ima_policy.c 49.6 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3 4 5 6
/*
 * Copyright (C) 2008 IBM Corporation
 * Author: Mimi Zohar <zohar@us.ibm.com>
 *
 * ima_policy.c
7
 *	- initialize default measure policy rules
8
 */
9

10
#include <linux/init.h>
11
#include <linux/list.h>
12
#include <linux/kernel_read_file.h>
13
#include <linux/fs.h>
14 15
#include <linux/security.h>
#include <linux/magic.h>
M
Mimi Zohar 已提交
16
#include <linux/parser.h>
17
#include <linux/slab.h>
18
#include <linux/rculist.h>
19
#include <linux/genhd.h>
20
#include <linux/seq_file.h>
21
#include <linux/ima.h>
22 23 24 25

#include "ima.h"

/* flags definitions */
26 27
#define IMA_FUNC	0x0001
#define IMA_MASK	0x0002
28 29
#define IMA_FSMAGIC	0x0004
#define IMA_UID		0x0008
30
#define IMA_FOWNER	0x0010
31
#define IMA_FSUUID	0x0020
32
#define IMA_INMASK	0x0040
33
#define IMA_EUID	0x0080
34
#define IMA_PCR		0x0100
35
#define IMA_FSNAME	0x0200
36
#define IMA_KEYRINGS	0x0400
37

38 39 40 41 42
#define UNKNOWN		0
#define MEASURE		0x0001	/* same as IMA_MEASURE */
#define DONT_MEASURE	0x0002
#define APPRAISE	0x0004	/* same as IMA_APPRAISE */
#define DONT_APPRAISE	0x0008
P
Peter Moody 已提交
43
#define AUDIT		0x0040
44 45
#define HASH		0x0100
#define DONT_HASH	0x0200
M
Mimi Zohar 已提交
46

47
#define INVALID_PCR(a) (((a) < 0) || \
48
	(a) >= (sizeof_field(struct integrity_iint_cache, measured_pcrs) * 8))
49

50
int ima_policy_flag;
51
static int temp_ima_appraise;
M
Mimi Zohar 已提交
52
static int build_ima_appraise __ro_after_init;
53

M
Mimi Zohar 已提交
54 55 56 57
#define MAX_LSM_RULES 6
enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
	LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
};
58

R
Roberto Sassu 已提交
59
enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB, EXEC_TCB };
M
Mimi Zohar 已提交
60

N
Nayna Jain 已提交
61 62
enum policy_rule_list { IMA_DEFAULT_POLICY = 1, IMA_CUSTOM_POLICY };

63 64 65 66 67
struct ima_rule_opt_list {
	size_t count;
	char *items[];
};

68
struct ima_rule_entry {
69
	struct list_head list;
M
Mimi Zohar 已提交
70
	int action;
71 72 73 74
	unsigned int flags;
	enum ima_hooks func;
	int mask;
	unsigned long fsmagic;
75
	uuid_t fsuuid;
76
	kuid_t uid;
77
	kuid_t fowner;
78 79
	bool (*uid_op)(kuid_t, kuid_t);    /* Handlers for operators       */
	bool (*fowner_op)(kuid_t, kuid_t); /* uid_eq(), uid_gt(), uid_lt() */
80
	int pcr;
M
Mimi Zohar 已提交
81 82
	struct {
		void *rule;	/* LSM file metadata specific */
83
		char *args_p;	/* audit value */
M
Mimi Zohar 已提交
84 85
		int type;	/* audit type */
	} lsm[MAX_LSM_RULES];
86
	char *fsname;
87
	struct ima_rule_opt_list *keyrings; /* Measure keys added to these keyrings */
88
	struct ima_template_desc *template;
89 90
};

91 92
/*
 * Without LSM specific knowledge, the default policy can only be
93
 * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
M
Mimi Zohar 已提交
94
 */
95 96 97 98 99 100 101

/*
 * The minimum rule set to allow for full TCB coverage.  Measures all files
 * opened or mmap for exec and everything read by root.  Dangerous because
 * normal users can easily run the machine out of memory simply building
 * and running executables.
 */
102
static struct ima_rule_entry dont_measure_rules[] __ro_after_init = {
103 104 105 106 107 108 109 110
	{.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
111
	{.action = DONT_MEASURE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
112 113
	{.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
	 .flags = IMA_FSMAGIC},
114 115
	{.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC,
	 .flags = IMA_FSMAGIC},
116 117
	{.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC}
M
Mimi Zohar 已提交
118 119
};

120
static struct ima_rule_entry original_measurement_rules[] __ro_after_init = {
M
Mimi Zohar 已提交
121 122 123 124 125
	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
	 .flags = IMA_FUNC | IMA_MASK},
	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
	 .flags = IMA_FUNC | IMA_MASK},
	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
126 127
	 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
	 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
M
Mimi Zohar 已提交
128 129 130 131
	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
};

132
static struct ima_rule_entry default_measurement_rules[] __ro_after_init = {
133
	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
134
	 .flags = IMA_FUNC | IMA_MASK},
135
	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
136
	 .flags = IMA_FUNC | IMA_MASK},
M
Mimi Zohar 已提交
137
	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
138 139
	 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
	 .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
M
Mimi Zohar 已提交
140
	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
141 142
	 .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
	 .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
143
	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
144
	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
145
	{.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
146
	{.action = MEASURE, .func = DIGEST_LIST_CHECK, .flags = IMA_FUNC},
147 148
};

149
static struct ima_rule_entry default_appraise_rules[] __ro_after_init = {
150 151 152 153 154 155 156 157 158
	{.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
159
	{.action = DONT_APPRAISE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
160
	{.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
161
	{.action = DONT_APPRAISE, .fsmagic = EFIVARFS_MAGIC, .flags = IMA_FSMAGIC},
162
	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
163
	{.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC},
M
Mimi Zohar 已提交
164 165 166 167
#ifdef CONFIG_IMA_WRITE_POLICY
	{.action = APPRAISE, .func = POLICY_CHECK,
	.flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
#endif
168
#ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
169 170
	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
	 .flags = IMA_FOWNER},
171 172
#else
	/* force signature */
173
	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
174 175
	 .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
#endif
176 177
};

M
Mimi Zohar 已提交
178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196
static struct ima_rule_entry build_appraise_rules[] __ro_after_init = {
#ifdef CONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS
	{.action = APPRAISE, .func = MODULE_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
#endif
#ifdef CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS
	{.action = APPRAISE, .func = FIRMWARE_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
#endif
#ifdef CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS
	{.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
#endif
#ifdef CONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS
	{.action = APPRAISE, .func = POLICY_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
#endif
};

197 198 199 200 201 202 203 204 205
static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
	{.action = APPRAISE, .func = MODULE_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
	{.action = APPRAISE, .func = FIRMWARE_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
	{.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
	{.action = APPRAISE, .func = POLICY_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
206 207
	{.action = APPRAISE, .func = DIGEST_LIST_CHECK,
	 .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
208 209
};

210
/* An array of architecture specific rules */
Y
YueHaibing 已提交
211
static struct ima_rule_entry *arch_policy_entry __ro_after_init;
212

213 214
static LIST_HEAD(ima_default_rules);
static LIST_HEAD(ima_policy_rules);
215
static LIST_HEAD(ima_temp_rules);
216
static struct list_head *ima_rules = &ima_default_rules;
217

M
Mimi Zohar 已提交
218
static int ima_policy __initdata;
219

220
static int __init default_measure_policy_setup(char *str)
221
{
M
Mimi Zohar 已提交
222 223 224 225
	if (ima_policy)
		return 1;

	ima_policy = ORIGINAL_TCB;
226 227
	return 1;
}
228 229
__setup("ima_tcb", default_measure_policy_setup);

230
static bool ima_use_appraise_tcb __initdata;
231
static bool ima_use_secure_boot __initdata;
232
static bool ima_fail_unverifiable_sigs __ro_after_init;
M
Mimi Zohar 已提交
233 234
static int __init policy_setup(char *str)
{
235
	char *p;
M
Mimi Zohar 已提交
236

237 238 239 240 241
	while ((p = strsep(&str, " |\n")) != NULL) {
		if (*p == ' ')
			continue;
		if ((strcmp(p, "tcb") == 0) && !ima_policy)
			ima_policy = DEFAULT_TCB;
R
Roberto Sassu 已提交
242 243
		else if ((strcmp(p, "exec_tcb") == 0) && !ima_policy)
			ima_policy = EXEC_TCB;
244
		else if (strcmp(p, "appraise_tcb") == 0)
245
			ima_use_appraise_tcb = true;
246
		else if (strcmp(p, "secure_boot") == 0)
247
			ima_use_secure_boot = true;
248 249
		else if (strcmp(p, "fail_securely") == 0)
			ima_fail_unverifiable_sigs = true;
250 251
		else
			pr_err("policy \"%s\" not found", p);
252
	}
M
Mimi Zohar 已提交
253 254 255 256 257

	return 1;
}
__setup("ima_policy=", policy_setup);

258 259
static int __init default_appraise_policy_setup(char *str)
{
260
	ima_use_appraise_tcb = true;
261 262 263
	return 1;
}
__setup("ima_appraise_tcb", default_appraise_policy_setup);
264

265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330
static struct ima_rule_opt_list *ima_alloc_rule_opt_list(const substring_t *src)
{
	struct ima_rule_opt_list *opt_list;
	size_t count = 0;
	char *src_copy;
	char *cur, *next;
	size_t i;

	src_copy = match_strdup(src);
	if (!src_copy)
		return ERR_PTR(-ENOMEM);

	next = src_copy;
	while ((cur = strsep(&next, "|"))) {
		/* Don't accept an empty list item */
		if (!(*cur)) {
			kfree(src_copy);
			return ERR_PTR(-EINVAL);
		}
		count++;
	}

	/* Don't accept an empty list */
	if (!count) {
		kfree(src_copy);
		return ERR_PTR(-EINVAL);
	}

	opt_list = kzalloc(struct_size(opt_list, items, count), GFP_KERNEL);
	if (!opt_list) {
		kfree(src_copy);
		return ERR_PTR(-ENOMEM);
	}

	/*
	 * strsep() has already replaced all instances of '|' with '\0',
	 * leaving a byte sequence of NUL-terminated strings. Reference each
	 * string with the array of items.
	 *
	 * IMPORTANT: Ownership of the allocated buffer is transferred from
	 * src_copy to the first element in the items array. To free the
	 * buffer, kfree() must only be called on the first element of the
	 * array.
	 */
	for (i = 0, cur = src_copy; i < count; i++) {
		opt_list->items[i] = cur;
		cur = strchr(cur, '\0') + 1;
	}
	opt_list->count = count;

	return opt_list;
}

static void ima_free_rule_opt_list(struct ima_rule_opt_list *opt_list)
{
	if (!opt_list)
		return;

	if (opt_list->count) {
		kfree(opt_list->items[0]);
		opt_list->count = 0;
	}

	kfree(opt_list);
}

331 332 333 334 335
static void ima_lsm_free_rule(struct ima_rule_entry *entry)
{
	int i;

	for (i = 0; i < MAX_LSM_RULES; i++) {
336
		ima_filter_rule_free(entry->lsm[i].rule);
337 338
		kfree(entry->lsm[i].args_p);
	}
339 340 341 342 343 344 345 346 347 348 349 350 351
}

static void ima_free_rule(struct ima_rule_entry *entry)
{
	if (!entry)
		return;

	/*
	 * entry->template->fields may be allocated in ima_parse_rule() but that
	 * reference is owned by the corresponding ima_template_desc element in
	 * the defined_templates list and cannot be freed here
	 */
	kfree(entry->fsname);
352
	ima_free_rule_opt_list(entry->keyrings);
353
	ima_lsm_free_rule(entry);
354 355 356 357 358 359
	kfree(entry);
}

static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry)
{
	struct ima_rule_entry *nentry;
360
	int i;
361 362 363 364 365

	/*
	 * Immutable elements are copied over as pointers and data; only
	 * lsm rules can change
	 */
366 367 368 369
	nentry = kmemdup(entry, sizeof(*nentry), GFP_KERNEL);
	if (!nentry)
		return NULL;

370
	memset(nentry->lsm, 0, sizeof_field(struct ima_rule_entry, lsm));
371 372

	for (i = 0; i < MAX_LSM_RULES; i++) {
373
		if (!entry->lsm[i].args_p)
374 375 376
			continue;

		nentry->lsm[i].type = entry->lsm[i].type;
377 378 379 380 381 382 383
		nentry->lsm[i].args_p = entry->lsm[i].args_p;
		/*
		 * Remove the reference from entry so that the associated
		 * memory will not be freed during a later call to
		 * ima_lsm_free_rule(entry).
		 */
		entry->lsm[i].args_p = NULL;
384

385 386 387
		ima_filter_rule_init(nentry->lsm[i].type, Audit_equal,
				     nentry->lsm[i].args_p,
				     &nentry->lsm[i].rule);
388 389
		if (!nentry->lsm[i].rule)
			pr_warn("rule for LSM \'%s\' is undefined\n",
390
				nentry->lsm[i].args_p);
391 392 393 394 395 396 397 398 399 400 401 402 403 404
	}
	return nentry;
}

static int ima_lsm_update_rule(struct ima_rule_entry *entry)
{
	struct ima_rule_entry *nentry;

	nentry = ima_lsm_copy_rule(entry);
	if (!nentry)
		return -ENOMEM;

	list_replace_rcu(&entry->list, &nentry->list);
	synchronize_rcu();
405 406 407 408 409 410
	/*
	 * ima_lsm_copy_rule() shallow copied all references, except for the
	 * LSM references, from entry to nentry so we only want to free the LSM
	 * references and the entry itself. All other memory refrences will now
	 * be owned by nentry.
	 */
411
	ima_lsm_free_rule(entry);
412
	kfree(entry);
413 414 415 416

	return 0;
}

417 418 419 420 421 422 423 424 425 426 427
static bool ima_rule_contains_lsm_cond(struct ima_rule_entry *entry)
{
	int i;

	for (i = 0; i < MAX_LSM_RULES; i++)
		if (entry->lsm[i].args_p)
			return true;

	return false;
}

428
/*
429 430
 * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
431
 * the reloaded LSM policy.
432 433 434
 */
static void ima_lsm_update_rules(void)
{
435
	struct ima_rule_entry *entry, *e;
436
	int result;
437

438
	list_for_each_entry_safe(entry, e, &ima_policy_rules, list) {
439
		if (!ima_rule_contains_lsm_cond(entry))
440 441 442 443
			continue;

		result = ima_lsm_update_rule(entry);
		if (result) {
444
			pr_err("lsm rule update error %d\n", result);
445
			return;
446 447 448 449
		}
	}
}

450 451 452 453 454 455 456 457 458 459
int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event,
			  void *lsm_data)
{
	if (event != LSM_POLICY_CHANGE)
		return NOTIFY_DONE;

	ima_lsm_update_rules();
	return NOTIFY_OK;
}

460
/**
461 462 463 464 465 466 467 468 469 470 471
 * ima_match_keyring - determine whether the keyring matches the measure rule
 * @rule: a pointer to a rule
 * @keyring: name of the keyring to match against the measure rule
 * @cred: a pointer to a credentials structure for user validation
 *
 * Returns true if keyring matches one in the rule, false otherwise.
 */
static bool ima_match_keyring(struct ima_rule_entry *rule,
			      const char *keyring, const struct cred *cred)
{
	bool matched = false;
472
	size_t i;
473 474 475 476 477 478 479 480 481 482

	if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
		return false;

	if (!rule->keyrings)
		return true;

	if (!keyring)
		return false;

483 484
	for (i = 0; i < rule->keyrings->count; i++) {
		if (!strcmp(rule->keyrings->items[i], keyring)) {
485 486 487 488 489 490 491 492
			matched = true;
			break;
		}
	}

	return matched;
}

493
/**
494
 * ima_match_rules - determine whether an inode matches the policy rule.
495 496
 * @rule: a pointer to a rule
 * @inode: a pointer to an inode
497 498
 * @cred: a pointer to a credentials structure for user validation
 * @secid: the secid of the task to be validated
499 500
 * @func: LIM hook identifier
 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
501
 * @keyring: keyring name to check in policy for KEY_CHECK func
502 503 504
 *
 * Returns true on rule match, false on failure.
 */
505
static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
506
			    const struct cred *cred, u32 secid,
507 508
			    enum ima_hooks func, int mask,
			    const char *keyring)
509
{
M
Mimi Zohar 已提交
510
	int i;
511

512 513 514
	if (func == KEY_CHECK) {
		return (rule->flags & IMA_FUNC) && (rule->func == func) &&
		       ima_match_keyring(rule, keyring, cred);
515
	}
516 517
	if ((rule->flags & IMA_FUNC) &&
	    (rule->func != func && func != POST_SETATTR))
518
		return false;
519 520
	if ((rule->flags & IMA_MASK) &&
	    (rule->mask != mask && func != POST_SETATTR))
521
		return false;
522 523 524
	if ((rule->flags & IMA_INMASK) &&
	    (!(rule->mask & mask) && func != POST_SETATTR))
		return false;
525 526 527
	if ((rule->flags & IMA_FSMAGIC)
	    && rule->fsmagic != inode->i_sb->s_magic)
		return false;
528 529 530
	if ((rule->flags & IMA_FSNAME)
	    && strcmp(rule->fsname, inode->i_sb->s_type->name))
		return false;
531
	if ((rule->flags & IMA_FSUUID) &&
532
	    !uuid_equal(&rule->fsuuid, &inode->i_sb->s_uuid))
533
		return false;
534
	if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
535
		return false;
536 537
	if (rule->flags & IMA_EUID) {
		if (has_capability_noaudit(current, CAP_SETUID)) {
538 539 540
			if (!rule->uid_op(cred->euid, rule->uid)
			    && !rule->uid_op(cred->suid, rule->uid)
			    && !rule->uid_op(cred->uid, rule->uid))
541
				return false;
542
		} else if (!rule->uid_op(cred->euid, rule->uid))
543 544 545
			return false;
	}

546 547
	if ((rule->flags & IMA_FOWNER) &&
	    !rule->fowner_op(inode->i_uid, rule->fowner))
548
		return false;
M
Mimi Zohar 已提交
549
	for (i = 0; i < MAX_LSM_RULES; i++) {
550
		int rc = 0;
551
		u32 osid;
M
Mimi Zohar 已提交
552

553 554 555 556 557 558
		if (!rule->lsm[i].rule) {
			if (!rule->lsm[i].args_p)
				continue;
			else
				return false;
		}
M
Mimi Zohar 已提交
559 560 561 562 563
		switch (i) {
		case LSM_OBJ_USER:
		case LSM_OBJ_ROLE:
		case LSM_OBJ_TYPE:
			security_inode_getsecid(inode, &osid);
564 565 566
			rc = ima_filter_rule_match(osid, rule->lsm[i].type,
						   Audit_equal,
						   rule->lsm[i].rule);
M
Mimi Zohar 已提交
567 568 569 570
			break;
		case LSM_SUBJ_USER:
		case LSM_SUBJ_ROLE:
		case LSM_SUBJ_TYPE:
571 572 573
			rc = ima_filter_rule_match(secid, rule->lsm[i].type,
						   Audit_equal,
						   rule->lsm[i].rule);
M
Mimi Zohar 已提交
574 575 576 577 578 579
		default:
			break;
		}
		if (!rc)
			return false;
	}
580 581 582
	return true;
}

583 584
/*
 * In addition to knowing that we need to appraise the file in general,
585
 * we need to differentiate between calling hooks, for hook specific rules.
586
 */
587
static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
588
{
589 590 591
	if (!(rule->flags & IMA_FUNC))
		return IMA_FILE_APPRAISE;

592
	switch (func) {
593 594 595 596
	case MMAP_CHECK:
		return IMA_MMAP_APPRAISE;
	case BPRM_CHECK:
		return IMA_BPRM_APPRAISE;
597 598
	case CREDS_CHECK:
		return IMA_CREDS_APPRAISE;
599
	case FILE_CHECK:
600
	case POST_SETATTR:
601
		return IMA_FILE_APPRAISE;
602 603 604
	case MODULE_CHECK ... MAX_CHECK - 1:
	default:
		return IMA_READ_APPRAISE;
605 606 607
	}
}

608 609 610
/**
 * ima_match_policy - decision based on LSM and other conditions
 * @inode: pointer to an inode for which the policy decision is being made
611 612 613
 * @cred: pointer to a credentials structure for which the policy decision is
 *        being made
 * @secid: LSM secid of the task to be validated
614 615
 * @func: IMA hook identifier
 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
616
 * @pcr: set the pcr to extend
617
 * @template_desc: the template that should be used for this rule
618 619
 * @keyring: the keyring name, if given, to be used to check in the policy.
 *           keyring can be NULL if func is anything other than KEY_CHECK.
620 621 622 623
 *
 * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 * conditions.
 *
624 625 626
 * Since the IMA policy may be updated multiple times we need to lock the
 * list when walking it.  Reads are many orders of magnitude more numerous
 * than writes so ima_match_policy() is classical RCU candidate.
627
 */
628
int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
629
		     enum ima_hooks func, int mask, int flags, int *pcr,
630 631
		     struct ima_template_desc **template_desc,
		     const char *keyring)
632
{
633
	struct ima_rule_entry *entry;
M
Mimi Zohar 已提交
634
	int action = 0, actmask = flags | (flags << 1);
635

636 637 638
	if (template_desc)
		*template_desc = ima_template_desc_current();

639 640
	rcu_read_lock();
	list_for_each_entry_rcu(entry, ima_rules, list) {
641

M
Mimi Zohar 已提交
642 643 644
		if (!(entry->action & actmask))
			continue;

645 646
		if (!ima_match_rules(entry, inode, cred, secid, func, mask,
				     keyring))
M
Mimi Zohar 已提交
647
			continue;
648

649 650
		action |= entry->flags & IMA_ACTION_FLAGS;

651
		action |= entry->action & IMA_DO_MASK;
652
		if (entry->action & IMA_APPRAISE) {
653
			action |= get_subaction(entry, func);
M
Mimi Zohar 已提交
654
			action &= ~IMA_HASH;
655 656
			if (ima_fail_unverifiable_sigs)
				action |= IMA_FAIL_UNVERIFIABLE_SIGS;
657
		}
658

659

660 661 662 663
		if (entry->action & IMA_DO_MASK)
			actmask &= ~(entry->action | entry->action << 1);
		else
			actmask &= ~(entry->action | entry->action >> 1);
664

665 666 667
		if ((pcr) && (entry->flags & IMA_PCR))
			*pcr = entry->pcr;

668 669 670
		if (template_desc && entry->template)
			*template_desc = entry->template;

M
Mimi Zohar 已提交
671 672
		if (!actmask)
			break;
673
	}
674
	rcu_read_unlock();
M
Mimi Zohar 已提交
675 676

	return action;
677 678
}

679 680 681 682 683 684 685 686 687 688 689 690 691 692 693
/*
 * Initialize the ima_policy_flag variable based on the currently
 * loaded policy.  Based on this flag, the decision to short circuit
 * out of a function or not call the function in the first place
 * can be made earlier.
 */
void ima_update_policy_flag(void)
{
	struct ima_rule_entry *entry;

	list_for_each_entry(entry, ima_rules, list) {
		if (entry->action & IMA_DO_MASK)
			ima_policy_flag |= entry->action;
	}

M
Mimi Zohar 已提交
694
	ima_appraise |= (build_ima_appraise | temp_ima_appraise);
695 696 697 698
	if (!ima_appraise)
		ima_policy_flag &= ~IMA_APPRAISE;
}

699 700 701 702 703 704 705 706
static int ima_appraise_flag(enum ima_hooks func)
{
	if (func == MODULE_CHECK)
		return IMA_APPRAISE_MODULES;
	else if (func == FIRMWARE_CHECK)
		return IMA_APPRAISE_FIRMWARE;
	else if (func == POLICY_CHECK)
		return IMA_APPRAISE_POLICY;
707 708
	else if (func == KEXEC_KERNEL_CHECK)
		return IMA_APPRAISE_KEXEC;
709 710
	else if (func == DIGEST_LIST_CHECK)
		return IMA_APPRAISE_DIGEST_LIST;
711 712 713
	return 0;
}

R
Roberto Sassu 已提交
714 715
static void __init add_rules(struct ima_rule_entry *entries, int count,
			     enum policy_rule_list policy_rule)
N
Nayna Jain 已提交
716 717 718 719 720 721
{
	int i = 0;

	for (i = 0; i < count; i++) {
		struct ima_rule_entry *entry;

R
Roberto Sassu 已提交
722 723 724 725 726 727 728 729 730 731 732 733
		if (ima_policy == EXEC_TCB) {
			if (entries == dont_measure_rules)
				if ((entries[i].flags & IMA_FSMAGIC) &&
				    entries[i].fsmagic == TMPFS_MAGIC)
					continue;

			if (entries == default_measurement_rules)
				if ((entries[i].flags & IMA_FUNC) &&
				    entries[i].func == FILE_CHECK)
					continue;
		}

N
Nayna Jain 已提交
734 735 736 737 738 739 740 741 742 743 744
		if (policy_rule & IMA_DEFAULT_POLICY)
			list_add_tail(&entries[i].list, &ima_default_rules);

		if (policy_rule & IMA_CUSTOM_POLICY) {
			entry = kmemdup(&entries[i], sizeof(*entry),
					GFP_KERNEL);
			if (!entry)
				continue;

			list_add_tail(&entry->list, &ima_policy_rules);
		}
745 746 747 748 749 750 751 752
		if (entries[i].action == APPRAISE) {
			if (entries != build_appraise_rules)
				temp_ima_appraise |=
					ima_appraise_flag(entries[i].func);
			else
				build_ima_appraise |=
					ima_appraise_flag(entries[i].func);
		}
N
Nayna Jain 已提交
753 754 755
	}
}

756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798
static int ima_parse_rule(char *rule, struct ima_rule_entry *entry);

static int __init ima_init_arch_policy(void)
{
	const char * const *arch_rules;
	const char * const *rules;
	int arch_entries = 0;
	int i = 0;

	arch_rules = arch_get_ima_policy();
	if (!arch_rules)
		return arch_entries;

	/* Get number of rules */
	for (rules = arch_rules; *rules != NULL; rules++)
		arch_entries++;

	arch_policy_entry = kcalloc(arch_entries + 1,
				    sizeof(*arch_policy_entry), GFP_KERNEL);
	if (!arch_policy_entry)
		return 0;

	/* Convert each policy string rules to struct ima_rule_entry format */
	for (rules = arch_rules, i = 0; *rules != NULL; rules++) {
		char rule[255];
		int result;

		result = strlcpy(rule, *rules, sizeof(rule));

		INIT_LIST_HEAD(&arch_policy_entry[i].list);
		result = ima_parse_rule(rule, &arch_policy_entry[i]);
		if (result) {
			pr_warn("Skipping unknown architecture policy rule: %s\n",
				rule);
			memset(&arch_policy_entry[i], 0,
			       sizeof(*arch_policy_entry));
			continue;
		}
		i++;
	}
	return i;
}

799 800 801
/**
 * ima_init_policy - initialize the default measure rules.
 *
802 803
 * ima_rules points to either the ima_default_rules or the
 * the new ima_policy_rules.
804
 */
805
void __init ima_init_policy(void)
806
{
807
	int build_appraise_entries, arch_entries;
808

N
Nayna Jain 已提交
809 810 811 812
	/* if !ima_policy, we load NO default rules */
	if (ima_policy)
		add_rules(dont_measure_rules, ARRAY_SIZE(dont_measure_rules),
			  IMA_DEFAULT_POLICY);
M
Mimi Zohar 已提交
813 814 815

	switch (ima_policy) {
	case ORIGINAL_TCB:
N
Nayna Jain 已提交
816 817 818
		add_rules(original_measurement_rules,
			  ARRAY_SIZE(original_measurement_rules),
			  IMA_DEFAULT_POLICY);
M
Mimi Zohar 已提交
819
		break;
R
Roberto Sassu 已提交
820 821
	case EXEC_TCB:
		fallthrough;
M
Mimi Zohar 已提交
822
	case DEFAULT_TCB:
N
Nayna Jain 已提交
823 824 825
		add_rules(default_measurement_rules,
			  ARRAY_SIZE(default_measurement_rules),
			  IMA_DEFAULT_POLICY);
M
Mimi Zohar 已提交
826 827 828
	default:
		break;
	}
829

830 831 832 833 834 835 836 837 838 839 840 841 842
	/*
	 * Based on runtime secure boot flags, insert arch specific measurement
	 * and appraise rules requiring file signatures for both the initial
	 * and custom policies, prior to other appraise rules.
	 * (Highest priority)
	 */
	arch_entries = ima_init_arch_policy();
	if (!arch_entries)
		pr_info("No architecture policies found\n");
	else
		add_rules(arch_policy_entry, arch_entries,
			  IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY);

843
	/*
M
Mimi Zohar 已提交
844
	 * Insert the builtin "secure_boot" policy rules requiring file
845
	 * signatures, prior to other appraise rules.
846
	 */
N
Nayna Jain 已提交
847 848 849
	if (ima_use_secure_boot)
		add_rules(secure_boot_rules, ARRAY_SIZE(secure_boot_rules),
			  IMA_DEFAULT_POLICY);
850

M
Mimi Zohar 已提交
851 852 853
	/*
	 * Insert the build time appraise rules requiring file signatures
	 * for both the initial and custom policies, prior to other appraise
N
Nayna Jain 已提交
854 855
	 * rules. As the secure boot rules includes all of the build time
	 * rules, include either one or the other set of rules, but not both.
M
Mimi Zohar 已提交
856
	 */
N
Nayna Jain 已提交
857 858 859 860 861 862 863 864
	build_appraise_entries = ARRAY_SIZE(build_appraise_rules);
	if (build_appraise_entries) {
		if (ima_use_secure_boot)
			add_rules(build_appraise_rules, build_appraise_entries,
				  IMA_CUSTOM_POLICY);
		else
			add_rules(build_appraise_rules, build_appraise_entries,
				  IMA_DEFAULT_POLICY | IMA_CUSTOM_POLICY);
M
Mimi Zohar 已提交
865 866
	}

N
Nayna Jain 已提交
867 868 869 870
	if (ima_use_appraise_tcb)
		add_rules(default_appraise_rules,
			  ARRAY_SIZE(default_appraise_rules),
			  IMA_DEFAULT_POLICY);
871

M
Mimi Zohar 已提交
872
	ima_update_policy_flag();
873
}
M
Mimi Zohar 已提交
874

875
/* Make sure we have a valid policy, at least containing some rules. */
876
int ima_check_policy(void)
877 878 879 880 881 882
{
	if (list_empty(&ima_temp_rules))
		return -EINVAL;
	return 0;
}

M
Mimi Zohar 已提交
883 884 885 886
/**
 * ima_update_policy - update default_rules with new measure rules
 *
 * Called on file .release to update the default rules with a complete new
887 888 889 890 891 892
 * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 * they make a queue.  The policy may be updated multiple times and this is the
 * RCU updater.
 *
 * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 * we switch from the default policy to user defined.
M
Mimi Zohar 已提交
893 894 895
 */
void ima_update_policy(void)
{
896
	struct list_head *policy = &ima_policy_rules;
897

898
	list_splice_tail_init_rcu(&ima_temp_rules, policy, synchronize_rcu);
899 900 901 902

	if (ima_rules != policy) {
		ima_policy_flag = 0;
		ima_rules = policy;
903 904 905 906 907 908 909 910

		/*
		 * IMA architecture specific policy rules are specified
		 * as strings and converted to an array of ima_entry_rules
		 * on boot.  After loading a custom policy, free the
		 * architecture specific rules stored as an array.
		 */
		kfree(arch_policy_entry);
911
	}
912
	ima_update_policy_flag();
913 914 915

	/* Custom IMA policy has been loaded */
	ima_process_queued_keys();
M
Mimi Zohar 已提交
916 917
}

918
/* Keep the enumeration in sync with the policy_tokens! */
M
Mimi Zohar 已提交
919
enum {
920
	Opt_measure, Opt_dont_measure,
921
	Opt_appraise, Opt_dont_appraise,
922
	Opt_audit, Opt_hash, Opt_dont_hash,
M
Mimi Zohar 已提交
923 924
	Opt_obj_user, Opt_obj_role, Opt_obj_type,
	Opt_subj_user, Opt_subj_role, Opt_subj_type,
925
	Opt_func, Opt_mask, Opt_fsmagic, Opt_fsname,
926 927 928
	Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq,
	Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt,
	Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt,
929
	Opt_appraise_type, Opt_appraise_flag,
930 931
	Opt_permit_directio, Opt_pcr, Opt_template, Opt_keyrings,
	Opt_err
M
Mimi Zohar 已提交
932 933
};

934
static const match_table_t policy_tokens = {
M
Mimi Zohar 已提交
935 936
	{Opt_measure, "measure"},
	{Opt_dont_measure, "dont_measure"},
937 938
	{Opt_appraise, "appraise"},
	{Opt_dont_appraise, "dont_appraise"},
P
Peter Moody 已提交
939
	{Opt_audit, "audit"},
940 941
	{Opt_hash, "hash"},
	{Opt_dont_hash, "dont_hash"},
M
Mimi Zohar 已提交
942 943 944 945 946 947 948 949 950
	{Opt_obj_user, "obj_user=%s"},
	{Opt_obj_role, "obj_role=%s"},
	{Opt_obj_type, "obj_type=%s"},
	{Opt_subj_user, "subj_user=%s"},
	{Opt_subj_role, "subj_role=%s"},
	{Opt_subj_type, "subj_type=%s"},
	{Opt_func, "func=%s"},
	{Opt_mask, "mask=%s"},
	{Opt_fsmagic, "fsmagic=%s"},
951
	{Opt_fsname, "fsname=%s"},
952
	{Opt_fsuuid, "fsuuid=%s"},
953 954 955 956 957 958 959 960 961
	{Opt_uid_eq, "uid=%s"},
	{Opt_euid_eq, "euid=%s"},
	{Opt_fowner_eq, "fowner=%s"},
	{Opt_uid_gt, "uid>%s"},
	{Opt_euid_gt, "euid>%s"},
	{Opt_fowner_gt, "fowner>%s"},
	{Opt_uid_lt, "uid<%s"},
	{Opt_euid_lt, "euid<%s"},
	{Opt_fowner_lt, "fowner<%s"},
962
	{Opt_appraise_type, "appraise_type=%s"},
963
	{Opt_appraise_flag, "appraise_flag=%s"},
964
	{Opt_permit_directio, "permit_directio"},
965
	{Opt_pcr, "pcr=%s"},
966
	{Opt_template, "template=%s"},
967
	{Opt_keyrings, "keyrings=%s"},
M
Mimi Zohar 已提交
968 969 970
	{Opt_err, NULL}
};

971
static int ima_lsm_rule_init(struct ima_rule_entry *entry,
972
			     substring_t *args, int lsm_rule, int audit_type)
M
Mimi Zohar 已提交
973 974 975
{
	int result;

976 977 978
	if (entry->lsm[lsm_rule].rule)
		return -EINVAL;

979 980 981 982
	entry->lsm[lsm_rule].args_p = match_strdup(args);
	if (!entry->lsm[lsm_rule].args_p)
		return -ENOMEM;

M
Mimi Zohar 已提交
983
	entry->lsm[lsm_rule].type = audit_type;
984 985 986
	result = ima_filter_rule_init(entry->lsm[lsm_rule].type, Audit_equal,
				      entry->lsm[lsm_rule].args_p,
				      &entry->lsm[lsm_rule].rule);
987
	if (!entry->lsm[lsm_rule].rule) {
988
		pr_warn("rule for LSM \'%s\' is undefined\n",
989
			entry->lsm[lsm_rule].args_p);
990 991 992

		if (ima_rules == &ima_default_rules) {
			kfree(entry->lsm[lsm_rule].args_p);
993
			entry->lsm[lsm_rule].args_p = NULL;
994 995 996
			result = -EINVAL;
		} else
			result = 0;
997 998
	}

M
Mimi Zohar 已提交
999 1000 1001
	return result;
}

1002 1003
static void ima_log_string_op(struct audit_buffer *ab, char *key, char *value,
			      bool (*rule_operator)(kuid_t, kuid_t))
1004
{
1005 1006 1007
	if (!ab)
		return;

1008 1009 1010 1011 1012 1013
	if (rule_operator == &uid_gt)
		audit_log_format(ab, "%s>", key);
	else if (rule_operator == &uid_lt)
		audit_log_format(ab, "%s<", key);
	else
		audit_log_format(ab, "%s=", key);
1014
	audit_log_format(ab, "%s ", value);
1015
}
1016 1017 1018 1019
static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
{
	ima_log_string_op(ab, key, value, NULL);
}
1020

1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052
/*
 * Validating the appended signature included in the measurement list requires
 * the file hash calculated without the appended signature (i.e., the 'd-modsig'
 * field). Therefore, notify the user if they have the 'modsig' field but not
 * the 'd-modsig' field in the template.
 */
static void check_template_modsig(const struct ima_template_desc *template)
{
#define MSG "template with 'modsig' field also needs 'd-modsig' field\n"
	bool has_modsig, has_dmodsig;
	static bool checked;
	int i;

	/* We only need to notify the user once. */
	if (checked)
		return;

	has_modsig = has_dmodsig = false;
	for (i = 0; i < template->num_fields; i++) {
		if (!strcmp(template->fields[i]->field_id, "modsig"))
			has_modsig = true;
		else if (!strcmp(template->fields[i]->field_id, "d-modsig"))
			has_dmodsig = true;
	}

	if (has_modsig && !has_dmodsig)
		pr_notice(MSG);

	checked = true;
#undef MSG
}

1053 1054
static bool ima_validate_rule(struct ima_rule_entry *entry)
{
1055
	/* Ensure that the action is set and is compatible with the flags */
1056 1057 1058
	if (entry->action == UNKNOWN)
		return false;

1059 1060 1061 1062
	if (entry->action != MEASURE && entry->flags & IMA_PCR)
		return false;

	if (entry->action != APPRAISE &&
1063 1064
	    entry->flags & (IMA_DIGSIG_REQUIRED | IMA_MODSIG_ALLOWED |
			    IMA_CHECK_BLACKLIST | IMA_META_IMMUTABLE_REQUIRED))
1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076
		return false;

	/*
	 * The IMA_FUNC bit must be set if and only if there's a valid hook
	 * function specified, and vice versa. Enforcing this property allows
	 * for the NONE case below to validate a rule without an explicit hook
	 * function.
	 */
	if (((entry->flags & IMA_FUNC) && entry->func == NONE) ||
	    (!(entry->flags & IMA_FUNC) && entry->func != NONE))
		return false;

1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088
	/*
	 * Ensure that the hook function is compatible with the other
	 * components of the rule
	 */
	switch (entry->func) {
	case NONE:
	case FILE_CHECK:
	case MMAP_CHECK:
	case BPRM_CHECK:
	case CREDS_CHECK:
	case POST_SETATTR:
	case FIRMWARE_CHECK:
1089
	case POLICY_CHECK:
1090
	case DIGEST_LIST_CHECK:
1091 1092 1093 1094
		if (entry->flags & ~(IMA_FUNC | IMA_MASK | IMA_FSMAGIC |
				     IMA_UID | IMA_FOWNER | IMA_FSUUID |
				     IMA_INMASK | IMA_EUID | IMA_PCR |
				     IMA_FSNAME | IMA_DIGSIG_REQUIRED |
1095 1096
				     IMA_PERMIT_DIRECTIO |
				     IMA_META_IMMUTABLE_REQUIRED))
1097 1098 1099 1100
			return false;

		break;
	case MODULE_CHECK:
1101 1102
	case KEXEC_KERNEL_CHECK:
	case KEXEC_INITRAMFS_CHECK:
1103 1104 1105 1106 1107
		if (entry->flags & ~(IMA_FUNC | IMA_MASK | IMA_FSMAGIC |
				     IMA_UID | IMA_FOWNER | IMA_FSUUID |
				     IMA_INMASK | IMA_EUID | IMA_PCR |
				     IMA_FSNAME | IMA_DIGSIG_REQUIRED |
				     IMA_PERMIT_DIRECTIO | IMA_MODSIG_ALLOWED |
1108 1109
				     IMA_CHECK_BLACKLIST |
				     IMA_META_IMMUTABLE_REQUIRED))
1110 1111
			return false;

1112 1113
		break;
	case KEXEC_CMDLINE:
1114 1115 1116
		if (entry->action & ~(MEASURE | DONT_MEASURE))
			return false;

1117 1118 1119
		if (entry->flags & ~(IMA_FUNC | IMA_FSMAGIC | IMA_UID |
				     IMA_FOWNER | IMA_FSUUID | IMA_EUID |
				     IMA_PCR | IMA_FSNAME))
1120 1121 1122
			return false;

		break;
1123 1124 1125 1126
	case KEY_CHECK:
		if (entry->action & ~(MEASURE | DONT_MEASURE))
			return false;

1127 1128 1129 1130 1131 1132 1133
		if (entry->flags & ~(IMA_FUNC | IMA_UID | IMA_PCR |
				     IMA_KEYRINGS))
			return false;

		if (ima_rule_contains_lsm_cond(entry))
			return false;

1134 1135 1136 1137 1138
		break;
	default:
		return false;
	}

1139 1140 1141 1142 1143
	/* Ensure that combinations of flags are compatible with each other */
	if (entry->flags & IMA_CHECK_BLACKLIST &&
	    !(entry->flags & IMA_MODSIG_ALLOWED))
		return false;

1144 1145 1146
	return true;
}

1147
static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
M
Mimi Zohar 已提交
1148 1149
{
	struct audit_buffer *ab;
1150
	char *from;
M
Mimi Zohar 已提交
1151
	char *p;
1152
	bool uid_token;
1153
	struct ima_template_desc *template_desc;
M
Mimi Zohar 已提交
1154 1155
	int result = 0;

1156 1157
	ab = integrity_audit_log_start(audit_context(), GFP_KERNEL,
				       AUDIT_INTEGRITY_POLICY_RULE);
M
Mimi Zohar 已提交
1158

1159
	entry->uid = INVALID_UID;
1160
	entry->fowner = INVALID_UID;
1161 1162
	entry->uid_op = &uid_eq;
	entry->fowner_op = &uid_eq;
1163
	entry->action = UNKNOWN;
E
Eric Paris 已提交
1164
	while ((p = strsep(&rule, " \t")) != NULL) {
M
Mimi Zohar 已提交
1165 1166 1167 1168 1169 1170
		substring_t args[MAX_OPT_ARGS];
		int token;
		unsigned long lnum;

		if (result < 0)
			break;
E
Eric Paris 已提交
1171 1172
		if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
			continue;
M
Mimi Zohar 已提交
1173 1174 1175
		token = match_token(p, policy_tokens, args);
		switch (token) {
		case Opt_measure:
1176
			ima_log_string(ab, "action", "measure");
1177 1178 1179 1180

			if (entry->action != UNKNOWN)
				result = -EINVAL;

M
Mimi Zohar 已提交
1181 1182 1183
			entry->action = MEASURE;
			break;
		case Opt_dont_measure:
1184
			ima_log_string(ab, "action", "dont_measure");
1185 1186 1187 1188

			if (entry->action != UNKNOWN)
				result = -EINVAL;

M
Mimi Zohar 已提交
1189 1190
			entry->action = DONT_MEASURE;
			break;
1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206
		case Opt_appraise:
			ima_log_string(ab, "action", "appraise");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = APPRAISE;
			break;
		case Opt_dont_appraise:
			ima_log_string(ab, "action", "dont_appraise");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = DONT_APPRAISE;
			break;
P
Peter Moody 已提交
1207 1208 1209 1210 1211 1212 1213 1214
		case Opt_audit:
			ima_log_string(ab, "action", "audit");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = AUDIT;
			break;
1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230
		case Opt_hash:
			ima_log_string(ab, "action", "hash");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = HASH;
			break;
		case Opt_dont_hash:
			ima_log_string(ab, "action", "dont_hash");

			if (entry->action != UNKNOWN)
				result = -EINVAL;

			entry->action = DONT_HASH;
			break;
M
Mimi Zohar 已提交
1231
		case Opt_func:
1232
			ima_log_string(ab, "func", args[0].from);
1233 1234

			if (entry->func)
1235
				result = -EINVAL;
1236

1237 1238 1239 1240 1241
			if (strcmp(args[0].from, "FILE_CHECK") == 0)
				entry->func = FILE_CHECK;
			/* PATH_CHECK is for backwards compat */
			else if (strcmp(args[0].from, "PATH_CHECK") == 0)
				entry->func = FILE_CHECK;
1242 1243
			else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
				entry->func = MODULE_CHECK;
1244 1245
			else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
				entry->func = FIRMWARE_CHECK;
M
Mimi Zohar 已提交
1246 1247 1248
			else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
				|| (strcmp(args[0].from, "MMAP_CHECK") == 0))
				entry->func = MMAP_CHECK;
M
Mimi Zohar 已提交
1249 1250
			else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
				entry->func = BPRM_CHECK;
1251 1252
			else if (strcmp(args[0].from, "CREDS_CHECK") == 0)
				entry->func = CREDS_CHECK;
1253 1254 1255 1256 1257 1258
			else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
				 0)
				entry->func = KEXEC_KERNEL_CHECK;
			else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
				 == 0)
				entry->func = KEXEC_INITRAMFS_CHECK;
1259 1260
			else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
				entry->func = POLICY_CHECK;
1261 1262
			else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0)
				entry->func = KEXEC_CMDLINE;
1263 1264
			else if (IS_ENABLED(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) &&
				 strcmp(args[0].from, "KEY_CHECK") == 0)
1265
				entry->func = KEY_CHECK;
1266 1267
			else if (strcmp(args[0].from, "DIGEST_LIST_CHECK") == 0)
				entry->func = DIGEST_LIST_CHECK;
M
Mimi Zohar 已提交
1268 1269 1270 1271 1272 1273
			else
				result = -EINVAL;
			if (!result)
				entry->flags |= IMA_FUNC;
			break;
		case Opt_mask:
1274
			ima_log_string(ab, "mask", args[0].from);
1275 1276 1277 1278

			if (entry->mask)
				result = -EINVAL;

1279 1280 1281 1282 1283
			from = args[0].from;
			if (*from == '^')
				from++;

			if ((strcmp(from, "MAY_EXEC")) == 0)
M
Mimi Zohar 已提交
1284
				entry->mask = MAY_EXEC;
1285
			else if (strcmp(from, "MAY_WRITE") == 0)
M
Mimi Zohar 已提交
1286
				entry->mask = MAY_WRITE;
1287
			else if (strcmp(from, "MAY_READ") == 0)
M
Mimi Zohar 已提交
1288
				entry->mask = MAY_READ;
1289
			else if (strcmp(from, "MAY_APPEND") == 0)
M
Mimi Zohar 已提交
1290 1291 1292 1293
				entry->mask = MAY_APPEND;
			else
				result = -EINVAL;
			if (!result)
1294 1295
				entry->flags |= (*args[0].from == '^')
				     ? IMA_INMASK : IMA_MASK;
M
Mimi Zohar 已提交
1296 1297
			break;
		case Opt_fsmagic:
1298
			ima_log_string(ab, "fsmagic", args[0].from);
1299 1300 1301 1302 1303 1304

			if (entry->fsmagic) {
				result = -EINVAL;
				break;
			}

1305
			result = kstrtoul(args[0].from, 16, &entry->fsmagic);
M
Mimi Zohar 已提交
1306 1307 1308
			if (!result)
				entry->flags |= IMA_FSMAGIC;
			break;
1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319
		case Opt_fsname:
			ima_log_string(ab, "fsname", args[0].from);

			entry->fsname = kstrdup(args[0].from, GFP_KERNEL);
			if (!entry->fsname) {
				result = -ENOMEM;
				break;
			}
			result = 0;
			entry->flags |= IMA_FSNAME;
			break;
1320 1321 1322
		case Opt_keyrings:
			ima_log_string(ab, "keyrings", args[0].from);

1323 1324
			if (!IS_ENABLED(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) ||
			    entry->keyrings) {
1325 1326 1327
				result = -EINVAL;
				break;
			}
1328

1329 1330 1331 1332
			entry->keyrings = ima_alloc_rule_opt_list(args);
			if (IS_ERR(entry->keyrings)) {
				result = PTR_ERR(entry->keyrings);
				entry->keyrings = NULL;
1333 1334
				break;
			}
1335

1336 1337
			entry->flags |= IMA_KEYRINGS;
			break;
1338 1339 1340
		case Opt_fsuuid:
			ima_log_string(ab, "fsuuid", args[0].from);

1341
			if (!uuid_is_null(&entry->fsuuid)) {
1342 1343 1344 1345
				result = -EINVAL;
				break;
			}

1346
			result = uuid_parse(args[0].from, &entry->fsuuid);
1347 1348
			if (!result)
				entry->flags |= IMA_FSUUID;
1349
			break;
1350 1351 1352
		case Opt_uid_gt:
		case Opt_euid_gt:
			entry->uid_op = &uid_gt;
1353
			fallthrough;
1354 1355 1356 1357
		case Opt_uid_lt:
		case Opt_euid_lt:
			if ((token == Opt_uid_lt) || (token == Opt_euid_lt))
				entry->uid_op = &uid_lt;
1358
			fallthrough;
1359 1360 1361 1362 1363 1364 1365 1366
		case Opt_uid_eq:
		case Opt_euid_eq:
			uid_token = (token == Opt_uid_eq) ||
				    (token == Opt_uid_gt) ||
				    (token == Opt_uid_lt);

			ima_log_string_op(ab, uid_token ? "uid" : "euid",
					  args[0].from, entry->uid_op);
1367

1368
			if (uid_valid(entry->uid)) {
1369 1370 1371 1372
				result = -EINVAL;
				break;
			}

1373
			result = kstrtoul(args[0].from, 10, &lnum);
M
Mimi Zohar 已提交
1374
			if (!result) {
1375 1376 1377 1378
				entry->uid = make_kuid(current_user_ns(),
						       (uid_t) lnum);
				if (!uid_valid(entry->uid) ||
				    (uid_t)lnum != lnum)
M
Mimi Zohar 已提交
1379 1380
					result = -EINVAL;
				else
1381
					entry->flags |= uid_token
1382
					    ? IMA_UID : IMA_EUID;
M
Mimi Zohar 已提交
1383 1384
			}
			break;
1385 1386
		case Opt_fowner_gt:
			entry->fowner_op = &uid_gt;
1387
			fallthrough;
1388 1389 1390
		case Opt_fowner_lt:
			if (token == Opt_fowner_lt)
				entry->fowner_op = &uid_lt;
1391
			fallthrough;
1392 1393 1394
		case Opt_fowner_eq:
			ima_log_string_op(ab, "fowner", args[0].from,
					  entry->fowner_op);
1395

1396
			if (uid_valid(entry->fowner)) {
1397 1398 1399 1400
				result = -EINVAL;
				break;
			}

1401
			result = kstrtoul(args[0].from, 10, &lnum);
1402
			if (!result) {
1403 1404
				entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
				if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
1405 1406 1407 1408 1409
					result = -EINVAL;
				else
					entry->flags |= IMA_FOWNER;
			}
			break;
M
Mimi Zohar 已提交
1410
		case Opt_obj_user:
1411
			ima_log_string(ab, "obj_user", args[0].from);
1412
			result = ima_lsm_rule_init(entry, args,
M
Mimi Zohar 已提交
1413 1414 1415 1416
						   LSM_OBJ_USER,
						   AUDIT_OBJ_USER);
			break;
		case Opt_obj_role:
1417
			ima_log_string(ab, "obj_role", args[0].from);
1418
			result = ima_lsm_rule_init(entry, args,
M
Mimi Zohar 已提交
1419 1420 1421 1422
						   LSM_OBJ_ROLE,
						   AUDIT_OBJ_ROLE);
			break;
		case Opt_obj_type:
1423
			ima_log_string(ab, "obj_type", args[0].from);
1424
			result = ima_lsm_rule_init(entry, args,
M
Mimi Zohar 已提交
1425 1426 1427 1428
						   LSM_OBJ_TYPE,
						   AUDIT_OBJ_TYPE);
			break;
		case Opt_subj_user:
1429
			ima_log_string(ab, "subj_user", args[0].from);
1430
			result = ima_lsm_rule_init(entry, args,
M
Mimi Zohar 已提交
1431 1432 1433 1434
						   LSM_SUBJ_USER,
						   AUDIT_SUBJ_USER);
			break;
		case Opt_subj_role:
1435
			ima_log_string(ab, "subj_role", args[0].from);
1436
			result = ima_lsm_rule_init(entry, args,
M
Mimi Zohar 已提交
1437 1438 1439 1440
						   LSM_SUBJ_ROLE,
						   AUDIT_SUBJ_ROLE);
			break;
		case Opt_subj_type:
1441
			ima_log_string(ab, "subj_type", args[0].from);
1442
			result = ima_lsm_rule_init(entry, args,
M
Mimi Zohar 已提交
1443 1444 1445
						   LSM_SUBJ_TYPE,
						   AUDIT_SUBJ_TYPE);
			break;
1446 1447 1448 1449
		case Opt_appraise_type:
			ima_log_string(ab, "appraise_type", args[0].from);
			if ((strcmp(args[0].from, "imasig")) == 0)
				entry->flags |= IMA_DIGSIG_REQUIRED;
1450
			else if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) &&
1451 1452 1453
				 strcmp(args[0].from, "imasig|modsig") == 0)
				entry->flags |= IMA_DIGSIG_REQUIRED |
						IMA_MODSIG_ALLOWED;
1454 1455
			else if (strcmp(args[0].from, "meta_immutable") == 0)
				entry->flags |= IMA_META_IMMUTABLE_REQUIRED;
1456 1457 1458
			else
				result = -EINVAL;
			break;
1459 1460
		case Opt_appraise_flag:
			ima_log_string(ab, "appraise_flag", args[0].from);
1461 1462
			if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) &&
			    strstr(args[0].from, "blacklist"))
1463
				entry->flags |= IMA_CHECK_BLACKLIST;
1464 1465
			else
				result = -EINVAL;
1466
			break;
1467 1468
		case Opt_permit_directio:
			entry->flags |= IMA_PERMIT_DIRECTIO;
1469 1470 1471 1472 1473
			break;
		case Opt_pcr:
			ima_log_string(ab, "pcr", args[0].from);

			result = kstrtoint(args[0].from, 10, &entry->pcr);
1474 1475
			if (result || INVALID_PCR(entry->pcr) ||
			    entry->pcr == ima_digest_list_pcr)
1476 1477 1478 1479
				result = -EINVAL;
			else
				entry->flags |= IMA_PCR;

1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501
			break;
		case Opt_template:
			ima_log_string(ab, "template", args[0].from);
			if (entry->action != MEASURE) {
				result = -EINVAL;
				break;
			}
			template_desc = lookup_template_desc(args[0].from);
			if (!template_desc || entry->template) {
				result = -EINVAL;
				break;
			}

			/*
			 * template_desc_init_fields() does nothing if
			 * the template is already initialised, so
			 * it's safe to do this unconditionally
			 */
			template_desc_init_fields(template_desc->fmt,
						 &(template_desc->fields),
						 &(template_desc->num_fields));
			entry->template = template_desc;
1502
			break;
M
Mimi Zohar 已提交
1503
		case Opt_err:
1504
			ima_log_string(ab, "UNKNOWN", p);
1505
			result = -EINVAL;
M
Mimi Zohar 已提交
1506 1507 1508
			break;
		}
	}
1509
	if (!result && !ima_validate_rule(entry))
M
Mimi Zohar 已提交
1510
		result = -EINVAL;
1511 1512 1513
	else if (entry->action == APPRAISE)
		temp_ima_appraise |= ima_appraise_flag(entry->func);

1514 1515 1516 1517 1518 1519
	if (!result && entry->flags & IMA_MODSIG_ALLOWED) {
		template_desc = entry->template ? entry->template :
						  ima_template_desc_current();
		check_template_modsig(template_desc);
	}

1520
	audit_log_format(ab, "res=%d", !result);
M
Mimi Zohar 已提交
1521 1522 1523 1524 1525
	audit_log_end(ab);
	return result;
}

/**
1526
 * ima_parse_add_rule - add a rule to ima_policy_rules
M
Mimi Zohar 已提交
1527 1528
 * @rule - ima measurement policy rule
 *
1529
 * Avoid locking by allowing just one writer at a time in ima_write_policy()
1530
 * Returns the length of the rule parsed, an error code on failure
M
Mimi Zohar 已提交
1531
 */
1532
ssize_t ima_parse_add_rule(char *rule)
M
Mimi Zohar 已提交
1533
{
1534
	static const char op[] = "update_policy";
1535
	char *p;
1536
	struct ima_rule_entry *entry;
1537
	ssize_t result, len;
M
Mimi Zohar 已提交
1538 1539
	int audit_info = 0;

1540 1541
	p = strsep(&rule, "\n");
	len = strlen(p) + 1;
1542
	p += strspn(p, " \t");
1543

1544
	if (*p == '#' || *p == '\0')
1545 1546
		return len;

M
Mimi Zohar 已提交
1547 1548 1549 1550 1551 1552 1553 1554 1555
	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
	if (!entry) {
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
				    NULL, op, "-ENOMEM", -ENOMEM, audit_info);
		return -ENOMEM;
	}

	INIT_LIST_HEAD(&entry->list);

1556
	result = ima_parse_rule(p, entry);
E
Eric Paris 已提交
1557
	if (result) {
1558
		ima_free_rule(entry);
M
Mimi Zohar 已提交
1559
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
1560
				    NULL, op, "invalid-policy", result,
M
Mimi Zohar 已提交
1561
				    audit_info);
E
Eric Paris 已提交
1562
		return result;
M
Mimi Zohar 已提交
1563
	}
E
Eric Paris 已提交
1564

1565
	list_add_tail(&entry->list, &ima_temp_rules);
E
Eric Paris 已提交
1566 1567

	return len;
M
Mimi Zohar 已提交
1568 1569
}

1570 1571 1572 1573 1574 1575
/**
 * ima_delete_rules() called to cleanup invalid in-flight policy.
 * We don't need locking as we operate on the temp list, which is
 * different from the active one.  There is also only one user of
 * ima_delete_rules() at a time.
 */
1576
void ima_delete_rules(void)
M
Mimi Zohar 已提交
1577
{
1578
	struct ima_rule_entry *entry, *tmp;
M
Mimi Zohar 已提交
1579

1580
	temp_ima_appraise = 0;
1581
	list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
M
Mimi Zohar 已提交
1582
		list_del(&entry->list);
1583
		ima_free_rule(entry);
M
Mimi Zohar 已提交
1584 1585
	}
}
1586

1587
#define __ima_hook_stringify(func, str)	(#func),
1588 1589 1590 1591 1592

const char *const func_tokens[] = {
	__ima_hooks(__ima_hook_stringify)
};

1593 1594 1595 1596 1597
#ifdef	CONFIG_IMA_READ_POLICY
enum {
	mask_exec = 0, mask_write, mask_read, mask_append
};

1598
static const char *const mask_tokens[] = {
1599 1600 1601 1602
	"^MAY_EXEC",
	"^MAY_WRITE",
	"^MAY_READ",
	"^MAY_APPEND"
1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636
};

void *ima_policy_start(struct seq_file *m, loff_t *pos)
{
	loff_t l = *pos;
	struct ima_rule_entry *entry;

	rcu_read_lock();
	list_for_each_entry_rcu(entry, ima_rules, list) {
		if (!l--) {
			rcu_read_unlock();
			return entry;
		}
	}
	rcu_read_unlock();
	return NULL;
}

void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
{
	struct ima_rule_entry *entry = v;

	rcu_read_lock();
	entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
	rcu_read_unlock();
	(*pos)++;

	return (&entry->list == ima_rules) ? NULL : entry;
}

void ima_policy_stop(struct seq_file *m, void *v)
{
}

1637
#define pt(token)	policy_tokens[token].pattern
1638 1639
#define mt(token)	mask_tokens[token]

1640 1641 1642 1643 1644
/*
 * policy_func_show - display the ima_hooks policy rule
 */
static void policy_func_show(struct seq_file *m, enum ima_hooks func)
{
1645 1646 1647 1648
	if (func > 0 && func < MAX_CHECK)
		seq_printf(m, "func=%s ", func_tokens[func]);
	else
		seq_printf(m, "func=%d ", func);
1649 1650
}

1651 1652 1653 1654 1655 1656 1657 1658 1659
static void ima_show_rule_opt_list(struct seq_file *m,
				   const struct ima_rule_opt_list *opt_list)
{
	size_t i;

	for (i = 0; i < opt_list->count; i++)
		seq_printf(m, "%s%s", i ? "|" : "", opt_list->items[i]);
}

1660 1661 1662
int ima_policy_show(struct seq_file *m, void *v)
{
	struct ima_rule_entry *entry = v;
1663
	int i;
1664
	char tbuf[64] = {0,};
1665
	int offset = 0;
1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678

	rcu_read_lock();

	if (entry->action & MEASURE)
		seq_puts(m, pt(Opt_measure));
	if (entry->action & DONT_MEASURE)
		seq_puts(m, pt(Opt_dont_measure));
	if (entry->action & APPRAISE)
		seq_puts(m, pt(Opt_appraise));
	if (entry->action & DONT_APPRAISE)
		seq_puts(m, pt(Opt_dont_appraise));
	if (entry->action & AUDIT)
		seq_puts(m, pt(Opt_audit));
1679 1680 1681 1682
	if (entry->action & HASH)
		seq_puts(m, pt(Opt_hash));
	if (entry->action & DONT_HASH)
		seq_puts(m, pt(Opt_dont_hash));
1683 1684 1685

	seq_puts(m, " ");

1686 1687
	if (entry->flags & IMA_FUNC)
		policy_func_show(m, entry->func);
1688

1689 1690 1691
	if ((entry->flags & IMA_MASK) || (entry->flags & IMA_INMASK)) {
		if (entry->flags & IMA_MASK)
			offset = 1;
1692
		if (entry->mask & MAY_EXEC)
1693
			seq_printf(m, pt(Opt_mask), mt(mask_exec) + offset);
1694
		if (entry->mask & MAY_WRITE)
1695
			seq_printf(m, pt(Opt_mask), mt(mask_write) + offset);
1696
		if (entry->mask & MAY_READ)
1697
			seq_printf(m, pt(Opt_mask), mt(mask_read) + offset);
1698
		if (entry->mask & MAY_APPEND)
1699
			seq_printf(m, pt(Opt_mask), mt(mask_append) + offset);
1700 1701 1702 1703 1704 1705 1706 1707 1708
		seq_puts(m, " ");
	}

	if (entry->flags & IMA_FSMAGIC) {
		snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
		seq_printf(m, pt(Opt_fsmagic), tbuf);
		seq_puts(m, " ");
	}

1709 1710 1711 1712 1713 1714
	if (entry->flags & IMA_FSNAME) {
		snprintf(tbuf, sizeof(tbuf), "%s", entry->fsname);
		seq_printf(m, pt(Opt_fsname), tbuf);
		seq_puts(m, " ");
	}

1715
	if (entry->flags & IMA_KEYRINGS) {
1716 1717
		seq_puts(m, "keyrings=");
		ima_show_rule_opt_list(m, entry->keyrings);
1718 1719 1720
		seq_puts(m, " ");
	}

1721 1722 1723 1724 1725 1726
	if (entry->flags & IMA_PCR) {
		snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
		seq_printf(m, pt(Opt_pcr), tbuf);
		seq_puts(m, " ");
	}

1727
	if (entry->flags & IMA_FSUUID) {
1728
		seq_printf(m, "fsuuid=%pU", &entry->fsuuid);
1729 1730 1731 1732 1733
		seq_puts(m, " ");
	}

	if (entry->flags & IMA_UID) {
		snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1734 1735 1736 1737 1738 1739
		if (entry->uid_op == &uid_gt)
			seq_printf(m, pt(Opt_uid_gt), tbuf);
		else if (entry->uid_op == &uid_lt)
			seq_printf(m, pt(Opt_uid_lt), tbuf);
		else
			seq_printf(m, pt(Opt_uid_eq), tbuf);
1740 1741 1742 1743 1744
		seq_puts(m, " ");
	}

	if (entry->flags & IMA_EUID) {
		snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1745 1746 1747 1748 1749 1750
		if (entry->uid_op == &uid_gt)
			seq_printf(m, pt(Opt_euid_gt), tbuf);
		else if (entry->uid_op == &uid_lt)
			seq_printf(m, pt(Opt_euid_lt), tbuf);
		else
			seq_printf(m, pt(Opt_euid_eq), tbuf);
1751 1752 1753 1754 1755
		seq_puts(m, " ");
	}

	if (entry->flags & IMA_FOWNER) {
		snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1756 1757 1758 1759 1760 1761
		if (entry->fowner_op == &uid_gt)
			seq_printf(m, pt(Opt_fowner_gt), tbuf);
		else if (entry->fowner_op == &uid_lt)
			seq_printf(m, pt(Opt_fowner_lt), tbuf);
		else
			seq_printf(m, pt(Opt_fowner_eq), tbuf);
1762 1763 1764 1765 1766 1767 1768 1769
		seq_puts(m, " ");
	}

	for (i = 0; i < MAX_LSM_RULES; i++) {
		if (entry->lsm[i].rule) {
			switch (i) {
			case LSM_OBJ_USER:
				seq_printf(m, pt(Opt_obj_user),
1770
					   entry->lsm[i].args_p);
1771 1772 1773
				break;
			case LSM_OBJ_ROLE:
				seq_printf(m, pt(Opt_obj_role),
1774
					   entry->lsm[i].args_p);
1775 1776 1777
				break;
			case LSM_OBJ_TYPE:
				seq_printf(m, pt(Opt_obj_type),
1778
					   entry->lsm[i].args_p);
1779 1780 1781
				break;
			case LSM_SUBJ_USER:
				seq_printf(m, pt(Opt_subj_user),
1782
					   entry->lsm[i].args_p);
1783 1784 1785
				break;
			case LSM_SUBJ_ROLE:
				seq_printf(m, pt(Opt_subj_role),
1786
					   entry->lsm[i].args_p);
1787 1788 1789
				break;
			case LSM_SUBJ_TYPE:
				seq_printf(m, pt(Opt_subj_type),
1790
					   entry->lsm[i].args_p);
1791 1792
				break;
			}
1793
			seq_puts(m, " ");
1794 1795
		}
	}
1796 1797
	if (entry->template)
		seq_printf(m, "template=%s ", entry->template->name);
1798 1799 1800 1801 1802 1803
	if (entry->flags & IMA_DIGSIG_REQUIRED) {
		if (entry->flags & IMA_MODSIG_ALLOWED)
			seq_puts(m, "appraise_type=imasig|modsig ");
		else
			seq_puts(m, "appraise_type=imasig ");
	}
1804 1805
	if (entry->flags & IMA_CHECK_BLACKLIST)
		seq_puts(m, "appraise_flag=check_blacklist ");
1806 1807
	if (entry->flags & IMA_META_IMMUTABLE_REQUIRED)
		seq_puts(m, "appraise_type=meta_immutable ");
1808 1809 1810 1811 1812 1813 1814
	if (entry->flags & IMA_PERMIT_DIRECTIO)
		seq_puts(m, "permit_directio ");
	rcu_read_unlock();
	seq_puts(m, "\n");
	return 0;
}
#endif	/* CONFIG_IMA_READ_POLICY */
1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864

#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)
/*
 * ima_appraise_signature: whether IMA will appraise a given function using
 * an IMA digital signature. This is restricted to cases where the kernel
 * has a set of built-in trusted keys in order to avoid an attacker simply
 * loading additional keys.
 */
bool ima_appraise_signature(enum kernel_read_file_id id)
{
	struct ima_rule_entry *entry;
	bool found = false;
	enum ima_hooks func;

	if (id >= READING_MAX_ID)
		return false;

	func = read_idmap[id] ?: FILE_CHECK;

	rcu_read_lock();
	list_for_each_entry_rcu(entry, ima_rules, list) {
		if (entry->action != APPRAISE)
			continue;

		/*
		 * A generic entry will match, but otherwise require that it
		 * match the func we're looking for
		 */
		if (entry->func && entry->func != func)
			continue;

		/*
		 * We require this to be a digital signature, not a raw IMA
		 * hash.
		 */
		if (entry->flags & IMA_DIGSIG_REQUIRED)
			found = true;

		/*
		 * We've found a rule that matches, so break now even if it
		 * didn't require a digital signature - a later rule that does
		 * won't override it, so would be a false positive.
		 */
		break;
	}

	rcu_read_unlock();
	return found;
}
#endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */