security/integrity/ima/ima_policy.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (C) 2008 IBM Corporation
   4  * Author: Mimi Zohar <zohar@us.ibm.com>
   5  *
   6  * ima_policy.c
   7  *      - initialize default measure policy rules
   8  */
   9
  10 #include <linux/init.h>
  11 #include <linux/list.h>
  12 #include <linux/kernel_read_file.h>
  13 #include <linux/fs.h>
  14 #include <linux/security.h>
  15 #include <linux/magic.h>
  16 #include <linux/parser.h>
  17 #include <linux/slab.h>
  18 #include <linux/rculist.h>
  19 #include <linux/genhd.h>
  20 #include <linux/seq_file.h>
  21 #include <linux/ima.h>
  22
  23 #include "ima.h"
  24
  25 /* flags definitions */
  26 #define IMA_FUNC        0x0001
  27 #define IMA_MASK        0x0002
  28 #define IMA_FSMAGIC     0x0004
  29 #define IMA_UID         0x0008
  30 #define IMA_FOWNER      0x0010
  31 #define IMA_FSUUID      0x0020
  32 #define IMA_INMASK      0x0040
  33 #define IMA_EUID        0x0080
  34 #define IMA_PCR         0x0100
  35 #define IMA_FSNAME      0x0200
  36 #define IMA_KEYRINGS    0x0400
  37 #define IMA_LABEL       0x0800
  38
  39 #define UNKNOWN         0
  40 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  41 #define DONT_MEASURE    0x0002
  42 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  43 #define DONT_APPRAISE   0x0008
  44 #define AUDIT           0x0040
  45 #define HASH            0x0100
  46 #define DONT_HASH       0x0200
  47
  48 #define INVALID_PCR(a) (((a) < 0) || \
  49         (a) >= (sizeof_field(struct integrity_iint_cache, measured_pcrs) * 8))
  50
  51 int ima_policy_flag;
  52 static int temp_ima_appraise;
  53 static int build_ima_appraise __ro_after_init;
  54
  55 #define MAX_LSM_RULES 6
  56 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  57         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  58 };
  59
  60 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  61
  62 enum policy_rule_list { IMA_DEFAULT_POLICY = 1, IMA_CUSTOM_POLICY };
  63
  64 struct ima_rule_opt_list {
  65         size_t count;
  66         char *items[];
  67 };
  68
  69 struct ima_rule_entry {
  70         struct list_head list;
  71         int action;
  72         unsigned int flags;
  73         enum ima_hooks func;
  74         int mask;
  75         unsigned long fsmagic;
  76         uuid_t fsuuid;
  77         kuid_t uid;
  78         kuid_t fowner;
  79         bool (*uid_op)(kuid_t, kuid_t);    /* Handlers for operators       */
  80         bool (*fowner_op)(kuid_t, kuid_t); /* uid_eq(), uid_gt(), uid_lt() */
  81         int pcr;
  82         struct {
  83                 void *rule;     /* LSM file metadata specific */
  84                 char *args_p;   /* audit value */
  85                 int type;       /* audit type */
  86         } lsm[MAX_LSM_RULES];
  87         char *fsname;
  88         struct ima_rule_opt_list *keyrings; /* Measure keys added to these keyrings */
  89         struct ima_rule_opt_list *label; /* Measure data grouped under this label */
  90         struct ima_template_desc *template;
  91 };
  92
  93 /*
  94  * Without LSM specific knowledge, the default policy can only be
  95  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  96  */
  97
  98 /*
  99  * The minimum rule set to allow for full TCB coverage.  Measures all files
 100  * opened or mmap for exec and everything read by root.  Dangerous because
 101  * normal users can easily run the machine out of memory simply building
 102  * and running executables.
 103  */
 104 static struct ima_rule_entry dont_measure_rules[] __ro_after_init = {
 105         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 106         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 107         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 108         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 109         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 110         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 111         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 112         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 113         {.action = DONT_MEASURE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
 114         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
 115          .flags = IMA_FSMAGIC},
 116         {.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC,
 117          .flags = IMA_FSMAGIC},
 118         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 119         {.action = DONT_MEASURE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC}
 120 };
 121
 122 static struct ima_rule_entry original_measurement_rules[] __ro_after_init = {
 123         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 124          .flags = IMA_FUNC | IMA_MASK},
 125         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 126          .flags = IMA_FUNC | IMA_MASK},
 127         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 128          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 129          .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 130         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 131         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 132 };
 133
 134 static struct ima_rule_entry default_measurement_rules[] __ro_after_init = {
 135         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 136          .flags = IMA_FUNC | IMA_MASK},
 137         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 138          .flags = IMA_FUNC | IMA_MASK},
 139         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 140          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 141          .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 142         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 143          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 144          .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 145         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 146         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 147         {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
 148 };
 149
 150 static struct ima_rule_entry default_appraise_rules[] __ro_after_init = {
 151         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 152         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 153         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 154         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 155         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 156         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 157         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 158         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 159         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 160         {.action = DONT_APPRAISE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
 161         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 162         {.action = DONT_APPRAISE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC},
 163         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 164         {.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 165 #ifdef CONFIG_IMA_WRITE_POLICY
 166         {.action = APPRAISE, .func = POLICY_CHECK,
 167         .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 168 #endif
 169 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 170         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
 171          .flags = IMA_FOWNER},
 172 #else
 173         /* force signature */
 174         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
 175          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 176 #endif
 177 };
 178
 179 static struct ima_rule_entry build_appraise_rules[] __ro_after_init = {
 180 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS
 181         {.action = APPRAISE, .func = MODULE_CHECK,
 182          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 183 #endif
 184 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS
 185         {.action = APPRAISE, .func = FIRMWARE_CHECK,
 186          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 187 #endif
 188 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS
 189         {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
 190          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 191 #endif
 192 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS
 193         {.action = APPRAISE, .func = POLICY_CHECK,
 194          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 195 #endif
 196 };
 197
 198 static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
 199         {.action = APPRAISE, .func = MODULE_CHECK,
 200          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 201         {.action = APPRAISE, .func = FIRMWARE_CHECK,
 202          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 203         {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
 204          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 205         {.action = APPRAISE, .func = POLICY_CHECK,
 206          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 207 };
 208
 209 /* An array of architecture specific rules */
 210 static struct ima_rule_entry *arch_policy_entry __ro_after_init;
 211
 212 static LIST_HEAD(ima_default_rules);
 213 static LIST_HEAD(ima_policy_rules);
 214 static LIST_HEAD(ima_temp_rules);
 215 static struct list_head *ima_rules = &ima_default_rules;
 216
 217 static int ima_policy __initdata;
 218
 219 static int __init default_measure_policy_setup(char *str)
 220 {
 221         if (ima_policy)
 222                 return 1;
 223
 224         ima_policy = ORIGINAL_TCB;
 225         return 1;
 226 }
 227 __setup("ima_tcb", default_measure_policy_setup);
 228
 229 static bool ima_use_appraise_tcb __initdata;
 230 static bool ima_use_secure_boot __initdata;
 231 static bool ima_fail_unverifiable_sigs __ro_after_init;
 232 static int __init policy_setup(char *str)
 233 {
 234         char *p;
 235
 236         while ((p = strsep(&str, " |\n")) != NULL) {
 237                 if (*p == ' ')
 238                         continue;
 239                 if ((strcmp(p, "tcb") == 0) && !ima_policy)
 240                         ima_policy = DEFAULT_TCB;
 241                 else if (strcmp(p, "appraise_tcb") == 0)
 242                         ima_use_appraise_tcb = true;
 243                 else if (strcmp(p, "secure_boot") == 0)
 244                         ima_use_secure_boot = true;
 245                 else if (strcmp(p, "fail_securely") == 0)
 246                         ima_fail_unverifiable_sigs = true;
 247                 else
 248                         pr_err("policy \"%s\" not found", p);
 249         }
 250
 251         return 1;
 252 }
 253 __setup("ima_policy=", policy_setup);
 254
 255 static int __init default_appraise_policy_setup(char *str)
 256 {
 257         ima_use_appraise_tcb = true;
 258         return 1;
 259 }
 260 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 261
 262 static struct ima_rule_opt_list *ima_alloc_rule_opt_list(const substring_t *src)
 263 {
 264         struct ima_rule_opt_list *opt_list;
 265         size_t count = 0;
 266         char *src_copy;
 267         char *cur, *next;
 268         size_t i;
 269
 270         src_copy = match_strdup(src);
 271         if (!src_copy)
 272                 return ERR_PTR(-ENOMEM);
 273
 274         next = src_copy;
 275         while ((cur = strsep(&next, "|"))) {
 276                 /* Don't accept an empty list item */
 277                 if (!(*cur)) {
 278                         kfree(src_copy);
 279                         return ERR_PTR(-EINVAL);
 280                 }
 281                 count++;
 282         }
 283
 284         /* Don't accept an empty list */
 285         if (!count) {
 286                 kfree(src_copy);
 287                 return ERR_PTR(-EINVAL);
 288         }
 289
 290         opt_list = kzalloc(struct_size(opt_list, items, count), GFP_KERNEL);
 291         if (!opt_list) {
 292                 kfree(src_copy);
 293                 return ERR_PTR(-ENOMEM);
 294         }
 295
 296         /*
 297          * strsep() has already replaced all instances of '|' with '\0',
 298          * leaving a byte sequence of NUL-terminated strings. Reference each
 299          * string with the array of items.
 300          *
 301          * IMPORTANT: Ownership of the allocated buffer is transferred from
 302          * src_copy to the first element in the items array. To free the
 303          * buffer, kfree() must only be called on the first element of the
 304          * array.
 305          */
 306         for (i = 0, cur = src_copy; i < count; i++) {
 307                 opt_list->items[i] = cur;
 308                 cur = strchr(cur, '\0') + 1;
 309         }
 310         opt_list->count = count;
 311
 312         return opt_list;
 313 }
 314
 315 static void ima_free_rule_opt_list(struct ima_rule_opt_list *opt_list)
 316 {
 317         if (!opt_list)
 318                 return;
 319
 320         if (opt_list->count) {
 321                 kfree(opt_list->items[0]);
 322                 opt_list->count = 0;
 323         }
 324
 325         kfree(opt_list);
 326 }
 327
 328 static void ima_lsm_free_rule(struct ima_rule_entry *entry)
 329 {
 330         int i;
 331
 332         for (i = 0; i < MAX_LSM_RULES; i++) {
 333                 ima_filter_rule_free(entry->lsm[i].rule);
 334                 kfree(entry->lsm[i].args_p);
 335         }
 336 }
 337
 338 static void ima_free_rule(struct ima_rule_entry *entry)
 339 {
 340         if (!entry)
 341                 return;
 342
 343         /*
 344          * entry->template->fields may be allocated in ima_parse_rule() but that
 345          * reference is owned by the corresponding ima_template_desc element in
 346          * the defined_templates list and cannot be freed here
 347          */
 348         kfree(entry->fsname);
 349         ima_free_rule_opt_list(entry->keyrings);
 350         ima_lsm_free_rule(entry);
 351         kfree(entry);
 352 }
 353
 354 static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry)
 355 {
 356         struct ima_rule_entry *nentry;
 357         int i;
 358
 359         /*
 360          * Immutable elements are copied over as pointers and data; only
 361          * lsm rules can change
 362          */
 363         nentry = kmemdup(entry, sizeof(*nentry), GFP_KERNEL);
 364         if (!nentry)
 365                 return NULL;
 366
 367         memset(nentry->lsm, 0, sizeof_field(struct ima_rule_entry, lsm));
 368
 369         for (i = 0; i < MAX_LSM_RULES; i++) {
 370                 if (!entry->lsm[i].args_p)
 371                         continue;
 372
 373                 nentry->lsm[i].type = entry->lsm[i].type;
 374                 nentry->lsm[i].args_p = entry->lsm[i].args_p;
 375                 /*
 376                  * Remove the reference from entry so that the associated
 377                  * memory will not be freed during a later call to
 378                  * ima_lsm_free_rule(entry).
 379                  */
 380                 entry->lsm[i].args_p = NULL;
 381
 382                 ima_filter_rule_init(nentry->lsm[i].type, Audit_equal,
 383                                      nentry->lsm[i].args_p,
 384                                      &nentry->lsm[i].rule);
 385                 if (!nentry->lsm[i].rule)
 386                         pr_warn("rule for LSM \'%s\' is undefined\n",
 387                                 nentry->lsm[i].args_p);
 388         }
 389         return nentry;
 390 }
 391
 392 static int ima_lsm_update_rule(struct ima_rule_entry *entry)
 393 {
 394         struct ima_rule_entry *nentry;
 395
 396         nentry = ima_lsm_copy_rule(entry);
 397         if (!nentry)
 398                 return -ENOMEM;
 399
 400         list_replace_rcu(&entry->list, &nentry->list);
 401         synchronize_rcu();
 402         /*
 403          * ima_lsm_copy_rule() shallow copied all references, except for the
 404          * LSM references, from entry to nentry so we only want to free the LSM
 405          * references and the entry itself. All other memory refrences will now
 406          * be owned by nentry.
 407          */
 408         ima_lsm_free_rule(entry);
 409         kfree(entry);
 410
 411         return 0;
 412 }
 413
 414 static bool ima_rule_contains_lsm_cond(struct ima_rule_entry *entry)
 415 {
 416         int i;
 417
 418         for (i = 0; i < MAX_LSM_RULES; i++)
 419                 if (entry->lsm[i].args_p)
 420                         return true;
 421
 422         return false;
 423 }
 424
 425 /*
 426  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 427  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 428  * the reloaded LSM policy.
 429  */
 430 static void ima_lsm_update_rules(void)
 431 {
 432         struct ima_rule_entry *entry, *e;
 433         int result;
 434
 435         list_for_each_entry_safe(entry, e, &ima_policy_rules, list) {
 436                 if (!ima_rule_contains_lsm_cond(entry))
 437                         continue;
 438
 439                 result = ima_lsm_update_rule(entry);
 440                 if (result) {
 441                         pr_err("lsm rule update error %d\n", result);
 442                         return;
 443                 }
 444         }
 445 }
 446
 447 int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
 448                           void *lsm_data)
 449 {
 450         if (event != LSM_POLICY_CHANGE)
 451                 return NOTIFY_DONE;
 452
 453         ima_lsm_update_rules();
 454         return NOTIFY_OK;
 455 }
 456
 457 /**
 458  * ima_match_rule_data - determine whether func_data matches the policy rule
 459  * @rule: a pointer to a rule
 460  * @func_data: data to match against the measure rule data
 461  * @cred: a pointer to a credentials structure for user validation
 462  *
 463  * Returns true if func_data matches one in the rule, false otherwise.
 464  */
 465 static bool ima_match_rule_data(struct ima_rule_entry *rule,
 466                                 const char *func_data,
 467                                 const struct cred *cred)
 468 {
 469         const struct ima_rule_opt_list *opt_list = NULL;
 470         bool matched = false;
 471         size_t i;
 472
 473         if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
 474                 return false;
 475
 476         switch (rule->func) {
 477         case KEY_CHECK:
 478                 if (!rule->keyrings)
 479                         return true;
 480
 481                 opt_list = rule->keyrings;
 482                 break;
 483         case CRITICAL_DATA:
 484                 if (!rule->label)
 485                         return true;
 486
 487                 opt_list = rule->label;
 488                 break;
 489         default:
 490                 return false;
 491         }
 492
 493         if (!func_data)
 494                 return false;
 495
 496         for (i = 0; i < opt_list->count; i++) {
 497                 if (!strcmp(opt_list->items[i], func_data)) {
 498                         matched = true;
 499                         break;
 500                 }
 501         }
 502
 503         return matched;
 504 }
 505
 506 /**
 507  * ima_match_rules - determine whether an inode matches the policy rule.
 508  * @rule: a pointer to a rule
 509  * @inode: a pointer to an inode
 510  * @cred: a pointer to a credentials structure for user validation
 511  * @secid: the secid of the task to be validated
 512  * @func: LIM hook identifier
 513  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 514  * @func_data: func specific data, may be NULL
 515  *
 516  * Returns true on rule match, false on failure.
 517  */
 518 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 519                             const struct cred *cred, u32 secid,
 520                             enum ima_hooks func, int mask,
 521                             const char *func_data)
 522 {
 523         int i;
 524
 525         if ((rule->flags & IMA_FUNC) &&
 526             (rule->func != func && func != POST_SETATTR))
 527                 return false;
 528
 529         switch (func) {
 530         case KEY_CHECK:
 531         case CRITICAL_DATA:
 532                 return ((rule->func == func) &&
 533                         ima_match_rule_data(rule, func_data, cred));
 534         default:
 535                 break;
 536         }
 537
 538         if ((rule->flags & IMA_MASK) &&
 539             (rule->mask != mask && func != POST_SETATTR))
 540                 return false;
 541         if ((rule->flags & IMA_INMASK) &&
 542             (!(rule->mask & mask) && func != POST_SETATTR))
 543                 return false;
 544         if ((rule->flags & IMA_FSMAGIC)
 545             && rule->fsmagic != inode->i_sb->s_magic)
 546                 return false;
 547         if ((rule->flags & IMA_FSNAME)
 548             && strcmp(rule->fsname, inode->i_sb->s_type->name))
 549                 return false;
 550         if ((rule->flags & IMA_FSUUID) &&
 551             !uuid_equal(&rule->fsuuid, &inode->i_sb->s_uuid))
 552                 return false;
 553         if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
 554                 return false;
 555         if (rule->flags & IMA_EUID) {
 556                 if (has_capability_noaudit(current, CAP_SETUID)) {
 557                         if (!rule->uid_op(cred->euid, rule->uid)
 558                             && !rule->uid_op(cred->suid, rule->uid)
 559                             && !rule->uid_op(cred->uid, rule->uid))
 560                                 return false;
 561                 } else if (!rule->uid_op(cred->euid, rule->uid))
 562                         return false;
 563         }
 564
 565         if ((rule->flags & IMA_FOWNER) &&
 566             !rule->fowner_op(inode->i_uid, rule->fowner))
 567                 return false;
 568         for (i = 0; i < MAX_LSM_RULES; i++) {
 569                 int rc = 0;
 570                 u32 osid;
 571
 572                 if (!rule->lsm[i].rule) {
 573                         if (!rule->lsm[i].args_p)
 574                                 continue;
 575                         else
 576                                 return false;
 577                 }
 578                 switch (i) {
 579                 case LSM_OBJ_USER:
 580                 case LSM_OBJ_ROLE:
 581                 case LSM_OBJ_TYPE:
 582                         security_inode_getsecid(inode, &osid);
 583                         rc = ima_filter_rule_match(osid, rule->lsm[i].type,
 584                                                    Audit_equal,
 585                                                    rule->lsm[i].rule);
 586                         break;
 587                 case LSM_SUBJ_USER:
 588                 case LSM_SUBJ_ROLE:
 589                 case LSM_SUBJ_TYPE:
 590                         rc = ima_filter_rule_match(secid, rule->lsm[i].type,
 591                                                    Audit_equal,
 592                                                    rule->lsm[i].rule);
 593                 default:
 594                         break;
 595                 }
 596                 if (!rc)
 597                         return false;
 598         }
 599         return true;
 600 }
 601
 602 /*
 603  * In addition to knowing that we need to appraise the file in general,
 604  * we need to differentiate between calling hooks, for hook specific rules.
 605  */
 606 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
 607 {
 608         if (!(rule->flags & IMA_FUNC))
 609                 return IMA_FILE_APPRAISE;
 610
 611         switch (func) {
 612         case MMAP_CHECK:
 613                 return IMA_MMAP_APPRAISE;
 614         case BPRM_CHECK:
 615                 return IMA_BPRM_APPRAISE;
 616         case CREDS_CHECK:
 617                 return IMA_CREDS_APPRAISE;
 618         case FILE_CHECK:
 619         case POST_SETATTR:
 620                 return IMA_FILE_APPRAISE;
 621         case MODULE_CHECK ... MAX_CHECK - 1:
 622         default:
 623                 return IMA_READ_APPRAISE;
 624         }
 625 }
 626
 627 /**
 628  * ima_match_policy - decision based on LSM and other conditions
 629  * @inode: pointer to an inode for which the policy decision is being made
 630  * @cred: pointer to a credentials structure for which the policy decision is
 631  *        being made
 632  * @secid: LSM secid of the task to be validated
 633  * @func: IMA hook identifier
 634  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 635  * @pcr: set the pcr to extend
 636  * @template_desc: the template that should be used for this rule
 637  * @func_data: func specific data, may be NULL
 638  *
 639  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 640  * conditions.
 641  *
 642  * Since the IMA policy may be updated multiple times we need to lock the
 643  * list when walking it.  Reads are many orders of magnitude more numerous
 644  * than writes so ima_match_policy() is classical RCU candidate.
 645  */
 646 int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
 647                      enum ima_hooks func, int mask, int flags, int *pcr,
 648                      struct ima_template_desc **template_desc,
 649                      const char *func_data)
 650 {
 651         struct ima_rule_entry *entry;
 652         int action = 0, actmask = flags | (flags << 1);
 653
 654         if (template_desc && !*template_desc)
 655                 *template_desc = ima_template_desc_current();
 656
 657         rcu_read_lock();
 658         list_for_each_entry_rcu(entry, ima_rules, list) {
 659
 660                 if (!(entry->action & actmask))
 661                         continue;
 662
 663                 if (!ima_match_rules(entry, inode, cred, secid, func, mask,
 664                                      func_data))
 665                         continue;
 666
 667                 action |= entry->flags & IMA_ACTION_FLAGS;
 668
 669                 action |= entry->action & IMA_DO_MASK;
 670                 if (entry->action & IMA_APPRAISE) {
 671                         action |= get_subaction(entry, func);
 672                         action &= ~IMA_HASH;
 673                         if (ima_fail_unverifiable_sigs)
 674                                 action |= IMA_FAIL_UNVERIFIABLE_SIGS;
 675                 }
 676
 677
 678                 if (entry->action & IMA_DO_MASK)
 679                         actmask &= ~(entry->action | entry->action << 1);
 680                 else
 681                         actmask &= ~(entry->action | entry->action >> 1);
 682
 683                 if ((pcr) && (entry->flags & IMA_PCR))
 684                         *pcr = entry->pcr;
 685
 686                 if (template_desc && entry->template)
 687                         *template_desc = entry->template;
 688
 689                 if (!actmask)
 690                         break;
 691         }
 692         rcu_read_unlock();
 693
 694         return action;
 695 }
 696
 697 /*
 698  * Initialize the ima_policy_flag variable based on the currently
 699  * loaded policy.  Based on this flag, the decision to short circuit
 700  * out of a function or not call the function in the first place
 701  * can be made earlier.
 702  */
 703 void ima_update_policy_flag(void)
 704 {
 705         struct ima_rule_entry *entry;
 706
 707         list_for_each_entry(entry, ima_rules, list) {
 708                 if (entry->action & IMA_DO_MASK)
 709                         ima_policy_flag |= entry->action;
 710         }
 711
 712         ima_appraise |= (build_ima_appraise | temp_ima_appraise);
 713         if (!ima_appraise)
 714                 ima_policy_flag &= ~IMA_APPRAISE;
 715 }
 716
 717 static int ima_appraise_flag(enum ima_hooks func)
 718 {
 719         if (func == MODULE_CHECK)
 720                 return IMA_APPRAISE_MODULES;
 721         else if (func == FIRMWARE_CHECK)
 722                 return IMA_APPRAISE_FIRMWARE;
 723         else if (func == POLICY_CHECK)
 724                 return IMA_APPRAISE_POLICY;
 725         else if (func == KEXEC_KERNEL_CHECK)
 726                 return IMA_APPRAISE_KEXEC;
 727         return 0;
 728 }
 729
 730 static void add_rules(struct ima_rule_entry *entries, int count,
 731                       enum policy_rule_list policy_rule)
 732 {
 733         int i = 0;
 734
 735         for (i = 0; i < count; i++) {
 736                 struct ima_rule_entry *entry;
 737
 738                 if (policy_rule & IMA_DEFAULT_POLICY)
 739                         list_add_tail(&entries[i].list, &ima_default_rules);
 740
 741                 if (policy_rule & IMA_CUSTOM_POLICY) {
 742                         entry = kmemdup(&entries[i], sizeof(*entry),
 743                                         GFP_KERNEL);
 744                         if (!entry)
 745                                 continue;
 746
 747                         list_add_tail(&entry->list, &ima_policy_rules);
 748                 }
 749                 if (entries[i].action == APPRAISE) {
 750                         if (entries != build_appraise_rules)
 751                                 temp_ima_appraise |=
 752                                         ima_appraise_flag(entries[i].func);
 753                         else
 754                                 build_ima_appraise |=
 755                                         ima_appraise_flag(entries[i].func);
 756                 }
 757         }
 758 }
 759
 760 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry);
 761
 762 static int __init ima_init_arch_policy(void)
 763 {
 764         const char * const *arch_rules;
 765         const char * const *rules;
 766         int arch_entries = 0;
 767         int i = 0;
 768
 769         arch_rules = arch_get_ima_policy();
 770         if (!arch_rules)
 771                 return arch_entries;
 772
 773         /* Get number of rules */
 774         for (rules = arch_rules; *rules != NULL; rules++)
 775                 arch_entries++;
 776
 777         arch_policy_entry = kcalloc(arch_entries + 1,
 778                                     sizeof(*arch_policy_entry), GFP_KERNEL);
 779         if (!arch_policy_entry)
 780                 return 0;
 781
 782         /* Convert each policy string rules to struct ima_rule_entry format */
 783         for (rules = arch_rules, i = 0; *rules != NULL; rules++) {
 784                 char rule[255];
 785                 int result;
 786
 787                 result = strlcpy(rule, *rules, sizeof(rule));
 788
 789                 INIT_LIST_HEAD(&arch_policy_entry[i].list);
 790                 result = ima_parse_rule(rule, &arch_policy_entry[i]);
 791                 if (result) {
 792                         pr_warn("Skipping unknown architecture policy rule: %s\n",
 793                                 rule);
 794                         memset(&arch_policy_entry[i], 0,
 795                                sizeof(*arch_policy_entry));
 796                         continue;
 797                 }
 798                 i++;
 799         }
 800         return i;
 801 }
 802
 803 /**
 804  * ima_init_policy - initialize the default measure rules.
 805  *
 806  * ima_rules points to either the ima_default_rules or the
 807  * the new ima_policy_rules.
 808  */
 809 void __init ima_init_policy(void)
 810 {
 811         int build_appraise_entries, arch_entries;
 812
 813         /* if !ima_policy, we load NO default rules */
 814         if (ima_policy)
 815                 add_rules(dont_measure_rules, ARRAY_SIZE(dont_measure_rules),
 816                           IMA_DEFAULT_POLICY);
 817
 818         switch (ima_policy) {
 819         case ORIGINAL_TCB:
 820                 add_rules(original_measurement_rules,
 821                           ARRAY_SIZE(original_measurement_rules),
 822                           IMA_DEFAULT_POLICY);
 823                 break;
 824         case DEFAULT_TCB:
 825                 add_rules(default_measurement_rules,
 826                           ARRAY_SIZE(default_measurement_rules),
 827                           IMA_DEFAULT_POLICY);
 828         default:
 829                 break;
 830         }
 831
 832         /*
 833          * Based on runtime secure boot flags, insert arch specific measurement
 834          * and appraise rules requiring file signatures for both the initial
 835          * and custom policies, prior to other appraise rules.
 836          * (Highest priority)
 837          */
 838         arch_entries = ima_init_arch_policy();
 839         if (!arch_entries)
 840                 pr_info("No architecture policies found\n");
 841         else
 842                 add_rules(arch_policy_entry, arch_entries,
 843                           IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY);
 844
 845         /*
 846          * Insert the builtin "secure_boot" policy rules requiring file
 847          * signatures, prior to other appraise rules.
 848          */
 849         if (ima_use_secure_boot)
 850                 add_rules(secure_boot_rules, ARRAY_SIZE(secure_boot_rules),
 851                           IMA_DEFAULT_POLICY);
 852
 853         /*
 854          * Insert the build time appraise rules requiring file signatures
 855          * for both the initial and custom policies, prior to other appraise
 856          * rules. As the secure boot rules includes all of the build time
 857          * rules, include either one or the other set of rules, but not both.
 858          */
 859         build_appraise_entries = ARRAY_SIZE(build_appraise_rules);
 860         if (build_appraise_entries) {
 861                 if (ima_use_secure_boot)
 862                         add_rules(build_appraise_rules, build_appraise_entries,
 863                                   IMA_CUSTOM_POLICY);
 864                 else
 865                         add_rules(build_appraise_rules, build_appraise_entries,
 866                                   IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY);
 867         }
 868
 869         if (ima_use_appraise_tcb)
 870                 add_rules(default_appraise_rules,
 871                           ARRAY_SIZE(default_appraise_rules),
 872                           IMA_DEFAULT_POLICY);
 873
 874         ima_update_policy_flag();
 875 }
 876
 877 /* Make sure we have a valid policy, at least containing some rules. */
 878 int ima_check_policy(void)
 879 {
 880         if (list_empty(&ima_temp_rules))
 881                 return -EINVAL;
 882         return 0;
 883 }
 884
 885 /**
 886  * ima_update_policy - update default_rules with new measure rules
 887  *
 888  * Called on file .release to update the default rules with a complete new
 889  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 890  * they make a queue.  The policy may be updated multiple times and this is the
 891  * RCU updater.
 892  *
 893  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 894  * we switch from the default policy to user defined.
 895  */
 896 void ima_update_policy(void)
 897 {
 898         struct list_head *policy = &ima_policy_rules;
 899
 900         list_splice_tail_init_rcu(&ima_temp_rules, policy, synchronize_rcu);
 901
 902         if (ima_rules != policy) {
 903                 ima_policy_flag = 0;
 904                 ima_rules = policy;
 905
 906                 /*
 907                  * IMA architecture specific policy rules are specified
 908                  * as strings and converted to an array of ima_entry_rules
 909                  * on boot.  After loading a custom policy, free the
 910                  * architecture specific rules stored as an array.
 911                  */
 912                 kfree(arch_policy_entry);
 913         }
 914         ima_update_policy_flag();
 915
 916         /* Custom IMA policy has been loaded */
 917         ima_process_queued_keys();
 918 }
 919
 920 /* Keep the enumeration in sync with the policy_tokens! */
 921 enum {
 922         Opt_measure, Opt_dont_measure,
 923         Opt_appraise, Opt_dont_appraise,
 924         Opt_audit, Opt_hash, Opt_dont_hash,
 925         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 926         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 927         Opt_func, Opt_mask, Opt_fsmagic, Opt_fsname,
 928         Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq,
 929         Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt,
 930         Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt,
 931         Opt_appraise_type, Opt_appraise_flag,
 932         Opt_permit_directio, Opt_pcr, Opt_template, Opt_keyrings,
 933         Opt_label, Opt_err
 934 };
 935
 936 static const match_table_t policy_tokens = {
 937         {Opt_measure, "measure"},
 938         {Opt_dont_measure, "dont_measure"},
 939         {Opt_appraise, "appraise"},
 940         {Opt_dont_appraise, "dont_appraise"},
 941         {Opt_audit, "audit"},
 942         {Opt_hash, "hash"},
 943         {Opt_dont_hash, "dont_hash"},
 944         {Opt_obj_user, "obj_user=%s"},
 945         {Opt_obj_role, "obj_role=%s"},
 946         {Opt_obj_type, "obj_type=%s"},
 947         {Opt_subj_user, "subj_user=%s"},
 948         {Opt_subj_role, "subj_role=%s"},
 949         {Opt_subj_type, "subj_type=%s"},
 950         {Opt_func, "func=%s"},
 951         {Opt_mask, "mask=%s"},
 952         {Opt_fsmagic, "fsmagic=%s"},
 953         {Opt_fsname, "fsname=%s"},
 954         {Opt_fsuuid, "fsuuid=%s"},
 955         {Opt_uid_eq, "uid=%s"},
 956         {Opt_euid_eq, "euid=%s"},
 957         {Opt_fowner_eq, "fowner=%s"},
 958         {Opt_uid_gt, "uid>%s"},
 959         {Opt_euid_gt, "euid>%s"},
 960         {Opt_fowner_gt, "fowner>%s"},
 961         {Opt_uid_lt, "uid<%s"},
 962         {Opt_euid_lt, "euid<%s"},
 963         {Opt_fowner_lt, "fowner<%s"},
 964         {Opt_appraise_type, "appraise_type=%s"},
 965         {Opt_appraise_flag, "appraise_flag=%s"},
 966         {Opt_permit_directio, "permit_directio"},
 967         {Opt_pcr, "pcr=%s"},
 968         {Opt_template, "template=%s"},
 969         {Opt_keyrings, "keyrings=%s"},
 970         {Opt_label, "label=%s"},
 971         {Opt_err, NULL}
 972 };
 973
 974 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 975                              substring_t *args, int lsm_rule, int audit_type)
 976 {
 977         int result;
 978
 979         if (entry->lsm[lsm_rule].rule)
 980                 return -EINVAL;
 981
 982         entry->lsm[lsm_rule].args_p = match_strdup(args);
 983         if (!entry->lsm[lsm_rule].args_p)
 984                 return -ENOMEM;
 985
 986         entry->lsm[lsm_rule].type = audit_type;
 987         result = ima_filter_rule_init(entry->lsm[lsm_rule].type, Audit_equal,
 988                                       entry->lsm[lsm_rule].args_p,
 989                                       &entry->lsm[lsm_rule].rule);
 990         if (!entry->lsm[lsm_rule].rule) {
 991                 pr_warn("rule for LSM \'%s\' is undefined\n",
 992                         entry->lsm[lsm_rule].args_p);
 993
 994                 if (ima_rules == &ima_default_rules) {
 995                         kfree(entry->lsm[lsm_rule].args_p);
 996                         entry->lsm[lsm_rule].args_p = NULL;
 997                         result = -EINVAL;
 998                 } else
 999                         result = 0;
1000         }
1001
1002         return result;
1003 }
1004
1005 static void ima_log_string_op(struct audit_buffer *ab, char *key, char *value,
1006                               bool (*rule_operator)(kuid_t, kuid_t))
1007 {
1008         if (!ab)
1009                 return;
1010
1011         if (rule_operator == &uid_gt)
1012                 audit_log_format(ab, "%s>", key);
1013         else if (rule_operator == &uid_lt)
1014                 audit_log_format(ab, "%s<", key);
1015         else
1016                 audit_log_format(ab, "%s=", key);
1017         audit_log_format(ab, "%s ", value);
1018 }
1019 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
1020 {
1021         ima_log_string_op(ab, key, value, NULL);
1022 }
1023
1024 /*
1025  * Validating the appended signature included in the measurement list requires
1026  * the file hash calculated without the appended signature (i.e., the 'd-modsig'
1027  * field). Therefore, notify the user if they have the 'modsig' field but not
1028  * the 'd-modsig' field in the template.
1029  */
1030 static void check_template_modsig(const struct ima_template_desc *template)
1031 {
1032 #define MSG "template with 'modsig' field also needs 'd-modsig' field\n"
1033         bool has_modsig, has_dmodsig;
1034         static bool checked;
1035         int i;
1036
1037         /* We only need to notify the user once. */
1038         if (checked)
1039                 return;
1040
1041         has_modsig = has_dmodsig = false;
1042         for (i = 0; i < template->num_fields; i++) {
1043                 if (!strcmp(template->fields[i]->field_id, "modsig"))
1044                         has_modsig = true;
1045                 else if (!strcmp(template->fields[i]->field_id, "d-modsig"))
1046                         has_dmodsig = true;
1047         }
1048
1049         if (has_modsig && !has_dmodsig)
1050                 pr_notice(MSG);
1051
1052         checked = true;
1053 #undef MSG
1054 }
1055
1056 static bool ima_validate_rule(struct ima_rule_entry *entry)
1057 {
1058         /* Ensure that the action is set and is compatible with the flags */
1059         if (entry->action == UNKNOWN)
1060                 return false;
1061
1062         if (entry->action != MEASURE && entry->flags & IMA_PCR)
1063                 return false;
1064
1065         if (entry->action != APPRAISE &&
1066             entry->flags & (IMA_DIGSIG_REQUIRED | IMA_MODSIG_ALLOWED | IMA_CHECK_BLACKLIST))
1067                 return false;
1068
1069         /*
1070          * The IMA_FUNC bit must be set if and only if there's a valid hook
1071          * function specified, and vice versa. Enforcing this property allows
1072          * for the NONE case below to validate a rule without an explicit hook
1073          * function.
1074          */
1075         if (((entry->flags & IMA_FUNC) && entry->func == NONE) ||
1076             (!(entry->flags & IMA_FUNC) && entry->func != NONE))
1077                 return false;
1078
1079         /*
1080          * Ensure that the hook function is compatible with the other
1081          * components of the rule
1082          */
1083         switch (entry->func) {
1084         case NONE:
1085         case FILE_CHECK:
1086         case MMAP_CHECK:
1087         case BPRM_CHECK:
1088         case CREDS_CHECK:
1089         case POST_SETATTR:
1090         case FIRMWARE_CHECK:
1091         case POLICY_CHECK:
1092                 if (entry->flags & ~(IMA_FUNC | IMA_MASK | IMA_FSMAGIC |
1093                                      IMA_UID | IMA_FOWNER | IMA_FSUUID |
1094                                      IMA_INMASK | IMA_EUID | IMA_PCR |
1095                                      IMA_FSNAME | IMA_DIGSIG_REQUIRED |
1096                                      IMA_PERMIT_DIRECTIO))
1097                         return false;
1098
1099                 break;
1100         case MODULE_CHECK:
1101         case KEXEC_KERNEL_CHECK:
1102         case KEXEC_INITRAMFS_CHECK:
1103                 if (entry->flags & ~(IMA_FUNC | IMA_MASK | IMA_FSMAGIC |
1104                                      IMA_UID | IMA_FOWNER | IMA_FSUUID |
1105                                      IMA_INMASK | IMA_EUID | IMA_PCR |
1106                                      IMA_FSNAME | IMA_DIGSIG_REQUIRED |
1107                                      IMA_PERMIT_DIRECTIO | IMA_MODSIG_ALLOWED |
1108                                      IMA_CHECK_BLACKLIST))
1109                         return false;
1110
1111                 break;
1112         case KEXEC_CMDLINE:
1113                 if (entry->action & ~(MEASURE | DONT_MEASURE))
1114                         return false;
1115
1116                 if (entry->flags & ~(IMA_FUNC | IMA_FSMAGIC | IMA_UID |
1117                                      IMA_FOWNER | IMA_FSUUID | IMA_EUID |
1118                                      IMA_PCR | IMA_FSNAME))
1119                         return false;
1120
1121                 break;
1122         case KEY_CHECK:
1123                 if (entry->action & ~(MEASURE | DONT_MEASURE))
1124                         return false;
1125
1126                 if (entry->flags & ~(IMA_FUNC | IMA_UID | IMA_PCR |
1127                                      IMA_KEYRINGS))
1128                         return false;
1129
1130                 if (ima_rule_contains_lsm_cond(entry))
1131                         return false;
1132
1133                 break;
1134         case CRITICAL_DATA:
1135                 if (entry->action & ~(MEASURE | DONT_MEASURE))
1136                         return false;
1137
1138                 if (entry->flags & ~(IMA_FUNC | IMA_UID | IMA_PCR |
1139                                      IMA_LABEL))
1140                         return false;
1141
1142                 if (ima_rule_contains_lsm_cond(entry))
1143                         return false;
1144
1145                 break;
1146         default:
1147                 return false;
1148         }
1149
1150         /* Ensure that combinations of flags are compatible with each other */
1151         if (entry->flags & IMA_CHECK_BLACKLIST &&
1152             !(entry->flags & IMA_MODSIG_ALLOWED))
1153                 return false;
1154
1155         return true;
1156 }
1157
1158 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
1159 {
1160         struct audit_buffer *ab;
1161         char *from;
1162         char *p;
1163         bool uid_token;
1164         struct ima_template_desc *template_desc;
1165         int result = 0;
1166
1167         ab = integrity_audit_log_start(audit_context(), GFP_KERNEL,
1168                                        AUDIT_INTEGRITY_POLICY_RULE);
1169
1170         entry->uid = INVALID_UID;
1171         entry->fowner = INVALID_UID;
1172         entry->uid_op = &uid_eq;
1173         entry->fowner_op = &uid_eq;
1174         entry->action = UNKNOWN;
1175         while ((p = strsep(&rule, " \t")) != NULL) {
1176                 substring_t args[MAX_OPT_ARGS];
1177                 int token;
1178                 unsigned long lnum;
1179
1180                 if (result < 0)
1181                         break;
1182                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
1183                         continue;
1184                 token = match_token(p, policy_tokens, args);
1185                 switch (token) {
1186                 case Opt_measure:
1187                         ima_log_string(ab, "action", "measure");
1188
1189                         if (entry->action != UNKNOWN)
1190                                 result = -EINVAL;
1191
1192                         entry->action = MEASURE;
1193                         break;
1194                 case Opt_dont_measure:
1195                         ima_log_string(ab, "action", "dont_measure");
1196
1197                         if (entry->action != UNKNOWN)
1198                                 result = -EINVAL;
1199
1200                         entry->action = DONT_MEASURE;
1201                         break;
1202                 case Opt_appraise:
1203                         ima_log_string(ab, "action", "appraise");
1204
1205                         if (entry->action != UNKNOWN)
1206                                 result = -EINVAL;
1207
1208                         entry->action = APPRAISE;
1209                         break;
1210                 case Opt_dont_appraise:
1211                         ima_log_string(ab, "action", "dont_appraise");
1212
1213                         if (entry->action != UNKNOWN)
1214                                 result = -EINVAL;
1215
1216                         entry->action = DONT_APPRAISE;
1217                         break;
1218                 case Opt_audit:
1219                         ima_log_string(ab, "action", "audit");
1220
1221                         if (entry->action != UNKNOWN)
1222                                 result = -EINVAL;
1223
1224                         entry->action = AUDIT;
1225                         break;
1226                 case Opt_hash:
1227                         ima_log_string(ab, "action", "hash");
1228
1229                         if (entry->action != UNKNOWN)
1230                                 result = -EINVAL;
1231
1232                         entry->action = HASH;
1233                         break;
1234                 case Opt_dont_hash:
1235                         ima_log_string(ab, "action", "dont_hash");
1236
1237                         if (entry->action != UNKNOWN)
1238                                 result = -EINVAL;
1239
1240                         entry->action = DONT_HASH;
1241                         break;
1242                 case Opt_func:
1243                         ima_log_string(ab, "func", args[0].from);
1244
1245                         if (entry->func)
1246                                 result = -EINVAL;
1247
1248                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
1249                                 entry->func = FILE_CHECK;
1250                         /* PATH_CHECK is for backwards compat */
1251                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
1252                                 entry->func = FILE_CHECK;
1253                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
1254                                 entry->func = MODULE_CHECK;
1255                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
1256                                 entry->func = FIRMWARE_CHECK;
1257                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
1258                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
1259                                 entry->func = MMAP_CHECK;
1260                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
1261                                 entry->func = BPRM_CHECK;
1262                         else if (strcmp(args[0].from, "CREDS_CHECK") == 0)
1263                                 entry->func = CREDS_CHECK;
1264                         else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
1265                                  0)
1266                                 entry->func = KEXEC_KERNEL_CHECK;
1267                         else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
1268                                  == 0)
1269                                 entry->func = KEXEC_INITRAMFS_CHECK;
1270                         else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
1271                                 entry->func = POLICY_CHECK;
1272                         else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0)
1273                                 entry->func = KEXEC_CMDLINE;
1274                         else if (IS_ENABLED(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) &&
1275                                  strcmp(args[0].from, "KEY_CHECK") == 0)
1276                                 entry->func = KEY_CHECK;
1277                         else if (strcmp(args[0].from, "CRITICAL_DATA") == 0)
1278                                 entry->func = CRITICAL_DATA;
1279                         else
1280                                 result = -EINVAL;
1281                         if (!result)
1282                                 entry->flags |= IMA_FUNC;
1283                         break;
1284                 case Opt_mask:
1285                         ima_log_string(ab, "mask", args[0].from);
1286
1287                         if (entry->mask)
1288                                 result = -EINVAL;
1289
1290                         from = args[0].from;
1291                         if (*from == '^')
1292                                 from++;
1293
1294                         if ((strcmp(from, "MAY_EXEC")) == 0)
1295                                 entry->mask = MAY_EXEC;
1296                         else if (strcmp(from, "MAY_WRITE") == 0)
1297                                 entry->mask = MAY_WRITE;
1298                         else if (strcmp(from, "MAY_READ") == 0)
1299                                 entry->mask = MAY_READ;
1300                         else if (strcmp(from, "MAY_APPEND") == 0)
1301                                 entry->mask = MAY_APPEND;
1302                         else
1303                                 result = -EINVAL;
1304                         if (!result)
1305                                 entry->flags |= (*args[0].from == '^')
1306                                      ? IMA_INMASK : IMA_MASK;
1307                         break;
1308                 case Opt_fsmagic:
1309                         ima_log_string(ab, "fsmagic", args[0].from);
1310
1311                         if (entry->fsmagic) {
1312                                 result = -EINVAL;
1313                                 break;
1314                         }
1315
1316                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
1317                         if (!result)
1318                                 entry->flags |= IMA_FSMAGIC;
1319                         break;
1320                 case Opt_fsname:
1321                         ima_log_string(ab, "fsname", args[0].from);
1322
1323                         entry->fsname = kstrdup(args[0].from, GFP_KERNEL);
1324                         if (!entry->fsname) {
1325                                 result = -ENOMEM;
1326                                 break;
1327                         }
1328                         result = 0;
1329                         entry->flags |= IMA_FSNAME;
1330                         break;
1331                 case Opt_keyrings:
1332                         ima_log_string(ab, "keyrings", args[0].from);
1333
1334                         if (!IS_ENABLED(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) ||
1335                             entry->keyrings) {
1336                                 result = -EINVAL;
1337                                 break;
1338                         }
1339
1340                         entry->keyrings = ima_alloc_rule_opt_list(args);
1341                         if (IS_ERR(entry->keyrings)) {
1342                                 result = PTR_ERR(entry->keyrings);
1343                                 entry->keyrings = NULL;
1344                                 break;
1345                         }
1346
1347                         entry->flags |= IMA_KEYRINGS;
1348                         break;
1349                 case Opt_label:
1350                         ima_log_string(ab, "label", args[0].from);
1351
1352                         if (entry->label) {
1353                                 result = -EINVAL;
1354                                 break;
1355                         }
1356
1357                         entry->label = ima_alloc_rule_opt_list(args);
1358                         if (IS_ERR(entry->label)) {
1359                                 result = PTR_ERR(entry->label);
1360                                 entry->label = NULL;
1361                                 break;
1362                         }
1363
1364                         entry->flags |= IMA_LABEL;
1365                         break;
1366                 case Opt_fsuuid:
1367                         ima_log_string(ab, "fsuuid", args[0].from);
1368
1369                         if (!uuid_is_null(&entry->fsuuid)) {
1370                                 result = -EINVAL;
1371                                 break;
1372                         }
1373
1374                         result = uuid_parse(args[0].from, &entry->fsuuid);
1375                         if (!result)
1376                                 entry->flags |= IMA_FSUUID;
1377                         break;
1378                 case Opt_uid_gt:
1379                 case Opt_euid_gt:
1380                         entry->uid_op = &uid_gt;
1381                         fallthrough;
1382                 case Opt_uid_lt:
1383                 case Opt_euid_lt:
1384                         if ((token == Opt_uid_lt) || (token == Opt_euid_lt))
1385                                 entry->uid_op = &uid_lt;
1386                         fallthrough;
1387                 case Opt_uid_eq:
1388                 case Opt_euid_eq:
1389                         uid_token = (token == Opt_uid_eq) ||
1390                                     (token == Opt_uid_gt) ||
1391                                     (token == Opt_uid_lt);
1392
1393                         ima_log_string_op(ab, uid_token ? "uid" : "euid",
1394                                           args[0].from, entry->uid_op);
1395
1396                         if (uid_valid(entry->uid)) {
1397                                 result = -EINVAL;
1398                                 break;
1399                         }
1400
1401                         result = kstrtoul(args[0].from, 10, &lnum);
1402                         if (!result) {
1403                                 entry->uid = make_kuid(current_user_ns(),
1404                                                        (uid_t) lnum);
1405                                 if (!uid_valid(entry->uid) ||
1406                                     (uid_t)lnum != lnum)
1407                                         result = -EINVAL;
1408                                 else
1409                                         entry->flags |= uid_token
1410                                             ? IMA_UID : IMA_EUID;
1411                         }
1412                         break;
1413                 case Opt_fowner_gt:
1414                         entry->fowner_op = &uid_gt;
1415                         fallthrough;
1416                 case Opt_fowner_lt:
1417                         if (token == Opt_fowner_lt)
1418                                 entry->fowner_op = &uid_lt;
1419                         fallthrough;
1420                 case Opt_fowner_eq:
1421                         ima_log_string_op(ab, "fowner", args[0].from,
1422                                           entry->fowner_op);
1423
1424                         if (uid_valid(entry->fowner)) {
1425                                 result = -EINVAL;
1426                                 break;
1427                         }
1428
1429                         result = kstrtoul(args[0].from, 10, &lnum);
1430                         if (!result) {
1431                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
1432                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
1433                                         result = -EINVAL;
1434                                 else
1435                                         entry->flags |= IMA_FOWNER;
1436                         }
1437                         break;
1438                 case Opt_obj_user:
1439                         ima_log_string(ab, "obj_user", args[0].from);
1440                         result = ima_lsm_rule_init(entry, args,
1441                                                    LSM_OBJ_USER,
1442                                                    AUDIT_OBJ_USER);
1443                         break;
1444                 case Opt_obj_role:
1445                         ima_log_string(ab, "obj_role", args[0].from);
1446                         result = ima_lsm_rule_init(entry, args,
1447                                                    LSM_OBJ_ROLE,
1448                                                    AUDIT_OBJ_ROLE);
1449                         break;
1450                 case Opt_obj_type:
1451                         ima_log_string(ab, "obj_type", args[0].from);
1452                         result = ima_lsm_rule_init(entry, args,
1453                                                    LSM_OBJ_TYPE,
1454                                                    AUDIT_OBJ_TYPE);
1455                         break;
1456                 case Opt_subj_user:
1457                         ima_log_string(ab, "subj_user", args[0].from);
1458                         result = ima_lsm_rule_init(entry, args,
1459                                                    LSM_SUBJ_USER,
1460                                                    AUDIT_SUBJ_USER);
1461                         break;
1462                 case Opt_subj_role:
1463                         ima_log_string(ab, "subj_role", args[0].from);
1464                         result = ima_lsm_rule_init(entry, args,
1465                                                    LSM_SUBJ_ROLE,
1466                                                    AUDIT_SUBJ_ROLE);
1467                         break;
1468                 case Opt_subj_type:
1469                         ima_log_string(ab, "subj_type", args[0].from);
1470                         result = ima_lsm_rule_init(entry, args,
1471                                                    LSM_SUBJ_TYPE,
1472                                                    AUDIT_SUBJ_TYPE);
1473                         break;
1474                 case Opt_appraise_type:
1475                         ima_log_string(ab, "appraise_type", args[0].from);
1476                         if ((strcmp(args[0].from, "imasig")) == 0)
1477                                 entry->flags |= IMA_DIGSIG_REQUIRED;
1478                         else if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) &&
1479                                  strcmp(args[0].from, "imasig|modsig") == 0)
1480                                 entry->flags |= IMA_DIGSIG_REQUIRED |
1481                                                 IMA_MODSIG_ALLOWED;
1482                         else
1483                                 result = -EINVAL;
1484                         break;
1485                 case Opt_appraise_flag:
1486                         ima_log_string(ab, "appraise_flag", args[0].from);
1487                         if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) &&
1488                             strstr(args[0].from, "blacklist"))
1489                                 entry->flags |= IMA_CHECK_BLACKLIST;
1490                         else
1491                                 result = -EINVAL;
1492                         break;
1493                 case Opt_permit_directio:
1494                         entry->flags |= IMA_PERMIT_DIRECTIO;
1495                         break;
1496                 case Opt_pcr:
1497                         ima_log_string(ab, "pcr", args[0].from);
1498
1499                         result = kstrtoint(args[0].from, 10, &entry->pcr);
1500                         if (result || INVALID_PCR(entry->pcr))
1501                                 result = -EINVAL;
1502                         else
1503                                 entry->flags |= IMA_PCR;
1504
1505                         break;
1506                 case Opt_template:
1507                         ima_log_string(ab, "template", args[0].from);
1508                         if (entry->action != MEASURE) {
1509                                 result = -EINVAL;
1510                                 break;
1511                         }
1512                         template_desc = lookup_template_desc(args[0].from);
1513                         if (!template_desc || entry->template) {
1514                                 result = -EINVAL;
1515                                 break;
1516                         }
1517
1518                         /*
1519                          * template_desc_init_fields() does nothing if
1520                          * the template is already initialised, so
1521                          * it's safe to do this unconditionally
1522                          */
1523                         template_desc_init_fields(template_desc->fmt,
1524                                                  &(template_desc->fields),
1525                                                  &(template_desc->num_fields));
1526                         entry->template = template_desc;
1527                         break;
1528                 case Opt_err:
1529                         ima_log_string(ab, "UNKNOWN", p);
1530                         result = -EINVAL;
1531                         break;
1532                 }
1533         }
1534         if (!result && !ima_validate_rule(entry))
1535                 result = -EINVAL;
1536         else if (entry->action == APPRAISE)
1537                 temp_ima_appraise |= ima_appraise_flag(entry->func);
1538
1539         if (!result && entry->flags & IMA_MODSIG_ALLOWED) {
1540                 template_desc = entry->template ? entry->template :
1541                                                   ima_template_desc_current();
1542                 check_template_modsig(template_desc);
1543         }
1544
1545         audit_log_format(ab, "res=%d", !result);
1546         audit_log_end(ab);
1547         return result;
1548 }
1549
1550 /**
1551  * ima_parse_add_rule - add a rule to ima_policy_rules
1552  * @rule - ima measurement policy rule
1553  *
1554  * Avoid locking by allowing just one writer at a time in ima_write_policy()
1555  * Returns the length of the rule parsed, an error code on failure
1556  */
1557 ssize_t ima_parse_add_rule(char *rule)
1558 {
1559         static const char op[] = "update_policy";
1560         char *p;
1561         struct ima_rule_entry *entry;
1562         ssize_t result, len;
1563         int audit_info = 0;
1564
1565         p = strsep(&rule, "\n");
1566         len = strlen(p) + 1;
1567         p += strspn(p, " \t");
1568
1569         if (*p == '#' || *p == '\0')
1570                 return len;
1571
1572         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1573         if (!entry) {
1574                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
1575                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
1576                 return -ENOMEM;
1577         }
1578
1579         INIT_LIST_HEAD(&entry->list);
1580
1581         result = ima_parse_rule(p, entry);
1582         if (result) {
1583                 ima_free_rule(entry);
1584                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
1585                                     NULL, op, "invalid-policy", result,
1586                                     audit_info);
1587                 return result;
1588         }
1589
1590         list_add_tail(&entry->list, &ima_temp_rules);
1591
1592         return len;
1593 }
1594
1595 /**
1596  * ima_delete_rules() called to cleanup invalid in-flight policy.
1597  * We don't need locking as we operate on the temp list, which is
1598  * different from the active one.  There is also only one user of
1599  * ima_delete_rules() at a time.
1600  */
1601 void ima_delete_rules(void)
1602 {
1603         struct ima_rule_entry *entry, *tmp;
1604
1605         temp_ima_appraise = 0;
1606         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
1607                 list_del(&entry->list);
1608                 ima_free_rule(entry);
1609         }
1610 }
1611
1612 #define __ima_hook_stringify(func, str) (#func),
1613
1614 const char *const func_tokens[] = {
1615         __ima_hooks(__ima_hook_stringify)
1616 };
1617
1618 #ifdef  CONFIG_IMA_READ_POLICY
1619 enum {
1620         mask_exec = 0, mask_write, mask_read, mask_append
1621 };
1622
1623 static const char *const mask_tokens[] = {
1624         "^MAY_EXEC",
1625         "^MAY_WRITE",
1626         "^MAY_READ",
1627         "^MAY_APPEND"
1628 };
1629
1630 void *ima_policy_start(struct seq_file *m, loff_t *pos)
1631 {
1632         loff_t l = *pos;
1633         struct ima_rule_entry *entry;
1634
1635         rcu_read_lock();
1636         list_for_each_entry_rcu(entry, ima_rules, list) {
1637                 if (!l--) {
1638                         rcu_read_unlock();
1639                         return entry;
1640                 }
1641         }
1642         rcu_read_unlock();
1643         return NULL;
1644 }
1645
1646 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
1647 {
1648         struct ima_rule_entry *entry = v;
1649
1650         rcu_read_lock();
1651         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
1652         rcu_read_unlock();
1653         (*pos)++;
1654
1655         return (&entry->list == ima_rules) ? NULL : entry;
1656 }
1657
1658 void ima_policy_stop(struct seq_file *m, void *v)
1659 {
1660 }
1661
1662 #define pt(token)       policy_tokens[token].pattern
1663 #define mt(token)       mask_tokens[token]
1664
1665 /*
1666  * policy_func_show - display the ima_hooks policy rule
1667  */
1668 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
1669 {
1670         if (func > 0 && func < MAX_CHECK)
1671                 seq_printf(m, "func=%s ", func_tokens[func]);
1672         else
1673                 seq_printf(m, "func=%d ", func);
1674 }
1675
1676 static void ima_show_rule_opt_list(struct seq_file *m,
1677                                    const struct ima_rule_opt_list *opt_list)
1678 {
1679         size_t i;
1680
1681         for (i = 0; i < opt_list->count; i++)
1682                 seq_printf(m, "%s%s", i ? "|" : "", opt_list->items[i]);
1683 }
1684
1685 int ima_policy_show(struct seq_file *m, void *v)
1686 {
1687         struct ima_rule_entry *entry = v;
1688         int i;
1689         char tbuf[64] = {0,};
1690         int offset = 0;
1691
1692         rcu_read_lock();
1693
1694         if (entry->action & MEASURE)
1695                 seq_puts(m, pt(Opt_measure));
1696         if (entry->action & DONT_MEASURE)
1697                 seq_puts(m, pt(Opt_dont_measure));
1698         if (entry->action & APPRAISE)
1699                 seq_puts(m, pt(Opt_appraise));
1700         if (entry->action & DONT_APPRAISE)
1701                 seq_puts(m, pt(Opt_dont_appraise));
1702         if (entry->action & AUDIT)
1703                 seq_puts(m, pt(Opt_audit));
1704         if (entry->action & HASH)
1705                 seq_puts(m, pt(Opt_hash));
1706         if (entry->action & DONT_HASH)
1707                 seq_puts(m, pt(Opt_dont_hash));
1708
1709         seq_puts(m, " ");
1710
1711         if (entry->flags & IMA_FUNC)
1712                 policy_func_show(m, entry->func);
1713
1714         if ((entry->flags & IMA_MASK) || (entry->flags & IMA_INMASK)) {
1715                 if (entry->flags & IMA_MASK)
1716                         offset = 1;
1717                 if (entry->mask & MAY_EXEC)
1718                         seq_printf(m, pt(Opt_mask), mt(mask_exec) + offset);
1719                 if (entry->mask & MAY_WRITE)
1720                         seq_printf(m, pt(Opt_mask), mt(mask_write) + offset);
1721                 if (entry->mask & MAY_READ)
1722                         seq_printf(m, pt(Opt_mask), mt(mask_read) + offset);
1723                 if (entry->mask & MAY_APPEND)
1724                         seq_printf(m, pt(Opt_mask), mt(mask_append) + offset);
1725                 seq_puts(m, " ");
1726         }
1727
1728         if (entry->flags & IMA_FSMAGIC) {
1729                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1730                 seq_printf(m, pt(Opt_fsmagic), tbuf);
1731                 seq_puts(m, " ");
1732         }
1733
1734         if (entry->flags & IMA_FSNAME) {
1735                 snprintf(tbuf, sizeof(tbuf), "%s", entry->fsname);
1736                 seq_printf(m, pt(Opt_fsname), tbuf);
1737                 seq_puts(m, " ");
1738         }
1739
1740         if (entry->flags & IMA_KEYRINGS) {
1741                 seq_puts(m, "keyrings=");
1742                 ima_show_rule_opt_list(m, entry->keyrings);
1743                 seq_puts(m, " ");
1744         }
1745
1746         if (entry->flags & IMA_LABEL) {
1747                 seq_puts(m, "label=");
1748                 ima_show_rule_opt_list(m, entry->label);
1749                 seq_puts(m, " ");
1750         }
1751
1752         if (entry->flags & IMA_PCR) {
1753                 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
1754                 seq_printf(m, pt(Opt_pcr), tbuf);
1755                 seq_puts(m, " ");
1756         }
1757
1758         if (entry->flags & IMA_FSUUID) {
1759                 seq_printf(m, "fsuuid=%pU", &entry->fsuuid);
1760                 seq_puts(m, " ");
1761         }
1762
1763         if (entry->flags & IMA_UID) {
1764                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1765                 if (entry->uid_op == &uid_gt)
1766                         seq_printf(m, pt(Opt_uid_gt), tbuf);
1767                 else if (entry->uid_op == &uid_lt)
1768                         seq_printf(m, pt(Opt_uid_lt), tbuf);
1769                 else
1770                         seq_printf(m, pt(Opt_uid_eq), tbuf);
1771                 seq_puts(m, " ");
1772         }
1773
1774         if (entry->flags & IMA_EUID) {
1775                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1776                 if (entry->uid_op == &uid_gt)
1777                         seq_printf(m, pt(Opt_euid_gt), tbuf);
1778                 else if (entry->uid_op == &uid_lt)
1779                         seq_printf(m, pt(Opt_euid_lt), tbuf);
1780                 else
1781                         seq_printf(m, pt(Opt_euid_eq), tbuf);
1782                 seq_puts(m, " ");
1783         }
1784
1785         if (entry->flags & IMA_FOWNER) {
1786                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1787                 if (entry->fowner_op == &uid_gt)
1788                         seq_printf(m, pt(Opt_fowner_gt), tbuf);
1789                 else if (entry->fowner_op == &uid_lt)
1790                         seq_printf(m, pt(Opt_fowner_lt), tbuf);
1791                 else
1792                         seq_printf(m, pt(Opt_fowner_eq), tbuf);
1793                 seq_puts(m, " ");
1794         }
1795
1796         for (i = 0; i < MAX_LSM_RULES; i++) {
1797                 if (entry->lsm[i].rule) {
1798                         switch (i) {
1799                         case LSM_OBJ_USER:
1800                                 seq_printf(m, pt(Opt_obj_user),
1801                                            entry->lsm[i].args_p);
1802                                 break;
1803                         case LSM_OBJ_ROLE:
1804                                 seq_printf(m, pt(Opt_obj_role),
1805                                            entry->lsm[i].args_p);
1806                                 break;
1807                         case LSM_OBJ_TYPE:
1808                                 seq_printf(m, pt(Opt_obj_type),
1809                                            entry->lsm[i].args_p);
1810                                 break;
1811                         case LSM_SUBJ_USER:
1812                                 seq_printf(m, pt(Opt_subj_user),
1813                                            entry->lsm[i].args_p);
1814                                 break;
1815                         case LSM_SUBJ_ROLE:
1816                                 seq_printf(m, pt(Opt_subj_role),
1817                                            entry->lsm[i].args_p);
1818                                 break;
1819                         case LSM_SUBJ_TYPE:
1820                                 seq_printf(m, pt(Opt_subj_type),
1821                                            entry->lsm[i].args_p);
1822                                 break;
1823                         }
1824                         seq_puts(m, " ");
1825                 }
1826         }
1827         if (entry->template)
1828                 seq_printf(m, "template=%s ", entry->template->name);
1829         if (entry->flags & IMA_DIGSIG_REQUIRED) {
1830                 if (entry->flags & IMA_MODSIG_ALLOWED)
1831                         seq_puts(m, "appraise_type=imasig|modsig ");
1832                 else
1833                         seq_puts(m, "appraise_type=imasig ");
1834         }
1835         if (entry->flags & IMA_CHECK_BLACKLIST)
1836                 seq_puts(m, "appraise_flag=check_blacklist ");
1837         if (entry->flags & IMA_PERMIT_DIRECTIO)
1838                 seq_puts(m, "permit_directio ");
1839         rcu_read_unlock();
1840         seq_puts(m, "\n");
1841         return 0;
1842 }
1843 #endif  /* CONFIG_IMA_READ_POLICY */
1844
1845 #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)
1846 /*
1847  * ima_appraise_signature: whether IMA will appraise a given function using
1848  * an IMA digital signature. This is restricted to cases where the kernel
1849  * has a set of built-in trusted keys in order to avoid an attacker simply
1850  * loading additional keys.
1851  */
1852 bool ima_appraise_signature(enum kernel_read_file_id id)
1853 {
1854         struct ima_rule_entry *entry;
1855         bool found = false;
1856         enum ima_hooks func;
1857
1858         if (id >= READING_MAX_ID)
1859                 return false;
1860
1861         func = read_idmap[id] ?: FILE_CHECK;
1862
1863         rcu_read_lock();
1864         list_for_each_entry_rcu(entry, ima_rules, list) {
1865                 if (entry->action != APPRAISE)
1866                         continue;
1867
1868                 /*
1869                  * A generic entry will match, but otherwise require that it
1870                  * match the func we're looking for
1871                  */
1872                 if (entry->func && entry->func != func)
1873                         continue;
1874
1875                 /*
1876                  * We require this to be a digital signature, not a raw IMA
1877                  * hash.
1878                  */
1879                 if (entry->flags & IMA_DIGSIG_REQUIRED)
1880                         found = true;
1881
1882                 /*
1883                  * We've found a rule that matches, so break now even if it
1884                  * didn't require a digital signature - a later rule that does
1885                  * won't override it, so would be a false positive.
1886                  */
1887                 break;
1888         }
1889
1890         rcu_read_unlock();
1891         return found;
1892 }
1893 #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */