1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * Copyright (C) 2009-2010 IBM Corporation
4 *
5 * Authors:
6 * Mimi Zohar <zohar@us.ibm.com>
7 */
8
9#ifdef pr_fmt
10#undef pr_fmt
11#endif
12
13#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15#include <linux/types.h>
16#include <linux/integrity.h>
17#include <crypto/sha.h>
18#include <linux/key.h>
19#include <linux/audit.h>
20
21/* iint action cache flags */
22#define IMA_MEASURE		0x00000001
23#define IMA_MEASURED		0x00000002
24#define IMA_APPRAISE		0x00000004
25#define IMA_APPRAISED		0x00000008
26/*#define IMA_COLLECT		0x00000010  do not use this flag */
27#define IMA_COLLECTED		0x00000020
28#define IMA_AUDIT		0x00000040
29#define IMA_AUDITED		0x00000080
30#define IMA_HASH		0x00000100
31#define IMA_HASHED		0x00000200
32
33/* iint cache flags */
34#define IMA_ACTION_FLAGS	0xff000000
35#define IMA_DIGSIG_REQUIRED	0x01000000
36#define IMA_PERMIT_DIRECTIO	0x02000000
37#define IMA_NEW_FILE		0x04000000
38#define EVM_IMMUTABLE_DIGSIG	0x08000000
39#define IMA_FAIL_UNVERIFIABLE_SIGS	0x10000000
40#define IMA_MODSIG_ALLOWED	0x20000000
41#define IMA_CHECK_BLACKLIST	0x40000000
42
43#define IMA_DO_MASK		(IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
44				 IMA_HASH | IMA_APPRAISE_SUBMASK)
45#define IMA_DONE_MASK		(IMA_MEASURED | IMA_APPRAISED | IMA_AUDITED | \
46				 IMA_HASHED | IMA_COLLECTED | \
47				 IMA_APPRAISED_SUBMASK)
48
49/* iint subaction appraise cache flags */
50#define IMA_FILE_APPRAISE	0x00001000
51#define IMA_FILE_APPRAISED	0x00002000
52#define IMA_MMAP_APPRAISE	0x00004000
53#define IMA_MMAP_APPRAISED	0x00008000
54#define IMA_BPRM_APPRAISE	0x00010000
55#define IMA_BPRM_APPRAISED	0x00020000
56#define IMA_READ_APPRAISE	0x00040000
57#define IMA_READ_APPRAISED	0x00080000
58#define IMA_CREDS_APPRAISE	0x00100000
59#define IMA_CREDS_APPRAISED	0x00200000
60#define IMA_APPRAISE_SUBMASK	(IMA_FILE_APPRAISE | IMA_MMAP_APPRAISE | \
61				 IMA_BPRM_APPRAISE | IMA_READ_APPRAISE | \
62				 IMA_CREDS_APPRAISE)
63#define IMA_APPRAISED_SUBMASK	(IMA_FILE_APPRAISED | IMA_MMAP_APPRAISED | \
64				 IMA_BPRM_APPRAISED | IMA_READ_APPRAISED | \
65				 IMA_CREDS_APPRAISED)
66
67/* iint cache atomic_flags */
68#define IMA_CHANGE_XATTR	0
69#define IMA_UPDATE_XATTR	1
70#define IMA_CHANGE_ATTR		2
71#define IMA_DIGSIG		3
72#define IMA_MUST_MEASURE	4
73
74enum evm_ima_xattr_type {
75	IMA_XATTR_DIGEST = 0x01,
76	EVM_XATTR_HMAC,
77	EVM_IMA_XATTR_DIGSIG,
78	IMA_XATTR_DIGEST_NG,
79	EVM_XATTR_PORTABLE_DIGSIG,
80	IMA_XATTR_LAST
81};
82
83struct evm_ima_xattr_data {
84	u8 type;
85	u8 data[];
86} __packed;
87
88/* Only used in the EVM HMAC code. */
89struct evm_xattr {
90	struct evm_ima_xattr_data data;
91	u8 digest[SHA1_DIGEST_SIZE];
92} __packed;
93
94#define IMA_MAX_DIGEST_SIZE	64
95
96struct ima_digest_data {
97	u8 algo;
98	u8 length;
99	union {
100		struct {
101			u8 unused;
102			u8 type;
103		} sha1;
104		struct {
105			u8 type;
106			u8 algo;
107		} ng;
108		u8 data[2];
109	} xattr;
110	u8 digest[];
111} __packed;
112
113/*
114 * signature format v2 - for using with asymmetric keys
115 */
116struct signature_v2_hdr {
117	uint8_t type;		/* xattr type */
118	uint8_t version;	/* signature format version */
119	uint8_t	hash_algo;	/* Digest algorithm [enum hash_algo] */
120	__be32 keyid;		/* IMA key identifier - not X509/PGP specific */
121	__be16 sig_size;	/* signature size */
122	uint8_t sig[];		/* signature payload */
123} __packed;
124
125/* integrity data associated with an inode */
126struct integrity_iint_cache {
127	struct rb_node rb_node;	/* rooted in integrity_iint_tree */
128	struct mutex mutex;	/* protects: version, flags, digest */
129	struct inode *inode;	/* back pointer to inode in question */
130	u64 version;		/* track inode changes */
131	unsigned long flags;
132	unsigned long measured_pcrs;
133	unsigned long atomic_flags;
134	unsigned long real_ino;
135	dev_t real_dev;
136	enum integrity_status ima_file_status:4;
137	enum integrity_status ima_mmap_status:4;
138	enum integrity_status ima_bprm_status:4;
139	enum integrity_status ima_read_status:4;
140	enum integrity_status ima_creds_status:4;
141	enum integrity_status evm_status:4;
142	struct ima_digest_data *ima_hash;
143};
144
145/* rbtree tree calls to lookup, insert, delete
146 * integrity data associated with an inode.
147 */
148struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
149
150int integrity_kernel_read(struct file *file, loff_t offset,
151			  void *addr, unsigned long count);
152
153#define INTEGRITY_KEYRING_EVM		0
154#define INTEGRITY_KEYRING_IMA		1
155#define INTEGRITY_KEYRING_PLATFORM	2
156#define INTEGRITY_KEYRING_MAX		3
157
158extern struct dentry *integrity_dir;
159
160struct modsig;
161
162#ifdef CONFIG_INTEGRITY_SIGNATURE
163
164int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
165			    const char *digest, int digestlen);
166int integrity_modsig_verify(unsigned int id, const struct modsig *modsig);
167
168int __init integrity_init_keyring(const unsigned int id);
169int __init integrity_load_x509(const unsigned int id, const char *path);
170int __init integrity_load_cert(const unsigned int id, const char *source,
171			       const void *data, size_t len, key_perm_t perm);
172#else
173
174static inline int integrity_digsig_verify(const unsigned int id,
175					  const char *sig, int siglen,
176					  const char *digest, int digestlen)
177{
178	return -EOPNOTSUPP;
179}
180
181static inline int integrity_modsig_verify(unsigned int id,
182					  const struct modsig *modsig)
183{
184	return -EOPNOTSUPP;
185}
186
187static inline int integrity_init_keyring(const unsigned int id)
188{
189	return 0;
190}
191
192static inline int __init integrity_load_cert(const unsigned int id,
193					     const char *source,
194					     const void *data, size_t len,
195					     key_perm_t perm)
196{
197	return 0;
198}
199#endif /* CONFIG_INTEGRITY_SIGNATURE */
200
201#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
202int asymmetric_verify(struct key *keyring, const char *sig,
203		      int siglen, const char *data, int datalen);
204#else
205static inline int asymmetric_verify(struct key *keyring, const char *sig,
206				    int siglen, const char *data, int datalen)
207{
208	return -EOPNOTSUPP;
209}
210#endif
211
212#ifdef CONFIG_IMA_APPRAISE_MODSIG
213int ima_modsig_verify(struct key *keyring, const struct modsig *modsig);
214#else
215static inline int ima_modsig_verify(struct key *keyring,
216				    const struct modsig *modsig)
217{
218	return -EOPNOTSUPP;
219}
220#endif
221
222#ifdef CONFIG_IMA_LOAD_X509
223void __init ima_load_x509(void);
224#else
225static inline void ima_load_x509(void)
226{
227}
228#endif
229
230#ifdef CONFIG_EVM_LOAD_X509
231void __init evm_load_x509(void);
232#else
233static inline void evm_load_x509(void)
234{
235}
236#endif
237
238#ifdef CONFIG_INTEGRITY_AUDIT
239/* declarations */
240void integrity_audit_msg(int audit_msgno, struct inode *inode,
241			 const unsigned char *fname, const char *op,
242			 const char *cause, int result, int info);
243
244void integrity_audit_message(int audit_msgno, struct inode *inode,
245			     const unsigned char *fname, const char *op,
246			     const char *cause, int result, int info,
247			     int errno);
248
249static inline struct audit_buffer *
250integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
251{
252	return audit_log_start(ctx, gfp_mask, type);
253}
254
255#else
256static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
257				       const unsigned char *fname,
258				       const char *op, const char *cause,
259				       int result, int info)
260{
261}
262
263static inline void integrity_audit_message(int audit_msgno,
264					   struct inode *inode,
265					   const unsigned char *fname,
266					   const char *op, const char *cause,
267					   int result, int info, int errno)
268{
269}
270
271static inline struct audit_buffer *
272integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
273{
274	return NULL;
275}
276
277#endif
278
279#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
280void __init add_to_platform_keyring(const char *source, const void *data,
281				    size_t len);
282#else
283static inline void __init add_to_platform_keyring(const char *source,
284						  const void *data, size_t len)
285{
286}
287#endif
288