1 // SPDX-License-Identifier: GPL-2.0-only
53 	if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) {  in hash_setup()
93 	    mapping_writably_mapped(file->f_mapping)) {  in mmap_violation_check()
94 		rc = -ETXTBSY;  in mmap_violation_check()
97 		if (!*pathbuf)	/* ima_rdwr_violation possibly pre-fetched */  in mmap_violation_check()
98 			*pathname = ima_d_path(&file->f_path, pathbuf,  in mmap_violation_check()
110  *	- Opening a file for write when already open for read,
112  *	- Opening a file for read when already open for write,
124 	fmode_t mode = file->f_mode;  in ima_rdwr_violation_check()
128 		if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) {  in ima_rdwr_violation_check()
133 						&iint->atomic_flags))  in ima_rdwr_violation_check()
138 			set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);  in ima_rdwr_violation_check()
146 	*pathname = ima_d_path(&file->f_path, pathbuf, filename);  in ima_rdwr_violation_check()
159 	fmode_t mode = file->f_mode;  in ima_check_last_writer()
165 	mutex_lock(&iint->mutex);  in ima_check_last_writer()
166 	if (atomic_read(&inode->i_writecount) == 1) {  in ima_check_last_writer()
170 					    &iint->atomic_flags);  in ima_check_last_writer()
171 		if ((iint->flags & IMA_NEW_FILE) ||  in ima_check_last_writer()
172 		    vfs_getattr_nosec(&file->f_path, &stat,  in ima_check_last_writer()
176 		    stat.change_cookie != iint->version) {  in ima_check_last_writer()
177 			iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);  in ima_check_last_writer()
178 			iint->measured_pcrs = 0;  in ima_check_last_writer()
183 	mutex_unlock(&iint->mutex);  in ima_check_last_writer()
187  * ima_file_free - called on __fput()
197 	if (!ima_policy_flag || !S_ISREG(inode->i_mode))  in ima_file_free()
226 	if (!ima_policy_flag || !S_ISREG(inode->i_mode))  in process_measurement()
230 	 * bitmask based on the appraise/audit/measurement policy.  in process_measurement()
253 			rc = -ENOMEM;  in process_measurement()
267 	mutex_lock(&iint->mutex);  in process_measurement()
269 	if (test_and_clear_bit(IMA_CHANGE_ATTR, &iint->atomic_flags))  in process_measurement()
271 		iint->flags &= ~(IMA_APPRAISE | IMA_APPRAISED |  in process_measurement()
276 	 * Re-evaulate the file if either the xattr has changed or the  in process_measurement()
277 	 * kernel has no way of detecting file change on the filesystem.  in process_measurement()
280 	if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags) ||  in process_measurement()
281 	    ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) &&  in process_measurement()
282 	     !(inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER) &&  in process_measurement()
284 		iint->flags &= ~IMA_DONE_MASK;  in process_measurement()
285 		iint->measured_pcrs = 0;  in process_measurement()
288 	/* Detect and re-evaluate changes made to the backing file. */  in process_measurement()
291 	    (action & IMA_DO_MASK) && (iint->flags & IMA_DONE_MASK)) {  in process_measurement()
293 		    backing_inode->i_sb->s_dev != iint->real_dev ||  in process_measurement()
294 		    backing_inode->i_ino != iint->real_ino ||  in process_measurement()
295 		    !inode_eq_iversion(backing_inode, iint->version)) {  in process_measurement()
296 			iint->flags &= ~IMA_DONE_MASK;  in process_measurement()
297 			iint->measured_pcrs = 0;  in process_measurement()
305 	iint->flags |= action;  in process_measurement()
307 	action &= ~((iint->flags & (IMA_DONE_MASK ^ IMA_MEASURED)) >> 1);  in process_measurement()
310 	if ((action & IMA_MEASURE) && (iint->measured_pcrs & (0x1 << pcr)))  in process_measurement()
315 	    !(test_bit(IMA_DIGSIG, &iint->atomic_flags))) {  in process_measurement()
319 		    (xattr_value->type == EVM_IMA_XATTR_DIGSIG))  in process_measurement()
320 			set_bit(IMA_DIGSIG, &iint->atomic_flags);  in process_measurement()
321 		iint->flags |= IMA_HASHED;  in process_measurement()
323 		set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);  in process_measurement()
338 	    strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) != 0) {  in process_measurement()
344 		 * Read the appended modsig if allowed by the policy, and allow  in process_measurement()
348 		if (iint->flags & IMA_MODSIG_ALLOWED) {  in process_measurement()
352 			    iint->flags & IMA_MEASURED)  in process_measurement()
360 	if (rc != 0 && rc != -EBADF && rc != -EINVAL)  in process_measurement()
363 	if (!pathbuf)	/* ima_rdwr_violation possibly pre-fetched */  in process_measurement()
364 		pathname = ima_d_path(&file->f_path, &pathbuf, filename);  in process_measurement()
372 		if (rc != -EPERM) {  in process_measurement()
386 	if ((file->f_flags & O_DIRECT) && (iint->flags & IMA_PERMIT_DIRECTIO))  in process_measurement()
392 		rc = -EACCES;  in process_measurement()
396 				    "denied-hash-algorithm", rc, 0);  in process_measurement()
399 	if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) &&  in process_measurement()
400 	     !(iint->flags & IMA_NEW_FILE))  in process_measurement()
401 		rc = -EACCES;  in process_measurement()
402 	mutex_unlock(&iint->mutex);  in process_measurement()
410 			return -EACCES;  in process_measurement()
411 		if (file->f_mode & FMODE_WRITE)  in process_measurement()
412 			set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);  in process_measurement()
418  * ima_file_mmap - based on policy, collect/store measurement.
421  * @prot: protection that will be applied by the kernel
425  * policy decision.
428  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
456  * ima_file_mprotect - based on policy, limit mprotect change
458  * @prot: contains the protection that will be applied by the kernel.
461  * IMA's mmap appraisal policy rules.  Due to locking issues (mmap semaphore
464  * PROT_EXECUTE change, if an mmap appraise policy rule exists.
466  * On mprotect change success, return 0.  On failure, return -EACESS.
482 	if (!(ima_policy_flag & IMA_APPRAISE) || !vma->vm_file ||  in ima_file_mprotect()
483 	    !(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC))  in ima_file_mprotect()
487 	inode = file_inode(vma->vm_file);  in ima_file_mprotect()
488 	action = ima_get_action(file_mnt_idmap(vma->vm_file), inode,  in ima_file_mprotect()
491 	action |= ima_get_action(file_mnt_idmap(vma->vm_file), inode,  in ima_file_mprotect()
496 	/* Is the mmap'ed file in policy? */  in ima_file_mprotect()
501 		result = -EPERM;  in ima_file_mprotect()
503 	file = vma->vm_file;  in ima_file_mprotect()
504 	pathname = ima_d_path(&file->f_path, &pathbuf, filename);  in ima_file_mprotect()
506 			    "collect_data", "failed-mprotect", result, 0);  in ima_file_mprotect()
514  * ima_bprm_check - based on policy, collect/store measurement.
524  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
532 	ret = process_measurement(bprm->file, current_cred(), secid, NULL, 0,  in ima_bprm_check()
537 	security_cred_getsecid(bprm->cred, &secid);  in ima_bprm_check()
538 	return process_measurement(bprm->file, bprm->cred, secid, NULL, 0,  in ima_bprm_check()
543  * ima_file_check - based on policy, collect/store measurement.
547  * Measure files based on the ima_must_measure() policy decision.
550  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
572 			mutex_lock(&iint->mutex);  in __ima_inode_hash()
575 	if ((!iint || !(iint->flags & IMA_COLLECTED)) && file) {  in __ima_inode_hash()
577 			mutex_unlock(&iint->mutex);  in __ima_inode_hash()
587 			if (rc != -ENOMEM)  in __ima_inode_hash()
590 			return -EOPNOTSUPP;  in __ima_inode_hash()
594 		mutex_lock(&iint->mutex);  in __ima_inode_hash()
598 		return -EOPNOTSUPP;  in __ima_inode_hash()
604 	if (!iint->ima_hash || !(iint->flags & IMA_COLLECTED)) {  in __ima_inode_hash()
605 		mutex_unlock(&iint->mutex);  in __ima_inode_hash()
606 		return -EOPNOTSUPP;  in __ima_inode_hash()
612 		copied_size = min_t(size_t, iint->ima_hash->length, buf_size);  in __ima_inode_hash()
613 		memcpy(buf, iint->ima_hash->digest, copied_size);  in __ima_inode_hash()
615 	hash_algo = iint->ima_hash->algo;  in __ima_inode_hash()
616 	mutex_unlock(&iint->mutex);  in __ima_inode_hash()
619 		kfree(iint->ima_hash);  in __ima_inode_hash()
625  * ima_file_hash - return a measurement of the file
638  * If the measurement cannot be performed, return -EOPNOTSUPP.
639  * If the parameters are incorrect, return -EINVAL.
644 		return -EINVAL;  in ima_file_hash()
651  * ima_inode_hash - return the stored measurement if the inode has been hashed
665  * If IMA is disabled or if no measurement is available, return -EOPNOTSUPP.
666  * If the parameters are incorrect, return -EINVAL.
671 		return -EINVAL;  in ima_inode_hash()
678  * ima_post_create_tmpfile - mark newly created tmpfile as new
684  * tmpfiles are in policy.
692 	if (!ima_policy_flag || !S_ISREG(inode->i_mode))  in ima_post_create_tmpfile()
706 	set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);  in ima_post_create_tmpfile()
707 	iint->ima_file_status = INTEGRITY_PASS;  in ima_post_create_tmpfile()
711  * ima_post_path_mknod - mark as a new inode
722 	struct inode *inode = dentry->d_inode;  in ima_post_path_mknod()
725 	if (!ima_policy_flag || !S_ISREG(inode->i_mode))  in ima_post_path_mknod()
738 	/* needed for re-opening empty files */  in ima_post_path_mknod()
739 	iint->flags |= IMA_NEW_FILE;  in ima_post_path_mknod()
743  * ima_read_file - pre-measure/appraise hook decision based on policy
748  * Permit reading a file based on policy. The policy rules are written
749  * in terms of the policy identifier.  Appraising the integrity of
752  * For permission return 0, otherwise return -EACCES.
761 	 * Do devices using pre-allocated memory run the risk of the  in ima_read_file()
792  * ima_post_read_file - in memory collect/appraise/audit measurement
798  * Measure/appraise/audit in memory file based on policy.  Policy rules
799  * are written in terms of a policy identifier.
802  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
816 			return -EACCES;  in ima_post_read_file()
827  * ima_load_data - appraise decision based on policy
828  * @id: kernel load data caller identifier
833  * data provided by userspace.  Enforce policy rules requiring a file
834  * signature (eg. kexec'ed kernel image).
836  * For permission return 0, otherwise return -EACCES.
849 …pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load…  in ima_load_data()
850 			return -EACCES;  in ima_load_data()
854 …pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load…  in ima_load_data()
855 			return -EACCES;	/* INTEGRITY_UNKNOWN */  in ima_load_data()
861 			return -EACCES;	/* INTEGRITY_UNKNOWN */  in ima_load_data()
869 …pr_err("impossible to appraise a module without a file descriptor. sig_enforce kernel parameter mi…  in ima_load_data()
870 			return -EACCES;	/* INTEGRITY_UNKNOWN */  in ima_load_data()
880  * ima_post_load_data - appraise decision based on policy
883  * @load_id: kernel load data caller identifier
884  * @description: @load_id-specific description of contents
886  * Measure/appraise/audit in memory buffer based on policy.  Policy rules
887  * are written in terms of a policy identifier.
890  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
900 			return -EACCES; /* INTEGRITY_UNKNOWN */  in ima_post_load_data()
909  * process_buffer_measurement - Measure the buffer or the buffer data hash
922  * Based on policy, either the buffer data or buffer data hash is measured
951 		return -EINVAL;  in process_buffer_measurement()
954 		return -ENOENT;  in process_buffer_measurement()
958 		ret = -EINVAL;  in process_buffer_measurement()
965 	 * based on policy.  To avoid code duplication, differentiate  in process_buffer_measurement()
967 	 * retrieving the policy rule information only for the LSM hook  in process_buffer_measurement()
976 			return -ENOENT;  in process_buffer_measurement()
983 	iint.ima_hash->algo = ima_hash_algo;  in process_buffer_measurement()
984 	iint.ima_hash->length = hash_digest_size[ima_hash_algo];  in process_buffer_measurement()
1007 		memcpy(digest, iint.ima_hash->digest, digest_hash_len);  in process_buffer_measurement()
1034  * ima_kexec_cmdline - measure kexec cmdline boot args
1035  * @kernel_fd: file descriptor of the kexec kernel being loaded
1053 				   buf, size, "kexec-cmdline", KEXEC_CMDLINE, 0,  in ima_kexec_cmdline()
1059  * ima_measure_critical_data - measure kernel integrity critical data
1068  * Measure data critical to the integrity of the kernel into the IMA log
1070  * structures, policies, and states stored in kernel memory that can
1083 		return -ENOPARAM;  in ima_measure_critical_data()