2011-03-09 12:13:22 -07:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2008 IBM Corporation
|
|
|
|
*
|
|
|
|
* Authors:
|
|
|
|
* Mimi Zohar <zohar@us.ibm.com>
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License as
|
|
|
|
* published by the Free Software Foundation, version 2 of the
|
|
|
|
* License.
|
|
|
|
*
|
|
|
|
* File: integrity_iint.c
|
|
|
|
* - implements the integrity hooks: integrity_inode_alloc,
|
|
|
|
* integrity_inode_free
|
|
|
|
* - cache integrity information associated with an inode
|
|
|
|
* using a rbtree tree.
|
|
|
|
*/
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/spinlock.h>
|
|
|
|
#include <linux/rbtree.h>
|
|
|
|
#include "integrity.h"
|
|
|
|
|
|
|
|
static struct rb_root integrity_iint_tree = RB_ROOT;
|
2012-02-08 12:15:42 -07:00
|
|
|
static DEFINE_RWLOCK(integrity_iint_lock);
|
2011-03-09 12:13:22 -07:00
|
|
|
static struct kmem_cache *iint_cache __read_mostly;
|
|
|
|
|
|
|
|
int iint_initialized;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* __integrity_iint_find - return the iint associated with an inode
|
|
|
|
*/
|
|
|
|
static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct integrity_iint_cache *iint;
|
|
|
|
struct rb_node *n = integrity_iint_tree.rb_node;
|
|
|
|
|
|
|
|
while (n) {
|
|
|
|
iint = rb_entry(n, struct integrity_iint_cache, rb_node);
|
|
|
|
|
|
|
|
if (inode < iint->inode)
|
|
|
|
n = n->rb_left;
|
|
|
|
else if (inode > iint->inode)
|
|
|
|
n = n->rb_right;
|
|
|
|
else
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (!n)
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
return iint;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* integrity_iint_find - return the iint associated with an inode
|
|
|
|
*/
|
|
|
|
struct integrity_iint_cache *integrity_iint_find(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct integrity_iint_cache *iint;
|
|
|
|
|
|
|
|
if (!IS_IMA(inode))
|
|
|
|
return NULL;
|
|
|
|
|
2012-02-08 12:15:42 -07:00
|
|
|
read_lock(&integrity_iint_lock);
|
2011-03-09 12:13:22 -07:00
|
|
|
iint = __integrity_iint_find(inode);
|
2012-02-08 12:15:42 -07:00
|
|
|
read_unlock(&integrity_iint_lock);
|
2011-03-09 12:13:22 -07:00
|
|
|
|
|
|
|
return iint;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void iint_free(struct integrity_iint_cache *iint)
|
|
|
|
{
|
|
|
|
iint->version = 0;
|
|
|
|
iint->flags = 0UL;
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 08:15:05 -07:00
|
|
|
iint->ima_status = INTEGRITY_UNKNOWN;
|
2011-08-15 06:30:11 -06:00
|
|
|
iint->evm_status = INTEGRITY_UNKNOWN;
|
2011-03-09 12:13:22 -07:00
|
|
|
kmem_cache_free(iint_cache, iint);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2011-10-19 03:04:40 -06:00
|
|
|
* integrity_inode_get - find or allocate an iint associated with an inode
|
2011-03-09 12:13:22 -07:00
|
|
|
* @inode: pointer to the inode
|
2011-10-19 03:04:40 -06:00
|
|
|
* @return: allocated iint
|
|
|
|
*
|
|
|
|
* Caller must lock i_mutex
|
2011-03-09 12:13:22 -07:00
|
|
|
*/
|
2011-10-19 03:04:40 -06:00
|
|
|
struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
|
2011-03-09 12:13:22 -07:00
|
|
|
{
|
|
|
|
struct rb_node **p;
|
2011-10-19 03:04:40 -06:00
|
|
|
struct rb_node *node, *parent = NULL;
|
|
|
|
struct integrity_iint_cache *iint, *test_iint;
|
2011-03-09 12:13:22 -07:00
|
|
|
|
2011-10-19 03:04:40 -06:00
|
|
|
iint = integrity_iint_find(inode);
|
|
|
|
if (iint)
|
|
|
|
return iint;
|
2011-03-09 12:13:22 -07:00
|
|
|
|
2011-10-19 03:04:40 -06:00
|
|
|
iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
|
|
|
|
if (!iint)
|
|
|
|
return NULL;
|
2011-03-09 12:13:22 -07:00
|
|
|
|
2012-02-08 12:15:42 -07:00
|
|
|
write_lock(&integrity_iint_lock);
|
2011-03-09 12:13:22 -07:00
|
|
|
|
|
|
|
p = &integrity_iint_tree.rb_node;
|
|
|
|
while (*p) {
|
|
|
|
parent = *p;
|
|
|
|
test_iint = rb_entry(parent, struct integrity_iint_cache,
|
|
|
|
rb_node);
|
|
|
|
if (inode < test_iint->inode)
|
|
|
|
p = &(*p)->rb_left;
|
|
|
|
else
|
2011-10-19 03:04:40 -06:00
|
|
|
p = &(*p)->rb_right;
|
2011-03-09 12:13:22 -07:00
|
|
|
}
|
|
|
|
|
2011-10-19 03:04:40 -06:00
|
|
|
iint->inode = inode;
|
|
|
|
node = &iint->rb_node;
|
2011-03-09 12:13:22 -07:00
|
|
|
inode->i_flags |= S_IMA;
|
2011-10-19 03:04:40 -06:00
|
|
|
rb_link_node(node, parent, p);
|
|
|
|
rb_insert_color(node, &integrity_iint_tree);
|
2011-03-09 12:13:22 -07:00
|
|
|
|
2012-02-08 12:15:42 -07:00
|
|
|
write_unlock(&integrity_iint_lock);
|
2011-10-19 03:04:40 -06:00
|
|
|
return iint;
|
2011-03-09 12:13:22 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* integrity_inode_free - called on security_inode_free
|
|
|
|
* @inode: pointer to the inode
|
|
|
|
*
|
|
|
|
* Free the integrity information(iint) associated with an inode.
|
|
|
|
*/
|
|
|
|
void integrity_inode_free(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct integrity_iint_cache *iint;
|
|
|
|
|
|
|
|
if (!IS_IMA(inode))
|
|
|
|
return;
|
|
|
|
|
2012-02-08 12:15:42 -07:00
|
|
|
write_lock(&integrity_iint_lock);
|
2011-03-09 12:13:22 -07:00
|
|
|
iint = __integrity_iint_find(inode);
|
|
|
|
rb_erase(&iint->rb_node, &integrity_iint_tree);
|
2012-02-08 12:15:42 -07:00
|
|
|
write_unlock(&integrity_iint_lock);
|
2011-03-09 12:13:22 -07:00
|
|
|
|
|
|
|
iint_free(iint);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void init_once(void *foo)
|
|
|
|
{
|
|
|
|
struct integrity_iint_cache *iint = foo;
|
|
|
|
|
|
|
|
memset(iint, 0, sizeof *iint);
|
|
|
|
iint->version = 0;
|
|
|
|
iint->flags = 0UL;
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 08:15:05 -07:00
|
|
|
iint->ima_status = INTEGRITY_UNKNOWN;
|
2011-05-06 02:34:17 -06:00
|
|
|
iint->evm_status = INTEGRITY_UNKNOWN;
|
2011-03-09 12:13:22 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static int __init integrity_iintcache_init(void)
|
|
|
|
{
|
|
|
|
iint_cache =
|
|
|
|
kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache),
|
|
|
|
0, SLAB_PANIC, init_once);
|
|
|
|
iint_initialized = 1;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
security_initcall(integrity_iintcache_init);
|