security/integrity/ima/ima_policy.c

   1 /*
   2  * Copyright (C) 2008 IBM Corporation
   3  * Author: Mimi Zohar <zohar@us.ibm.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, version 2 of the License.
   8  *
   9  * ima_policy.c
  10  *      - initialize default measure policy rules
  11  *
  12  */
  13 #include <linux/module.h>
  14 #include <linux/list.h>
  15 #include <linux/security.h>
  16 #include <linux/magic.h>
  17 #include <linux/parser.h>
  18 #include <linux/slab.h>
  19 #include <linux/rculist.h>
  20 #include <linux/genhd.h>
  21 #include <linux/seq_file.h>
  22
  23 #include "ima.h"
  24
  25 /* flags definitions */
  26 #define IMA_FUNC        0x0001
  27 #define IMA_MASK        0x0002
  28 #define IMA_FSMAGIC     0x0004
  29 #define IMA_UID         0x0008
  30 #define IMA_FOWNER      0x0010
  31 #define IMA_FSUUID      0x0020
  32 #define IMA_INMASK      0x0040
  33 #define IMA_EUID        0x0080
  34
  35 #define UNKNOWN         0
  36 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  37 #define DONT_MEASURE    0x0002
  38 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  39 #define DONT_APPRAISE   0x0008
  40 #define AUDIT           0x0040
  41
  42 int ima_policy_flag;
  43 static int temp_ima_appraise;
  44
  45 #define MAX_LSM_RULES 6
  46 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  47         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  48 };
  49
  50 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  51
  52 struct ima_rule_entry {
  53         struct list_head list;
  54         int action;
  55         unsigned int flags;
  56         enum ima_hooks func;
  57         int mask;
  58         unsigned long fsmagic;
  59         u8 fsuuid[16];
  60         kuid_t uid;
  61         kuid_t fowner;
  62         struct {
  63                 void *rule;     /* LSM file metadata specific */
  64                 void *args_p;   /* audit value */
  65                 int type;       /* audit type */
  66         } lsm[MAX_LSM_RULES];
  67 };
  68
  69 /*
  70  * Without LSM specific knowledge, the default policy can only be
  71  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  72  */
  73
  74 /*
  75  * The minimum rule set to allow for full TCB coverage.  Measures all files
  76  * opened or mmap for exec and everything read by root.  Dangerous because
  77  * normal users can easily run the machine out of memory simply building
  78  * and running executables.
  79  */
  80 static struct ima_rule_entry dont_measure_rules[] = {
  81         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  82         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
  83         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
  84         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
  85         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  86         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
  87         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
  88         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
  89         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
  90          .flags = IMA_FSMAGIC},
  91         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
  92 };
  93
  94 static struct ima_rule_entry original_measurement_rules[] = {
  95         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
  96          .flags = IMA_FUNC | IMA_MASK},
  97         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
  98          .flags = IMA_FUNC | IMA_MASK},
  99         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 100          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 101         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 102         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 103 };
 104
 105 static struct ima_rule_entry default_measurement_rules[] = {
 106         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 107          .flags = IMA_FUNC | IMA_MASK},
 108         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 109          .flags = IMA_FUNC | IMA_MASK},
 110         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 111          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 112         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 113          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 114         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 115         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 116 };
 117
 118 static struct ima_rule_entry default_appraise_rules[] = {
 119         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 120         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 121         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 122         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 123         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 124         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 125         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 126         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 127         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 128         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 129         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 130 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 131         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
 132 #else
 133         /* force signature */
 134         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID,
 135          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 136 #endif
 137 };
 138
 139 static LIST_HEAD(ima_default_rules);
 140 static LIST_HEAD(ima_policy_rules);
 141 static LIST_HEAD(ima_temp_rules);
 142 static struct list_head *ima_rules;
 143
 144 static int ima_policy __initdata;
 145
 146 static int __init default_measure_policy_setup(char *str)
 147 {
 148         if (ima_policy)
 149                 return 1;
 150
 151         ima_policy = ORIGINAL_TCB;
 152         return 1;
 153 }
 154 __setup("ima_tcb", default_measure_policy_setup);
 155
 156 static int __init policy_setup(char *str)
 157 {
 158         if (ima_policy)
 159                 return 1;
 160
 161         if (strcmp(str, "tcb") == 0)
 162                 ima_policy = DEFAULT_TCB;
 163
 164         return 1;
 165 }
 166 __setup("ima_policy=", policy_setup);
 167
 168 static bool ima_use_appraise_tcb __initdata;
 169 static int __init default_appraise_policy_setup(char *str)
 170 {
 171         ima_use_appraise_tcb = 1;
 172         return 1;
 173 }
 174 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 175
 176 /*
 177  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 178  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 179  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
 180  * they don't.
 181  */
 182 static void ima_lsm_update_rules(void)
 183 {
 184         struct ima_rule_entry *entry;
 185         int result;
 186         int i;
 187
 188         list_for_each_entry(entry, &ima_policy_rules, list) {
 189                 for (i = 0; i < MAX_LSM_RULES; i++) {
 190                         if (!entry->lsm[i].rule)
 191                                 continue;
 192                         result = security_filter_rule_init(entry->lsm[i].type,
 193                                                            Audit_equal,
 194                                                            entry->lsm[i].args_p,
 195                                                            &entry->lsm[i].rule);
 196                         BUG_ON(!entry->lsm[i].rule);
 197                 }
 198         }
 199 }
 200
 201 /**
 202  * ima_match_rules - determine whether an inode matches the measure rule.
 203  * @rule: a pointer to a rule
 204  * @inode: a pointer to an inode
 205  * @func: LIM hook identifier
 206  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 207  *
 208  * Returns true on rule match, false on failure.
 209  */
 210 static bool ima_match_rules(struct ima_rule_entry *rule,
 211                             struct inode *inode, enum ima_hooks func, int mask)
 212 {
 213         struct task_struct *tsk = current;
 214         const struct cred *cred = current_cred();
 215         int i;
 216
 217         if ((rule->flags & IMA_FUNC) &&
 218             (rule->func != func && func != POST_SETATTR))
 219                 return false;
 220         if ((rule->flags & IMA_MASK) &&
 221             (rule->mask != mask && func != POST_SETATTR))
 222                 return false;
 223         if ((rule->flags & IMA_INMASK) &&
 224             (!(rule->mask & mask) && func != POST_SETATTR))
 225                 return false;
 226         if ((rule->flags & IMA_FSMAGIC)
 227             && rule->fsmagic != inode->i_sb->s_magic)
 228                 return false;
 229         if ((rule->flags & IMA_FSUUID) &&
 230             memcmp(rule->fsuuid, inode->i_sb->s_uuid, sizeof(rule->fsuuid)))
 231                 return false;
 232         if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
 233                 return false;
 234         if (rule->flags & IMA_EUID) {
 235                 if (has_capability_noaudit(current, CAP_SETUID)) {
 236                         if (!uid_eq(rule->uid, cred->euid)
 237                             && !uid_eq(rule->uid, cred->suid)
 238                             && !uid_eq(rule->uid, cred->uid))
 239                                 return false;
 240                 } else if (!uid_eq(rule->uid, cred->euid))
 241                         return false;
 242         }
 243
 244         if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
 245                 return false;
 246         for (i = 0; i < MAX_LSM_RULES; i++) {
 247                 int rc = 0;
 248                 u32 osid, sid;
 249                 int retried = 0;
 250
 251                 if (!rule->lsm[i].rule)
 252                         continue;
 253 retry:
 254                 switch (i) {
 255                 case LSM_OBJ_USER:
 256                 case LSM_OBJ_ROLE:
 257                 case LSM_OBJ_TYPE:
 258                         security_inode_getsecid(inode, &osid);
 259                         rc = security_filter_rule_match(osid,
 260                                                         rule->lsm[i].type,
 261                                                         Audit_equal,
 262                                                         rule->lsm[i].rule,
 263                                                         NULL);
 264                         break;
 265                 case LSM_SUBJ_USER:
 266                 case LSM_SUBJ_ROLE:
 267                 case LSM_SUBJ_TYPE:
 268                         security_task_getsecid(tsk, &sid);
 269                         rc = security_filter_rule_match(sid,
 270                                                         rule->lsm[i].type,
 271                                                         Audit_equal,
 272                                                         rule->lsm[i].rule,
 273                                                         NULL);
 274                 default:
 275                         break;
 276                 }
 277                 if ((rc < 0) && (!retried)) {
 278                         retried = 1;
 279                         ima_lsm_update_rules();
 280                         goto retry;
 281                 }
 282                 if (!rc)
 283                         return false;
 284         }
 285         return true;
 286 }
 287
 288 /*
 289  * In addition to knowing that we need to appraise the file in general,
 290  * we need to differentiate between calling hooks, for hook specific rules.
 291  */
 292 static int get_subaction(struct ima_rule_entry *rule, int func)
 293 {
 294         if (!(rule->flags & IMA_FUNC))
 295                 return IMA_FILE_APPRAISE;
 296
 297         switch (func) {
 298         case MMAP_CHECK:
 299                 return IMA_MMAP_APPRAISE;
 300         case BPRM_CHECK:
 301                 return IMA_BPRM_APPRAISE;
 302         case MODULE_CHECK:
 303                 return IMA_MODULE_APPRAISE;
 304         case FIRMWARE_CHECK:
 305                 return IMA_FIRMWARE_APPRAISE;
 306         case FILE_CHECK:
 307         default:
 308                 return IMA_FILE_APPRAISE;
 309         }
 310 }
 311
 312 /**
 313  * ima_match_policy - decision based on LSM and other conditions
 314  * @inode: pointer to an inode for which the policy decision is being made
 315  * @func: IMA hook identifier
 316  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 317  *
 318  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 319  * conditions.
 320  *
 321  * Since the IMA policy may be updated multiple times we need to lock the
 322  * list when walking it.  Reads are many orders of magnitude more numerous
 323  * than writes so ima_match_policy() is classical RCU candidate.
 324  */
 325 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
 326                      int flags)
 327 {
 328         struct ima_rule_entry *entry;
 329         int action = 0, actmask = flags | (flags << 1);
 330
 331         rcu_read_lock();
 332         list_for_each_entry_rcu(entry, ima_rules, list) {
 333
 334                 if (!(entry->action & actmask))
 335                         continue;
 336
 337                 if (!ima_match_rules(entry, inode, func, mask))
 338                         continue;
 339
 340                 action |= entry->flags & IMA_ACTION_FLAGS;
 341
 342                 action |= entry->action & IMA_DO_MASK;
 343                 if (entry->action & IMA_APPRAISE)
 344                         action |= get_subaction(entry, func);
 345
 346                 if (entry->action & IMA_DO_MASK)
 347                         actmask &= ~(entry->action | entry->action << 1);
 348                 else
 349                         actmask &= ~(entry->action | entry->action >> 1);
 350
 351                 if (!actmask)
 352                         break;
 353         }
 354         rcu_read_unlock();
 355
 356         return action;
 357 }
 358
 359 /*
 360  * Initialize the ima_policy_flag variable based on the currently
 361  * loaded policy.  Based on this flag, the decision to short circuit
 362  * out of a function or not call the function in the first place
 363  * can be made earlier.
 364  */
 365 void ima_update_policy_flag(void)
 366 {
 367         struct ima_rule_entry *entry;
 368
 369         list_for_each_entry(entry, ima_rules, list) {
 370                 if (entry->action & IMA_DO_MASK)
 371                         ima_policy_flag |= entry->action;
 372         }
 373
 374         ima_appraise |= temp_ima_appraise;
 375         if (!ima_appraise)
 376                 ima_policy_flag &= ~IMA_APPRAISE;
 377 }
 378
 379 /**
 380  * ima_init_policy - initialize the default measure rules.
 381  *
 382  * ima_rules points to either the ima_default_rules or the
 383  * the new ima_policy_rules.
 384  */
 385 void __init ima_init_policy(void)
 386 {
 387         int i, measure_entries, appraise_entries;
 388
 389         /* if !ima_policy set entries = 0 so we load NO default rules */
 390         measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 391         appraise_entries = ima_use_appraise_tcb ?
 392                          ARRAY_SIZE(default_appraise_rules) : 0;
 393
 394         for (i = 0; i < measure_entries; i++)
 395                 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
 396
 397         switch (ima_policy) {
 398         case ORIGINAL_TCB:
 399                 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
 400                         list_add_tail(&original_measurement_rules[i].list,
 401                                       &ima_default_rules);
 402                 break;
 403         case DEFAULT_TCB:
 404                 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
 405                         list_add_tail(&default_measurement_rules[i].list,
 406                                       &ima_default_rules);
 407         default:
 408                 break;
 409         }
 410
 411         for (i = 0; i < appraise_entries; i++) {
 412                 list_add_tail(&default_appraise_rules[i].list,
 413                               &ima_default_rules);
 414         }
 415
 416         ima_rules = &ima_default_rules;
 417 }
 418
 419 /* Make sure we have a valid policy, at least containing some rules. */
 420 int ima_check_policy()
 421 {
 422         if (list_empty(&ima_temp_rules))
 423                 return -EINVAL;
 424         return 0;
 425 }
 426
 427 /**
 428  * ima_update_policy - update default_rules with new measure rules
 429  *
 430  * Called on file .release to update the default rules with a complete new
 431  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 432  * they make a queue.  The policy may be updated multiple times and this is the
 433  * RCU updater.
 434  *
 435  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 436  * we switch from the default policy to user defined.
 437  */
 438 void ima_update_policy(void)
 439 {
 440         struct list_head *first, *last, *policy;
 441
 442         /* append current policy with the new rules */
 443         first = (&ima_temp_rules)->next;
 444         last = (&ima_temp_rules)->prev;
 445         policy = &ima_policy_rules;
 446
 447         synchronize_rcu();
 448
 449         last->next = policy;
 450         rcu_assign_pointer(list_next_rcu(policy->prev), first);
 451         first->prev = policy->prev;
 452         policy->prev = last;
 453
 454         /* prepare for the next policy rules addition */
 455         INIT_LIST_HEAD(&ima_temp_rules);
 456
 457         if (ima_rules != policy) {
 458                 ima_policy_flag = 0;
 459                 ima_rules = policy;
 460         }
 461         ima_update_policy_flag();
 462 }
 463
 464 enum {
 465         Opt_err = -1,
 466         Opt_measure = 1, Opt_dont_measure,
 467         Opt_appraise, Opt_dont_appraise,
 468         Opt_audit,
 469         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 470         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 471         Opt_func, Opt_mask, Opt_fsmagic,
 472         Opt_fsuuid, Opt_uid, Opt_euid, Opt_fowner,
 473         Opt_appraise_type, Opt_permit_directio
 474 };
 475
 476 static match_table_t policy_tokens = {
 477         {Opt_measure, "measure"},
 478         {Opt_dont_measure, "dont_measure"},
 479         {Opt_appraise, "appraise"},
 480         {Opt_dont_appraise, "dont_appraise"},
 481         {Opt_audit, "audit"},
 482         {Opt_obj_user, "obj_user=%s"},
 483         {Opt_obj_role, "obj_role=%s"},
 484         {Opt_obj_type, "obj_type=%s"},
 485         {Opt_subj_user, "subj_user=%s"},
 486         {Opt_subj_role, "subj_role=%s"},
 487         {Opt_subj_type, "subj_type=%s"},
 488         {Opt_func, "func=%s"},
 489         {Opt_mask, "mask=%s"},
 490         {Opt_fsmagic, "fsmagic=%s"},
 491         {Opt_fsuuid, "fsuuid=%s"},
 492         {Opt_uid, "uid=%s"},
 493         {Opt_euid, "euid=%s"},
 494         {Opt_fowner, "fowner=%s"},
 495         {Opt_appraise_type, "appraise_type=%s"},
 496         {Opt_permit_directio, "permit_directio"},
 497         {Opt_err, NULL}
 498 };
 499
 500 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 501                              substring_t *args, int lsm_rule, int audit_type)
 502 {
 503         int result;
 504
 505         if (entry->lsm[lsm_rule].rule)
 506                 return -EINVAL;
 507
 508         entry->lsm[lsm_rule].args_p = match_strdup(args);
 509         if (!entry->lsm[lsm_rule].args_p)
 510                 return -ENOMEM;
 511
 512         entry->lsm[lsm_rule].type = audit_type;
 513         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 514                                            Audit_equal,
 515                                            entry->lsm[lsm_rule].args_p,
 516                                            &entry->lsm[lsm_rule].rule);
 517         if (!entry->lsm[lsm_rule].rule) {
 518                 kfree(entry->lsm[lsm_rule].args_p);
 519                 return -EINVAL;
 520         }
 521
 522         return result;
 523 }
 524
 525 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
 526 {
 527         audit_log_format(ab, "%s=", key);
 528         audit_log_untrustedstring(ab, value);
 529         audit_log_format(ab, " ");
 530 }
 531
 532 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 533 {
 534         struct audit_buffer *ab;
 535         char *from;
 536         char *p;
 537         int result = 0;
 538
 539         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
 540
 541         entry->uid = INVALID_UID;
 542         entry->fowner = INVALID_UID;
 543         entry->action = UNKNOWN;
 544         while ((p = strsep(&rule, " \t")) != NULL) {
 545                 substring_t args[MAX_OPT_ARGS];
 546                 int token;
 547                 unsigned long lnum;
 548
 549                 if (result < 0)
 550                         break;
 551                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
 552                         continue;
 553                 token = match_token(p, policy_tokens, args);
 554                 switch (token) {
 555                 case Opt_measure:
 556                         ima_log_string(ab, "action", "measure");
 557
 558                         if (entry->action != UNKNOWN)
 559                                 result = -EINVAL;
 560
 561                         entry->action = MEASURE;
 562                         break;
 563                 case Opt_dont_measure:
 564                         ima_log_string(ab, "action", "dont_measure");
 565
 566                         if (entry->action != UNKNOWN)
 567                                 result = -EINVAL;
 568
 569                         entry->action = DONT_MEASURE;
 570                         break;
 571                 case Opt_appraise:
 572                         ima_log_string(ab, "action", "appraise");
 573
 574                         if (entry->action != UNKNOWN)
 575                                 result = -EINVAL;
 576
 577                         entry->action = APPRAISE;
 578                         break;
 579                 case Opt_dont_appraise:
 580                         ima_log_string(ab, "action", "dont_appraise");
 581
 582                         if (entry->action != UNKNOWN)
 583                                 result = -EINVAL;
 584
 585                         entry->action = DONT_APPRAISE;
 586                         break;
 587                 case Opt_audit:
 588                         ima_log_string(ab, "action", "audit");
 589
 590                         if (entry->action != UNKNOWN)
 591                                 result = -EINVAL;
 592
 593                         entry->action = AUDIT;
 594                         break;
 595                 case Opt_func:
 596                         ima_log_string(ab, "func", args[0].from);
 597
 598                         if (entry->func)
 599                                 result = -EINVAL;
 600
 601                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
 602                                 entry->func = FILE_CHECK;
 603                         /* PATH_CHECK is for backwards compat */
 604                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
 605                                 entry->func = FILE_CHECK;
 606                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
 607                                 entry->func = MODULE_CHECK;
 608                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
 609                                 entry->func = FIRMWARE_CHECK;
 610                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
 611                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
 612                                 entry->func = MMAP_CHECK;
 613                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
 614                                 entry->func = BPRM_CHECK;
 615                         else
 616                                 result = -EINVAL;
 617                         if (!result)
 618                                 entry->flags |= IMA_FUNC;
 619                         break;
 620                 case Opt_mask:
 621                         ima_log_string(ab, "mask", args[0].from);
 622
 623                         if (entry->mask)
 624                                 result = -EINVAL;
 625
 626                         from = args[0].from;
 627                         if (*from == '^')
 628                                 from++;
 629
 630                         if ((strcmp(from, "MAY_EXEC")) == 0)
 631                                 entry->mask = MAY_EXEC;
 632                         else if (strcmp(from, "MAY_WRITE") == 0)
 633                                 entry->mask = MAY_WRITE;
 634                         else if (strcmp(from, "MAY_READ") == 0)
 635                                 entry->mask = MAY_READ;
 636                         else if (strcmp(from, "MAY_APPEND") == 0)
 637                                 entry->mask = MAY_APPEND;
 638                         else
 639                                 result = -EINVAL;
 640                         if (!result)
 641                                 entry->flags |= (*args[0].from == '^')
 642                                      ? IMA_INMASK : IMA_MASK;
 643                         break;
 644                 case Opt_fsmagic:
 645                         ima_log_string(ab, "fsmagic", args[0].from);
 646
 647                         if (entry->fsmagic) {
 648                                 result = -EINVAL;
 649                                 break;
 650                         }
 651
 652                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
 653                         if (!result)
 654                                 entry->flags |= IMA_FSMAGIC;
 655                         break;
 656                 case Opt_fsuuid:
 657                         ima_log_string(ab, "fsuuid", args[0].from);
 658
 659                         if (memchr_inv(entry->fsuuid, 0x00,
 660                                        sizeof(entry->fsuuid))) {
 661                                 result = -EINVAL;
 662                                 break;
 663                         }
 664
 665                         result = blk_part_pack_uuid(args[0].from,
 666                                                     entry->fsuuid);
 667                         if (!result)
 668                                 entry->flags |= IMA_FSUUID;
 669                         break;
 670                 case Opt_uid:
 671                         ima_log_string(ab, "uid", args[0].from);
 672                 case Opt_euid:
 673                         if (token == Opt_euid)
 674                                 ima_log_string(ab, "euid", args[0].from);
 675
 676                         if (uid_valid(entry->uid)) {
 677                                 result = -EINVAL;
 678                                 break;
 679                         }
 680
 681                         result = kstrtoul(args[0].from, 10, &lnum);
 682                         if (!result) {
 683                                 entry->uid = make_kuid(current_user_ns(),
 684                                                        (uid_t) lnum);
 685                                 if (!uid_valid(entry->uid) ||
 686                                     (uid_t)lnum != lnum)
 687                                         result = -EINVAL;
 688                                 else
 689                                         entry->flags |= (token == Opt_uid)
 690                                             ? IMA_UID : IMA_EUID;
 691                         }
 692                         break;
 693                 case Opt_fowner:
 694                         ima_log_string(ab, "fowner", args[0].from);
 695
 696                         if (uid_valid(entry->fowner)) {
 697                                 result = -EINVAL;
 698                                 break;
 699                         }
 700
 701                         result = kstrtoul(args[0].from, 10, &lnum);
 702                         if (!result) {
 703                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
 704                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
 705                                         result = -EINVAL;
 706                                 else
 707                                         entry->flags |= IMA_FOWNER;
 708                         }
 709                         break;
 710                 case Opt_obj_user:
 711                         ima_log_string(ab, "obj_user", args[0].from);
 712                         result = ima_lsm_rule_init(entry, args,
 713                                                    LSM_OBJ_USER,
 714                                                    AUDIT_OBJ_USER);
 715                         break;
 716                 case Opt_obj_role:
 717                         ima_log_string(ab, "obj_role", args[0].from);
 718                         result = ima_lsm_rule_init(entry, args,
 719                                                    LSM_OBJ_ROLE,
 720                                                    AUDIT_OBJ_ROLE);
 721                         break;
 722                 case Opt_obj_type:
 723                         ima_log_string(ab, "obj_type", args[0].from);
 724                         result = ima_lsm_rule_init(entry, args,
 725                                                    LSM_OBJ_TYPE,
 726                                                    AUDIT_OBJ_TYPE);
 727                         break;
 728                 case Opt_subj_user:
 729                         ima_log_string(ab, "subj_user", args[0].from);
 730                         result = ima_lsm_rule_init(entry, args,
 731                                                    LSM_SUBJ_USER,
 732                                                    AUDIT_SUBJ_USER);
 733                         break;
 734                 case Opt_subj_role:
 735                         ima_log_string(ab, "subj_role", args[0].from);
 736                         result = ima_lsm_rule_init(entry, args,
 737                                                    LSM_SUBJ_ROLE,
 738                                                    AUDIT_SUBJ_ROLE);
 739                         break;
 740                 case Opt_subj_type:
 741                         ima_log_string(ab, "subj_type", args[0].from);
 742                         result = ima_lsm_rule_init(entry, args,
 743                                                    LSM_SUBJ_TYPE,
 744                                                    AUDIT_SUBJ_TYPE);
 745                         break;
 746                 case Opt_appraise_type:
 747                         if (entry->action != APPRAISE) {
 748                                 result = -EINVAL;
 749                                 break;
 750                         }
 751
 752                         ima_log_string(ab, "appraise_type", args[0].from);
 753                         if ((strcmp(args[0].from, "imasig")) == 0)
 754                                 entry->flags |= IMA_DIGSIG_REQUIRED;
 755                         else
 756                                 result = -EINVAL;
 757                         break;
 758                 case Opt_permit_directio:
 759                         entry->flags |= IMA_PERMIT_DIRECTIO;
 760                         break;
 761                 case Opt_err:
 762                         ima_log_string(ab, "UNKNOWN", p);
 763                         result = -EINVAL;
 764                         break;
 765                 }
 766         }
 767         if (!result && (entry->action == UNKNOWN))
 768                 result = -EINVAL;
 769         else if (entry->func == MODULE_CHECK)
 770                 temp_ima_appraise |= IMA_APPRAISE_MODULES;
 771         else if (entry->func == FIRMWARE_CHECK)
 772                 temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
 773         audit_log_format(ab, "res=%d", !result);
 774         audit_log_end(ab);
 775         return result;
 776 }
 777
 778 /**
 779  * ima_parse_add_rule - add a rule to ima_policy_rules
 780  * @rule - ima measurement policy rule
 781  *
 782  * Avoid locking by allowing just one writer at a time in ima_write_policy()
 783  * Returns the length of the rule parsed, an error code on failure
 784  */
 785 ssize_t ima_parse_add_rule(char *rule)
 786 {
 787         static const char op[] = "update_policy";
 788         char *p;
 789         struct ima_rule_entry *entry;
 790         ssize_t result, len;
 791         int audit_info = 0;
 792
 793         p = strsep(&rule, "\n");
 794         len = strlen(p) + 1;
 795         p += strspn(p, " \t");
 796
 797         if (*p == '#' || *p == '\0')
 798                 return len;
 799
 800         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 801         if (!entry) {
 802                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 803                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
 804                 return -ENOMEM;
 805         }
 806
 807         INIT_LIST_HEAD(&entry->list);
 808
 809         result = ima_parse_rule(p, entry);
 810         if (result) {
 811                 kfree(entry);
 812                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 813                                     NULL, op, "invalid-policy", result,
 814                                     audit_info);
 815                 return result;
 816         }
 817
 818         list_add_tail(&entry->list, &ima_temp_rules);
 819
 820         return len;
 821 }
 822
 823 /**
 824  * ima_delete_rules() called to cleanup invalid in-flight policy.
 825  * We don't need locking as we operate on the temp list, which is
 826  * different from the active one.  There is also only one user of
 827  * ima_delete_rules() at a time.
 828  */
 829 void ima_delete_rules(void)
 830 {
 831         struct ima_rule_entry *entry, *tmp;
 832         int i;
 833
 834         temp_ima_appraise = 0;
 835         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
 836                 for (i = 0; i < MAX_LSM_RULES; i++)
 837                         kfree(entry->lsm[i].args_p);
 838
 839                 list_del(&entry->list);
 840                 kfree(entry);
 841         }
 842 }
 843
 844 #ifdef  CONFIG_IMA_READ_POLICY
 845 enum {
 846         mask_exec = 0, mask_write, mask_read, mask_append
 847 };
 848
 849 static char *mask_tokens[] = {
 850         "MAY_EXEC",
 851         "MAY_WRITE",
 852         "MAY_READ",
 853         "MAY_APPEND"
 854 };
 855
 856 enum {
 857         func_file = 0, func_mmap, func_bprm,
 858         func_module, func_firmware, func_post
 859 };
 860
 861 static char *func_tokens[] = {
 862         "FILE_CHECK",
 863         "MMAP_CHECK",
 864         "BPRM_CHECK",
 865         "MODULE_CHECK",
 866         "FIRMWARE_CHECK",
 867         "POST_SETATTR"
 868 };
 869
 870 void *ima_policy_start(struct seq_file *m, loff_t *pos)
 871 {
 872         loff_t l = *pos;
 873         struct ima_rule_entry *entry;
 874
 875         rcu_read_lock();
 876         list_for_each_entry_rcu(entry, ima_rules, list) {
 877                 if (!l--) {
 878                         rcu_read_unlock();
 879                         return entry;
 880                 }
 881         }
 882         rcu_read_unlock();
 883         return NULL;
 884 }
 885
 886 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
 887 {
 888         struct ima_rule_entry *entry = v;
 889
 890         rcu_read_lock();
 891         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
 892         rcu_read_unlock();
 893         (*pos)++;
 894
 895         return (&entry->list == ima_rules) ? NULL : entry;
 896 }
 897
 898 void ima_policy_stop(struct seq_file *m, void *v)
 899 {
 900 }
 901
 902 #define pt(token)       policy_tokens[token + Opt_err].pattern
 903 #define mt(token)       mask_tokens[token]
 904 #define ft(token)       func_tokens[token]
 905
 906 int ima_policy_show(struct seq_file *m, void *v)
 907 {
 908         struct ima_rule_entry *entry = v;
 909         int i = 0;
 910         char tbuf[64] = {0,};
 911
 912         rcu_read_lock();
 913
 914         if (entry->action & MEASURE)
 915                 seq_puts(m, pt(Opt_measure));
 916         if (entry->action & DONT_MEASURE)
 917                 seq_puts(m, pt(Opt_dont_measure));
 918         if (entry->action & APPRAISE)
 919                 seq_puts(m, pt(Opt_appraise));
 920         if (entry->action & DONT_APPRAISE)
 921                 seq_puts(m, pt(Opt_dont_appraise));
 922         if (entry->action & AUDIT)
 923                 seq_puts(m, pt(Opt_audit));
 924
 925         seq_puts(m, " ");
 926
 927         if (entry->flags & IMA_FUNC) {
 928                 switch (entry->func) {
 929                 case FILE_CHECK:
 930                         seq_printf(m, pt(Opt_func), ft(func_file));
 931                         break;
 932                 case MMAP_CHECK:
 933                         seq_printf(m, pt(Opt_func), ft(func_mmap));
 934                         break;
 935                 case BPRM_CHECK:
 936                         seq_printf(m, pt(Opt_func), ft(func_bprm));
 937                         break;
 938                 case MODULE_CHECK:
 939                         seq_printf(m, pt(Opt_func), ft(func_module));
 940                         break;
 941                 case FIRMWARE_CHECK:
 942                         seq_printf(m, pt(Opt_func), ft(func_firmware));
 943                         break;
 944                 case POST_SETATTR:
 945                         seq_printf(m, pt(Opt_func), ft(func_post));
 946                         break;
 947                 default:
 948                         snprintf(tbuf, sizeof(tbuf), "%d", entry->func);
 949                         seq_printf(m, pt(Opt_func), tbuf);
 950                         break;
 951                 }
 952                 seq_puts(m, " ");
 953         }
 954
 955         if (entry->flags & IMA_MASK) {
 956                 if (entry->mask & MAY_EXEC)
 957                         seq_printf(m, pt(Opt_mask), mt(mask_exec));
 958                 if (entry->mask & MAY_WRITE)
 959                         seq_printf(m, pt(Opt_mask), mt(mask_write));
 960                 if (entry->mask & MAY_READ)
 961                         seq_printf(m, pt(Opt_mask), mt(mask_read));
 962                 if (entry->mask & MAY_APPEND)
 963                         seq_printf(m, pt(Opt_mask), mt(mask_append));
 964                 seq_puts(m, " ");
 965         }
 966
 967         if (entry->flags & IMA_FSMAGIC) {
 968                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
 969                 seq_printf(m, pt(Opt_fsmagic), tbuf);
 970                 seq_puts(m, " ");
 971         }
 972
 973         if (entry->flags & IMA_FSUUID) {
 974                 seq_puts(m, "fsuuid=");
 975                 for (i = 0; i < ARRAY_SIZE(entry->fsuuid); ++i) {
 976                         switch (i) {
 977                         case 4:
 978                         case 6:
 979                         case 8:
 980                         case 10:
 981                                 seq_puts(m, "-");
 982                         }
 983                         seq_printf(m, "%x", entry->fsuuid[i]);
 984                 }
 985                 seq_puts(m, " ");
 986         }
 987
 988         if (entry->flags & IMA_UID) {
 989                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
 990                 seq_printf(m, pt(Opt_uid), tbuf);
 991                 seq_puts(m, " ");
 992         }
 993
 994         if (entry->flags & IMA_EUID) {
 995                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
 996                 seq_printf(m, pt(Opt_euid), tbuf);
 997                 seq_puts(m, " ");
 998         }
 999
1000         if (entry->flags & IMA_FOWNER) {
1001                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1002                 seq_printf(m, pt(Opt_fowner), tbuf);
1003                 seq_puts(m, " ");
1004         }
1005
1006         for (i = 0; i < MAX_LSM_RULES; i++) {
1007                 if (entry->lsm[i].rule) {
1008                         switch (i) {
1009                         case LSM_OBJ_USER:
1010                                 seq_printf(m, pt(Opt_obj_user),
1011                                            (char *)entry->lsm[i].args_p);
1012                                 break;
1013                         case LSM_OBJ_ROLE:
1014                                 seq_printf(m, pt(Opt_obj_role),
1015                                            (char *)entry->lsm[i].args_p);
1016                                 break;
1017                         case LSM_OBJ_TYPE:
1018                                 seq_printf(m, pt(Opt_obj_type),
1019                                            (char *)entry->lsm[i].args_p);
1020                                 break;
1021                         case LSM_SUBJ_USER:
1022                                 seq_printf(m, pt(Opt_subj_user),
1023                                            (char *)entry->lsm[i].args_p);
1024                                 break;
1025                         case LSM_SUBJ_ROLE:
1026                                 seq_printf(m, pt(Opt_subj_role),
1027                                            (char *)entry->lsm[i].args_p);
1028                                 break;
1029                         case LSM_SUBJ_TYPE:
1030                                 seq_printf(m, pt(Opt_subj_type),
1031                                            (char *)entry->lsm[i].args_p);
1032                                 break;
1033                         }
1034                 }
1035         }
1036         if (entry->flags & IMA_DIGSIG_REQUIRED)
1037                 seq_puts(m, "appraise_type=imasig ");
1038         if (entry->flags & IMA_PERMIT_DIRECTIO)
1039                 seq_puts(m, "permit_directio ");
1040         rcu_read_unlock();
1041         seq_puts(m, "\n");
1042         return 0;
1043 }
1044 #endif  /* CONFIG_IMA_READ_POLICY */