2019-06-01 10:08:55 +02:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-only
|
2011-03-09 20:13:22 +01:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2008 IBM Corporation
|
|
|
|
*
|
|
|
|
* Authors:
|
|
|
|
* Mimi Zohar <zohar@us.ibm.com>
|
|
|
|
*
|
|
|
|
* File: integrity_iint.c
|
|
|
|
* - implements the integrity hooks: integrity_inode_alloc,
|
|
|
|
* integrity_inode_free
|
|
|
|
* - cache integrity information associated with an inode
|
|
|
|
* using a rbtree tree.
|
|
|
|
*/
|
|
|
|
#include <linux/slab.h>
|
2018-12-09 21:36:29 +01:00
|
|
|
#include <linux/init.h>
|
2011-03-09 20:13:22 +01:00
|
|
|
#include <linux/spinlock.h>
|
|
|
|
#include <linux/rbtree.h>
|
2014-11-05 16:01:12 +01:00
|
|
|
#include <linux/file.h>
|
|
|
|
#include <linux/uaccess.h>
|
2018-05-12 01:12:34 +02:00
|
|
|
#include <linux/security.h>
|
2018-10-11 02:18:21 +02:00
|
|
|
#include <linux/lsm_hooks.h>
|
2011-03-09 20:13:22 +01:00
|
|
|
#include "integrity.h"
|
|
|
|
|
|
|
|
static struct rb_root integrity_iint_tree = RB_ROOT;
|
2012-02-08 20:15:42 +01:00
|
|
|
static DEFINE_RWLOCK(integrity_iint_lock);
|
2011-03-09 20:13:22 +01:00
|
|
|
static struct kmem_cache *iint_cache __read_mostly;
|
|
|
|
|
2018-05-12 01:12:34 +02:00
|
|
|
struct dentry *integrity_dir;
|
|
|
|
|
2011-03-09 20:13:22 +01:00
|
|
|
/*
|
|
|
|
* __integrity_iint_find - return the iint associated with an inode
|
|
|
|
*/
|
|
|
|
static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct integrity_iint_cache *iint;
|
|
|
|
struct rb_node *n = integrity_iint_tree.rb_node;
|
|
|
|
|
|
|
|
while (n) {
|
|
|
|
iint = rb_entry(n, struct integrity_iint_cache, rb_node);
|
|
|
|
|
|
|
|
if (inode < iint->inode)
|
|
|
|
n = n->rb_left;
|
|
|
|
else if (inode > iint->inode)
|
|
|
|
n = n->rb_right;
|
|
|
|
else
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (!n)
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
return iint;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* integrity_iint_find - return the iint associated with an inode
|
|
|
|
*/
|
|
|
|
struct integrity_iint_cache *integrity_iint_find(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct integrity_iint_cache *iint;
|
|
|
|
|
|
|
|
if (!IS_IMA(inode))
|
|
|
|
return NULL;
|
|
|
|
|
2012-02-08 20:15:42 +01:00
|
|
|
read_lock(&integrity_iint_lock);
|
2011-03-09 20:13:22 +01:00
|
|
|
iint = __integrity_iint_find(inode);
|
2012-02-08 20:15:42 +01:00
|
|
|
read_unlock(&integrity_iint_lock);
|
2011-03-09 20:13:22 +01:00
|
|
|
|
|
|
|
return iint;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void iint_free(struct integrity_iint_cache *iint)
|
|
|
|
{
|
2013-04-25 09:44:04 +02:00
|
|
|
kfree(iint->ima_hash);
|
|
|
|
iint->ima_hash = NULL;
|
2011-03-09 20:13:22 +01:00
|
|
|
iint->version = 0;
|
|
|
|
iint->flags = 0UL;
|
2018-01-23 16:00:41 +01:00
|
|
|
iint->atomic_flags = 0UL;
|
2012-12-03 23:08:11 +01:00
|
|
|
iint->ima_file_status = INTEGRITY_UNKNOWN;
|
|
|
|
iint->ima_mmap_status = INTEGRITY_UNKNOWN;
|
|
|
|
iint->ima_bprm_status = INTEGRITY_UNKNOWN;
|
2015-11-19 18:39:22 +01:00
|
|
|
iint->ima_read_status = INTEGRITY_UNKNOWN;
|
2018-01-08 22:36:20 +01:00
|
|
|
iint->ima_creds_status = INTEGRITY_UNKNOWN;
|
2011-08-15 14:30:11 +02:00
|
|
|
iint->evm_status = INTEGRITY_UNKNOWN;
|
2016-06-01 20:14:00 +02:00
|
|
|
iint->measured_pcrs = 0;
|
2011-03-09 20:13:22 +01:00
|
|
|
kmem_cache_free(iint_cache, iint);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2011-10-19 11:04:40 +02:00
|
|
|
* integrity_inode_get - find or allocate an iint associated with an inode
|
2011-03-09 20:13:22 +01:00
|
|
|
* @inode: pointer to the inode
|
2011-10-19 11:04:40 +02:00
|
|
|
* @return: allocated iint
|
|
|
|
*
|
|
|
|
* Caller must lock i_mutex
|
2011-03-09 20:13:22 +01:00
|
|
|
*/
|
2011-10-19 11:04:40 +02:00
|
|
|
struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
|
2011-03-09 20:13:22 +01:00
|
|
|
{
|
|
|
|
struct rb_node **p;
|
2011-10-19 11:04:40 +02:00
|
|
|
struct rb_node *node, *parent = NULL;
|
|
|
|
struct integrity_iint_cache *iint, *test_iint;
|
2011-03-09 20:13:22 +01:00
|
|
|
|
2011-10-19 11:04:40 +02:00
|
|
|
iint = integrity_iint_find(inode);
|
|
|
|
if (iint)
|
|
|
|
return iint;
|
2011-03-09 20:13:22 +01:00
|
|
|
|
2011-10-19 11:04:40 +02:00
|
|
|
iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
|
|
|
|
if (!iint)
|
|
|
|
return NULL;
|
2011-03-09 20:13:22 +01:00
|
|
|
|
2012-02-08 20:15:42 +01:00
|
|
|
write_lock(&integrity_iint_lock);
|
2011-03-09 20:13:22 +01:00
|
|
|
|
|
|
|
p = &integrity_iint_tree.rb_node;
|
|
|
|
while (*p) {
|
|
|
|
parent = *p;
|
|
|
|
test_iint = rb_entry(parent, struct integrity_iint_cache,
|
|
|
|
rb_node);
|
|
|
|
if (inode < test_iint->inode)
|
|
|
|
p = &(*p)->rb_left;
|
|
|
|
else
|
2011-10-19 11:04:40 +02:00
|
|
|
p = &(*p)->rb_right;
|
2011-03-09 20:13:22 +01:00
|
|
|
}
|
|
|
|
|
2011-10-19 11:04:40 +02:00
|
|
|
iint->inode = inode;
|
|
|
|
node = &iint->rb_node;
|
2011-03-09 20:13:22 +01:00
|
|
|
inode->i_flags |= S_IMA;
|
2011-10-19 11:04:40 +02:00
|
|
|
rb_link_node(node, parent, p);
|
|
|
|
rb_insert_color(node, &integrity_iint_tree);
|
2011-03-09 20:13:22 +01:00
|
|
|
|
2012-02-08 20:15:42 +01:00
|
|
|
write_unlock(&integrity_iint_lock);
|
2011-10-19 11:04:40 +02:00
|
|
|
return iint;
|
2011-03-09 20:13:22 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* integrity_inode_free - called on security_inode_free
|
|
|
|
* @inode: pointer to the inode
|
|
|
|
*
|
|
|
|
* Free the integrity information(iint) associated with an inode.
|
|
|
|
*/
|
|
|
|
void integrity_inode_free(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct integrity_iint_cache *iint;
|
|
|
|
|
|
|
|
if (!IS_IMA(inode))
|
|
|
|
return;
|
|
|
|
|
2012-02-08 20:15:42 +01:00
|
|
|
write_lock(&integrity_iint_lock);
|
2011-03-09 20:13:22 +01:00
|
|
|
iint = __integrity_iint_find(inode);
|
|
|
|
rb_erase(&iint->rb_node, &integrity_iint_tree);
|
2012-02-08 20:15:42 +01:00
|
|
|
write_unlock(&integrity_iint_lock);
|
2011-03-09 20:13:22 +01:00
|
|
|
|
|
|
|
iint_free(iint);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void init_once(void *foo)
|
|
|
|
{
|
|
|
|
struct integrity_iint_cache *iint = foo;
|
|
|
|
|
2014-03-04 17:04:20 +01:00
|
|
|
memset(iint, 0, sizeof(*iint));
|
2012-12-03 23:08:11 +01:00
|
|
|
iint->ima_file_status = INTEGRITY_UNKNOWN;
|
|
|
|
iint->ima_mmap_status = INTEGRITY_UNKNOWN;
|
|
|
|
iint->ima_bprm_status = INTEGRITY_UNKNOWN;
|
2015-11-19 18:39:22 +01:00
|
|
|
iint->ima_read_status = INTEGRITY_UNKNOWN;
|
2018-01-08 22:36:20 +01:00
|
|
|
iint->ima_creds_status = INTEGRITY_UNKNOWN;
|
2011-05-06 10:34:17 +02:00
|
|
|
iint->evm_status = INTEGRITY_UNKNOWN;
|
ima: re-introduce own integrity cache lock
Before IMA appraisal was introduced, IMA was using own integrity cache
lock along with i_mutex. process_measurement and ima_file_free took
the iint->mutex first and then the i_mutex, while setxattr, chmod and
chown took the locks in reverse order. To resolve the potential deadlock,
i_mutex was moved to protect entire IMA functionality and the redundant
iint->mutex was eliminated.
Solution was based on the assumption that filesystem code does not take
i_mutex further. But when file is opened with O_DIRECT flag, direct-io
implementation takes i_mutex and produces deadlock. Furthermore, certain
other filesystem operations, such as llseek, also take i_mutex.
More recently some filesystems have replaced their filesystem specific
lock with the global i_rwsem to read a file. As a result, when IMA
attempts to calculate the file hash, reading the file attempts to take
the i_rwsem again.
To resolve O_DIRECT related deadlock problem, this patch re-introduces
iint->mutex. But to eliminate the original chmod() related deadlock
problem, this patch eliminates the requirement for chmod hooks to take
the iint->mutex by introducing additional atomic iint->attr_flags to
indicate calling of the hooks. The allowed locking order is to take
the iint->mutex first and then the i_rwsem.
Original flags were cleared in chmod(), setxattr() or removwxattr()
hooks and tested when file was closed or opened again. New atomic flags
are set or cleared in those hooks and tested to clear iint->flags on
close or on open.
Atomic flags are following:
* IMA_CHANGE_ATTR - indicates that chATTR() was called (chmod, chown,
chgrp) and file attributes have changed. On file open, it causes IMA
to clear iint->flags to re-evaluate policy and perform IMA functions
again.
* IMA_CHANGE_XATTR - indicates that setxattr or removexattr was called
and extended attributes have changed. On file open, it causes IMA to
clear iint->flags IMA_DONE_MASK to re-appraise.
* IMA_UPDATE_XATTR - indicates that security.ima needs to be updated.
It is cleared if file policy changes and no update is needed.
* IMA_DIGSIG - indicates that file security.ima has signature and file
security.ima must not update to file has on file close.
* IMA_MUST_MEASURE - indicates the file is in the measurement policy.
Fixes: Commit 6552321831dc ("xfs: remove i_iolock and use i_rwsem in
the VFS inode instead")
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2017-12-05 20:06:34 +01:00
|
|
|
mutex_init(&iint->mutex);
|
2011-03-09 20:13:22 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
static int __init integrity_iintcache_init(void)
|
|
|
|
{
|
|
|
|
iint_cache =
|
|
|
|
kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache),
|
|
|
|
0, SLAB_PANIC, init_once);
|
|
|
|
return 0;
|
|
|
|
}
|
2018-10-11 02:18:23 +02:00
|
|
|
DEFINE_LSM(integrity) = {
|
2018-10-11 02:18:24 +02:00
|
|
|
.name = "integrity",
|
2018-10-11 02:18:23 +02:00
|
|
|
.init = integrity_iintcache_init,
|
|
|
|
};
|
2014-11-05 16:01:12 +01:00
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* integrity_kernel_read - read data from the file
|
|
|
|
*
|
|
|
|
* This is a function for reading file content instead of kernel_read().
|
|
|
|
* It does not perform locking checks to ensure it cannot be blocked.
|
|
|
|
* It does not perform security checks because it is irrelevant for IMA.
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
int integrity_kernel_read(struct file *file, loff_t offset,
|
2017-06-08 03:49:10 +02:00
|
|
|
void *addr, unsigned long count)
|
2014-11-05 16:01:12 +01:00
|
|
|
{
|
|
|
|
mm_segment_t old_fs;
|
|
|
|
char __user *buf = (char __user *)addr;
|
2014-11-05 16:01:17 +01:00
|
|
|
ssize_t ret;
|
2014-11-05 16:01:12 +01:00
|
|
|
|
|
|
|
if (!(file->f_mode & FMODE_READ))
|
|
|
|
return -EBADF;
|
|
|
|
|
|
|
|
old_fs = get_fs();
|
2019-03-04 19:39:05 +01:00
|
|
|
set_fs(KERNEL_DS);
|
2014-11-05 16:01:17 +01:00
|
|
|
ret = __vfs_read(file, buf, count, &offset);
|
2014-11-05 16:01:12 +01:00
|
|
|
set_fs(old_fs);
|
2014-11-05 16:01:17 +01:00
|
|
|
|
2014-11-05 16:01:12 +01:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2014-11-05 16:01:15 +01:00
|
|
|
/*
|
|
|
|
* integrity_load_keys - load integrity keys hook
|
|
|
|
*
|
|
|
|
* Hooks is called from init/main.c:kernel_init_freeable()
|
|
|
|
* when rootfs is ready
|
|
|
|
*/
|
|
|
|
void __init integrity_load_keys(void)
|
|
|
|
{
|
|
|
|
ima_load_x509();
|
2015-10-22 20:26:21 +02:00
|
|
|
evm_load_x509();
|
2014-11-05 16:01:15 +01:00
|
|
|
}
|
2018-05-12 01:12:34 +02:00
|
|
|
|
|
|
|
static int __init integrity_fs_init(void)
|
|
|
|
{
|
|
|
|
integrity_dir = securityfs_create_dir("integrity", NULL);
|
|
|
|
if (IS_ERR(integrity_dir)) {
|
2018-06-05 12:25:45 +02:00
|
|
|
int ret = PTR_ERR(integrity_dir);
|
|
|
|
|
|
|
|
if (ret != -ENODEV)
|
|
|
|
pr_err("Unable to create integrity sysfs dir: %d\n",
|
|
|
|
ret);
|
2018-05-12 01:12:34 +02:00
|
|
|
integrity_dir = NULL;
|
2018-06-05 12:25:45 +02:00
|
|
|
return ret;
|
2018-05-12 01:12:34 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
late_initcall(integrity_fs_init)
|