security/integrity/ima/ima_appraise.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (C) 2011 IBM Corporation
   4  *
   5  * Author:
   6  * Mimi Zohar <zohar@us.ibm.com>
   7  */
   8 #include <linux/init.h>
   9 #include <linux/file.h>
  10 #include <linux/fs.h>
  11 #include <linux/xattr.h>
  12 #include <linux/magic.h>
  13 #include <linux/ima.h>
  14 #include <linux/evm.h>
  15
  16 #include "ima.h"
  17
  18 static int __init default_appraise_setup(char *str)
  19 {
  20 #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
  21         if (strncmp(str, "off", 3) == 0)
  22                 ima_appraise = 0;
  23         else if (strncmp(str, "log", 3) == 0)
  24                 ima_appraise = IMA_APPRAISE_LOG;
  25         else if (strncmp(str, "fix", 3) == 0)
  26                 ima_appraise = IMA_APPRAISE_FIX;
  27 #endif
  28         return 1;
  29 }
  30
  31 __setup("ima_appraise=", default_appraise_setup);
  32
  33 /*
  34  * is_ima_appraise_enabled - return appraise status
  35  *
  36  * Only return enabled, if not in ima_appraise="fix" or "log" modes.
  37  */
  38 bool is_ima_appraise_enabled(void)
  39 {
  40         return ima_appraise & IMA_APPRAISE_ENFORCE;
  41 }
  42
  43 /*
  44  * ima_must_appraise - set appraise flag
  45  *
  46  * Return 1 to appraise or hash
  47  */
  48 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
  49 {
  50         u32 secid;
  51
  52         if (!ima_appraise)
  53                 return 0;
  54
  55         security_task_getsecid(current, &secid);
  56         return ima_match_policy(inode, current_cred(), secid, func, mask,
  57                                 IMA_APPRAISE | IMA_HASH, NULL);
  58 }
  59
  60 static int ima_fix_xattr(struct dentry *dentry,
  61                          struct integrity_iint_cache *iint)
  62 {
  63         int rc, offset;
  64         u8 algo = iint->ima_hash->algo;
  65
  66         if (algo <= HASH_ALGO_SHA1) {
  67                 offset = 1;
  68                 iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;
  69         } else {
  70                 offset = 0;
  71                 iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG;
  72                 iint->ima_hash->xattr.ng.algo = algo;
  73         }
  74         rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA,
  75                                    &iint->ima_hash->xattr.data[offset],
  76                                    (sizeof(iint->ima_hash->xattr) - offset) +
  77                                    iint->ima_hash->length, 0);
  78         return rc;
  79 }
  80
  81 /* Return specific func appraised cached result */
  82 enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
  83                                            enum ima_hooks func)
  84 {
  85         switch (func) {
  86         case MMAP_CHECK:
  87                 return iint->ima_mmap_status;
  88         case BPRM_CHECK:
  89                 return iint->ima_bprm_status;
  90         case CREDS_CHECK:
  91                 return iint->ima_creds_status;
  92         case FILE_CHECK:
  93         case POST_SETATTR:
  94                 return iint->ima_file_status;
  95         case MODULE_CHECK ... MAX_CHECK - 1:
  96         default:
  97                 return iint->ima_read_status;
  98         }
  99 }
 100
 101 static void ima_set_cache_status(struct integrity_iint_cache *iint,
 102                                  enum ima_hooks func,
 103                                  enum integrity_status status)
 104 {
 105         switch (func) {
 106         case MMAP_CHECK:
 107                 iint->ima_mmap_status = status;
 108                 break;
 109         case BPRM_CHECK:
 110                 iint->ima_bprm_status = status;
 111                 break;
 112         case CREDS_CHECK:
 113                 iint->ima_creds_status = status;
 114                 break;
 115         case FILE_CHECK:
 116         case POST_SETATTR:
 117                 iint->ima_file_status = status;
 118                 break;
 119         case MODULE_CHECK ... MAX_CHECK - 1:
 120         default:
 121                 iint->ima_read_status = status;
 122                 break;
 123         }
 124 }
 125
 126 static void ima_cache_flags(struct integrity_iint_cache *iint,
 127                              enum ima_hooks func)
 128 {
 129         switch (func) {
 130         case MMAP_CHECK:
 131                 iint->flags |= (IMA_MMAP_APPRAISED | IMA_APPRAISED);
 132                 break;
 133         case BPRM_CHECK:
 134                 iint->flags |= (IMA_BPRM_APPRAISED | IMA_APPRAISED);
 135                 break;
 136         case CREDS_CHECK:
 137                 iint->flags |= (IMA_CREDS_APPRAISED | IMA_APPRAISED);
 138                 break;
 139         case FILE_CHECK:
 140         case POST_SETATTR:
 141                 iint->flags |= (IMA_FILE_APPRAISED | IMA_APPRAISED);
 142                 break;
 143         case MODULE_CHECK ... MAX_CHECK - 1:
 144         default:
 145                 iint->flags |= (IMA_READ_APPRAISED | IMA_APPRAISED);
 146                 break;
 147         }
 148 }
 149
 150 enum hash_algo ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
 151                                  int xattr_len)
 152 {
 153         struct signature_v2_hdr *sig;
 154         enum hash_algo ret;
 155
 156         if (!xattr_value || xattr_len < 2)
 157                 /* return default hash algo */
 158                 return ima_hash_algo;
 159
 160         switch (xattr_value->type) {
 161         case EVM_IMA_XATTR_DIGSIG:
 162                 sig = (typeof(sig))xattr_value;
 163                 if (sig->version != 2 || xattr_len <= sizeof(*sig))
 164                         return ima_hash_algo;
 165                 return sig->hash_algo;
 166                 break;
 167         case IMA_XATTR_DIGEST_NG:
 168                 ret = xattr_value->digest[0];
 169                 if (ret < HASH_ALGO__LAST)
 170                         return ret;
 171                 break;
 172         case IMA_XATTR_DIGEST:
 173                 /* this is for backward compatibility */
 174                 if (xattr_len == 21) {
 175                         unsigned int zero = 0;
 176                         if (!memcmp(&xattr_value->digest[16], &zero, 4))
 177                                 return HASH_ALGO_MD5;
 178                         else
 179                                 return HASH_ALGO_SHA1;
 180                 } else if (xattr_len == 17)
 181                         return HASH_ALGO_MD5;
 182                 break;
 183         }
 184
 185         /* return default hash algo */
 186         return ima_hash_algo;
 187 }
 188
 189 int ima_read_xattr(struct dentry *dentry,
 190                    struct evm_ima_xattr_data **xattr_value)
 191 {
 192         ssize_t ret;
 193
 194         ret = vfs_getxattr_alloc(dentry, XATTR_NAME_IMA, (char **)xattr_value,
 195                                  0, GFP_NOFS);
 196         if (ret == -EOPNOTSUPP)
 197                 ret = 0;
 198         return ret;
 199 }
 200
 201 /*
 202  * ima_appraise_measurement - appraise file measurement
 203  *
 204  * Call evm_verifyxattr() to verify the integrity of 'security.ima'.
 205  * Assuming success, compare the xattr hash with the collected measurement.
 206  *
 207  * Return 0 on success, error code otherwise
 208  */
 209 int ima_appraise_measurement(enum ima_hooks func,
 210                              struct integrity_iint_cache *iint,
 211                              struct file *file, const unsigned char *filename,
 212                              struct evm_ima_xattr_data *xattr_value,
 213                              int xattr_len)
 214 {
 215         static const char op[] = "appraise_data";
 216         const char *cause = "unknown";
 217         struct dentry *dentry = file_dentry(file);
 218         struct inode *inode = d_backing_inode(dentry);
 219         enum integrity_status status = INTEGRITY_UNKNOWN;
 220         int rc = xattr_len, hash_start = 0;
 221
 222         if (!(inode->i_opflags & IOP_XATTR))
 223                 return INTEGRITY_UNKNOWN;
 224
 225         if (rc <= 0) {
 226                 if (rc && rc != -ENODATA)
 227                         goto out;
 228
 229                 cause = iint->flags & IMA_DIGSIG_REQUIRED ?
 230                                 "IMA-signature-required" : "missing-hash";
 231                 status = INTEGRITY_NOLABEL;
 232                 if (file->f_mode & FMODE_CREATED)
 233                         iint->flags |= IMA_NEW_FILE;
 234                 if ((iint->flags & IMA_NEW_FILE) &&
 235                     (!(iint->flags & IMA_DIGSIG_REQUIRED) ||
 236                      (inode->i_size == 0)))
 237                         status = INTEGRITY_PASS;
 238                 goto out;
 239         }
 240
 241         status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);
 242         switch (status) {
 243         case INTEGRITY_PASS:
 244         case INTEGRITY_PASS_IMMUTABLE:
 245         case INTEGRITY_UNKNOWN:
 246                 break;
 247         case INTEGRITY_NOXATTRS:        /* No EVM protected xattrs. */
 248         case INTEGRITY_NOLABEL:         /* No security.evm xattr. */
 249                 cause = "missing-HMAC";
 250                 goto out;
 251         case INTEGRITY_FAIL:            /* Invalid HMAC/signature. */
 252                 cause = "invalid-HMAC";
 253                 goto out;
 254         default:
 255                 WARN_ONCE(true, "Unexpected integrity status %d\n", status);
 256         }
 257
 258         switch (xattr_value->type) {
 259         case IMA_XATTR_DIGEST_NG:
 260                 /* first byte contains algorithm id */
 261                 hash_start = 1;
 262                 /* fall through */
 263         case IMA_XATTR_DIGEST:
 264                 if (iint->flags & IMA_DIGSIG_REQUIRED) {
 265                         cause = "IMA-signature-required";
 266                         status = INTEGRITY_FAIL;
 267                         break;
 268                 }
 269                 clear_bit(IMA_DIGSIG, &iint->atomic_flags);
 270                 if (xattr_len - sizeof(xattr_value->type) - hash_start >=
 271                                 iint->ima_hash->length)
 272                         /* xattr length may be longer. md5 hash in previous
 273                            version occupied 20 bytes in xattr, instead of 16
 274                          */
 275                         rc = memcmp(&xattr_value->digest[hash_start],
 276                                     iint->ima_hash->digest,
 277                                     iint->ima_hash->length);
 278                 else
 279                         rc = -EINVAL;
 280                 if (rc) {
 281                         cause = "invalid-hash";
 282                         status = INTEGRITY_FAIL;
 283                         break;
 284                 }
 285                 status = INTEGRITY_PASS;
 286                 break;
 287         case EVM_IMA_XATTR_DIGSIG:
 288                 set_bit(IMA_DIGSIG, &iint->atomic_flags);
 289                 rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
 290                                              (const char *)xattr_value,
 291                                              xattr_len,
 292                                              iint->ima_hash->digest,
 293                                              iint->ima_hash->length);
 294                 if (rc == -EOPNOTSUPP) {
 295                         status = INTEGRITY_UNKNOWN;
 296                         break;
 297                 }
 298                 if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc &&
 299                     func == KEXEC_KERNEL_CHECK)
 300                         rc = integrity_digsig_verify(INTEGRITY_KEYRING_PLATFORM,
 301                                                      (const char *)xattr_value,
 302                                                      xattr_len,
 303                                                      iint->ima_hash->digest,
 304                                                      iint->ima_hash->length);
 305                 if (rc) {
 306                         cause = "invalid-signature";
 307                         status = INTEGRITY_FAIL;
 308                 } else {
 309                         status = INTEGRITY_PASS;
 310                 }
 311                 break;
 312         default:
 313                 status = INTEGRITY_UNKNOWN;
 314                 cause = "unknown-ima-data";
 315                 break;
 316         }
 317
 318 out:
 319         /*
 320          * File signatures on some filesystems can not be properly verified.
 321          * When such filesystems are mounted by an untrusted mounter or on a
 322          * system not willing to accept such a risk, fail the file signature
 323          * verification.
 324          */
 325         if ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) &&
 326             ((inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER) ||
 327              (iint->flags & IMA_FAIL_UNVERIFIABLE_SIGS))) {
 328                 status = INTEGRITY_FAIL;
 329                 cause = "unverifiable-signature";
 330                 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
 331                                     op, cause, rc, 0);
 332         } else if (status != INTEGRITY_PASS) {
 333                 /* Fix mode, but don't replace file signatures. */
 334                 if ((ima_appraise & IMA_APPRAISE_FIX) &&
 335                     (!xattr_value ||
 336                      xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
 337                         if (!ima_fix_xattr(dentry, iint))
 338                                 status = INTEGRITY_PASS;
 339                 }
 340
 341                 /* Permit new files with file signatures, but without data. */
 342                 if (inode->i_size == 0 && iint->flags & IMA_NEW_FILE &&
 343                     xattr_value && xattr_value->type == EVM_IMA_XATTR_DIGSIG) {
 344                         status = INTEGRITY_PASS;
 345                 }
 346
 347                 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
 348                                     op, cause, rc, 0);
 349         } else {
 350                 ima_cache_flags(iint, func);
 351         }
 352
 353         ima_set_cache_status(iint, func, status);
 354         return status;
 355 }
 356
 357 /*
 358  * ima_update_xattr - update 'security.ima' hash value
 359  */
 360 void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
 361 {
 362         struct dentry *dentry = file_dentry(file);
 363         int rc = 0;
 364
 365         /* do not collect and update hash for digital signatures */
 366         if (test_bit(IMA_DIGSIG, &iint->atomic_flags))
 367                 return;
 368
 369         if ((iint->ima_file_status != INTEGRITY_PASS) &&
 370             !(iint->flags & IMA_HASH))
 371                 return;
 372
 373         rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo);
 374         if (rc < 0)
 375                 return;
 376
 377         inode_lock(file_inode(file));
 378         ima_fix_xattr(dentry, iint);
 379         inode_unlock(file_inode(file));
 380 }
 381
 382 /**
 383  * ima_inode_post_setattr - reflect file metadata changes
 384  * @dentry: pointer to the affected dentry
 385  *
 386  * Changes to a dentry's metadata might result in needing to appraise.
 387  *
 388  * This function is called from notify_change(), which expects the caller
 389  * to lock the inode's i_mutex.
 390  */
 391 void ima_inode_post_setattr(struct dentry *dentry)
 392 {
 393         struct inode *inode = d_backing_inode(dentry);
 394         struct integrity_iint_cache *iint;
 395         int action;
 396
 397         if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)
 398             || !(inode->i_opflags & IOP_XATTR))
 399                 return;
 400
 401         action = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
 402         if (!action)
 403                 __vfs_removexattr(dentry, XATTR_NAME_IMA);
 404         iint = integrity_iint_find(inode);
 405         if (iint) {
 406                 set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
 407                 if (!action)
 408                         clear_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
 409         }
 410 }
 411
 412 /*
 413  * ima_protect_xattr - protect 'security.ima'
 414  *
 415  * Ensure that not just anyone can modify or remove 'security.ima'.
 416  */
 417 static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
 418                              const void *xattr_value, size_t xattr_value_len)
 419 {
 420         if (strcmp(xattr_name, XATTR_NAME_IMA) == 0) {
 421                 if (!capable(CAP_SYS_ADMIN))
 422                         return -EPERM;
 423                 return 1;
 424         }
 425         return 0;
 426 }
 427
 428 static void ima_reset_appraise_flags(struct inode *inode, int digsig)
 429 {
 430         struct integrity_iint_cache *iint;
 431
 432         if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode))
 433                 return;
 434
 435         iint = integrity_iint_find(inode);
 436         if (!iint)
 437                 return;
 438         iint->measured_pcrs = 0;
 439         set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags);
 440         if (digsig)
 441                 set_bit(IMA_DIGSIG, &iint->atomic_flags);
 442         else
 443                 clear_bit(IMA_DIGSIG, &iint->atomic_flags);
 444 }
 445
 446 int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
 447                        const void *xattr_value, size_t xattr_value_len)
 448 {
 449         const struct evm_ima_xattr_data *xvalue = xattr_value;
 450         int result;
 451
 452         result = ima_protect_xattr(dentry, xattr_name, xattr_value,
 453                                    xattr_value_len);
 454         if (result == 1) {
 455                 if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
 456                         return -EINVAL;
 457                 ima_reset_appraise_flags(d_backing_inode(dentry),
 458                         xvalue->type == EVM_IMA_XATTR_DIGSIG);
 459                 result = 0;
 460         }
 461         return result;
 462 }
 463
 464 int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name)
 465 {
 466         int result;
 467
 468         result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
 469         if (result == 1) {
 470                 ima_reset_appraise_flags(d_backing_inode(dentry), 0);
 471                 result = 0;
 472         }
 473         return result;
 474 }