security/integrity/ima/ima_policy.c

   1 /*
   2  * Copyright (C) 2008 IBM Corporation
   3  * Author: Mimi Zohar <zohar@us.ibm.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, version 2 of the License.
   8  *
   9  * ima_policy.c
  10  *      - initialize default measure policy rules
  11  *
  12  */
  13 #include <linux/module.h>
  14 #include <linux/list.h>
  15 #include <linux/fs.h>
  16 #include <linux/security.h>
  17 #include <linux/magic.h>
  18 #include <linux/parser.h>
  19 #include <linux/slab.h>
  20 #include <linux/rculist.h>
  21 #include <linux/genhd.h>
  22 #include <linux/seq_file.h>
  23
  24 #include "ima.h"
  25
  26 /* flags definitions */
  27 #define IMA_FUNC        0x0001
  28 #define IMA_MASK        0x0002
  29 #define IMA_FSMAGIC     0x0004
  30 #define IMA_UID         0x0008
  31 #define IMA_FOWNER      0x0010
  32 #define IMA_FSUUID      0x0020
  33 #define IMA_INMASK      0x0040
  34 #define IMA_EUID        0x0080
  35
  36 #define UNKNOWN         0
  37 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  38 #define DONT_MEASURE    0x0002
  39 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  40 #define DONT_APPRAISE   0x0008
  41 #define AUDIT           0x0040
  42
  43 int ima_policy_flag;
  44 static int temp_ima_appraise;
  45
  46 #define MAX_LSM_RULES 6
  47 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  48         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  49 };
  50
  51 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  52
  53 struct ima_rule_entry {
  54         struct list_head list;
  55         int action;
  56         unsigned int flags;
  57         enum ima_hooks func;
  58         int mask;
  59         unsigned long fsmagic;
  60         u8 fsuuid[16];
  61         kuid_t uid;
  62         kuid_t fowner;
  63         struct {
  64                 void *rule;     /* LSM file metadata specific */
  65                 void *args_p;   /* audit value */
  66                 int type;       /* audit type */
  67         } lsm[MAX_LSM_RULES];
  68 };
  69
  70 /*
  71  * Without LSM specific knowledge, the default policy can only be
  72  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  73  */
  74
  75 /*
  76  * The minimum rule set to allow for full TCB coverage.  Measures all files
  77  * opened or mmap for exec and everything read by root.  Dangerous because
  78  * normal users can easily run the machine out of memory simply building
  79  * and running executables.
  80  */
  81 static struct ima_rule_entry dont_measure_rules[] = {
  82         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  83         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
  84         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
  85         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
  86         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  87         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
  88         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
  89         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
  90         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
  91          .flags = IMA_FSMAGIC},
  92         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
  93 };
  94
  95 static struct ima_rule_entry original_measurement_rules[] = {
  96         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
  97          .flags = IMA_FUNC | IMA_MASK},
  98         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
  99          .flags = IMA_FUNC | IMA_MASK},
 100         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 101          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 102         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 103         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 104 };
 105
 106 static struct ima_rule_entry default_measurement_rules[] = {
 107         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 108          .flags = IMA_FUNC | IMA_MASK},
 109         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 110          .flags = IMA_FUNC | IMA_MASK},
 111         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 112          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 113         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 114          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 115         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 116         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 117 };
 118
 119 static struct ima_rule_entry default_appraise_rules[] = {
 120         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 121         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 122         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 123         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 124         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 125         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 126         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 127         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 128         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 129         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 130         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 131 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 132         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
 133 #else
 134         /* force signature */
 135         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID,
 136          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 137 #endif
 138 };
 139
 140 static LIST_HEAD(ima_default_rules);
 141 static LIST_HEAD(ima_policy_rules);
 142 static LIST_HEAD(ima_temp_rules);
 143 static struct list_head *ima_rules;
 144
 145 static int ima_policy __initdata;
 146
 147 static int __init default_measure_policy_setup(char *str)
 148 {
 149         if (ima_policy)
 150                 return 1;
 151
 152         ima_policy = ORIGINAL_TCB;
 153         return 1;
 154 }
 155 __setup("ima_tcb", default_measure_policy_setup);
 156
 157 static int __init policy_setup(char *str)
 158 {
 159         if (ima_policy)
 160                 return 1;
 161
 162         if (strcmp(str, "tcb") == 0)
 163                 ima_policy = DEFAULT_TCB;
 164
 165         return 1;
 166 }
 167 __setup("ima_policy=", policy_setup);
 168
 169 static bool ima_use_appraise_tcb __initdata;
 170 static int __init default_appraise_policy_setup(char *str)
 171 {
 172         ima_use_appraise_tcb = 1;
 173         return 1;
 174 }
 175 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 176
 177 /*
 178  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 179  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 180  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
 181  * they don't.
 182  */
 183 static void ima_lsm_update_rules(void)
 184 {
 185         struct ima_rule_entry *entry;
 186         int result;
 187         int i;
 188
 189         list_for_each_entry(entry, &ima_policy_rules, list) {
 190                 for (i = 0; i < MAX_LSM_RULES; i++) {
 191                         if (!entry->lsm[i].rule)
 192                                 continue;
 193                         result = security_filter_rule_init(entry->lsm[i].type,
 194                                                            Audit_equal,
 195                                                            entry->lsm[i].args_p,
 196                                                            &entry->lsm[i].rule);
 197                         BUG_ON(!entry->lsm[i].rule);
 198                 }
 199         }
 200 }
 201
 202 /**
 203  * ima_match_rules - determine whether an inode matches the measure rule.
 204  * @rule: a pointer to a rule
 205  * @inode: a pointer to an inode
 206  * @func: LIM hook identifier
 207  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 208  *
 209  * Returns true on rule match, false on failure.
 210  */
 211 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 212                             enum ima_hooks func, int mask)
 213 {
 214         struct task_struct *tsk = current;
 215         const struct cred *cred = current_cred();
 216         int i;
 217
 218         if ((rule->flags & IMA_FUNC) &&
 219             (rule->func != func && func != POST_SETATTR))
 220                 return false;
 221         if ((rule->flags & IMA_MASK) &&
 222             (rule->mask != mask && func != POST_SETATTR))
 223                 return false;
 224         if ((rule->flags & IMA_INMASK) &&
 225             (!(rule->mask & mask) && func != POST_SETATTR))
 226                 return false;
 227         if ((rule->flags & IMA_FSMAGIC)
 228             && rule->fsmagic != inode->i_sb->s_magic)
 229                 return false;
 230         if ((rule->flags & IMA_FSUUID) &&
 231             memcmp(rule->fsuuid, inode->i_sb->s_uuid, sizeof(rule->fsuuid)))
 232                 return false;
 233         if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
 234                 return false;
 235         if (rule->flags & IMA_EUID) {
 236                 if (has_capability_noaudit(current, CAP_SETUID)) {
 237                         if (!uid_eq(rule->uid, cred->euid)
 238                             && !uid_eq(rule->uid, cred->suid)
 239                             && !uid_eq(rule->uid, cred->uid))
 240                                 return false;
 241                 } else if (!uid_eq(rule->uid, cred->euid))
 242                         return false;
 243         }
 244
 245         if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
 246                 return false;
 247         for (i = 0; i < MAX_LSM_RULES; i++) {
 248                 int rc = 0;
 249                 u32 osid, sid;
 250                 int retried = 0;
 251
 252                 if (!rule->lsm[i].rule)
 253                         continue;
 254 retry:
 255                 switch (i) {
 256                 case LSM_OBJ_USER:
 257                 case LSM_OBJ_ROLE:
 258                 case LSM_OBJ_TYPE:
 259                         security_inode_getsecid(inode, &osid);
 260                         rc = security_filter_rule_match(osid,
 261                                                         rule->lsm[i].type,
 262                                                         Audit_equal,
 263                                                         rule->lsm[i].rule,
 264                                                         NULL);
 265                         break;
 266                 case LSM_SUBJ_USER:
 267                 case LSM_SUBJ_ROLE:
 268                 case LSM_SUBJ_TYPE:
 269                         security_task_getsecid(tsk, &sid);
 270                         rc = security_filter_rule_match(sid,
 271                                                         rule->lsm[i].type,
 272                                                         Audit_equal,
 273                                                         rule->lsm[i].rule,
 274                                                         NULL);
 275                 default:
 276                         break;
 277                 }
 278                 if ((rc < 0) && (!retried)) {
 279                         retried = 1;
 280                         ima_lsm_update_rules();
 281                         goto retry;
 282                 }
 283                 if (!rc)
 284                         return false;
 285         }
 286         return true;
 287 }
 288
 289 /*
 290  * In addition to knowing that we need to appraise the file in general,
 291  * we need to differentiate between calling hooks, for hook specific rules.
 292  */
 293 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
 294 {
 295         if (!(rule->flags & IMA_FUNC))
 296                 return IMA_FILE_APPRAISE;
 297
 298         switch (func) {
 299         case MMAP_CHECK:
 300                 return IMA_MMAP_APPRAISE;
 301         case BPRM_CHECK:
 302                 return IMA_BPRM_APPRAISE;
 303         case MODULE_CHECK:
 304                 return IMA_MODULE_APPRAISE;
 305         case FIRMWARE_CHECK:
 306                 return IMA_FIRMWARE_APPRAISE;
 307         case FILE_CHECK:
 308         default:
 309                 return IMA_FILE_APPRAISE;
 310         }
 311 }
 312
 313 /**
 314  * ima_match_policy - decision based on LSM and other conditions
 315  * @inode: pointer to an inode for which the policy decision is being made
 316  * @func: IMA hook identifier
 317  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 318  *
 319  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 320  * conditions.
 321  *
 322  * Since the IMA policy may be updated multiple times we need to lock the
 323  * list when walking it.  Reads are many orders of magnitude more numerous
 324  * than writes so ima_match_policy() is classical RCU candidate.
 325  */
 326 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
 327                      int flags)
 328 {
 329         struct ima_rule_entry *entry;
 330         int action = 0, actmask = flags | (flags << 1);
 331
 332         rcu_read_lock();
 333         list_for_each_entry_rcu(entry, ima_rules, list) {
 334
 335                 if (!(entry->action & actmask))
 336                         continue;
 337
 338                 if (!ima_match_rules(entry, inode, func, mask))
 339                         continue;
 340
 341                 action |= entry->flags & IMA_ACTION_FLAGS;
 342
 343                 action |= entry->action & IMA_DO_MASK;
 344                 if (entry->action & IMA_APPRAISE)
 345                         action |= get_subaction(entry, func);
 346
 347                 if (entry->action & IMA_DO_MASK)
 348                         actmask &= ~(entry->action | entry->action << 1);
 349                 else
 350                         actmask &= ~(entry->action | entry->action >> 1);
 351
 352                 if (!actmask)
 353                         break;
 354         }
 355         rcu_read_unlock();
 356
 357         return action;
 358 }
 359
 360 /*
 361  * Initialize the ima_policy_flag variable based on the currently
 362  * loaded policy.  Based on this flag, the decision to short circuit
 363  * out of a function or not call the function in the first place
 364  * can be made earlier.
 365  */
 366 void ima_update_policy_flag(void)
 367 {
 368         struct ima_rule_entry *entry;
 369
 370         list_for_each_entry(entry, ima_rules, list) {
 371                 if (entry->action & IMA_DO_MASK)
 372                         ima_policy_flag |= entry->action;
 373         }
 374
 375         ima_appraise |= temp_ima_appraise;
 376         if (!ima_appraise)
 377                 ima_policy_flag &= ~IMA_APPRAISE;
 378 }
 379
 380 /**
 381  * ima_init_policy - initialize the default measure rules.
 382  *
 383  * ima_rules points to either the ima_default_rules or the
 384  * the new ima_policy_rules.
 385  */
 386 void __init ima_init_policy(void)
 387 {
 388         int i, measure_entries, appraise_entries;
 389
 390         /* if !ima_policy set entries = 0 so we load NO default rules */
 391         measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 392         appraise_entries = ima_use_appraise_tcb ?
 393                          ARRAY_SIZE(default_appraise_rules) : 0;
 394
 395         for (i = 0; i < measure_entries; i++)
 396                 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
 397
 398         switch (ima_policy) {
 399         case ORIGINAL_TCB:
 400                 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
 401                         list_add_tail(&original_measurement_rules[i].list,
 402                                       &ima_default_rules);
 403                 break;
 404         case DEFAULT_TCB:
 405                 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
 406                         list_add_tail(&default_measurement_rules[i].list,
 407                                       &ima_default_rules);
 408         default:
 409                 break;
 410         }
 411
 412         for (i = 0; i < appraise_entries; i++) {
 413                 list_add_tail(&default_appraise_rules[i].list,
 414                               &ima_default_rules);
 415         }
 416
 417         ima_rules = &ima_default_rules;
 418 }
 419
 420 /* Make sure we have a valid policy, at least containing some rules. */
 421 int ima_check_policy(void)
 422 {
 423         if (list_empty(&ima_temp_rules))
 424                 return -EINVAL;
 425         return 0;
 426 }
 427
 428 /**
 429  * ima_update_policy - update default_rules with new measure rules
 430  *
 431  * Called on file .release to update the default rules with a complete new
 432  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 433  * they make a queue.  The policy may be updated multiple times and this is the
 434  * RCU updater.
 435  *
 436  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 437  * we switch from the default policy to user defined.
 438  */
 439 void ima_update_policy(void)
 440 {
 441         struct list_head *first, *last, *policy;
 442
 443         /* append current policy with the new rules */
 444         first = (&ima_temp_rules)->next;
 445         last = (&ima_temp_rules)->prev;
 446         policy = &ima_policy_rules;
 447
 448         synchronize_rcu();
 449
 450         last->next = policy;
 451         rcu_assign_pointer(list_next_rcu(policy->prev), first);
 452         first->prev = policy->prev;
 453         policy->prev = last;
 454
 455         /* prepare for the next policy rules addition */
 456         INIT_LIST_HEAD(&ima_temp_rules);
 457
 458         if (ima_rules != policy) {
 459                 ima_policy_flag = 0;
 460                 ima_rules = policy;
 461         }
 462         ima_update_policy_flag();
 463 }
 464
 465 enum {
 466         Opt_err = -1,
 467         Opt_measure = 1, Opt_dont_measure,
 468         Opt_appraise, Opt_dont_appraise,
 469         Opt_audit,
 470         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 471         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 472         Opt_func, Opt_mask, Opt_fsmagic,
 473         Opt_fsuuid, Opt_uid, Opt_euid, Opt_fowner,
 474         Opt_appraise_type, Opt_permit_directio
 475 };
 476
 477 static match_table_t policy_tokens = {
 478         {Opt_measure, "measure"},
 479         {Opt_dont_measure, "dont_measure"},
 480         {Opt_appraise, "appraise"},
 481         {Opt_dont_appraise, "dont_appraise"},
 482         {Opt_audit, "audit"},
 483         {Opt_obj_user, "obj_user=%s"},
 484         {Opt_obj_role, "obj_role=%s"},
 485         {Opt_obj_type, "obj_type=%s"},
 486         {Opt_subj_user, "subj_user=%s"},
 487         {Opt_subj_role, "subj_role=%s"},
 488         {Opt_subj_type, "subj_type=%s"},
 489         {Opt_func, "func=%s"},
 490         {Opt_mask, "mask=%s"},
 491         {Opt_fsmagic, "fsmagic=%s"},
 492         {Opt_fsuuid, "fsuuid=%s"},
 493         {Opt_uid, "uid=%s"},
 494         {Opt_euid, "euid=%s"},
 495         {Opt_fowner, "fowner=%s"},
 496         {Opt_appraise_type, "appraise_type=%s"},
 497         {Opt_permit_directio, "permit_directio"},
 498         {Opt_err, NULL}
 499 };
 500
 501 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 502                              substring_t *args, int lsm_rule, int audit_type)
 503 {
 504         int result;
 505
 506         if (entry->lsm[lsm_rule].rule)
 507                 return -EINVAL;
 508
 509         entry->lsm[lsm_rule].args_p = match_strdup(args);
 510         if (!entry->lsm[lsm_rule].args_p)
 511                 return -ENOMEM;
 512
 513         entry->lsm[lsm_rule].type = audit_type;
 514         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 515                                            Audit_equal,
 516                                            entry->lsm[lsm_rule].args_p,
 517                                            &entry->lsm[lsm_rule].rule);
 518         if (!entry->lsm[lsm_rule].rule) {
 519                 kfree(entry->lsm[lsm_rule].args_p);
 520                 return -EINVAL;
 521         }
 522
 523         return result;
 524 }
 525
 526 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
 527 {
 528         audit_log_format(ab, "%s=", key);
 529         audit_log_untrustedstring(ab, value);
 530         audit_log_format(ab, " ");
 531 }
 532
 533 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 534 {
 535         struct audit_buffer *ab;
 536         char *from;
 537         char *p;
 538         int result = 0;
 539
 540         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
 541
 542         entry->uid = INVALID_UID;
 543         entry->fowner = INVALID_UID;
 544         entry->action = UNKNOWN;
 545         while ((p = strsep(&rule, " \t")) != NULL) {
 546                 substring_t args[MAX_OPT_ARGS];
 547                 int token;
 548                 unsigned long lnum;
 549
 550                 if (result < 0)
 551                         break;
 552                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
 553                         continue;
 554                 token = match_token(p, policy_tokens, args);
 555                 switch (token) {
 556                 case Opt_measure:
 557                         ima_log_string(ab, "action", "measure");
 558
 559                         if (entry->action != UNKNOWN)
 560                                 result = -EINVAL;
 561
 562                         entry->action = MEASURE;
 563                         break;
 564                 case Opt_dont_measure:
 565                         ima_log_string(ab, "action", "dont_measure");
 566
 567                         if (entry->action != UNKNOWN)
 568                                 result = -EINVAL;
 569
 570                         entry->action = DONT_MEASURE;
 571                         break;
 572                 case Opt_appraise:
 573                         ima_log_string(ab, "action", "appraise");
 574
 575                         if (entry->action != UNKNOWN)
 576                                 result = -EINVAL;
 577
 578                         entry->action = APPRAISE;
 579                         break;
 580                 case Opt_dont_appraise:
 581                         ima_log_string(ab, "action", "dont_appraise");
 582
 583                         if (entry->action != UNKNOWN)
 584                                 result = -EINVAL;
 585
 586                         entry->action = DONT_APPRAISE;
 587                         break;
 588                 case Opt_audit:
 589                         ima_log_string(ab, "action", "audit");
 590
 591                         if (entry->action != UNKNOWN)
 592                                 result = -EINVAL;
 593
 594                         entry->action = AUDIT;
 595                         break;
 596                 case Opt_func:
 597                         ima_log_string(ab, "func", args[0].from);
 598
 599                         if (entry->func)
 600                                 result = -EINVAL;
 601
 602                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
 603                                 entry->func = FILE_CHECK;
 604                         /* PATH_CHECK is for backwards compat */
 605                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
 606                                 entry->func = FILE_CHECK;
 607                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
 608                                 entry->func = MODULE_CHECK;
 609                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
 610                                 entry->func = FIRMWARE_CHECK;
 611                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
 612                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
 613                                 entry->func = MMAP_CHECK;
 614                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
 615                                 entry->func = BPRM_CHECK;
 616                         else
 617                                 result = -EINVAL;
 618                         if (!result)
 619                                 entry->flags |= IMA_FUNC;
 620                         break;
 621                 case Opt_mask:
 622                         ima_log_string(ab, "mask", args[0].from);
 623
 624                         if (entry->mask)
 625                                 result = -EINVAL;
 626
 627                         from = args[0].from;
 628                         if (*from == '^')
 629                                 from++;
 630
 631                         if ((strcmp(from, "MAY_EXEC")) == 0)
 632                                 entry->mask = MAY_EXEC;
 633                         else if (strcmp(from, "MAY_WRITE") == 0)
 634                                 entry->mask = MAY_WRITE;
 635                         else if (strcmp(from, "MAY_READ") == 0)
 636                                 entry->mask = MAY_READ;
 637                         else if (strcmp(from, "MAY_APPEND") == 0)
 638                                 entry->mask = MAY_APPEND;
 639                         else
 640                                 result = -EINVAL;
 641                         if (!result)
 642                                 entry->flags |= (*args[0].from == '^')
 643                                      ? IMA_INMASK : IMA_MASK;
 644                         break;
 645                 case Opt_fsmagic:
 646                         ima_log_string(ab, "fsmagic", args[0].from);
 647
 648                         if (entry->fsmagic) {
 649                                 result = -EINVAL;
 650                                 break;
 651                         }
 652
 653                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
 654                         if (!result)
 655                                 entry->flags |= IMA_FSMAGIC;
 656                         break;
 657                 case Opt_fsuuid:
 658                         ima_log_string(ab, "fsuuid", args[0].from);
 659
 660                         if (memchr_inv(entry->fsuuid, 0x00,
 661                                        sizeof(entry->fsuuid))) {
 662                                 result = -EINVAL;
 663                                 break;
 664                         }
 665
 666                         result = blk_part_pack_uuid(args[0].from,
 667                                                     entry->fsuuid);
 668                         if (!result)
 669                                 entry->flags |= IMA_FSUUID;
 670                         break;
 671                 case Opt_uid:
 672                         ima_log_string(ab, "uid", args[0].from);
 673                 case Opt_euid:
 674                         if (token == Opt_euid)
 675                                 ima_log_string(ab, "euid", args[0].from);
 676
 677                         if (uid_valid(entry->uid)) {
 678                                 result = -EINVAL;
 679                                 break;
 680                         }
 681
 682                         result = kstrtoul(args[0].from, 10, &lnum);
 683                         if (!result) {
 684                                 entry->uid = make_kuid(current_user_ns(),
 685                                                        (uid_t) lnum);
 686                                 if (!uid_valid(entry->uid) ||
 687                                     (uid_t)lnum != lnum)
 688                                         result = -EINVAL;
 689                                 else
 690                                         entry->flags |= (token == Opt_uid)
 691                                             ? IMA_UID : IMA_EUID;
 692                         }
 693                         break;
 694                 case Opt_fowner:
 695                         ima_log_string(ab, "fowner", args[0].from);
 696
 697                         if (uid_valid(entry->fowner)) {
 698                                 result = -EINVAL;
 699                                 break;
 700                         }
 701
 702                         result = kstrtoul(args[0].from, 10, &lnum);
 703                         if (!result) {
 704                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
 705                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
 706                                         result = -EINVAL;
 707                                 else
 708                                         entry->flags |= IMA_FOWNER;
 709                         }
 710                         break;
 711                 case Opt_obj_user:
 712                         ima_log_string(ab, "obj_user", args[0].from);
 713                         result = ima_lsm_rule_init(entry, args,
 714                                                    LSM_OBJ_USER,
 715                                                    AUDIT_OBJ_USER);
 716                         break;
 717                 case Opt_obj_role:
 718                         ima_log_string(ab, "obj_role", args[0].from);
 719                         result = ima_lsm_rule_init(entry, args,
 720                                                    LSM_OBJ_ROLE,
 721                                                    AUDIT_OBJ_ROLE);
 722                         break;
 723                 case Opt_obj_type:
 724                         ima_log_string(ab, "obj_type", args[0].from);
 725                         result = ima_lsm_rule_init(entry, args,
 726                                                    LSM_OBJ_TYPE,
 727                                                    AUDIT_OBJ_TYPE);
 728                         break;
 729                 case Opt_subj_user:
 730                         ima_log_string(ab, "subj_user", args[0].from);
 731                         result = ima_lsm_rule_init(entry, args,
 732                                                    LSM_SUBJ_USER,
 733                                                    AUDIT_SUBJ_USER);
 734                         break;
 735                 case Opt_subj_role:
 736                         ima_log_string(ab, "subj_role", args[0].from);
 737                         result = ima_lsm_rule_init(entry, args,
 738                                                    LSM_SUBJ_ROLE,
 739                                                    AUDIT_SUBJ_ROLE);
 740                         break;
 741                 case Opt_subj_type:
 742                         ima_log_string(ab, "subj_type", args[0].from);
 743                         result = ima_lsm_rule_init(entry, args,
 744                                                    LSM_SUBJ_TYPE,
 745                                                    AUDIT_SUBJ_TYPE);
 746                         break;
 747                 case Opt_appraise_type:
 748                         if (entry->action != APPRAISE) {
 749                                 result = -EINVAL;
 750                                 break;
 751                         }
 752
 753                         ima_log_string(ab, "appraise_type", args[0].from);
 754                         if ((strcmp(args[0].from, "imasig")) == 0)
 755                                 entry->flags |= IMA_DIGSIG_REQUIRED;
 756                         else
 757                                 result = -EINVAL;
 758                         break;
 759                 case Opt_permit_directio:
 760                         entry->flags |= IMA_PERMIT_DIRECTIO;
 761                         break;
 762                 case Opt_err:
 763                         ima_log_string(ab, "UNKNOWN", p);
 764                         result = -EINVAL;
 765                         break;
 766                 }
 767         }
 768         if (!result && (entry->action == UNKNOWN))
 769                 result = -EINVAL;
 770         else if (entry->func == MODULE_CHECK)
 771                 temp_ima_appraise |= IMA_APPRAISE_MODULES;
 772         else if (entry->func == FIRMWARE_CHECK)
 773                 temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
 774         audit_log_format(ab, "res=%d", !result);
 775         audit_log_end(ab);
 776         return result;
 777 }
 778
 779 /**
 780  * ima_parse_add_rule - add a rule to ima_policy_rules
 781  * @rule - ima measurement policy rule
 782  *
 783  * Avoid locking by allowing just one writer at a time in ima_write_policy()
 784  * Returns the length of the rule parsed, an error code on failure
 785  */
 786 ssize_t ima_parse_add_rule(char *rule)
 787 {
 788         static const char op[] = "update_policy";
 789         char *p;
 790         struct ima_rule_entry *entry;
 791         ssize_t result, len;
 792         int audit_info = 0;
 793
 794         p = strsep(&rule, "\n");
 795         len = strlen(p) + 1;
 796         p += strspn(p, " \t");
 797
 798         if (*p == '#' || *p == '\0')
 799                 return len;
 800
 801         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 802         if (!entry) {
 803                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 804                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
 805                 return -ENOMEM;
 806         }
 807
 808         INIT_LIST_HEAD(&entry->list);
 809
 810         result = ima_parse_rule(p, entry);
 811         if (result) {
 812                 kfree(entry);
 813                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 814                                     NULL, op, "invalid-policy", result,
 815                                     audit_info);
 816                 return result;
 817         }
 818
 819         list_add_tail(&entry->list, &ima_temp_rules);
 820
 821         return len;
 822 }
 823
 824 /**
 825  * ima_delete_rules() called to cleanup invalid in-flight policy.
 826  * We don't need locking as we operate on the temp list, which is
 827  * different from the active one.  There is also only one user of
 828  * ima_delete_rules() at a time.
 829  */
 830 void ima_delete_rules(void)
 831 {
 832         struct ima_rule_entry *entry, *tmp;
 833         int i;
 834
 835         temp_ima_appraise = 0;
 836         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
 837                 for (i = 0; i < MAX_LSM_RULES; i++)
 838                         kfree(entry->lsm[i].args_p);
 839
 840                 list_del(&entry->list);
 841                 kfree(entry);
 842         }
 843 }
 844
 845 #ifdef  CONFIG_IMA_READ_POLICY
 846 enum {
 847         mask_exec = 0, mask_write, mask_read, mask_append
 848 };
 849
 850 static char *mask_tokens[] = {
 851         "MAY_EXEC",
 852         "MAY_WRITE",
 853         "MAY_READ",
 854         "MAY_APPEND"
 855 };
 856
 857 enum {
 858         func_file = 0, func_mmap, func_bprm,
 859         func_module, func_firmware, func_post
 860 };
 861
 862 static char *func_tokens[] = {
 863         "FILE_CHECK",
 864         "MMAP_CHECK",
 865         "BPRM_CHECK",
 866         "MODULE_CHECK",
 867         "FIRMWARE_CHECK",
 868         "POST_SETATTR"
 869 };
 870
 871 void *ima_policy_start(struct seq_file *m, loff_t *pos)
 872 {
 873         loff_t l = *pos;
 874         struct ima_rule_entry *entry;
 875
 876         rcu_read_lock();
 877         list_for_each_entry_rcu(entry, ima_rules, list) {
 878                 if (!l--) {
 879                         rcu_read_unlock();
 880                         return entry;
 881                 }
 882         }
 883         rcu_read_unlock();
 884         return NULL;
 885 }
 886
 887 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
 888 {
 889         struct ima_rule_entry *entry = v;
 890
 891         rcu_read_lock();
 892         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
 893         rcu_read_unlock();
 894         (*pos)++;
 895
 896         return (&entry->list == ima_rules) ? NULL : entry;
 897 }
 898
 899 void ima_policy_stop(struct seq_file *m, void *v)
 900 {
 901 }
 902
 903 #define pt(token)       policy_tokens[token + Opt_err].pattern
 904 #define mt(token)       mask_tokens[token]
 905 #define ft(token)       func_tokens[token]
 906
 907 /*
 908  * policy_func_show - display the ima_hooks policy rule
 909  */
 910 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
 911 {
 912         char tbuf[64] = {0,};
 913
 914         switch (func) {
 915         case FILE_CHECK:
 916                 seq_printf(m, pt(Opt_func), ft(func_file));
 917                 break;
 918         case MMAP_CHECK:
 919                 seq_printf(m, pt(Opt_func), ft(func_mmap));
 920                 break;
 921         case BPRM_CHECK:
 922                 seq_printf(m, pt(Opt_func), ft(func_bprm));
 923                 break;
 924         case MODULE_CHECK:
 925                 seq_printf(m, pt(Opt_func), ft(func_module));
 926                 break;
 927         case FIRMWARE_CHECK:
 928                 seq_printf(m, pt(Opt_func), ft(func_firmware));
 929                 break;
 930         case POST_SETATTR:
 931                 seq_printf(m, pt(Opt_func), ft(func_post));
 932                 break;
 933         default:
 934                 snprintf(tbuf, sizeof(tbuf), "%d", func);
 935                 seq_printf(m, pt(Opt_func), tbuf);
 936                 break;
 937         }
 938         seq_puts(m, " ");
 939 }
 940
 941 int ima_policy_show(struct seq_file *m, void *v)
 942 {
 943         struct ima_rule_entry *entry = v;
 944         int i = 0;
 945         char tbuf[64] = {0,};
 946
 947         rcu_read_lock();
 948
 949         if (entry->action & MEASURE)
 950                 seq_puts(m, pt(Opt_measure));
 951         if (entry->action & DONT_MEASURE)
 952                 seq_puts(m, pt(Opt_dont_measure));
 953         if (entry->action & APPRAISE)
 954                 seq_puts(m, pt(Opt_appraise));
 955         if (entry->action & DONT_APPRAISE)
 956                 seq_puts(m, pt(Opt_dont_appraise));
 957         if (entry->action & AUDIT)
 958                 seq_puts(m, pt(Opt_audit));
 959
 960         seq_puts(m, " ");
 961
 962         if (entry->flags & IMA_FUNC)
 963                 policy_func_show(m, entry->func);
 964
 965         if (entry->flags & IMA_MASK) {
 966                 if (entry->mask & MAY_EXEC)
 967                         seq_printf(m, pt(Opt_mask), mt(mask_exec));
 968                 if (entry->mask & MAY_WRITE)
 969                         seq_printf(m, pt(Opt_mask), mt(mask_write));
 970                 if (entry->mask & MAY_READ)
 971                         seq_printf(m, pt(Opt_mask), mt(mask_read));
 972                 if (entry->mask & MAY_APPEND)
 973                         seq_printf(m, pt(Opt_mask), mt(mask_append));
 974                 seq_puts(m, " ");
 975         }
 976
 977         if (entry->flags & IMA_FSMAGIC) {
 978                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
 979                 seq_printf(m, pt(Opt_fsmagic), tbuf);
 980                 seq_puts(m, " ");
 981         }
 982
 983         if (entry->flags & IMA_FSUUID) {
 984                 seq_puts(m, "fsuuid=");
 985                 for (i = 0; i < ARRAY_SIZE(entry->fsuuid); ++i) {
 986                         switch (i) {
 987                         case 4:
 988                         case 6:
 989                         case 8:
 990                         case 10:
 991                                 seq_puts(m, "-");
 992                         }
 993                         seq_printf(m, "%x", entry->fsuuid[i]);
 994                 }
 995                 seq_puts(m, " ");
 996         }
 997
 998         if (entry->flags & IMA_UID) {
 999                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1000                 seq_printf(m, pt(Opt_uid), tbuf);
1001                 seq_puts(m, " ");
1002         }
1003
1004         if (entry->flags & IMA_EUID) {
1005                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1006                 seq_printf(m, pt(Opt_euid), tbuf);
1007                 seq_puts(m, " ");
1008         }
1009
1010         if (entry->flags & IMA_FOWNER) {
1011                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1012                 seq_printf(m, pt(Opt_fowner), tbuf);
1013                 seq_puts(m, " ");
1014         }
1015
1016         for (i = 0; i < MAX_LSM_RULES; i++) {
1017                 if (entry->lsm[i].rule) {
1018                         switch (i) {
1019                         case LSM_OBJ_USER:
1020                                 seq_printf(m, pt(Opt_obj_user),
1021                                            (char *)entry->lsm[i].args_p);
1022                                 break;
1023                         case LSM_OBJ_ROLE:
1024                                 seq_printf(m, pt(Opt_obj_role),
1025                                            (char *)entry->lsm[i].args_p);
1026                                 break;
1027                         case LSM_OBJ_TYPE:
1028                                 seq_printf(m, pt(Opt_obj_type),
1029                                            (char *)entry->lsm[i].args_p);
1030                                 break;
1031                         case LSM_SUBJ_USER:
1032                                 seq_printf(m, pt(Opt_subj_user),
1033                                            (char *)entry->lsm[i].args_p);
1034                                 break;
1035                         case LSM_SUBJ_ROLE:
1036                                 seq_printf(m, pt(Opt_subj_role),
1037                                            (char *)entry->lsm[i].args_p);
1038                                 break;
1039                         case LSM_SUBJ_TYPE:
1040                                 seq_printf(m, pt(Opt_subj_type),
1041                                            (char *)entry->lsm[i].args_p);
1042                                 break;
1043                         }
1044                 }
1045         }
1046         if (entry->flags & IMA_DIGSIG_REQUIRED)
1047                 seq_puts(m, "appraise_type=imasig ");
1048         if (entry->flags & IMA_PERMIT_DIRECTIO)
1049                 seq_puts(m, "permit_directio ");
1050         rcu_read_unlock();
1051         seq_puts(m, "\n");
1052         return 0;
1053 }
1054 #endif  /* CONFIG_IMA_READ_POLICY */