security/integrity/integrity.h

0001 /* SPDX-License-Identifier: GPL-2.0-only */
0002 /*
0003  * Copyright (C) 2009-2010 IBM Corporation
0004  *
0005  * Authors:
0006  * Mimi Zohar <zohar@us.ibm.com>
0007  */
0008
0009 #ifdef pr_fmt
0010 #undef pr_fmt
0011 #endif
0012
0013 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0014
0015 #include <linux/types.h>
0016 #include <linux/integrity.h>
0017 #include <crypto/sha1.h>
0018 #include <crypto/hash.h>
0019 #include <linux/key.h>
0020 #include <linux/audit.h>
0021
0022 /* iint action cache flags */
0023 #define IMA_MEASURE     0x00000001
0024 #define IMA_MEASURED        0x00000002
0025 #define IMA_APPRAISE        0x00000004
0026 #define IMA_APPRAISED       0x00000008
0027 /*#define IMA_COLLECT       0x00000010  do not use this flag */
0028 #define IMA_COLLECTED       0x00000020
0029 #define IMA_AUDIT       0x00000040
0030 #define IMA_AUDITED     0x00000080
0031 #define IMA_HASH        0x00000100
0032 #define IMA_HASHED      0x00000200
0033
0034 /* iint policy rule cache flags */
0035 #define IMA_NONACTION_FLAGS 0xff000000
0036 #define IMA_DIGSIG_REQUIRED 0x01000000
0037 #define IMA_PERMIT_DIRECTIO 0x02000000
0038 #define IMA_NEW_FILE        0x04000000
0039 #define EVM_IMMUTABLE_DIGSIG    0x08000000
0040 #define IMA_FAIL_UNVERIFIABLE_SIGS  0x10000000
0041 #define IMA_MODSIG_ALLOWED  0x20000000
0042 #define IMA_CHECK_BLACKLIST 0x40000000
0043 #define IMA_VERITY_REQUIRED 0x80000000
0044
0045 #define IMA_DO_MASK     (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
0046                  IMA_HASH | IMA_APPRAISE_SUBMASK)
0047 #define IMA_DONE_MASK       (IMA_MEASURED | IMA_APPRAISED | IMA_AUDITED | \
0048                  IMA_HASHED | IMA_COLLECTED | \
0049                  IMA_APPRAISED_SUBMASK)
0050
0051 /* iint subaction appraise cache flags */
0052 #define IMA_FILE_APPRAISE   0x00001000
0053 #define IMA_FILE_APPRAISED  0x00002000
0054 #define IMA_MMAP_APPRAISE   0x00004000
0055 #define IMA_MMAP_APPRAISED  0x00008000
0056 #define IMA_BPRM_APPRAISE   0x00010000
0057 #define IMA_BPRM_APPRAISED  0x00020000
0058 #define IMA_READ_APPRAISE   0x00040000
0059 #define IMA_READ_APPRAISED  0x00080000
0060 #define IMA_CREDS_APPRAISE  0x00100000
0061 #define IMA_CREDS_APPRAISED 0x00200000
0062 #define IMA_APPRAISE_SUBMASK    (IMA_FILE_APPRAISE | IMA_MMAP_APPRAISE | \
0063                  IMA_BPRM_APPRAISE | IMA_READ_APPRAISE | \
0064                  IMA_CREDS_APPRAISE)
0065 #define IMA_APPRAISED_SUBMASK   (IMA_FILE_APPRAISED | IMA_MMAP_APPRAISED | \
0066                  IMA_BPRM_APPRAISED | IMA_READ_APPRAISED | \
0067                  IMA_CREDS_APPRAISED)
0068
0069 /* iint cache atomic_flags */
0070 #define IMA_CHANGE_XATTR    0
0071 #define IMA_UPDATE_XATTR    1
0072 #define IMA_CHANGE_ATTR     2
0073 #define IMA_DIGSIG      3
0074 #define IMA_MUST_MEASURE    4
0075
0076 enum evm_ima_xattr_type {
0077     IMA_XATTR_DIGEST = 0x01,
0078     EVM_XATTR_HMAC,
0079     EVM_IMA_XATTR_DIGSIG,
0080     IMA_XATTR_DIGEST_NG,
0081     EVM_XATTR_PORTABLE_DIGSIG,
0082     IMA_VERITY_DIGSIG,
0083     IMA_XATTR_LAST
0084 };
0085
0086 struct evm_ima_xattr_data {
0087     u8 type;
0088     u8 data[];
0089 } __packed;
0090
0091 /* Only used in the EVM HMAC code. */
0092 struct evm_xattr {
0093     struct evm_ima_xattr_data data;
0094     u8 digest[SHA1_DIGEST_SIZE];
0095 } __packed;
0096
0097 #define IMA_MAX_DIGEST_SIZE HASH_MAX_DIGESTSIZE
0098
0099 struct ima_digest_data {
0100     u8 algo;
0101     u8 length;
0102     union {
0103         struct {
0104             u8 unused;
0105             u8 type;
0106         } sha1;
0107         struct {
0108             u8 type;
0109             u8 algo;
0110         } ng;
0111         u8 data[2];
0112     } xattr;
0113     u8 digest[];
0114 } __packed;
0115
0116 /*
0117  * Instead of wrapping the ima_digest_data struct inside a local structure
0118  * with the maximum hash size, define ima_max_digest_data struct.
0119  */
0120 struct ima_max_digest_data {
0121     struct ima_digest_data hdr;
0122     u8 digest[HASH_MAX_DIGESTSIZE];
0123 } __packed;
0124
0125 /*
0126  * signature header format v2 - for using with asymmetric keys
0127  *
0128  * The signature_v2_hdr struct includes a signature format version
0129  * to simplify defining new signature formats.
0130  *
0131  * signature format:
0132  * version 2: regular file data hash based signature
0133  * version 3: struct ima_file_id data based signature
0134  */
0135 struct signature_v2_hdr {
0136     uint8_t type;       /* xattr type */
0137     uint8_t version;    /* signature format version */
0138     uint8_t hash_algo;  /* Digest algorithm [enum hash_algo] */
0139     __be32 keyid;       /* IMA key identifier - not X509/PGP specific */
0140     __be16 sig_size;    /* signature size */
0141     uint8_t sig[];      /* signature payload */
0142 } __packed;
0143
0144 /*
0145  * IMA signature version 3 disambiguates the data that is signed, by
0146  * indirectly signing the hash of the ima_file_id structure data,
0147  * containing either the fsverity_descriptor struct digest or, in the
0148  * future, the regular IMA file hash.
0149  *
0150  * (The hash of the ima_file_id structure is only of the portion used.)
0151  */
0152 struct ima_file_id {
0153     __u8 hash_type;     /* xattr type [enum evm_ima_xattr_type] */
0154     __u8 hash_algorithm;    /* Digest algorithm [enum hash_algo] */
0155     __u8 hash[HASH_MAX_DIGESTSIZE];
0156 } __packed;
0157
0158 /* integrity data associated with an inode */
0159 struct integrity_iint_cache {
0160     struct rb_node rb_node; /* rooted in integrity_iint_tree */
0161     struct mutex mutex; /* protects: version, flags, digest */
0162     struct inode *inode;    /* back pointer to inode in question */
0163     u64 version;        /* track inode changes */
0164     unsigned long flags;
0165     unsigned long measured_pcrs;
0166     unsigned long atomic_flags;
0167     enum integrity_status ima_file_status:4;
0168     enum integrity_status ima_mmap_status:4;
0169     enum integrity_status ima_bprm_status:4;
0170     enum integrity_status ima_read_status:4;
0171     enum integrity_status ima_creds_status:4;
0172     enum integrity_status evm_status:4;
0173     struct ima_digest_data *ima_hash;
0174 };
0175
0176 /* rbtree tree calls to lookup, insert, delete
0177  * integrity data associated with an inode.
0178  */
0179 struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
0180
0181 int integrity_kernel_read(struct file *file, loff_t offset,
0182               void *addr, unsigned long count);
0183
0184 #define INTEGRITY_KEYRING_EVM       0
0185 #define INTEGRITY_KEYRING_IMA       1
0186 #define INTEGRITY_KEYRING_PLATFORM  2
0187 #define INTEGRITY_KEYRING_MACHINE   3
0188 #define INTEGRITY_KEYRING_MAX       4
0189
0190 extern struct dentry *integrity_dir;
0191
0192 struct modsig;
0193
0194 #ifdef CONFIG_INTEGRITY_SIGNATURE
0195
0196 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
0197                 const char *digest, int digestlen);
0198 int integrity_modsig_verify(unsigned int id, const struct modsig *modsig);
0199
0200 int __init integrity_init_keyring(const unsigned int id);
0201 int __init integrity_load_x509(const unsigned int id, const char *path);
0202 int __init integrity_load_cert(const unsigned int id, const char *source,
0203                    const void *data, size_t len, key_perm_t perm);
0204 #else
0205
0206 static inline int integrity_digsig_verify(const unsigned int id,
0207                       const char *sig, int siglen,
0208                       const char *digest, int digestlen)
0209 {
0210     return -EOPNOTSUPP;
0211 }
0212
0213 static inline int integrity_modsig_verify(unsigned int id,
0214                       const struct modsig *modsig)
0215 {
0216     return -EOPNOTSUPP;
0217 }
0218
0219 static inline int integrity_init_keyring(const unsigned int id)
0220 {
0221     return 0;
0222 }
0223
0224 static inline int __init integrity_load_cert(const unsigned int id,
0225                          const char *source,
0226                          const void *data, size_t len,
0227                          key_perm_t perm)
0228 {
0229     return 0;
0230 }
0231 #endif /* CONFIG_INTEGRITY_SIGNATURE */
0232
0233 #ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
0234 int asymmetric_verify(struct key *keyring, const char *sig,
0235               int siglen, const char *data, int datalen);
0236 #else
0237 static inline int asymmetric_verify(struct key *keyring, const char *sig,
0238                     int siglen, const char *data, int datalen)
0239 {
0240     return -EOPNOTSUPP;
0241 }
0242 #endif
0243
0244 #ifdef CONFIG_IMA_APPRAISE_MODSIG
0245 int ima_modsig_verify(struct key *keyring, const struct modsig *modsig);
0246 #else
0247 static inline int ima_modsig_verify(struct key *keyring,
0248                     const struct modsig *modsig)
0249 {
0250     return -EOPNOTSUPP;
0251 }
0252 #endif
0253
0254 #ifdef CONFIG_IMA_LOAD_X509
0255 void __init ima_load_x509(void);
0256 #else
0257 static inline void ima_load_x509(void)
0258 {
0259 }
0260 #endif
0261
0262 #ifdef CONFIG_EVM_LOAD_X509
0263 void __init evm_load_x509(void);
0264 #else
0265 static inline void evm_load_x509(void)
0266 {
0267 }
0268 #endif
0269
0270 #ifdef CONFIG_INTEGRITY_AUDIT
0271 /* declarations */
0272 void integrity_audit_msg(int audit_msgno, struct inode *inode,
0273              const unsigned char *fname, const char *op,
0274              const char *cause, int result, int info);
0275
0276 void integrity_audit_message(int audit_msgno, struct inode *inode,
0277                  const unsigned char *fname, const char *op,
0278                  const char *cause, int result, int info,
0279                  int errno);
0280
0281 static inline struct audit_buffer *
0282 integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
0283 {
0284     return audit_log_start(ctx, gfp_mask, type);
0285 }
0286
0287 #else
0288 static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
0289                        const unsigned char *fname,
0290                        const char *op, const char *cause,
0291                        int result, int info)
0292 {
0293 }
0294
0295 static inline void integrity_audit_message(int audit_msgno,
0296                        struct inode *inode,
0297                        const unsigned char *fname,
0298                        const char *op, const char *cause,
0299                        int result, int info, int errno)
0300 {
0301 }
0302
0303 static inline struct audit_buffer *
0304 integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
0305 {
0306     return NULL;
0307 }
0308
0309 #endif
0310
0311 #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
0312 void __init add_to_platform_keyring(const char *source, const void *data,
0313                     size_t len);
0314 #else
0315 static inline void __init add_to_platform_keyring(const char *source,
0316                           const void *data, size_t len)
0317 {
0318 }
0319 #endif
0320
0321 #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
0322 void __init add_to_machine_keyring(const char *source, const void *data, size_t len);
0323 bool __init trust_moklist(void);
0324 #else
0325 static inline void __init add_to_machine_keyring(const char *source,
0326                           const void *data, size_t len)
0327 {
0328 }
0329 static inline bool __init trust_moklist(void)
0330 {
0331     return false;
0332 }
0333 #endif