2009-02-04 14:06:58 +00:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2005,2006,2007,2008 IBM Corporation
|
|
|
|
*
|
|
|
|
* Authors:
|
|
|
|
* Mimi Zohar <zohar@us.ibm.com>
|
|
|
|
* Kylene Hall <kjhall@us.ibm.com>
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
|
|
|
* the Free Software Foundation, version 2 of the License.
|
|
|
|
*
|
|
|
|
* File: ima_crypto.c
|
2014-03-04 16:04:20 +00:00
|
|
|
* Calculates md5/sha1 file hash, template hash, boot-aggreate hash
|
2009-02-04 14:06:58 +00:00
|
|
|
*/
|
|
|
|
|
2014-02-24 21:59:56 +00:00
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
|
2009-02-04 14:06:58 +00:00
|
|
|
#include <linux/kernel.h>
|
2014-02-26 15:05:20 +00:00
|
|
|
#include <linux/moduleparam.h>
|
|
|
|
#include <linux/ratelimit.h>
|
2009-02-04 14:06:58 +00:00
|
|
|
#include <linux/file.h>
|
|
|
|
#include <linux/crypto.h>
|
|
|
|
#include <linux/scatterlist.h>
|
|
|
|
#include <linux/err.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 08:04:11 +00:00
|
|
|
#include <linux/slab.h>
|
2012-06-08 07:42:30 +00:00
|
|
|
#include <crypto/hash.h>
|
2013-04-25 07:43:56 +00:00
|
|
|
#include <crypto/hash_info.h>
|
2009-02-04 14:06:58 +00:00
|
|
|
#include "ima.h"
|
|
|
|
|
2014-02-26 15:05:20 +00:00
|
|
|
struct ahash_completion {
|
|
|
|
struct completion completion;
|
|
|
|
int err;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* minimum file size for ahash use */
|
|
|
|
static unsigned long ima_ahash_minsize;
|
|
|
|
module_param_named(ahash_minsize, ima_ahash_minsize, ulong, 0644);
|
|
|
|
MODULE_PARM_DESC(ahash_minsize, "Minimum file size for ahash use");
|
|
|
|
|
2014-05-06 11:47:13 +00:00
|
|
|
/* default is 0 - 1 page. */
|
|
|
|
static int ima_maxorder;
|
|
|
|
static unsigned int ima_bufsize = PAGE_SIZE;
|
|
|
|
|
|
|
|
static int param_set_bufsize(const char *val, const struct kernel_param *kp)
|
|
|
|
{
|
|
|
|
unsigned long long size;
|
|
|
|
int order;
|
|
|
|
|
|
|
|
size = memparse(val, NULL);
|
|
|
|
order = get_order(size);
|
|
|
|
if (order >= MAX_ORDER)
|
|
|
|
return -EINVAL;
|
|
|
|
ima_maxorder = order;
|
|
|
|
ima_bufsize = PAGE_SIZE << order;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct kernel_param_ops param_ops_bufsize = {
|
|
|
|
.set = param_set_bufsize,
|
|
|
|
.get = param_get_uint,
|
|
|
|
};
|
|
|
|
#define param_check_bufsize(name, p) __param_check(name, p, unsigned int)
|
|
|
|
|
|
|
|
module_param_named(ahash_bufsize, ima_bufsize, bufsize, 0644);
|
|
|
|
MODULE_PARM_DESC(ahash_bufsize, "Maximum ahash buffer size");
|
|
|
|
|
2012-06-08 07:42:30 +00:00
|
|
|
static struct crypto_shash *ima_shash_tfm;
|
2014-02-26 15:05:20 +00:00
|
|
|
static struct crypto_ahash *ima_ahash_tfm;
|
2012-06-08 07:42:30 +00:00
|
|
|
|
2014-05-08 11:03:22 +00:00
|
|
|
/**
|
|
|
|
* ima_kernel_read - read file content
|
|
|
|
*
|
|
|
|
* This is a function for reading file content instead of kernel_read().
|
|
|
|
* It does not perform locking checks to ensure it cannot be blocked.
|
|
|
|
* It does not perform security checks because it is irrelevant for IMA.
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
static int ima_kernel_read(struct file *file, loff_t offset,
|
|
|
|
char *addr, unsigned long count)
|
|
|
|
{
|
|
|
|
mm_segment_t old_fs;
|
|
|
|
char __user *buf = addr;
|
2014-06-23 17:32:56 +00:00
|
|
|
ssize_t ret = -EINVAL;
|
2014-05-08 11:03:22 +00:00
|
|
|
|
|
|
|
if (!(file->f_mode & FMODE_READ))
|
|
|
|
return -EBADF;
|
|
|
|
|
|
|
|
old_fs = get_fs();
|
|
|
|
set_fs(get_ds());
|
|
|
|
if (file->f_op->read)
|
|
|
|
ret = file->f_op->read(file, buf, count, &offset);
|
2014-06-23 17:32:56 +00:00
|
|
|
else if (file->f_op->aio_read)
|
2014-05-08 11:03:22 +00:00
|
|
|
ret = do_sync_read(file, buf, count, &offset);
|
2014-06-23 17:32:56 +00:00
|
|
|
else if (file->f_op->read_iter)
|
|
|
|
ret = new_sync_read(file, buf, count, &offset);
|
2014-05-08 11:03:22 +00:00
|
|
|
set_fs(old_fs);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2014-09-03 07:19:58 +00:00
|
|
|
int __init ima_init_crypto(void)
|
2009-02-04 14:06:58 +00:00
|
|
|
{
|
2012-06-08 07:42:30 +00:00
|
|
|
long rc;
|
2009-02-04 14:06:58 +00:00
|
|
|
|
2013-04-25 07:43:56 +00:00
|
|
|
ima_shash_tfm = crypto_alloc_shash(hash_algo_name[ima_hash_algo], 0, 0);
|
2012-06-08 07:42:30 +00:00
|
|
|
if (IS_ERR(ima_shash_tfm)) {
|
|
|
|
rc = PTR_ERR(ima_shash_tfm);
|
2013-04-25 07:43:56 +00:00
|
|
|
pr_err("Can not allocate %s (reason: %ld)\n",
|
|
|
|
hash_algo_name[ima_hash_algo], rc);
|
2009-02-04 14:06:58 +00:00
|
|
|
return rc;
|
|
|
|
}
|
2012-06-08 07:42:30 +00:00
|
|
|
return 0;
|
2009-02-04 14:06:58 +00:00
|
|
|
}
|
|
|
|
|
2013-07-04 14:40:01 +00:00
|
|
|
static struct crypto_shash *ima_alloc_tfm(enum hash_algo algo)
|
|
|
|
{
|
|
|
|
struct crypto_shash *tfm = ima_shash_tfm;
|
|
|
|
int rc;
|
|
|
|
|
2014-08-15 10:28:52 +00:00
|
|
|
if (algo < 0 || algo >= HASH_ALGO__LAST)
|
|
|
|
algo = ima_hash_algo;
|
|
|
|
|
|
|
|
if (algo != ima_hash_algo) {
|
2013-07-04 14:40:01 +00:00
|
|
|
tfm = crypto_alloc_shash(hash_algo_name[algo], 0, 0);
|
|
|
|
if (IS_ERR(tfm)) {
|
|
|
|
rc = PTR_ERR(tfm);
|
|
|
|
pr_err("Can not allocate %s (reason: %d)\n",
|
|
|
|
hash_algo_name[algo], rc);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return tfm;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void ima_free_tfm(struct crypto_shash *tfm)
|
|
|
|
{
|
|
|
|
if (tfm != ima_shash_tfm)
|
|
|
|
crypto_free_shash(tfm);
|
|
|
|
}
|
|
|
|
|
2014-05-06 11:47:13 +00:00
|
|
|
/**
|
|
|
|
* ima_alloc_pages() - Allocate contiguous pages.
|
|
|
|
* @max_size: Maximum amount of memory to allocate.
|
|
|
|
* @allocated_size: Returned size of actual allocation.
|
|
|
|
* @last_warn: Should the min_size allocation warn or not.
|
|
|
|
*
|
|
|
|
* Tries to do opportunistic allocation for memory first trying to allocate
|
|
|
|
* max_size amount of memory and then splitting that until zero order is
|
|
|
|
* reached. Allocation is tried without generating allocation warnings unless
|
|
|
|
* last_warn is set. Last_warn set affects only last allocation of zero order.
|
|
|
|
*
|
|
|
|
* By default, ima_maxorder is 0 and it is equivalent to kmalloc(GFP_KERNEL)
|
|
|
|
*
|
|
|
|
* Return pointer to allocated memory, or NULL on failure.
|
|
|
|
*/
|
|
|
|
static void *ima_alloc_pages(loff_t max_size, size_t *allocated_size,
|
|
|
|
int last_warn)
|
|
|
|
{
|
|
|
|
void *ptr;
|
|
|
|
int order = ima_maxorder;
|
|
|
|
gfp_t gfp_mask = __GFP_WAIT | __GFP_NOWARN | __GFP_NORETRY;
|
|
|
|
|
|
|
|
if (order)
|
|
|
|
order = min(get_order(max_size), order);
|
|
|
|
|
|
|
|
for (; order; order--) {
|
|
|
|
ptr = (void *)__get_free_pages(gfp_mask, order);
|
|
|
|
if (ptr) {
|
|
|
|
*allocated_size = PAGE_SIZE << order;
|
|
|
|
return ptr;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* order is zero - one page */
|
|
|
|
|
|
|
|
gfp_mask = GFP_KERNEL;
|
|
|
|
|
|
|
|
if (!last_warn)
|
|
|
|
gfp_mask |= __GFP_NOWARN;
|
|
|
|
|
|
|
|
ptr = (void *)__get_free_pages(gfp_mask, 0);
|
|
|
|
if (ptr) {
|
|
|
|
*allocated_size = PAGE_SIZE;
|
|
|
|
return ptr;
|
|
|
|
}
|
|
|
|
|
|
|
|
*allocated_size = 0;
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* ima_free_pages() - Free pages allocated by ima_alloc_pages().
|
|
|
|
* @ptr: Pointer to allocated pages.
|
|
|
|
* @size: Size of allocated buffer.
|
|
|
|
*/
|
|
|
|
static void ima_free_pages(void *ptr, size_t size)
|
|
|
|
{
|
|
|
|
if (!ptr)
|
|
|
|
return;
|
|
|
|
free_pages((unsigned long)ptr, get_order(size));
|
|
|
|
}
|
|
|
|
|
2014-02-26 15:05:20 +00:00
|
|
|
static struct crypto_ahash *ima_alloc_atfm(enum hash_algo algo)
|
|
|
|
{
|
|
|
|
struct crypto_ahash *tfm = ima_ahash_tfm;
|
|
|
|
int rc;
|
|
|
|
|
2014-07-28 11:59:49 +00:00
|
|
|
if (algo < 0 || algo >= HASH_ALGO__LAST)
|
|
|
|
algo = ima_hash_algo;
|
|
|
|
|
|
|
|
if (algo != ima_hash_algo || !tfm) {
|
2014-02-26 15:05:20 +00:00
|
|
|
tfm = crypto_alloc_ahash(hash_algo_name[algo], 0, 0);
|
|
|
|
if (!IS_ERR(tfm)) {
|
|
|
|
if (algo == ima_hash_algo)
|
|
|
|
ima_ahash_tfm = tfm;
|
|
|
|
} else {
|
|
|
|
rc = PTR_ERR(tfm);
|
|
|
|
pr_err("Can not allocate %s (reason: %d)\n",
|
|
|
|
hash_algo_name[algo], rc);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return tfm;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void ima_free_atfm(struct crypto_ahash *tfm)
|
|
|
|
{
|
|
|
|
if (tfm != ima_ahash_tfm)
|
|
|
|
crypto_free_ahash(tfm);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void ahash_complete(struct crypto_async_request *req, int err)
|
|
|
|
{
|
|
|
|
struct ahash_completion *res = req->data;
|
|
|
|
|
|
|
|
if (err == -EINPROGRESS)
|
|
|
|
return;
|
|
|
|
res->err = err;
|
|
|
|
complete(&res->completion);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ahash_wait(int err, struct ahash_completion *res)
|
|
|
|
{
|
|
|
|
switch (err) {
|
|
|
|
case 0:
|
|
|
|
break;
|
|
|
|
case -EINPROGRESS:
|
|
|
|
case -EBUSY:
|
|
|
|
wait_for_completion(&res->completion);
|
|
|
|
reinit_completion(&res->completion);
|
|
|
|
err = res->err;
|
|
|
|
/* fall through */
|
|
|
|
default:
|
|
|
|
pr_crit_ratelimited("ahash calculation failed: err: %d\n", err);
|
|
|
|
}
|
|
|
|
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ima_calc_file_hash_atfm(struct file *file,
|
|
|
|
struct ima_digest_data *hash,
|
|
|
|
struct crypto_ahash *tfm)
|
|
|
|
{
|
|
|
|
loff_t i_size, offset;
|
2014-05-06 11:54:27 +00:00
|
|
|
char *rbuf[2] = { NULL, };
|
|
|
|
int rc, read = 0, rbuf_len, active = 0, ahash_rc = 0;
|
2014-02-26 15:05:20 +00:00
|
|
|
struct ahash_request *req;
|
|
|
|
struct scatterlist sg[1];
|
|
|
|
struct ahash_completion res;
|
2014-05-06 11:54:27 +00:00
|
|
|
size_t rbuf_size[2];
|
2014-02-26 15:05:20 +00:00
|
|
|
|
|
|
|
hash->length = crypto_ahash_digestsize(tfm);
|
|
|
|
|
|
|
|
req = ahash_request_alloc(tfm, GFP_KERNEL);
|
|
|
|
if (!req)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
init_completion(&res.completion);
|
|
|
|
ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
|
|
|
|
CRYPTO_TFM_REQ_MAY_SLEEP,
|
|
|
|
ahash_complete, &res);
|
|
|
|
|
|
|
|
rc = ahash_wait(crypto_ahash_init(req), &res);
|
|
|
|
if (rc)
|
|
|
|
goto out1;
|
|
|
|
|
|
|
|
i_size = i_size_read(file_inode(file));
|
|
|
|
|
|
|
|
if (i_size == 0)
|
|
|
|
goto out2;
|
|
|
|
|
2014-05-06 11:47:13 +00:00
|
|
|
/*
|
|
|
|
* Try to allocate maximum size of memory.
|
|
|
|
* Fail if even a single page cannot be allocated.
|
|
|
|
*/
|
2014-05-06 11:54:27 +00:00
|
|
|
rbuf[0] = ima_alloc_pages(i_size, &rbuf_size[0], 1);
|
|
|
|
if (!rbuf[0]) {
|
2014-02-26 15:05:20 +00:00
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out1;
|
|
|
|
}
|
|
|
|
|
2014-05-06 11:54:27 +00:00
|
|
|
/* Only allocate one buffer if that is enough. */
|
|
|
|
if (i_size > rbuf_size[0]) {
|
|
|
|
/*
|
|
|
|
* Try to allocate secondary buffer. If that fails fallback to
|
|
|
|
* using single buffering. Use previous memory allocation size
|
|
|
|
* as baseline for possible allocation size.
|
|
|
|
*/
|
|
|
|
rbuf[1] = ima_alloc_pages(i_size - rbuf_size[0],
|
|
|
|
&rbuf_size[1], 0);
|
|
|
|
}
|
|
|
|
|
2014-02-26 15:05:20 +00:00
|
|
|
if (!(file->f_mode & FMODE_READ)) {
|
|
|
|
file->f_mode |= FMODE_READ;
|
|
|
|
read = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (offset = 0; offset < i_size; offset += rbuf_len) {
|
2014-05-06 11:54:27 +00:00
|
|
|
if (!rbuf[1] && offset) {
|
|
|
|
/* Not using two buffers, and it is not the first
|
|
|
|
* read/request, wait for the completion of the
|
|
|
|
* previous ahash_update() request.
|
|
|
|
*/
|
|
|
|
rc = ahash_wait(ahash_rc, &res);
|
|
|
|
if (rc)
|
|
|
|
goto out3;
|
|
|
|
}
|
|
|
|
/* read buffer */
|
|
|
|
rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
|
|
|
|
rc = ima_kernel_read(file, offset, rbuf[active], rbuf_len);
|
|
|
|
if (rc != rbuf_len)
|
|
|
|
goto out3;
|
|
|
|
|
|
|
|
if (rbuf[1] && offset) {
|
|
|
|
/* Using two buffers, and it is not the first
|
|
|
|
* read/request, wait for the completion of the
|
|
|
|
* previous ahash_update() request.
|
|
|
|
*/
|
|
|
|
rc = ahash_wait(ahash_rc, &res);
|
|
|
|
if (rc)
|
|
|
|
goto out3;
|
2014-02-26 15:05:20 +00:00
|
|
|
}
|
|
|
|
|
2014-05-06 11:54:27 +00:00
|
|
|
sg_init_one(&sg[0], rbuf[active], rbuf_len);
|
2014-02-26 15:05:20 +00:00
|
|
|
ahash_request_set_crypt(req, sg, NULL, rbuf_len);
|
|
|
|
|
2014-05-06 11:54:27 +00:00
|
|
|
ahash_rc = crypto_ahash_update(req);
|
|
|
|
|
|
|
|
if (rbuf[1])
|
|
|
|
active = !active; /* swap buffers, if we use two */
|
2014-02-26 15:05:20 +00:00
|
|
|
}
|
2014-05-06 11:54:27 +00:00
|
|
|
/* wait for the last update request to complete */
|
|
|
|
rc = ahash_wait(ahash_rc, &res);
|
|
|
|
out3:
|
2014-02-26 15:05:20 +00:00
|
|
|
if (read)
|
|
|
|
file->f_mode &= ~FMODE_READ;
|
2014-05-06 11:54:27 +00:00
|
|
|
ima_free_pages(rbuf[0], rbuf_size[0]);
|
|
|
|
ima_free_pages(rbuf[1], rbuf_size[1]);
|
2014-02-26 15:05:20 +00:00
|
|
|
out2:
|
|
|
|
if (!rc) {
|
|
|
|
ahash_request_set_crypt(req, NULL, hash->digest, 0);
|
|
|
|
rc = ahash_wait(crypto_ahash_final(req), &res);
|
|
|
|
}
|
|
|
|
out1:
|
|
|
|
ahash_request_free(req);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ima_calc_file_ahash(struct file *file, struct ima_digest_data *hash)
|
|
|
|
{
|
|
|
|
struct crypto_ahash *tfm;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tfm = ima_alloc_atfm(hash->algo);
|
|
|
|
if (IS_ERR(tfm))
|
|
|
|
return PTR_ERR(tfm);
|
|
|
|
|
|
|
|
rc = ima_calc_file_hash_atfm(file, hash, tfm);
|
|
|
|
|
|
|
|
ima_free_atfm(tfm);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2013-04-25 07:43:56 +00:00
|
|
|
static int ima_calc_file_hash_tfm(struct file *file,
|
|
|
|
struct ima_digest_data *hash,
|
|
|
|
struct crypto_shash *tfm)
|
2009-02-04 14:06:58 +00:00
|
|
|
{
|
2009-08-21 18:32:49 +00:00
|
|
|
loff_t i_size, offset = 0;
|
2009-02-04 14:06:58 +00:00
|
|
|
char *rbuf;
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 15:15:05 +00:00
|
|
|
int rc, read = 0;
|
2014-04-04 21:18:00 +00:00
|
|
|
SHASH_DESC_ON_STACK(shash, tfm);
|
2009-02-04 14:06:58 +00:00
|
|
|
|
2014-04-04 21:18:00 +00:00
|
|
|
shash->tfm = tfm;
|
|
|
|
shash->flags = 0;
|
2012-06-08 07:42:30 +00:00
|
|
|
|
2013-07-04 14:40:01 +00:00
|
|
|
hash->length = crypto_shash_digestsize(tfm);
|
|
|
|
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_init(shash);
|
2009-02-04 14:06:58 +00:00
|
|
|
if (rc != 0)
|
|
|
|
return rc;
|
|
|
|
|
2014-02-27 18:16:47 +00:00
|
|
|
i_size = i_size_read(file_inode(file));
|
|
|
|
|
|
|
|
if (i_size == 0)
|
2009-02-04 14:06:58 +00:00
|
|
|
goto out;
|
2014-02-27 18:16:47 +00:00
|
|
|
|
|
|
|
rbuf = kzalloc(PAGE_SIZE, GFP_KERNEL);
|
|
|
|
if (!rbuf)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 15:15:05 +00:00
|
|
|
if (!(file->f_mode & FMODE_READ)) {
|
|
|
|
file->f_mode |= FMODE_READ;
|
|
|
|
read = 1;
|
|
|
|
}
|
2014-02-27 18:16:47 +00:00
|
|
|
|
2009-02-04 14:06:58 +00:00
|
|
|
while (offset < i_size) {
|
|
|
|
int rbuf_len;
|
|
|
|
|
2014-05-08 11:03:22 +00:00
|
|
|
rbuf_len = ima_kernel_read(file, offset, rbuf, PAGE_SIZE);
|
2009-02-04 14:06:58 +00:00
|
|
|
if (rbuf_len < 0) {
|
|
|
|
rc = rbuf_len;
|
|
|
|
break;
|
|
|
|
}
|
2009-08-21 18:32:49 +00:00
|
|
|
if (rbuf_len == 0)
|
|
|
|
break;
|
2009-02-04 14:06:58 +00:00
|
|
|
offset += rbuf_len;
|
|
|
|
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_update(shash, rbuf, rbuf_len);
|
2009-02-04 14:06:58 +00:00
|
|
|
if (rc)
|
|
|
|
break;
|
|
|
|
}
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 15:15:05 +00:00
|
|
|
if (read)
|
|
|
|
file->f_mode &= ~FMODE_READ;
|
2014-02-27 18:16:47 +00:00
|
|
|
kfree(rbuf);
|
2009-02-04 14:06:58 +00:00
|
|
|
out:
|
2014-02-27 18:16:47 +00:00
|
|
|
if (!rc)
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_final(shash, hash->digest);
|
2009-02-04 14:06:58 +00:00
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2014-02-26 15:05:20 +00:00
|
|
|
static int ima_calc_file_shash(struct file *file, struct ima_digest_data *hash)
|
2013-04-25 07:43:56 +00:00
|
|
|
{
|
2013-07-04 14:40:01 +00:00
|
|
|
struct crypto_shash *tfm;
|
2013-04-25 07:43:56 +00:00
|
|
|
int rc;
|
|
|
|
|
2013-07-04 14:40:01 +00:00
|
|
|
tfm = ima_alloc_tfm(hash->algo);
|
|
|
|
if (IS_ERR(tfm))
|
|
|
|
return PTR_ERR(tfm);
|
2013-04-25 07:43:56 +00:00
|
|
|
|
|
|
|
rc = ima_calc_file_hash_tfm(file, hash, tfm);
|
|
|
|
|
2013-07-04 14:40:01 +00:00
|
|
|
ima_free_tfm(tfm);
|
2013-04-25 07:43:56 +00:00
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2014-02-26 15:05:20 +00:00
|
|
|
/*
|
|
|
|
* ima_calc_file_hash - calculate file hash
|
|
|
|
*
|
|
|
|
* Asynchronous hash (ahash) allows using HW acceleration for calculating
|
|
|
|
* a hash. ahash performance varies for different data sizes on different
|
|
|
|
* crypto accelerators. shash performance might be better for smaller files.
|
|
|
|
* The 'ima.ahash_minsize' module parameter allows specifying the best
|
|
|
|
* minimum file size for using ahash on the system.
|
|
|
|
*
|
|
|
|
* If the ima.ahash_minsize parameter is not specified, this function uses
|
|
|
|
* shash for the hash calculation. If ahash fails, it falls back to using
|
|
|
|
* shash.
|
|
|
|
*/
|
|
|
|
int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
|
|
|
|
{
|
|
|
|
loff_t i_size;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
i_size = i_size_read(file_inode(file));
|
|
|
|
|
|
|
|
if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
|
|
|
|
rc = ima_calc_file_ahash(file, hash);
|
|
|
|
if (!rc)
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return ima_calc_file_shash(file, hash);
|
|
|
|
}
|
|
|
|
|
2009-02-04 14:06:58 +00:00
|
|
|
/*
|
2013-06-07 10:16:33 +00:00
|
|
|
* Calculate the hash of template data
|
2009-02-04 14:06:58 +00:00
|
|
|
*/
|
2013-06-07 10:16:33 +00:00
|
|
|
static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
|
2013-11-08 18:21:39 +00:00
|
|
|
struct ima_template_desc *td,
|
2013-06-07 10:16:33 +00:00
|
|
|
int num_fields,
|
|
|
|
struct ima_digest_data *hash,
|
|
|
|
struct crypto_shash *tfm)
|
2009-02-04 14:06:58 +00:00
|
|
|
{
|
2014-04-04 21:18:00 +00:00
|
|
|
SHASH_DESC_ON_STACK(shash, tfm);
|
2013-06-07 10:16:33 +00:00
|
|
|
int rc, i;
|
2009-02-04 14:06:58 +00:00
|
|
|
|
2014-04-04 21:18:00 +00:00
|
|
|
shash->tfm = tfm;
|
|
|
|
shash->flags = 0;
|
2009-02-04 14:06:58 +00:00
|
|
|
|
2013-06-07 10:16:24 +00:00
|
|
|
hash->length = crypto_shash_digestsize(tfm);
|
2013-04-25 07:43:56 +00:00
|
|
|
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_init(shash);
|
2013-06-07 10:16:33 +00:00
|
|
|
if (rc != 0)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
for (i = 0; i < num_fields; i++) {
|
2014-02-03 12:56:05 +00:00
|
|
|
u8 buffer[IMA_EVENT_NAME_LEN_MAX + 1] = { 0 };
|
|
|
|
u8 *data_to_hash = field_data[i].data;
|
|
|
|
u32 datalen = field_data[i].len;
|
|
|
|
|
2013-11-08 18:21:39 +00:00
|
|
|
if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) {
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_update(shash,
|
2013-11-08 18:21:39 +00:00
|
|
|
(const u8 *) &field_data[i].len,
|
|
|
|
sizeof(field_data[i].len));
|
|
|
|
if (rc)
|
|
|
|
break;
|
2014-02-03 12:56:05 +00:00
|
|
|
} else if (strcmp(td->fields[i]->field_id, "n") == 0) {
|
|
|
|
memcpy(buffer, data_to_hash, datalen);
|
|
|
|
data_to_hash = buffer;
|
|
|
|
datalen = IMA_EVENT_NAME_LEN_MAX + 1;
|
2013-11-08 18:21:39 +00:00
|
|
|
}
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_update(shash, data_to_hash, datalen);
|
2013-06-07 10:16:33 +00:00
|
|
|
if (rc)
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!rc)
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_final(shash, hash->digest);
|
2013-06-07 10:16:33 +00:00
|
|
|
|
|
|
|
return rc;
|
2009-02-04 14:06:58 +00:00
|
|
|
}
|
|
|
|
|
2013-11-08 18:21:39 +00:00
|
|
|
int ima_calc_field_array_hash(struct ima_field_data *field_data,
|
|
|
|
struct ima_template_desc *desc, int num_fields,
|
2013-06-07 10:16:33 +00:00
|
|
|
struct ima_digest_data *hash)
|
2013-06-07 10:16:24 +00:00
|
|
|
{
|
|
|
|
struct crypto_shash *tfm;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tfm = ima_alloc_tfm(hash->algo);
|
|
|
|
if (IS_ERR(tfm))
|
|
|
|
return PTR_ERR(tfm);
|
|
|
|
|
2013-11-08 18:21:39 +00:00
|
|
|
rc = ima_calc_field_array_hash_tfm(field_data, desc, num_fields,
|
|
|
|
hash, tfm);
|
2013-06-07 10:16:24 +00:00
|
|
|
|
|
|
|
ima_free_tfm(tfm);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2009-05-21 19:43:32 +00:00
|
|
|
static void __init ima_pcrread(int idx, u8 *pcr)
|
2009-02-04 14:06:58 +00:00
|
|
|
{
|
|
|
|
if (!ima_used_chip)
|
|
|
|
return;
|
|
|
|
|
|
|
|
if (tpm_pcr_read(TPM_ANY_NUM, idx, pcr) != 0)
|
2014-02-24 21:59:56 +00:00
|
|
|
pr_err("Error Communicating to TPM chip\n");
|
2009-02-04 14:06:58 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Calculate the boot aggregate hash
|
|
|
|
*/
|
2013-06-07 10:16:25 +00:00
|
|
|
static int __init ima_calc_boot_aggregate_tfm(char *digest,
|
|
|
|
struct crypto_shash *tfm)
|
2009-02-04 14:06:58 +00:00
|
|
|
{
|
2013-03-12 00:29:47 +00:00
|
|
|
u8 pcr_i[TPM_DIGEST_SIZE];
|
2009-02-04 14:06:58 +00:00
|
|
|
int rc, i;
|
2014-04-04 21:18:00 +00:00
|
|
|
SHASH_DESC_ON_STACK(shash, tfm);
|
2012-06-08 07:42:30 +00:00
|
|
|
|
2014-04-04 21:18:00 +00:00
|
|
|
shash->tfm = tfm;
|
|
|
|
shash->flags = 0;
|
2009-02-04 14:06:58 +00:00
|
|
|
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_init(shash);
|
2009-02-04 14:06:58 +00:00
|
|
|
if (rc != 0)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
/* cumulative sha1 over tpm registers 0-7 */
|
|
|
|
for (i = TPM_PCR0; i < TPM_PCR8; i++) {
|
|
|
|
ima_pcrread(i, pcr_i);
|
|
|
|
/* now accumulate with current aggregate */
|
2014-04-04 21:18:00 +00:00
|
|
|
rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE);
|
2009-02-04 14:06:58 +00:00
|
|
|
}
|
|
|
|
if (!rc)
|
2014-04-04 21:18:00 +00:00
|
|
|
crypto_shash_final(shash, digest);
|
2009-02-04 14:06:58 +00:00
|
|
|
return rc;
|
|
|
|
}
|
2013-06-07 10:16:25 +00:00
|
|
|
|
|
|
|
int __init ima_calc_boot_aggregate(struct ima_digest_data *hash)
|
|
|
|
{
|
|
|
|
struct crypto_shash *tfm;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tfm = ima_alloc_tfm(hash->algo);
|
|
|
|
if (IS_ERR(tfm))
|
|
|
|
return PTR_ERR(tfm);
|
|
|
|
|
|
|
|
hash->length = crypto_shash_digestsize(tfm);
|
|
|
|
rc = ima_calc_boot_aggregate_tfm(hash->digest, tfm);
|
|
|
|
|
|
|
|
ima_free_tfm(tfm);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|