1/*
  2 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
  3 *
  4 * Authors:
  5 * Reiner Sailer <sailer@watson.ibm.com>
  6 * Serge Hallyn <serue@us.ibm.com>
  7 * Kylene Hall <kylene@us.ibm.com>
  8 * Mimi Zohar <zohar@us.ibm.com>
  9 *
 10 * This program is free software; you can redistribute it and/or
 11 * modify it under the terms of the GNU General Public License as
 12 * published by the Free Software Foundation, version 2 of the
 13 * License.
 14 *
 15 * File: ima_main.c
 16 *	implements the IMA hooks: ima_bprm_check, ima_file_mmap,
 17 *	and ima_file_check.
 18 */
 19#include <linux/module.h>
 20#include <linux/file.h>
 21#include <linux/binfmts.h>
 22#include <linux/mount.h>
 23#include <linux/mman.h>
 24#include <linux/slab.h>
 25#include <linux/ima.h>
 26
 27#include "ima.h"
 28
 29int ima_initialized;
 30
 31char *ima_hash = "sha1";
 32static int __init hash_setup(char *str)
 33{
 34	if (strncmp(str, "md5", 3) == 0)
 35		ima_hash = "md5";
 36	return 1;
 37}
 38__setup("ima_hash=", hash_setup);
 39
 40/*
 41 * ima_rdwr_violation_check
 42 *
 43 * Only invalidate the PCR for measured files:
 44 * 	- Opening a file for write when already open for read,
 45 *	  results in a time of measure, time of use (ToMToU) error.
 46 *	- Opening a file for read when already open for write,
 47 * 	  could result in a file measurement error.
 48 *
 49 */
 50static void ima_rdwr_violation_check(struct file *file)
 51{
 52	struct dentry *dentry = file->f_path.dentry;
 53	struct inode *inode = dentry->d_inode;
 54	fmode_t mode = file->f_mode;
 55	int rc;
 56	bool send_tomtou = false, send_writers = false;
 57
 58	if (!S_ISREG(inode->i_mode) || !ima_initialized)
 59		return;
 60
 61	mutex_lock(&inode->i_mutex);	/* file metadata: permissions, xattr */
 62
 63	if (mode & FMODE_WRITE) {
 64		if (atomic_read(&inode->i_readcount) && IS_IMA(inode))
 65			send_tomtou = true;
 66		goto out;
 67	}
 68
 69	rc = ima_must_measure(inode, MAY_READ, FILE_CHECK);
 70	if (rc < 0)
 71		goto out;
 72
 73	if (atomic_read(&inode->i_writecount) > 0)
 74		send_writers = true;
 75out:
 76	mutex_unlock(&inode->i_mutex);
 77
 78	if (send_tomtou)
 79		ima_add_violation(inode, dentry->d_name.name, "invalid_pcr",
 80				  "ToMToU");
 81	if (send_writers)
 82		ima_add_violation(inode, dentry->d_name.name, "invalid_pcr",
 83				  "open_writers");
 84}
 85
 86static void ima_check_last_writer(struct integrity_iint_cache *iint,
 87				  struct inode *inode,
 88				  struct file *file)
 89{
 90	fmode_t mode = file->f_mode;
 91
 92	mutex_lock(&iint->mutex);
 93	if (mode & FMODE_WRITE &&
 94	    atomic_read(&inode->i_writecount) == 1 &&
 95	    iint->version != inode->i_version)
 96		iint->flags &= ~IMA_MEASURED;
 97	mutex_unlock(&iint->mutex);
 98}
 99
100/**
101 * ima_file_free - called on __fput()
102 * @file: pointer to file structure being freed
103 *
104 * Flag files that changed, based on i_version
105 */
106void ima_file_free(struct file *file)
107{
108	struct inode *inode = file->f_dentry->d_inode;
109	struct integrity_iint_cache *iint;
110
111	if (!iint_initialized || !S_ISREG(inode->i_mode))
112		return;
113
114	iint = integrity_iint_find(inode);
115	if (!iint)
116		return;
117
118	ima_check_last_writer(iint, inode, file);
119}
120
121static int process_measurement(struct file *file, const unsigned char *filename,
122			       int mask, int function)
123{
124	struct inode *inode = file->f_dentry->d_inode;
125	struct integrity_iint_cache *iint;
126	int rc = 0;
127
128	if (!ima_initialized || !S_ISREG(inode->i_mode))
129		return 0;
130
131	rc = ima_must_measure(inode, mask, function);
132	if (rc != 0)
133		return rc;
134retry:
135	iint = integrity_iint_find(inode);
136	if (!iint) {
137		rc = integrity_inode_alloc(inode);
138		if (!rc || rc == -EEXIST)
139			goto retry;
140		return rc;
141	}
142
143	mutex_lock(&iint->mutex);
144
145	rc = iint->flags & IMA_MEASURED ? 1 : 0;
146	if (rc != 0)
147		goto out;
148
149	rc = ima_collect_measurement(iint, file);
150	if (!rc)
151		ima_store_measurement(iint, file, filename);
152out:
153	mutex_unlock(&iint->mutex);
154	return rc;
155}
156
157/**
158 * ima_file_mmap - based on policy, collect/store measurement.
159 * @file: pointer to the file to be measured (May be NULL)
160 * @prot: contains the protection that will be applied by the kernel.
161 *
162 * Measure files being mmapped executable based on the ima_must_measure()
163 * policy decision.
164 *
165 * Return 0 on success, an error code on failure.
166 * (Based on the results of appraise_measurement().)
167 */
168int ima_file_mmap(struct file *file, unsigned long prot)
169{
170	int rc;
171
172	if (!file)
173		return 0;
174	if (prot & PROT_EXEC)
175		rc = process_measurement(file, file->f_dentry->d_name.name,
176					 MAY_EXEC, FILE_MMAP);
177	return 0;
178}
179
180/**
181 * ima_bprm_check - based on policy, collect/store measurement.
182 * @bprm: contains the linux_binprm structure
183 *
184 * The OS protects against an executable file, already open for write,
185 * from being executed in deny_write_access() and an executable file,
186 * already open for execute, from being modified in get_write_access().
187 * So we can be certain that what we verify and measure here is actually
188 * what is being executed.
189 *
190 * Return 0 on success, an error code on failure.
191 * (Based on the results of appraise_measurement().)
192 */
193int ima_bprm_check(struct linux_binprm *bprm)
194{
195	int rc;
196
197	rc = process_measurement(bprm->file,
198				 (strcmp(bprm->filename, bprm->interp) == 0) ?
199				 bprm->filename : bprm->interp,
200				 MAY_EXEC, BPRM_CHECK);
201	return 0;
202}
203
204/**
205 * ima_path_check - based on policy, collect/store measurement.
206 * @file: pointer to the file to be measured
207 * @mask: contains MAY_READ, MAY_WRITE or MAY_EXECUTE
208 *
209 * Measure files based on the ima_must_measure() policy decision.
210 *
211 * Always return 0 and audit dentry_open failures.
212 * (Return code will be based upon measurement appraisal.)
213 */
214int ima_file_check(struct file *file, int mask)
215{
216	int rc;
217
218	ima_rdwr_violation_check(file);
219	rc = process_measurement(file, file->f_dentry->d_name.name,
220				 mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
221				 FILE_CHECK);
222	return 0;
223}
224EXPORT_SYMBOL_GPL(ima_file_check);
225
226static int __init init_ima(void)
227{
228	int error;
229
230	error = ima_init();
231	ima_initialized = 1;
232	return error;
233}
234
235static void __exit cleanup_ima(void)
236{
237	ima_cleanup();
238}
239
240late_initcall(init_ima);	/* Start IMA after the TPM is available */
241
242MODULE_DESCRIPTION("Integrity Measurement Architecture");
243MODULE_LICENSE("GPL");