mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
![Mimi Zohar](/assets/img/avatar_default.png)
IMA currently maintains an integrity measurement list used to assert the integrity of the running system to a third party. The IMA-appraisal extension adds local integrity validation and enforcement of the measurement against a "good" value stored as an extended attribute 'security.ima'. The initial methods for validating 'security.ima' are hashed based, which provides file data integrity, and digital signature based, which in addition to providing file data integrity, provides authenticity. This patch creates and maintains the 'security.ima' xattr, containing the file data hash measurement. Protection of the xattr is provided by EVM, if enabled and configured. Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata integrity and, assuming success, compares the file's current hash value with the one stored as an extended attribute in 'security.ima'. Changelov v4: - changed iint cache flags to hex values Changelog v3: - change appraisal default for filesystems without xattr support to fail Changelog v2: - fix audit msg 'res' value - removed unused 'ima_appraise=' values Changelog v1: - removed unused iint mutex (Dmitry Kasatkin) - setattr hook must not reset appraised (Dmitry Kasatkin) - evm_verifyxattr() now differentiates between no 'security.evm' xattr (INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the 'security.evm' (INTEGRITY_NOXATTRS). - replace hash_status with ima_status (Dmitry Kasatkin) - re-initialize slab element ima_status on free (Dmitry Kasatkin) - include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA - merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin) - removed unnecessary error variable in process_measurement() (Dmitry Kasatkin) - use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured (moved ima_inode_post_setattr() to ima_appraise.c) - make sure ima_collect_measurement() can read file Changelog: - add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin) - fix the race condition between chmod, which takes the i_mutex and then iint->mutex, and ima_file_free() and process_measurement(), which take the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin) - cleanup of ima_appraise_measurement() (Dmitry Kasatkin) - changes as a result of the iint not allocated for all regular files, but only for those measured/appraised. - don't try to appraise new/empty files - expanded ima_appraisal description in ima/Kconfig - IMA appraise definitions required even if IMA_APPRAISE not enabled - add return value to ima_must_appraise() stub - unconditionally set status = INTEGRITY_PASS *after* testing status, not before. (Found by Joe Perches) Signed-off-by: Mimi Zohar <zohar@us.ibm.com> Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
149 lines
3.1 KiB
C
149 lines
3.1 KiB
C
/*
|
|
* Copyright (C) 2005,2006,2007,2008 IBM Corporation
|
|
*
|
|
* Authors:
|
|
* Mimi Zohar <zohar@us.ibm.com>
|
|
* Kylene Hall <kjhall@us.ibm.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, version 2 of the License.
|
|
*
|
|
* File: ima_crypto.c
|
|
* Calculates md5/sha1 file hash, template hash, boot-aggreate hash
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/file.h>
|
|
#include <linux/crypto.h>
|
|
#include <linux/scatterlist.h>
|
|
#include <linux/err.h>
|
|
#include <linux/slab.h>
|
|
#include "ima.h"
|
|
|
|
static int init_desc(struct hash_desc *desc)
|
|
{
|
|
int rc;
|
|
|
|
desc->tfm = crypto_alloc_hash(ima_hash, 0, CRYPTO_ALG_ASYNC);
|
|
if (IS_ERR(desc->tfm)) {
|
|
pr_info("IMA: failed to load %s transform: %ld\n",
|
|
ima_hash, PTR_ERR(desc->tfm));
|
|
rc = PTR_ERR(desc->tfm);
|
|
return rc;
|
|
}
|
|
desc->flags = 0;
|
|
rc = crypto_hash_init(desc);
|
|
if (rc)
|
|
crypto_free_hash(desc->tfm);
|
|
return rc;
|
|
}
|
|
|
|
/*
|
|
* Calculate the MD5/SHA1 file digest
|
|
*/
|
|
int ima_calc_hash(struct file *file, char *digest)
|
|
{
|
|
struct hash_desc desc;
|
|
struct scatterlist sg[1];
|
|
loff_t i_size, offset = 0;
|
|
char *rbuf;
|
|
int rc, read = 0;
|
|
|
|
rc = init_desc(&desc);
|
|
if (rc != 0)
|
|
return rc;
|
|
|
|
rbuf = kzalloc(PAGE_SIZE, GFP_KERNEL);
|
|
if (!rbuf) {
|
|
rc = -ENOMEM;
|
|
goto out;
|
|
}
|
|
if (!(file->f_mode & FMODE_READ)) {
|
|
file->f_mode |= FMODE_READ;
|
|
read = 1;
|
|
}
|
|
i_size = i_size_read(file->f_dentry->d_inode);
|
|
while (offset < i_size) {
|
|
int rbuf_len;
|
|
|
|
rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE);
|
|
if (rbuf_len < 0) {
|
|
rc = rbuf_len;
|
|
break;
|
|
}
|
|
if (rbuf_len == 0)
|
|
break;
|
|
offset += rbuf_len;
|
|
sg_init_one(sg, rbuf, rbuf_len);
|
|
|
|
rc = crypto_hash_update(&desc, sg, rbuf_len);
|
|
if (rc)
|
|
break;
|
|
}
|
|
kfree(rbuf);
|
|
if (!rc)
|
|
rc = crypto_hash_final(&desc, digest);
|
|
if (read)
|
|
file->f_mode &= ~FMODE_READ;
|
|
out:
|
|
crypto_free_hash(desc.tfm);
|
|
return rc;
|
|
}
|
|
|
|
/*
|
|
* Calculate the hash of a given template
|
|
*/
|
|
int ima_calc_template_hash(int template_len, void *template, char *digest)
|
|
{
|
|
struct hash_desc desc;
|
|
struct scatterlist sg[1];
|
|
int rc;
|
|
|
|
rc = init_desc(&desc);
|
|
if (rc != 0)
|
|
return rc;
|
|
|
|
sg_init_one(sg, template, template_len);
|
|
rc = crypto_hash_update(&desc, sg, template_len);
|
|
if (!rc)
|
|
rc = crypto_hash_final(&desc, digest);
|
|
crypto_free_hash(desc.tfm);
|
|
return rc;
|
|
}
|
|
|
|
static void __init ima_pcrread(int idx, u8 *pcr)
|
|
{
|
|
if (!ima_used_chip)
|
|
return;
|
|
|
|
if (tpm_pcr_read(TPM_ANY_NUM, idx, pcr) != 0)
|
|
pr_err("IMA: Error Communicating to TPM chip\n");
|
|
}
|
|
|
|
/*
|
|
* Calculate the boot aggregate hash
|
|
*/
|
|
int __init ima_calc_boot_aggregate(char *digest)
|
|
{
|
|
struct hash_desc desc;
|
|
struct scatterlist sg;
|
|
u8 pcr_i[IMA_DIGEST_SIZE];
|
|
int rc, i;
|
|
|
|
rc = init_desc(&desc);
|
|
if (rc != 0)
|
|
return rc;
|
|
|
|
/* cumulative sha1 over tpm registers 0-7 */
|
|
for (i = TPM_PCR0; i < TPM_PCR8; i++) {
|
|
ima_pcrread(i, pcr_i);
|
|
/* now accumulate with current aggregate */
|
|
sg_init_one(&sg, pcr_i, IMA_DIGEST_SIZE);
|
|
rc = crypto_hash_update(&desc, &sg, IMA_DIGEST_SIZE);
|
|
}
|
|
if (!rc)
|
|
crypto_hash_final(&desc, digest);
|
|
crypto_free_hash(desc.tfm);
|
|
return rc;
|
|
}
|