security/integrity/ima/ima_policy.c

   1 /*
   2  * Copyright (C) 2008 IBM Corporation
   3  * Author: Mimi Zohar <zohar@us.ibm.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, version 2 of the License.
   8  *
   9  * ima_policy.c
  10  *      - initialize default measure policy rules
  11  *
  12  */
  13 #include <linux/module.h>
  14 #include <linux/list.h>
  15 #include <linux/fs.h>
  16 #include <linux/security.h>
  17 #include <linux/magic.h>
  18 #include <linux/parser.h>
  19 #include <linux/slab.h>
  20 #include <linux/rculist.h>
  21 #include <linux/genhd.h>
  22 #include <linux/seq_file.h>
  23
  24 #include "ima.h"
  25
  26 /* flags definitions */
  27 #define IMA_FUNC        0x0001
  28 #define IMA_MASK        0x0002
  29 #define IMA_FSMAGIC     0x0004
  30 #define IMA_UID         0x0008
  31 #define IMA_FOWNER      0x0010
  32 #define IMA_FSUUID      0x0020
  33 #define IMA_INMASK      0x0040
  34 #define IMA_EUID        0x0080
  35 #define IMA_PCR         0x0100
  36
  37 #define UNKNOWN         0
  38 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  39 #define DONT_MEASURE    0x0002
  40 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  41 #define DONT_APPRAISE   0x0008
  42 #define AUDIT           0x0040
  43
  44 #define INVALID_PCR(a) (((a) < 0) || \
  45         (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
  46
  47 int ima_policy_flag;
  48 static int temp_ima_appraise;
  49
  50 #define MAX_LSM_RULES 6
  51 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  52         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  53 };
  54
  55 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  56
  57 struct ima_rule_entry {
  58         struct list_head list;
  59         int action;
  60         unsigned int flags;
  61         enum ima_hooks func;
  62         int mask;
  63         unsigned long fsmagic;
  64         u8 fsuuid[16];
  65         kuid_t uid;
  66         kuid_t fowner;
  67         int pcr;
  68         struct {
  69                 void *rule;     /* LSM file metadata specific */
  70                 void *args_p;   /* audit value */
  71                 int type;       /* audit type */
  72         } lsm[MAX_LSM_RULES];
  73 };
  74
  75 /*
  76  * Without LSM specific knowledge, the default policy can only be
  77  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  78  */
  79
  80 /*
  81  * The minimum rule set to allow for full TCB coverage.  Measures all files
  82  * opened or mmap for exec and everything read by root.  Dangerous because
  83  * normal users can easily run the machine out of memory simply building
  84  * and running executables.
  85  */
  86 static struct ima_rule_entry dont_measure_rules[] = {
  87         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  88         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
  89         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
  90         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
  91         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  92         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
  93         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
  94         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
  95         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
  96          .flags = IMA_FSMAGIC},
  97         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
  98 };
  99
 100 static struct ima_rule_entry original_measurement_rules[] = {
 101         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 102          .flags = IMA_FUNC | IMA_MASK},
 103         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 104          .flags = IMA_FUNC | IMA_MASK},
 105         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 106          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 107         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 108         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 109 };
 110
 111 static struct ima_rule_entry default_measurement_rules[] = {
 112         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 113          .flags = IMA_FUNC | IMA_MASK},
 114         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 115          .flags = IMA_FUNC | IMA_MASK},
 116         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 117          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 118         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 119          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 120         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 121         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 122         {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
 123 };
 124
 125 static struct ima_rule_entry default_appraise_rules[] = {
 126         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 127         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 128         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 129         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 130         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 131         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 132         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 133         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 134         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 135         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 136         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 137 #ifdef CONFIG_IMA_WRITE_POLICY
 138         {.action = APPRAISE, .func = POLICY_CHECK,
 139         .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 140 #endif
 141 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 142         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
 143 #else
 144         /* force signature */
 145         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID,
 146          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 147 #endif
 148 };
 149
 150 static LIST_HEAD(ima_default_rules);
 151 static LIST_HEAD(ima_policy_rules);
 152 static LIST_HEAD(ima_temp_rules);
 153 static struct list_head *ima_rules;
 154
 155 static int ima_policy __initdata;
 156
 157 static int __init default_measure_policy_setup(char *str)
 158 {
 159         if (ima_policy)
 160                 return 1;
 161
 162         ima_policy = ORIGINAL_TCB;
 163         return 1;
 164 }
 165 __setup("ima_tcb", default_measure_policy_setup);
 166
 167 static int __init policy_setup(char *str)
 168 {
 169         if (ima_policy)
 170                 return 1;
 171
 172         if (strcmp(str, "tcb") == 0)
 173                 ima_policy = DEFAULT_TCB;
 174
 175         return 1;
 176 }
 177 __setup("ima_policy=", policy_setup);
 178
 179 static bool ima_use_appraise_tcb __initdata;
 180 static int __init default_appraise_policy_setup(char *str)
 181 {
 182         ima_use_appraise_tcb = 1;
 183         return 1;
 184 }
 185 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 186
 187 /*
 188  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 189  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 190  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
 191  * they don't.
 192  */
 193 static void ima_lsm_update_rules(void)
 194 {
 195         struct ima_rule_entry *entry;
 196         int result;
 197         int i;
 198
 199         list_for_each_entry(entry, &ima_policy_rules, list) {
 200                 for (i = 0; i < MAX_LSM_RULES; i++) {
 201                         if (!entry->lsm[i].rule)
 202                                 continue;
 203                         result = security_filter_rule_init(entry->lsm[i].type,
 204                                                            Audit_equal,
 205                                                            entry->lsm[i].args_p,
 206                                                            &entry->lsm[i].rule);
 207                         BUG_ON(!entry->lsm[i].rule);
 208                 }
 209         }
 210 }
 211
 212 /**
 213  * ima_match_rules - determine whether an inode matches the measure rule.
 214  * @rule: a pointer to a rule
 215  * @inode: a pointer to an inode
 216  * @func: LIM hook identifier
 217  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 218  *
 219  * Returns true on rule match, false on failure.
 220  */
 221 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 222                             enum ima_hooks func, int mask)
 223 {
 224         struct task_struct *tsk = current;
 225         const struct cred *cred = current_cred();
 226         int i;
 227
 228         if ((rule->flags & IMA_FUNC) &&
 229             (rule->func != func && func != POST_SETATTR))
 230                 return false;
 231         if ((rule->flags & IMA_MASK) &&
 232             (rule->mask != mask && func != POST_SETATTR))
 233                 return false;
 234         if ((rule->flags & IMA_INMASK) &&
 235             (!(rule->mask & mask) && func != POST_SETATTR))
 236                 return false;
 237         if ((rule->flags & IMA_FSMAGIC)
 238             && rule->fsmagic != inode->i_sb->s_magic)
 239                 return false;
 240         if ((rule->flags & IMA_FSUUID) &&
 241             memcmp(rule->fsuuid, inode->i_sb->s_uuid, sizeof(rule->fsuuid)))
 242                 return false;
 243         if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
 244                 return false;
 245         if (rule->flags & IMA_EUID) {
 246                 if (has_capability_noaudit(current, CAP_SETUID)) {
 247                         if (!uid_eq(rule->uid, cred->euid)
 248                             && !uid_eq(rule->uid, cred->suid)
 249                             && !uid_eq(rule->uid, cred->uid))
 250                                 return false;
 251                 } else if (!uid_eq(rule->uid, cred->euid))
 252                         return false;
 253         }
 254
 255         if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
 256                 return false;
 257         for (i = 0; i < MAX_LSM_RULES; i++) {
 258                 int rc = 0;
 259                 u32 osid, sid;
 260                 int retried = 0;
 261
 262                 if (!rule->lsm[i].rule)
 263                         continue;
 264 retry:
 265                 switch (i) {
 266                 case LSM_OBJ_USER:
 267                 case LSM_OBJ_ROLE:
 268                 case LSM_OBJ_TYPE:
 269                         security_inode_getsecid(inode, &osid);
 270                         rc = security_filter_rule_match(osid,
 271                                                         rule->lsm[i].type,
 272                                                         Audit_equal,
 273                                                         rule->lsm[i].rule,
 274                                                         NULL);
 275                         break;
 276                 case LSM_SUBJ_USER:
 277                 case LSM_SUBJ_ROLE:
 278                 case LSM_SUBJ_TYPE:
 279                         security_task_getsecid(tsk, &sid);
 280                         rc = security_filter_rule_match(sid,
 281                                                         rule->lsm[i].type,
 282                                                         Audit_equal,
 283                                                         rule->lsm[i].rule,
 284                                                         NULL);
 285                 default:
 286                         break;
 287                 }
 288                 if ((rc < 0) && (!retried)) {
 289                         retried = 1;
 290                         ima_lsm_update_rules();
 291                         goto retry;
 292                 }
 293                 if (!rc)
 294                         return false;
 295         }
 296         return true;
 297 }
 298
 299 /*
 300  * In addition to knowing that we need to appraise the file in general,
 301  * we need to differentiate between calling hooks, for hook specific rules.
 302  */
 303 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
 304 {
 305         if (!(rule->flags & IMA_FUNC))
 306                 return IMA_FILE_APPRAISE;
 307
 308         switch (func) {
 309         case MMAP_CHECK:
 310                 return IMA_MMAP_APPRAISE;
 311         case BPRM_CHECK:
 312                 return IMA_BPRM_APPRAISE;
 313         case FILE_CHECK:
 314         case POST_SETATTR:
 315                 return IMA_FILE_APPRAISE;
 316         case MODULE_CHECK ... MAX_CHECK - 1:
 317         default:
 318                 return IMA_READ_APPRAISE;
 319         }
 320 }
 321
 322 /**
 323  * ima_match_policy - decision based on LSM and other conditions
 324  * @inode: pointer to an inode for which the policy decision is being made
 325  * @func: IMA hook identifier
 326  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 327  * @pcr: set the pcr to extend
 328  *
 329  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 330  * conditions.
 331  *
 332  * Since the IMA policy may be updated multiple times we need to lock the
 333  * list when walking it.  Reads are many orders of magnitude more numerous
 334  * than writes so ima_match_policy() is classical RCU candidate.
 335  */
 336 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
 337                      int flags, int *pcr)
 338 {
 339         struct ima_rule_entry *entry;
 340         int action = 0, actmask = flags | (flags << 1);
 341
 342         rcu_read_lock();
 343         list_for_each_entry_rcu(entry, ima_rules, list) {
 344
 345                 if (!(entry->action & actmask))
 346                         continue;
 347
 348                 if (!ima_match_rules(entry, inode, func, mask))
 349                         continue;
 350
 351                 action |= entry->flags & IMA_ACTION_FLAGS;
 352
 353                 action |= entry->action & IMA_DO_MASK;
 354                 if (entry->action & IMA_APPRAISE)
 355                         action |= get_subaction(entry, func);
 356
 357                 if (entry->action & IMA_DO_MASK)
 358                         actmask &= ~(entry->action | entry->action << 1);
 359                 else
 360                         actmask &= ~(entry->action | entry->action >> 1);
 361
 362                 if ((pcr) && (entry->flags & IMA_PCR))
 363                         *pcr = entry->pcr;
 364
 365                 if (!actmask)
 366                         break;
 367         }
 368         rcu_read_unlock();
 369
 370         return action;
 371 }
 372
 373 /*
 374  * Initialize the ima_policy_flag variable based on the currently
 375  * loaded policy.  Based on this flag, the decision to short circuit
 376  * out of a function or not call the function in the first place
 377  * can be made earlier.
 378  */
 379 void ima_update_policy_flag(void)
 380 {
 381         struct ima_rule_entry *entry;
 382
 383         list_for_each_entry(entry, ima_rules, list) {
 384                 if (entry->action & IMA_DO_MASK)
 385                         ima_policy_flag |= entry->action;
 386         }
 387
 388         ima_appraise |= temp_ima_appraise;
 389         if (!ima_appraise)
 390                 ima_policy_flag &= ~IMA_APPRAISE;
 391 }
 392
 393 /**
 394  * ima_init_policy - initialize the default measure rules.
 395  *
 396  * ima_rules points to either the ima_default_rules or the
 397  * the new ima_policy_rules.
 398  */
 399 void __init ima_init_policy(void)
 400 {
 401         int i, measure_entries, appraise_entries;
 402
 403         /* if !ima_policy set entries = 0 so we load NO default rules */
 404         measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 405         appraise_entries = ima_use_appraise_tcb ?
 406                          ARRAY_SIZE(default_appraise_rules) : 0;
 407
 408         for (i = 0; i < measure_entries; i++)
 409                 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
 410
 411         switch (ima_policy) {
 412         case ORIGINAL_TCB:
 413                 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
 414                         list_add_tail(&original_measurement_rules[i].list,
 415                                       &ima_default_rules);
 416                 break;
 417         case DEFAULT_TCB:
 418                 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
 419                         list_add_tail(&default_measurement_rules[i].list,
 420                                       &ima_default_rules);
 421         default:
 422                 break;
 423         }
 424
 425         for (i = 0; i < appraise_entries; i++) {
 426                 list_add_tail(&default_appraise_rules[i].list,
 427                               &ima_default_rules);
 428                 if (default_appraise_rules[i].func == POLICY_CHECK)
 429                         temp_ima_appraise |= IMA_APPRAISE_POLICY;
 430         }
 431
 432         ima_rules = &ima_default_rules;
 433         ima_update_policy_flag();
 434 }
 435
 436 /* Make sure we have a valid policy, at least containing some rules. */
 437 int ima_check_policy(void)
 438 {
 439         if (list_empty(&ima_temp_rules))
 440                 return -EINVAL;
 441         return 0;
 442 }
 443
 444 /**
 445  * ima_update_policy - update default_rules with new measure rules
 446  *
 447  * Called on file .release to update the default rules with a complete new
 448  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 449  * they make a queue.  The policy may be updated multiple times and this is the
 450  * RCU updater.
 451  *
 452  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 453  * we switch from the default policy to user defined.
 454  */
 455 void ima_update_policy(void)
 456 {
 457         struct list_head *first, *last, *policy;
 458
 459         /* append current policy with the new rules */
 460         first = (&ima_temp_rules)->next;
 461         last = (&ima_temp_rules)->prev;
 462         policy = &ima_policy_rules;
 463
 464         synchronize_rcu();
 465
 466         last->next = policy;
 467         rcu_assign_pointer(list_next_rcu(policy->prev), first);
 468         first->prev = policy->prev;
 469         policy->prev = last;
 470
 471         /* prepare for the next policy rules addition */
 472         INIT_LIST_HEAD(&ima_temp_rules);
 473
 474         if (ima_rules != policy) {
 475                 ima_policy_flag = 0;
 476                 ima_rules = policy;
 477         }
 478         ima_update_policy_flag();
 479 }
 480
 481 enum {
 482         Opt_err = -1,
 483         Opt_measure = 1, Opt_dont_measure,
 484         Opt_appraise, Opt_dont_appraise,
 485         Opt_audit,
 486         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 487         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 488         Opt_func, Opt_mask, Opt_fsmagic,
 489         Opt_fsuuid, Opt_uid, Opt_euid, Opt_fowner,
 490         Opt_appraise_type, Opt_permit_directio,
 491         Opt_pcr
 492 };
 493
 494 static match_table_t policy_tokens = {
 495         {Opt_measure, "measure"},
 496         {Opt_dont_measure, "dont_measure"},
 497         {Opt_appraise, "appraise"},
 498         {Opt_dont_appraise, "dont_appraise"},
 499         {Opt_audit, "audit"},
 500         {Opt_obj_user, "obj_user=%s"},
 501         {Opt_obj_role, "obj_role=%s"},
 502         {Opt_obj_type, "obj_type=%s"},
 503         {Opt_subj_user, "subj_user=%s"},
 504         {Opt_subj_role, "subj_role=%s"},
 505         {Opt_subj_type, "subj_type=%s"},
 506         {Opt_func, "func=%s"},
 507         {Opt_mask, "mask=%s"},
 508         {Opt_fsmagic, "fsmagic=%s"},
 509         {Opt_fsuuid, "fsuuid=%s"},
 510         {Opt_uid, "uid=%s"},
 511         {Opt_euid, "euid=%s"},
 512         {Opt_fowner, "fowner=%s"},
 513         {Opt_appraise_type, "appraise_type=%s"},
 514         {Opt_permit_directio, "permit_directio"},
 515         {Opt_pcr, "pcr=%s"},
 516         {Opt_err, NULL}
 517 };
 518
 519 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 520                              substring_t *args, int lsm_rule, int audit_type)
 521 {
 522         int result;
 523
 524         if (entry->lsm[lsm_rule].rule)
 525                 return -EINVAL;
 526
 527         entry->lsm[lsm_rule].args_p = match_strdup(args);
 528         if (!entry->lsm[lsm_rule].args_p)
 529                 return -ENOMEM;
 530
 531         entry->lsm[lsm_rule].type = audit_type;
 532         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 533                                            Audit_equal,
 534                                            entry->lsm[lsm_rule].args_p,
 535                                            &entry->lsm[lsm_rule].rule);
 536         if (!entry->lsm[lsm_rule].rule) {
 537                 kfree(entry->lsm[lsm_rule].args_p);
 538                 return -EINVAL;
 539         }
 540
 541         return result;
 542 }
 543
 544 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
 545 {
 546         audit_log_format(ab, "%s=", key);
 547         audit_log_untrustedstring(ab, value);
 548         audit_log_format(ab, " ");
 549 }
 550
 551 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 552 {
 553         struct audit_buffer *ab;
 554         char *from;
 555         char *p;
 556         int result = 0;
 557
 558         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
 559
 560         entry->uid = INVALID_UID;
 561         entry->fowner = INVALID_UID;
 562         entry->action = UNKNOWN;
 563         while ((p = strsep(&rule, " \t")) != NULL) {
 564                 substring_t args[MAX_OPT_ARGS];
 565                 int token;
 566                 unsigned long lnum;
 567
 568                 if (result < 0)
 569                         break;
 570                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
 571                         continue;
 572                 token = match_token(p, policy_tokens, args);
 573                 switch (token) {
 574                 case Opt_measure:
 575                         ima_log_string(ab, "action", "measure");
 576
 577                         if (entry->action != UNKNOWN)
 578                                 result = -EINVAL;
 579
 580                         entry->action = MEASURE;
 581                         break;
 582                 case Opt_dont_measure:
 583                         ima_log_string(ab, "action", "dont_measure");
 584
 585                         if (entry->action != UNKNOWN)
 586                                 result = -EINVAL;
 587
 588                         entry->action = DONT_MEASURE;
 589                         break;
 590                 case Opt_appraise:
 591                         ima_log_string(ab, "action", "appraise");
 592
 593                         if (entry->action != UNKNOWN)
 594                                 result = -EINVAL;
 595
 596                         entry->action = APPRAISE;
 597                         break;
 598                 case Opt_dont_appraise:
 599                         ima_log_string(ab, "action", "dont_appraise");
 600
 601                         if (entry->action != UNKNOWN)
 602                                 result = -EINVAL;
 603
 604                         entry->action = DONT_APPRAISE;
 605                         break;
 606                 case Opt_audit:
 607                         ima_log_string(ab, "action", "audit");
 608
 609                         if (entry->action != UNKNOWN)
 610                                 result = -EINVAL;
 611
 612                         entry->action = AUDIT;
 613                         break;
 614                 case Opt_func:
 615                         ima_log_string(ab, "func", args[0].from);
 616
 617                         if (entry->func)
 618                                 result = -EINVAL;
 619
 620                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
 621                                 entry->func = FILE_CHECK;
 622                         /* PATH_CHECK is for backwards compat */
 623                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
 624                                 entry->func = FILE_CHECK;
 625                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
 626                                 entry->func = MODULE_CHECK;
 627                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
 628                                 entry->func = FIRMWARE_CHECK;
 629                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
 630                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
 631                                 entry->func = MMAP_CHECK;
 632                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
 633                                 entry->func = BPRM_CHECK;
 634                         else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
 635                                  0)
 636                                 entry->func = KEXEC_KERNEL_CHECK;
 637                         else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
 638                                  == 0)
 639                                 entry->func = KEXEC_INITRAMFS_CHECK;
 640                         else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
 641                                 entry->func = POLICY_CHECK;
 642                         else
 643                                 result = -EINVAL;
 644                         if (!result)
 645                                 entry->flags |= IMA_FUNC;
 646                         break;
 647                 case Opt_mask:
 648                         ima_log_string(ab, "mask", args[0].from);
 649
 650                         if (entry->mask)
 651                                 result = -EINVAL;
 652
 653                         from = args[0].from;
 654                         if (*from == '^')
 655                                 from++;
 656
 657                         if ((strcmp(from, "MAY_EXEC")) == 0)
 658                                 entry->mask = MAY_EXEC;
 659                         else if (strcmp(from, "MAY_WRITE") == 0)
 660                                 entry->mask = MAY_WRITE;
 661                         else if (strcmp(from, "MAY_READ") == 0)
 662                                 entry->mask = MAY_READ;
 663                         else if (strcmp(from, "MAY_APPEND") == 0)
 664                                 entry->mask = MAY_APPEND;
 665                         else
 666                                 result = -EINVAL;
 667                         if (!result)
 668                                 entry->flags |= (*args[0].from == '^')
 669                                      ? IMA_INMASK : IMA_MASK;
 670                         break;
 671                 case Opt_fsmagic:
 672                         ima_log_string(ab, "fsmagic", args[0].from);
 673
 674                         if (entry->fsmagic) {
 675                                 result = -EINVAL;
 676                                 break;
 677                         }
 678
 679                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
 680                         if (!result)
 681                                 entry->flags |= IMA_FSMAGIC;
 682                         break;
 683                 case Opt_fsuuid:
 684                         ima_log_string(ab, "fsuuid", args[0].from);
 685
 686                         if (memchr_inv(entry->fsuuid, 0x00,
 687                                        sizeof(entry->fsuuid))) {
 688                                 result = -EINVAL;
 689                                 break;
 690                         }
 691
 692                         result = blk_part_pack_uuid(args[0].from,
 693                                                     entry->fsuuid);
 694                         if (!result)
 695                                 entry->flags |= IMA_FSUUID;
 696                         break;
 697                 case Opt_uid:
 698                         ima_log_string(ab, "uid", args[0].from);
 699                 case Opt_euid:
 700                         if (token == Opt_euid)
 701                                 ima_log_string(ab, "euid", args[0].from);
 702
 703                         if (uid_valid(entry->uid)) {
 704                                 result = -EINVAL;
 705                                 break;
 706                         }
 707
 708                         result = kstrtoul(args[0].from, 10, &lnum);
 709                         if (!result) {
 710                                 entry->uid = make_kuid(current_user_ns(),
 711                                                        (uid_t) lnum);
 712                                 if (!uid_valid(entry->uid) ||
 713                                     (uid_t)lnum != lnum)
 714                                         result = -EINVAL;
 715                                 else
 716                                         entry->flags |= (token == Opt_uid)
 717                                             ? IMA_UID : IMA_EUID;
 718                         }
 719                         break;
 720                 case Opt_fowner:
 721                         ima_log_string(ab, "fowner", args[0].from);
 722
 723                         if (uid_valid(entry->fowner)) {
 724                                 result = -EINVAL;
 725                                 break;
 726                         }
 727
 728                         result = kstrtoul(args[0].from, 10, &lnum);
 729                         if (!result) {
 730                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
 731                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
 732                                         result = -EINVAL;
 733                                 else
 734                                         entry->flags |= IMA_FOWNER;
 735                         }
 736                         break;
 737                 case Opt_obj_user:
 738                         ima_log_string(ab, "obj_user", args[0].from);
 739                         result = ima_lsm_rule_init(entry, args,
 740                                                    LSM_OBJ_USER,
 741                                                    AUDIT_OBJ_USER);
 742                         break;
 743                 case Opt_obj_role:
 744                         ima_log_string(ab, "obj_role", args[0].from);
 745                         result = ima_lsm_rule_init(entry, args,
 746                                                    LSM_OBJ_ROLE,
 747                                                    AUDIT_OBJ_ROLE);
 748                         break;
 749                 case Opt_obj_type:
 750                         ima_log_string(ab, "obj_type", args[0].from);
 751                         result = ima_lsm_rule_init(entry, args,
 752                                                    LSM_OBJ_TYPE,
 753                                                    AUDIT_OBJ_TYPE);
 754                         break;
 755                 case Opt_subj_user:
 756                         ima_log_string(ab, "subj_user", args[0].from);
 757                         result = ima_lsm_rule_init(entry, args,
 758                                                    LSM_SUBJ_USER,
 759                                                    AUDIT_SUBJ_USER);
 760                         break;
 761                 case Opt_subj_role:
 762                         ima_log_string(ab, "subj_role", args[0].from);
 763                         result = ima_lsm_rule_init(entry, args,
 764                                                    LSM_SUBJ_ROLE,
 765                                                    AUDIT_SUBJ_ROLE);
 766                         break;
 767                 case Opt_subj_type:
 768                         ima_log_string(ab, "subj_type", args[0].from);
 769                         result = ima_lsm_rule_init(entry, args,
 770                                                    LSM_SUBJ_TYPE,
 771                                                    AUDIT_SUBJ_TYPE);
 772                         break;
 773                 case Opt_appraise_type:
 774                         if (entry->action != APPRAISE) {
 775                                 result = -EINVAL;
 776                                 break;
 777                         }
 778
 779                         ima_log_string(ab, "appraise_type", args[0].from);
 780                         if ((strcmp(args[0].from, "imasig")) == 0)
 781                                 entry->flags |= IMA_DIGSIG_REQUIRED;
 782                         else
 783                                 result = -EINVAL;
 784                         break;
 785                 case Opt_permit_directio:
 786                         entry->flags |= IMA_PERMIT_DIRECTIO;
 787                         break;
 788                 case Opt_pcr:
 789                         if (entry->action != MEASURE) {
 790                                 result = -EINVAL;
 791                                 break;
 792                         }
 793                         ima_log_string(ab, "pcr", args[0].from);
 794
 795                         result = kstrtoint(args[0].from, 10, &entry->pcr);
 796                         if (result || INVALID_PCR(entry->pcr))
 797                                 result = -EINVAL;
 798                         else
 799                                 entry->flags |= IMA_PCR;
 800
 801                         break;
 802                 case Opt_err:
 803                         ima_log_string(ab, "UNKNOWN", p);
 804                         result = -EINVAL;
 805                         break;
 806                 }
 807         }
 808         if (!result && (entry->action == UNKNOWN))
 809                 result = -EINVAL;
 810         else if (entry->func == MODULE_CHECK)
 811                 temp_ima_appraise |= IMA_APPRAISE_MODULES;
 812         else if (entry->func == FIRMWARE_CHECK)
 813                 temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
 814         else if (entry->func == POLICY_CHECK)
 815                 temp_ima_appraise |= IMA_APPRAISE_POLICY;
 816         audit_log_format(ab, "res=%d", !result);
 817         audit_log_end(ab);
 818         return result;
 819 }
 820
 821 /**
 822  * ima_parse_add_rule - add a rule to ima_policy_rules
 823  * @rule - ima measurement policy rule
 824  *
 825  * Avoid locking by allowing just one writer at a time in ima_write_policy()
 826  * Returns the length of the rule parsed, an error code on failure
 827  */
 828 ssize_t ima_parse_add_rule(char *rule)
 829 {
 830         static const char op[] = "update_policy";
 831         char *p;
 832         struct ima_rule_entry *entry;
 833         ssize_t result, len;
 834         int audit_info = 0;
 835
 836         p = strsep(&rule, "\n");
 837         len = strlen(p) + 1;
 838         p += strspn(p, " \t");
 839
 840         if (*p == '#' || *p == '\0')
 841                 return len;
 842
 843         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 844         if (!entry) {
 845                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 846                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
 847                 return -ENOMEM;
 848         }
 849
 850         INIT_LIST_HEAD(&entry->list);
 851
 852         result = ima_parse_rule(p, entry);
 853         if (result) {
 854                 kfree(entry);
 855                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 856                                     NULL, op, "invalid-policy", result,
 857                                     audit_info);
 858                 return result;
 859         }
 860
 861         list_add_tail(&entry->list, &ima_temp_rules);
 862
 863         return len;
 864 }
 865
 866 /**
 867  * ima_delete_rules() called to cleanup invalid in-flight policy.
 868  * We don't need locking as we operate on the temp list, which is
 869  * different from the active one.  There is also only one user of
 870  * ima_delete_rules() at a time.
 871  */
 872 void ima_delete_rules(void)
 873 {
 874         struct ima_rule_entry *entry, *tmp;
 875         int i;
 876
 877         temp_ima_appraise = 0;
 878         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
 879                 for (i = 0; i < MAX_LSM_RULES; i++)
 880                         kfree(entry->lsm[i].args_p);
 881
 882                 list_del(&entry->list);
 883                 kfree(entry);
 884         }
 885 }
 886
 887 #ifdef  CONFIG_IMA_READ_POLICY
 888 enum {
 889         mask_exec = 0, mask_write, mask_read, mask_append
 890 };
 891
 892 static char *mask_tokens[] = {
 893         "MAY_EXEC",
 894         "MAY_WRITE",
 895         "MAY_READ",
 896         "MAY_APPEND"
 897 };
 898
 899 enum {
 900         func_file = 0, func_mmap, func_bprm,
 901         func_module, func_firmware, func_post,
 902         func_kexec_kernel, func_kexec_initramfs,
 903         func_policy
 904 };
 905
 906 static char *func_tokens[] = {
 907         "FILE_CHECK",
 908         "MMAP_CHECK",
 909         "BPRM_CHECK",
 910         "MODULE_CHECK",
 911         "FIRMWARE_CHECK",
 912         "POST_SETATTR",
 913         "KEXEC_KERNEL_CHECK",
 914         "KEXEC_INITRAMFS_CHECK",
 915         "POLICY_CHECK"
 916 };
 917
 918 void *ima_policy_start(struct seq_file *m, loff_t *pos)
 919 {
 920         loff_t l = *pos;
 921         struct ima_rule_entry *entry;
 922
 923         rcu_read_lock();
 924         list_for_each_entry_rcu(entry, ima_rules, list) {
 925                 if (!l--) {
 926                         rcu_read_unlock();
 927                         return entry;
 928                 }
 929         }
 930         rcu_read_unlock();
 931         return NULL;
 932 }
 933
 934 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
 935 {
 936         struct ima_rule_entry *entry = v;
 937
 938         rcu_read_lock();
 939         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
 940         rcu_read_unlock();
 941         (*pos)++;
 942
 943         return (&entry->list == ima_rules) ? NULL : entry;
 944 }
 945
 946 void ima_policy_stop(struct seq_file *m, void *v)
 947 {
 948 }
 949
 950 #define pt(token)       policy_tokens[token + Opt_err].pattern
 951 #define mt(token)       mask_tokens[token]
 952 #define ft(token)       func_tokens[token]
 953
 954 /*
 955  * policy_func_show - display the ima_hooks policy rule
 956  */
 957 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
 958 {
 959         char tbuf[64] = {0,};
 960
 961         switch (func) {
 962         case FILE_CHECK:
 963                 seq_printf(m, pt(Opt_func), ft(func_file));
 964                 break;
 965         case MMAP_CHECK:
 966                 seq_printf(m, pt(Opt_func), ft(func_mmap));
 967                 break;
 968         case BPRM_CHECK:
 969                 seq_printf(m, pt(Opt_func), ft(func_bprm));
 970                 break;
 971         case MODULE_CHECK:
 972                 seq_printf(m, pt(Opt_func), ft(func_module));
 973                 break;
 974         case FIRMWARE_CHECK:
 975                 seq_printf(m, pt(Opt_func), ft(func_firmware));
 976                 break;
 977         case POST_SETATTR:
 978                 seq_printf(m, pt(Opt_func), ft(func_post));
 979                 break;
 980         case KEXEC_KERNEL_CHECK:
 981                 seq_printf(m, pt(Opt_func), ft(func_kexec_kernel));
 982                 break;
 983         case KEXEC_INITRAMFS_CHECK:
 984                 seq_printf(m, pt(Opt_func), ft(func_kexec_initramfs));
 985                 break;
 986         case POLICY_CHECK:
 987                 seq_printf(m, pt(Opt_func), ft(func_policy));
 988                 break;
 989         default:
 990                 snprintf(tbuf, sizeof(tbuf), "%d", func);
 991                 seq_printf(m, pt(Opt_func), tbuf);
 992                 break;
 993         }
 994         seq_puts(m, " ");
 995 }
 996
 997 int ima_policy_show(struct seq_file *m, void *v)
 998 {
 999         struct ima_rule_entry *entry = v;
1000         int i;
1001         char tbuf[64] = {0,};
1002
1003         rcu_read_lock();
1004
1005         if (entry->action & MEASURE)
1006                 seq_puts(m, pt(Opt_measure));
1007         if (entry->action & DONT_MEASURE)
1008                 seq_puts(m, pt(Opt_dont_measure));
1009         if (entry->action & APPRAISE)
1010                 seq_puts(m, pt(Opt_appraise));
1011         if (entry->action & DONT_APPRAISE)
1012                 seq_puts(m, pt(Opt_dont_appraise));
1013         if (entry->action & AUDIT)
1014                 seq_puts(m, pt(Opt_audit));
1015
1016         seq_puts(m, " ");
1017
1018         if (entry->flags & IMA_FUNC)
1019                 policy_func_show(m, entry->func);
1020
1021         if (entry->flags & IMA_MASK) {
1022                 if (entry->mask & MAY_EXEC)
1023                         seq_printf(m, pt(Opt_mask), mt(mask_exec));
1024                 if (entry->mask & MAY_WRITE)
1025                         seq_printf(m, pt(Opt_mask), mt(mask_write));
1026                 if (entry->mask & MAY_READ)
1027                         seq_printf(m, pt(Opt_mask), mt(mask_read));
1028                 if (entry->mask & MAY_APPEND)
1029                         seq_printf(m, pt(Opt_mask), mt(mask_append));
1030                 seq_puts(m, " ");
1031         }
1032
1033         if (entry->flags & IMA_FSMAGIC) {
1034                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1035                 seq_printf(m, pt(Opt_fsmagic), tbuf);
1036                 seq_puts(m, " ");
1037         }
1038
1039         if (entry->flags & IMA_PCR) {
1040                 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
1041                 seq_printf(m, pt(Opt_pcr), tbuf);
1042                 seq_puts(m, " ");
1043         }
1044
1045         if (entry->flags & IMA_FSUUID) {
1046                 seq_printf(m, "fsuuid=%pU", entry->fsuuid);
1047                 seq_puts(m, " ");
1048         }
1049
1050         if (entry->flags & IMA_UID) {
1051                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1052                 seq_printf(m, pt(Opt_uid), tbuf);
1053                 seq_puts(m, " ");
1054         }
1055
1056         if (entry->flags & IMA_EUID) {
1057                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1058                 seq_printf(m, pt(Opt_euid), tbuf);
1059                 seq_puts(m, " ");
1060         }
1061
1062         if (entry->flags & IMA_FOWNER) {
1063                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1064                 seq_printf(m, pt(Opt_fowner), tbuf);
1065                 seq_puts(m, " ");
1066         }
1067
1068         for (i = 0; i < MAX_LSM_RULES; i++) {
1069                 if (entry->lsm[i].rule) {
1070                         switch (i) {
1071                         case LSM_OBJ_USER:
1072                                 seq_printf(m, pt(Opt_obj_user),
1073                                            (char *)entry->lsm[i].args_p);
1074                                 break;
1075                         case LSM_OBJ_ROLE:
1076                                 seq_printf(m, pt(Opt_obj_role),
1077                                            (char *)entry->lsm[i].args_p);
1078                                 break;
1079                         case LSM_OBJ_TYPE:
1080                                 seq_printf(m, pt(Opt_obj_type),
1081                                            (char *)entry->lsm[i].args_p);
1082                                 break;
1083                         case LSM_SUBJ_USER:
1084                                 seq_printf(m, pt(Opt_subj_user),
1085                                            (char *)entry->lsm[i].args_p);
1086                                 break;
1087                         case LSM_SUBJ_ROLE:
1088                                 seq_printf(m, pt(Opt_subj_role),
1089                                            (char *)entry->lsm[i].args_p);
1090                                 break;
1091                         case LSM_SUBJ_TYPE:
1092                                 seq_printf(m, pt(Opt_subj_type),
1093                                            (char *)entry->lsm[i].args_p);
1094                                 break;
1095                         }
1096                 }
1097         }
1098         if (entry->flags & IMA_DIGSIG_REQUIRED)
1099                 seq_puts(m, "appraise_type=imasig ");
1100         if (entry->flags & IMA_PERMIT_DIRECTIO)
1101                 seq_puts(m, "permit_directio ");
1102         rcu_read_unlock();
1103         seq_puts(m, "\n");
1104         return 0;
1105 }
1106 #endif  /* CONFIG_IMA_READ_POLICY */