ima_appraise.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * Copyright (C) 2011 IBM Corporation
  4 *
  5 * Author:
  6 * Mimi Zohar <zohar@us.ibm.com>
  7 */
  8#include <linux/module.h>
  9#include <linux/init.h>
 10#include <linux/file.h>
 11#include <linux/binfmts.h>
 12#include <linux/fs.h>
 13#include <linux/xattr.h>
 14#include <linux/magic.h>
 15#include <linux/ima.h>
 16#include <linux/evm.h>
 17#include <linux/fsverity.h>
 18#include <keys/system_keyring.h>
 19#include <uapi/linux/fsverity.h>
 20
 21#include "ima.h"
 22
 23#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
 24static char *ima_appraise_cmdline_default __initdata;
 25core_param(ima_appraise, ima_appraise_cmdline_default, charp, 0);
 26
 27void __init ima_appraise_parse_cmdline(void)
 28{
 29	const char *str = ima_appraise_cmdline_default;
 30	bool sb_state = arch_ima_get_secureboot();
 31	int appraisal_state = ima_appraise;
 32
 33	if (!str)
 34		return;
 35
 36	if (strncmp(str, "off", 3) == 0)
 37		appraisal_state = 0;
 38	else if (strncmp(str, "log", 3) == 0)
 39		appraisal_state = IMA_APPRAISE_LOG;
 40	else if (strncmp(str, "fix", 3) == 0)
 41		appraisal_state = IMA_APPRAISE_FIX;
 42	else if (strncmp(str, "enforce", 7) == 0)
 43		appraisal_state = IMA_APPRAISE_ENFORCE;
 44	else
 45		pr_err("invalid \"%s\" appraise option", str);
 46
 47	/* If appraisal state was changed, but secure boot is enabled,
 48	 * keep its default */
 49	if (sb_state) {
 50		if (!(appraisal_state & IMA_APPRAISE_ENFORCE))
 51			pr_info("Secure boot enabled: ignoring ima_appraise=%s option",
 52				str);
 53	} else {
 54		ima_appraise = appraisal_state;
 55	}
 56}
 57#endif
 58
 59/*
 60 * is_ima_appraise_enabled - return appraise status
 61 *
 62 * Only return enabled, if not in ima_appraise="fix" or "log" modes.
 63 */
 64bool is_ima_appraise_enabled(void)
 65{
 66	return ima_appraise & IMA_APPRAISE_ENFORCE;
 67}
 68
 69/*
 70 * ima_must_appraise - set appraise flag
 71 *
 72 * Return 1 to appraise or hash
 73 */
 74int ima_must_appraise(struct mnt_idmap *idmap, struct inode *inode,
 75		      int mask, enum ima_hooks func)
 76{
 77	struct lsm_prop prop;
 78
 79	if (!ima_appraise)
 80		return 0;
 81
 82	security_current_getlsmprop_subj(&prop);
 83	return ima_match_policy(idmap, inode, current_cred(), &prop,
 84				func, mask, IMA_APPRAISE | IMA_HASH, NULL,
 85				NULL, NULL, NULL);
 86}
 87
 88static int ima_fix_xattr(struct dentry *dentry, struct ima_iint_cache *iint)
 89{
 90	int rc, offset;
 91	u8 algo = iint->ima_hash->algo;
 92
 93	if (algo <= HASH_ALGO_SHA1) {
 94		offset = 1;
 95		iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;
 96	} else {
 97		offset = 0;
 98		iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG;
 99		iint->ima_hash->xattr.ng.algo = algo;
100	}
101	rc = __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_IMA,
102				   &iint->ima_hash->xattr.data[offset],
103				   (sizeof(iint->ima_hash->xattr) - offset) +
104				   iint->ima_hash->length, 0);
105	return rc;
106}
107
108/* Return specific func appraised cached result */
109enum integrity_status ima_get_cache_status(struct ima_iint_cache *iint,
110					   enum ima_hooks func)
111{
112	switch (func) {
113	case MMAP_CHECK:
114	case MMAP_CHECK_REQPROT:
115		return iint->ima_mmap_status;
116	case BPRM_CHECK:
117		return iint->ima_bprm_status;
118	case CREDS_CHECK:
119		return iint->ima_creds_status;
120	case FILE_CHECK:
121	case POST_SETATTR:
122		return iint->ima_file_status;
123	case MODULE_CHECK ... MAX_CHECK - 1:
124	default:
125		return iint->ima_read_status;
126	}
127}
128
129static void ima_set_cache_status(struct ima_iint_cache *iint,
130				 enum ima_hooks func,
131				 enum integrity_status status)
132{
133	switch (func) {
134	case MMAP_CHECK:
135	case MMAP_CHECK_REQPROT:
136		iint->ima_mmap_status = status;
137		break;
138	case BPRM_CHECK:
139		iint->ima_bprm_status = status;
140		break;
141	case CREDS_CHECK:
142		iint->ima_creds_status = status;
143		break;
144	case FILE_CHECK:
145	case POST_SETATTR:
146		iint->ima_file_status = status;
147		break;
148	case MODULE_CHECK ... MAX_CHECK - 1:
149	default:
150		iint->ima_read_status = status;
151		break;
152	}
153}
154
155static void ima_cache_flags(struct ima_iint_cache *iint, enum ima_hooks func)
156{
157	switch (func) {
158	case MMAP_CHECK:
159	case MMAP_CHECK_REQPROT:
160		iint->flags |= (IMA_MMAP_APPRAISED | IMA_APPRAISED);
161		break;
162	case BPRM_CHECK:
163		iint->flags |= (IMA_BPRM_APPRAISED | IMA_APPRAISED);
164		break;
165	case CREDS_CHECK:
166		iint->flags |= (IMA_CREDS_APPRAISED | IMA_APPRAISED);
167		break;
168	case FILE_CHECK:
169	case POST_SETATTR:
170		iint->flags |= (IMA_FILE_APPRAISED | IMA_APPRAISED);
171		break;
172	case MODULE_CHECK ... MAX_CHECK - 1:
173	default:
174		iint->flags |= (IMA_READ_APPRAISED | IMA_APPRAISED);
175		break;
176	}
177}
178
179enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value,
180				 int xattr_len)
181{
182	struct signature_v2_hdr *sig;
183	enum hash_algo ret;
184
185	if (!xattr_value || xattr_len < 2)
186		/* return default hash algo */
187		return ima_hash_algo;
188
189	switch (xattr_value->type) {
190	case IMA_VERITY_DIGSIG:
191		sig = (typeof(sig))xattr_value;
192		if (sig->version != 3 || xattr_len <= sizeof(*sig) ||
193		    sig->hash_algo >= HASH_ALGO__LAST)
194			return ima_hash_algo;
195		return sig->hash_algo;
196	case EVM_IMA_XATTR_DIGSIG:
197		sig = (typeof(sig))xattr_value;
198		if (sig->version != 2 || xattr_len <= sizeof(*sig)
199		    || sig->hash_algo >= HASH_ALGO__LAST)
200			return ima_hash_algo;
201		return sig->hash_algo;
202	case IMA_XATTR_DIGEST_NG:
203		/* first byte contains algorithm id */
204		ret = xattr_value->data[0];
205		if (ret < HASH_ALGO__LAST)
206			return ret;
207		break;
208	case IMA_XATTR_DIGEST:
209		/* this is for backward compatibility */
210		if (xattr_len == 21) {
211			unsigned int zero = 0;
212			if (!memcmp(&xattr_value->data[16], &zero, 4))
213				return HASH_ALGO_MD5;
214			else
215				return HASH_ALGO_SHA1;
216		} else if (xattr_len == 17)
217			return HASH_ALGO_MD5;
218		break;
219	}
220
221	/* return default hash algo */
222	return ima_hash_algo;
223}
224
225int ima_read_xattr(struct dentry *dentry,
226		   struct evm_ima_xattr_data **xattr_value, int xattr_len)
227{
228	int ret;
229
230	ret = vfs_getxattr_alloc(&nop_mnt_idmap, dentry, XATTR_NAME_IMA,
231				 (char **)xattr_value, xattr_len, GFP_NOFS);
232	if (ret == -EOPNOTSUPP)
233		ret = 0;
234	return ret;
235}
236
237/*
238 * calc_file_id_hash - calculate the hash of the ima_file_id struct data
239 * @type: xattr type [enum evm_ima_xattr_type]
240 * @algo: hash algorithm [enum hash_algo]
241 * @digest: pointer to the digest to be hashed
242 * @hash: (out) pointer to the hash
243 *
244 * IMA signature version 3 disambiguates the data that is signed by
245 * indirectly signing the hash of the ima_file_id structure data.
246 *
247 * Signing the ima_file_id struct is currently only supported for
248 * IMA_VERITY_DIGSIG type xattrs.
249 *
250 * Return 0 on success, error code otherwise.
251 */
252static int calc_file_id_hash(enum evm_ima_xattr_type type,
253			     enum hash_algo algo, const u8 *digest,
254			     struct ima_digest_data *hash)
255{
256	struct ima_file_id file_id = {
257		.hash_type = IMA_VERITY_DIGSIG, .hash_algorithm = algo};
258	unsigned int unused = HASH_MAX_DIGESTSIZE - hash_digest_size[algo];
259
260	if (type != IMA_VERITY_DIGSIG)
261		return -EINVAL;
262
263	memcpy(file_id.hash, digest, hash_digest_size[algo]);
264
265	hash->algo = algo;
266	hash->length = hash_digest_size[algo];
267
268	return ima_calc_buffer_hash(&file_id, sizeof(file_id) - unused, hash);
269}
270
271/*
272 * xattr_verify - verify xattr digest or signature
273 *
274 * Verify whether the hash or signature matches the file contents.
275 *
276 * Return 0 on success, error code otherwise.
277 */
278static int xattr_verify(enum ima_hooks func, struct ima_iint_cache *iint,
279			struct evm_ima_xattr_data *xattr_value, int xattr_len,
280			enum integrity_status *status, const char **cause)
281{
282	struct ima_max_digest_data hash;
283	struct signature_v2_hdr *sig;
284	int rc = -EINVAL, hash_start = 0;
285	int mask;
286
287	switch (xattr_value->type) {
288	case IMA_XATTR_DIGEST_NG:
289		/* first byte contains algorithm id */
290		hash_start = 1;
291		fallthrough;
292	case IMA_XATTR_DIGEST:
293		if (*status != INTEGRITY_PASS_IMMUTABLE) {
294			if (iint->flags & IMA_DIGSIG_REQUIRED) {
295				if (iint->flags & IMA_VERITY_REQUIRED)
296					*cause = "verity-signature-required";
297				else
298					*cause = "IMA-signature-required";
299				*status = INTEGRITY_FAIL;
300				break;
301			}
302			clear_bit(IMA_DIGSIG, &iint->atomic_flags);
303		} else {
304			set_bit(IMA_DIGSIG, &iint->atomic_flags);
305		}
306		if (xattr_len - sizeof(xattr_value->type) - hash_start >=
307				iint->ima_hash->length)
308			/*
309			 * xattr length may be longer. md5 hash in previous
310			 * version occupied 20 bytes in xattr, instead of 16
311			 */
312			rc = memcmp(&xattr_value->data[hash_start],
313				    iint->ima_hash->digest,
314				    iint->ima_hash->length);
315		else
316			rc = -EINVAL;
317		if (rc) {
318			*cause = "invalid-hash";
319			*status = INTEGRITY_FAIL;
320			break;
321		}
322		*status = INTEGRITY_PASS;
323		break;
324	case EVM_IMA_XATTR_DIGSIG:
325		set_bit(IMA_DIGSIG, &iint->atomic_flags);
326
327		mask = IMA_DIGSIG_REQUIRED | IMA_VERITY_REQUIRED;
328		if ((iint->flags & mask) == mask) {
329			*cause = "verity-signature-required";
330			*status = INTEGRITY_FAIL;
331			break;
332		}
333
334		sig = (typeof(sig))xattr_value;
335		if (sig->version >= 3) {
336			*cause = "invalid-signature-version";
337			*status = INTEGRITY_FAIL;
338			break;
339		}
340		rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
341					     (const char *)xattr_value,
342					     xattr_len,
343					     iint->ima_hash->digest,
344					     iint->ima_hash->length);
345		if (rc == -EOPNOTSUPP) {
346			*status = INTEGRITY_UNKNOWN;
347			break;
348		}
349		if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc &&
350		    func == KEXEC_KERNEL_CHECK)
351			rc = integrity_digsig_verify(INTEGRITY_KEYRING_PLATFORM,
352						     (const char *)xattr_value,
353						     xattr_len,
354						     iint->ima_hash->digest,
355						     iint->ima_hash->length);
356		if (rc) {
357			*cause = "invalid-signature";
358			*status = INTEGRITY_FAIL;
359		} else {
360			*status = INTEGRITY_PASS;
361		}
362		break;
363	case IMA_VERITY_DIGSIG:
364		set_bit(IMA_DIGSIG, &iint->atomic_flags);
365
366		if (iint->flags & IMA_DIGSIG_REQUIRED) {
367			if (!(iint->flags & IMA_VERITY_REQUIRED)) {
368				*cause = "IMA-signature-required";
369				*status = INTEGRITY_FAIL;
370				break;
371			}
372		}
373
374		sig = (typeof(sig))xattr_value;
375		if (sig->version != 3) {
376			*cause = "invalid-signature-version";
377			*status = INTEGRITY_FAIL;
378			break;
379		}
380
381		rc = calc_file_id_hash(IMA_VERITY_DIGSIG, iint->ima_hash->algo,
382				       iint->ima_hash->digest,
383				       container_of(&hash.hdr,
384					       struct ima_digest_data, hdr));
385		if (rc) {
386			*cause = "sigv3-hashing-error";
387			*status = INTEGRITY_FAIL;
388			break;
389		}
390
391		rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
392					     (const char *)xattr_value,
393					     xattr_len, hash.digest,
394					     hash.hdr.length);
395		if (rc) {
396			*cause = "invalid-verity-signature";
397			*status = INTEGRITY_FAIL;
398		} else {
399			*status = INTEGRITY_PASS;
400		}
401
402		break;
403	default:
404		*status = INTEGRITY_UNKNOWN;
405		*cause = "unknown-ima-data";
406		break;
407	}
408
409	return rc;
410}
411
412/*
413 * modsig_verify - verify modsig signature
414 *
415 * Verify whether the signature matches the file contents.
416 *
417 * Return 0 on success, error code otherwise.
418 */
419static int modsig_verify(enum ima_hooks func, const struct modsig *modsig,
420			 enum integrity_status *status, const char **cause)
421{
422	int rc;
423
424	rc = integrity_modsig_verify(INTEGRITY_KEYRING_IMA, modsig);
425	if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc &&
426	    func == KEXEC_KERNEL_CHECK)
427		rc = integrity_modsig_verify(INTEGRITY_KEYRING_PLATFORM,
428					     modsig);
429	if (rc) {
430		*cause = "invalid-signature";
431		*status = INTEGRITY_FAIL;
432	} else {
433		*status = INTEGRITY_PASS;
434	}
435
436	return rc;
437}
438
439/*
440 * ima_check_blacklist - determine if the binary is blacklisted.
441 *
442 * Add the hash of the blacklisted binary to the measurement list, based
443 * on policy.
444 *
445 * Returns -EPERM if the hash is blacklisted.
446 */
447int ima_check_blacklist(struct ima_iint_cache *iint,
448			const struct modsig *modsig, int pcr)
449{
450	enum hash_algo hash_algo;
451	const u8 *digest = NULL;
452	u32 digestsize = 0;
453	int rc = 0;
454
455	if (!(iint->flags & IMA_CHECK_BLACKLIST))
456		return 0;
457
458	if (iint->flags & IMA_MODSIG_ALLOWED && modsig) {
459		ima_get_modsig_digest(modsig, &hash_algo, &digest, &digestsize);
460
461		rc = is_binary_blacklisted(digest, digestsize);
462	} else if (iint->flags & IMA_DIGSIG_REQUIRED && iint->ima_hash)
463		rc = is_binary_blacklisted(iint->ima_hash->digest, iint->ima_hash->length);
464
465	if ((rc == -EPERM) && (iint->flags & IMA_MEASURE))
466		process_buffer_measurement(&nop_mnt_idmap, NULL, digest, digestsize,
467					   "blacklisted-hash", NONE,
468					   pcr, NULL, false, NULL, 0);
469
470	return rc;
471}
472
473/*
474 * ima_appraise_measurement - appraise file measurement
475 *
476 * Call evm_verifyxattr() to verify the integrity of 'security.ima'.
477 * Assuming success, compare the xattr hash with the collected measurement.
478 *
479 * Return 0 on success, error code otherwise
480 */
481int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
482			     struct file *file, const unsigned char *filename,
483			     struct evm_ima_xattr_data *xattr_value,
484			     int xattr_len, const struct modsig *modsig,
485			     bool bprm_is_check)
486{
487	static const char op[] = "appraise_data";
488	int audit_msgno = AUDIT_INTEGRITY_DATA;
489	const char *cause = "unknown";
490	struct dentry *dentry = file_dentry(file);
491	struct inode *inode = d_backing_inode(dentry);
492	enum integrity_status status = INTEGRITY_UNKNOWN;
493	int rc = xattr_len;
494	bool try_modsig = iint->flags & IMA_MODSIG_ALLOWED && modsig;
495
496	/* If not appraising a modsig, we need an xattr. */
497	if (!(inode->i_opflags & IOP_XATTR) && !try_modsig)
498		return INTEGRITY_UNKNOWN;
499
500	/*
501	 * Unlike any of the other LSM hooks where the kernel enforces file
502	 * integrity, enforcing file integrity for the bprm_creds_for_exec()
503	 * LSM hook with the AT_EXECVE_CHECK flag is left up to the discretion
504	 * of the script interpreter(userspace). Differentiate kernel and
505	 * userspace enforced integrity audit messages.
506	 */
507	if (bprm_is_check)
508		audit_msgno = AUDIT_INTEGRITY_USERSPACE;
509
510	/* If reading the xattr failed and there's no modsig, error out. */
511	if (rc <= 0 && !try_modsig) {
512		if (rc && rc != -ENODATA)
513			goto out;
514
515		if (iint->flags & IMA_DIGSIG_REQUIRED) {
516			if (iint->flags & IMA_VERITY_REQUIRED)
517				cause = "verity-signature-required";
518			else
519				cause = "IMA-signature-required";
520		} else {
521			cause = "missing-hash";
522		}
523
524		status = INTEGRITY_NOLABEL;
525		if (file->f_mode & FMODE_CREATED)
526			iint->flags |= IMA_NEW_FILE;
527		if ((iint->flags & IMA_NEW_FILE) &&
528		    (!(iint->flags & IMA_DIGSIG_REQUIRED) ||
529		     (inode->i_size == 0)))
530			status = INTEGRITY_PASS;
531		goto out;
532	}
533
534	status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value,
535				 rc < 0 ? 0 : rc);
536	switch (status) {
537	case INTEGRITY_PASS:
538	case INTEGRITY_PASS_IMMUTABLE:
539	case INTEGRITY_UNKNOWN:
540		break;
541	case INTEGRITY_NOXATTRS:	/* No EVM protected xattrs. */
542		/* It's fine not to have xattrs when using a modsig. */
543		if (try_modsig)
544			break;
545		fallthrough;
546	case INTEGRITY_NOLABEL:		/* No security.evm xattr. */
547		cause = "missing-HMAC";
548		goto out;
549	case INTEGRITY_FAIL_IMMUTABLE:
550		set_bit(IMA_DIGSIG, &iint->atomic_flags);
551		cause = "invalid-fail-immutable";
552		goto out;
553	case INTEGRITY_FAIL:		/* Invalid HMAC/signature. */
554		cause = "invalid-HMAC";
555		goto out;
556	default:
557		WARN_ONCE(true, "Unexpected integrity status %d\n", status);
558	}
559
560	if (xattr_value)
561		rc = xattr_verify(func, iint, xattr_value, xattr_len, &status,
562				  &cause);
563
564	/*
565	 * If we have a modsig and either no imasig or the imasig's key isn't
566	 * known, then try verifying the modsig.
567	 */
568	if (try_modsig &&
569	    (!xattr_value || xattr_value->type == IMA_XATTR_DIGEST_NG ||
570	     rc == -ENOKEY))
571		rc = modsig_verify(func, modsig, &status, &cause);
572
573out:
574	/*
575	 * File signatures on some filesystems can not be properly verified.
576	 * When such filesystems are mounted by an untrusted mounter or on a
577	 * system not willing to accept such a risk, fail the file signature
578	 * verification.
579	 */
580	if ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) &&
581	    ((inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER) ||
582	     (iint->flags & IMA_FAIL_UNVERIFIABLE_SIGS))) {
583		status = INTEGRITY_FAIL;
584		cause = "unverifiable-signature";
585		integrity_audit_msg(audit_msgno, inode, filename,
586				    op, cause, rc, 0);
587	} else if (status != INTEGRITY_PASS) {
588		/* Fix mode, but don't replace file signatures. */
589		if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig &&
590		    (!xattr_value ||
591		     xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
592			if (!ima_fix_xattr(dentry, iint))
593				status = INTEGRITY_PASS;
594		}
595
596		/*
597		 * Permit new files with file/EVM portable signatures, but
598		 * without data.
599		 */
600		if (inode->i_size == 0 && iint->flags & IMA_NEW_FILE &&
601		    test_bit(IMA_DIGSIG, &iint->atomic_flags)) {
602			status = INTEGRITY_PASS;
603		}
604
605		integrity_audit_msg(audit_msgno, inode, filename,
606				    op, cause, rc, 0);
607	} else {
608		ima_cache_flags(iint, func);
609	}
610
611	ima_set_cache_status(iint, func, status);
612	return status;
613}
614
615/*
616 * ima_update_xattr - update 'security.ima' hash value
617 */
618void ima_update_xattr(struct ima_iint_cache *iint, struct file *file)
619{
620	struct dentry *dentry = file_dentry(file);
621	int rc = 0;
622
623	/* do not collect and update hash for digital signatures */
624	if (test_bit(IMA_DIGSIG, &iint->atomic_flags))
625		return;
626
627	if ((iint->ima_file_status != INTEGRITY_PASS) &&
628	    !(iint->flags & IMA_HASH))
629		return;
630
631	rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo, NULL);
632	if (rc < 0)
633		return;
634
635	inode_lock(file_inode(file));
636	ima_fix_xattr(dentry, iint);
637	inode_unlock(file_inode(file));
638}
639
640/**
641 * ima_inode_post_setattr - reflect file metadata changes
642 * @idmap:  idmap of the mount the inode was found from
643 * @dentry: pointer to the affected dentry
644 * @ia_valid: for the UID and GID status
645 *
646 * Changes to a dentry's metadata might result in needing to appraise.
647 *
648 * This function is called from notify_change(), which expects the caller
649 * to lock the inode's i_mutex.
650 */
651static void ima_inode_post_setattr(struct mnt_idmap *idmap,
652				   struct dentry *dentry, int ia_valid)
653{
654	struct inode *inode = d_backing_inode(dentry);
655	struct ima_iint_cache *iint;
656	int action;
657
658	if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)
659	    || !(inode->i_opflags & IOP_XATTR))
660		return;
661
662	action = ima_must_appraise(idmap, inode, MAY_ACCESS, POST_SETATTR);
663	iint = ima_iint_find(inode);
664	if (iint) {
665		set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
666		if (!action)
667			clear_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
668	}
669}
670
671/*
672 * ima_protect_xattr - protect 'security.ima'
673 *
674 * Ensure that not just anyone can modify or remove 'security.ima'.
675 */
676static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
677			     const void *xattr_value, size_t xattr_value_len)
678{
679	if (strcmp(xattr_name, XATTR_NAME_IMA) == 0) {
680		if (!capable(CAP_SYS_ADMIN))
681			return -EPERM;
682		return 1;
683	}
684	return 0;
685}
686
687/*
688 * ima_reset_appraise_flags - reset ima_iint_cache flags
689 *
690 * @digsig: whether to clear/set IMA_DIGSIG flag, tristate values
691 *          0: clear IMA_DIGSIG
692 *          1: set IMA_DIGSIG
693 *         -1: don't change IMA_DIGSIG
694 *
695 */
696static void ima_reset_appraise_flags(struct inode *inode, int digsig)
697{
698	struct ima_iint_cache *iint;
699
700	if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode))
701		return;
702
703	iint = ima_iint_find(inode);
704	if (!iint)
705		return;
706	iint->measured_pcrs = 0;
707	set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags);
708	if (digsig == 1)
709		set_bit(IMA_DIGSIG, &iint->atomic_flags);
710	else if (digsig == 0)
711		clear_bit(IMA_DIGSIG, &iint->atomic_flags);
712}
713
714/**
715 * validate_hash_algo() - Block setxattr with unsupported hash algorithms
716 * @dentry: object of the setxattr()
717 * @xattr_value: userland supplied xattr value
718 * @xattr_value_len: length of xattr_value
719 *
720 * The xattr value is mapped to its hash algorithm, and this algorithm
721 * must be built in the kernel for the setxattr to be allowed.
722 *
723 * Emit an audit message when the algorithm is invalid.
724 *
725 * Return: 0 on success, else an error.
726 */
727static int validate_hash_algo(struct dentry *dentry,
728			      const struct evm_ima_xattr_data *xattr_value,
729			      size_t xattr_value_len)
730{
731	char *path = NULL, *pathbuf = NULL;
732	enum hash_algo xattr_hash_algo;
733	const char *errmsg = "unavailable-hash-algorithm";
734	unsigned int allowed_hashes;
735
736	xattr_hash_algo = ima_get_hash_algo(xattr_value, xattr_value_len);
737
738	allowed_hashes = atomic_read(&ima_setxattr_allowed_hash_algorithms);
739
740	if (allowed_hashes) {
741		/* success if the algorithm is allowed in the ima policy */
742		if (allowed_hashes & (1U << xattr_hash_algo))
743			return 0;
744
745		/*
746		 * We use a different audit message when the hash algorithm
747		 * is denied by a policy rule, instead of not being built
748		 * in the kernel image
749		 */
750		errmsg = "denied-hash-algorithm";
751	} else {
752		if (likely(xattr_hash_algo == ima_hash_algo))
753			return 0;
754
755		/* allow any xattr using an algorithm built in the kernel */
756		if (crypto_has_alg(hash_algo_name[xattr_hash_algo], 0, 0))
757			return 0;
758	}
759
760	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
761	if (!pathbuf)
762		return -EACCES;
763
764	path = dentry_path(dentry, pathbuf, PATH_MAX);
765
766	integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path,
767			    "set_data", errmsg, -EACCES, 0);
768
769	kfree(pathbuf);
770
771	return -EACCES;
772}
773
774static int ima_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
775			      const char *xattr_name, const void *xattr_value,
776			      size_t xattr_value_len, int flags)
777{
778	const struct evm_ima_xattr_data *xvalue = xattr_value;
779	int digsig = 0;
780	int result;
781	int err;
782
783	result = ima_protect_xattr(dentry, xattr_name, xattr_value,
784				   xattr_value_len);
785	if (result == 1) {
786		if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
787			return -EINVAL;
788
789		err = validate_hash_algo(dentry, xvalue, xattr_value_len);
790		if (err)
791			return err;
792
793		digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
794	} else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
795		digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
796	} else {
797		digsig = -1;
798	}
799	if (result == 1 || evm_revalidate_status(xattr_name)) {
800		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
801		if (result == 1)
802			result = 0;
803	}
804	return result;
805}
806
807static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
808			     const char *acl_name, struct posix_acl *kacl)
809{
810	if (evm_revalidate_status(acl_name))
811		ima_reset_appraise_flags(d_backing_inode(dentry), -1);
812
813	return 0;
814}
815
816static int ima_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,
817				 const char *xattr_name)
818{
819	int result, digsig = -1;
820
821	result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
822	if (result == 1 || evm_revalidate_status(xattr_name)) {
823		if (!strcmp(xattr_name, XATTR_NAME_IMA))
824			digsig = 0;
825		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
826		if (result == 1)
827			result = 0;
828	}
829	return result;
830}
831
832static int ima_inode_remove_acl(struct mnt_idmap *idmap, struct dentry *dentry,
833				const char *acl_name)
834{
835	return ima_inode_set_acl(idmap, dentry, acl_name, NULL);
836}
837
838static struct security_hook_list ima_appraise_hooks[] __ro_after_init = {
839	LSM_HOOK_INIT(inode_post_setattr, ima_inode_post_setattr),
840	LSM_HOOK_INIT(inode_setxattr, ima_inode_setxattr),
841	LSM_HOOK_INIT(inode_set_acl, ima_inode_set_acl),
842	LSM_HOOK_INIT(inode_removexattr, ima_inode_removexattr),
843	LSM_HOOK_INIT(inode_remove_acl, ima_inode_remove_acl),
844};
845
846void __init init_ima_appraise_lsm(const struct lsm_id *lsmid)
847{
848	security_add_hooks(ima_appraise_hooks, ARRAY_SIZE(ima_appraise_hooks),
849			   lsmid);
850}