
Dmitry Kasatkin | c7c8bb2 | 2013-04-25 10:43:56 +0300 | [diff] [blame] | 164 | |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 165 | rc = crypto_shash_init(&desc.shash); |
| 166 | if (rc != 0) |
| 167 | return rc; |
| 168 | |
| 169 | for (i = 0; i < num_fields; i++) { |
Roberto Sassu | e3b64c2 | 2014-02-03 13:56:05 +0100 | [diff] [blame] | 170 | u8 buffer[IMA_EVENT_NAME_LEN_MAX + 1] = { 0 }; |
| 171 | u8 *data_to_hash = field_data[i].data; |
| 172 | u32 datalen = field_data[i].len; |
| 173 | |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 174 | if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) { |
| 175 | rc = crypto_shash_update(&desc.shash, |
| 176 | (const u8 *) &field_data[i].len, |
| 177 | sizeof(field_data[i].len)); |
| 178 | if (rc) |
| 179 | break; |
Roberto Sassu | e3b64c2 | 2014-02-03 13:56:05 +0100 | [diff] [blame] | 180 | } else if (strcmp(td->fields[i]->field_id, "n") == 0) { |
| 181 | memcpy(buffer, data_to_hash, datalen); |
| 182 | data_to_hash = buffer; |
| 183 | datalen = IMA_EVENT_NAME_LEN_MAX + 1; |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 184 | } |
Roberto Sassu | e3b64c2 | 2014-02-03 13:56:05 +0100 | [diff] [blame] | 185 | rc = crypto_shash_update(&desc.shash, data_to_hash, datalen); |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 186 | if (rc) |
| 187 | break; |
| 188 | } |
| 189 | |
| 190 | if (!rc) |
| 191 | rc = crypto_shash_final(&desc.shash, hash->digest); |
| 192 | |
| 193 | return rc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 194 | } |
| 195 | |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 196 | int ima_calc_field_array_hash(struct ima_field_data *field_data, |
| 197 | struct ima_template_desc *desc, int num_fields, |
Roberto Sassu | a71dc65 | 2013-06-07 12:16:33 +0200 | [diff] [blame] | 198 | struct ima_digest_data *hash) |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 199 | { |
| 200 | struct crypto_shash *tfm; |
| 201 | int rc; |
| 202 | |
| 203 | tfm = ima_alloc_tfm(hash->algo); |
| 204 | if (IS_ERR(tfm)) |
| 205 | return PTR_ERR(tfm); |
| 206 | |
Roberto Sassu | b6f8f16 | 2013-11-08 19:21:39 +0100 | [diff] [blame] | 207 | rc = ima_calc_field_array_hash_tfm(field_data, desc, num_fields, |
| 208 | hash, tfm); |
Dmitry Kasatkin | ea59399 | 2013-06-07 12:16:24 +0200 | [diff] [blame] | 209 | |
| 210 | ima_free_tfm(tfm); |
| 211 | |
| 212 | return rc; |
| 213 | } |
| 214 | |
Eric Paris | 932995f | 2009-05-21 15:43:32 -0400 | [diff] [blame] | 215 | static void __init ima_pcrread(int idx, u8 *pcr) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 216 | { |
| 217 | if (!ima_used_chip) |
| 218 | return; |
| 219 | |
| 220 | if (tpm_pcr_read(TPM_ANY_NUM, idx, pcr) != 0) |
Joe Perches | 20ee451 | 2014-02-24 13:59:56 -0800 | [diff] [blame] | 221 | pr_err("Error Communicating to TPM chip\n"); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 222 | } |
| 223 | |
| 224 | /* |
| 225 | * Calculate the boot aggregate hash |
| 226 | */ |
Dmitry Kasatkin | 09ef543 | 2013-06-07 12:16:25 +0200 | [diff] [blame] | 227 | static int __init ima_calc_boot_aggregate_tfm(char *digest, |
| 228 | struct crypto_shash *tfm) |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 229 | { |
Mimi Zohar | 140d802 | 2013-03-11 20:29:47 -0400 | [diff] [blame] | 230 | u8 pcr_i[TPM_DIGEST_SIZE]; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 231 | int rc, i; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 232 | struct { |
| 233 | struct shash_desc shash; |
Dmitry Kasatkin | 09ef543 | 2013-06-07 12:16:25 +0200 | [diff] [blame] | 234 | char ctx[crypto_shash_descsize(tfm)]; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 235 | } desc; |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 236 | |
Dmitry Kasatkin | 09ef543 | 2013-06-07 12:16:25 +0200 | [diff] [blame] | 237 | desc.shash.tfm = tfm; |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 238 | desc.shash.flags = 0; |
| 239 | |
| 240 | rc = crypto_shash_init(&desc.shash); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 241 | if (rc != 0) |
| 242 | return rc; |
| 243 | |
| 244 | /* cumulative sha1 over tpm registers 0-7 */ |
| 245 | for (i = TPM_PCR0; i < TPM_PCR8; i++) { |
| 246 | ima_pcrread(i, pcr_i); |
| 247 | /* now accumulate with current aggregate */ |
Mimi Zohar | 140d802 | 2013-03-11 20:29:47 -0400 | [diff] [blame] | 248 | rc = crypto_shash_update(&desc.shash, pcr_i, TPM_DIGEST_SIZE); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 249 | } |
| 250 | if (!rc) |
Dmitry Kasatkin | 76bb28f | 2012-06-08 10:42:30 +0300 | [diff] [blame] | 251 | crypto_shash_final(&desc.shash, digest); |
Mimi Zohar | 3323eec9 | 2009-02-04 09:06:58 -0500 | [diff] [blame] | 252 | return rc; |
| 253 | } |
Dmitry Kasatkin | 09ef543 | 2013-06-07 12:16:25 +0200 | [diff] [blame] | 254 | |
| 255 | int __init ima_calc_boot_aggregate(struct ima_digest_data *hash) |
| 256 | { |
| 257 | struct crypto_shash *tfm; |
| 258 | int rc; |
| 259 | |
| 260 | tfm = ima_alloc_tfm(hash->algo); |
| 261 | if (IS_ERR(tfm)) |
| 262 | return PTR_ERR(tfm); |
| 263 | |
| 264 | hash->length = crypto_shash_digestsize(tfm); |
| 265 | rc = ima_calc_boot_aggregate_tfm(hash->digest, tfm); |
| 266 | |
| 267 | ima_free_tfm(tfm); |
| 268 | |
| 269 | return rc; |
| 270 | } |