ima_policy.c 12.4 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
/*
 * Copyright (C) 2008 IBM Corporation
 * Author: Mimi Zohar <zohar@us.ibm.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 2 of the License.
 *
 * ima_policy.c
 * 	- initialize default measure policy rules
 *
 */
#include <linux/module.h>
#include <linux/list.h>
#include <linux/security.h>
#include <linux/magic.h>
M
Mimi Zohar 已提交
17
#include <linux/parser.h>
18
#include <linux/slab.h>
19 20 21 22 23 24 25 26 27

#include "ima.h"

/* flags definitions */
#define IMA_FUNC 	0x0001
#define IMA_MASK 	0x0002
#define IMA_FSMAGIC	0x0004
#define IMA_UID		0x0008

M
Mimi Zohar 已提交
28 29 30 31 32 33
enum ima_action { UNKNOWN = -1, DONT_MEASURE = 0, MEASURE };

#define MAX_LSM_RULES 6
enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
	LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
};
34 35 36 37 38 39 40 41 42

struct ima_measure_rule_entry {
	struct list_head list;
	enum ima_action action;
	unsigned int flags;
	enum ima_hooks func;
	int mask;
	unsigned long fsmagic;
	uid_t uid;
M
Mimi Zohar 已提交
43 44 45 46
	struct {
		void *rule;	/* LSM file metadata specific */
		int type;	/* audit type */
	} lsm[MAX_LSM_RULES];
47 48
};

49 50
/*
 * Without LSM specific knowledge, the default policy can only be
M
Mimi Zohar 已提交
51 52
 * written in terms of .action, .func, .mask, .fsmagic, and .uid
 */
53 54 55 56 57 58 59

/*
 * The minimum rule set to allow for full TCB coverage.  Measures all files
 * opened or mmap for exec and everything read by root.  Dangerous because
 * normal users can easily run the machine out of memory simply building
 * and running executables.
 */
60
static struct ima_measure_rule_entry default_rules[] = {
61
	{.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
62 63 64
	{.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
65 66
	{.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
	{.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
67 68 69 70
	{.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC,
	 .flags = IMA_FUNC | IMA_MASK},
	{.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
	 .flags = IMA_FUNC | IMA_MASK},
71
	{.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = 0,
72
	 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
73 74 75
};

static LIST_HEAD(measure_default_rules);
M
Mimi Zohar 已提交
76
static LIST_HEAD(measure_policy_rules);
77 78
static struct list_head *ima_measure;

M
Mimi Zohar 已提交
79 80
static DEFINE_MUTEX(ima_measure_mutex);

81 82 83 84 85 86 87 88
static bool ima_use_tcb __initdata;
static int __init default_policy_setup(char *str)
{
	ima_use_tcb = 1;
	return 1;
}
__setup("ima_tcb", default_policy_setup);

89 90 91 92 93 94 95 96 97 98 99 100 101
/**
 * ima_match_rules - determine whether an inode matches the measure rule.
 * @rule: a pointer to a rule
 * @inode: a pointer to an inode
 * @func: LIM hook identifier
 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 *
 * Returns true on rule match, false on failure.
 */
static bool ima_match_rules(struct ima_measure_rule_entry *rule,
			    struct inode *inode, enum ima_hooks func, int mask)
{
	struct task_struct *tsk = current;
M
Mimi Zohar 已提交
102
	int i;
103 104 105 106 107 108 109 110 111 112

	if ((rule->flags & IMA_FUNC) && rule->func != func)
		return false;
	if ((rule->flags & IMA_MASK) && rule->mask != mask)
		return false;
	if ((rule->flags & IMA_FSMAGIC)
	    && rule->fsmagic != inode->i_sb->s_magic)
		return false;
	if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid)
		return false;
M
Mimi Zohar 已提交
113
	for (i = 0; i < MAX_LSM_RULES; i++) {
114
		int rc = 0;
M
Mimi Zohar 已提交
115 116 117 118 119 120 121 122 123 124 125 126
		u32 osid, sid;

		if (!rule->lsm[i].rule)
			continue;

		switch (i) {
		case LSM_OBJ_USER:
		case LSM_OBJ_ROLE:
		case LSM_OBJ_TYPE:
			security_inode_getsecid(inode, &osid);
			rc = security_filter_rule_match(osid,
							rule->lsm[i].type,
127
							Audit_equal,
M
Mimi Zohar 已提交
128 129 130 131 132 133 134 135 136
							rule->lsm[i].rule,
							NULL);
			break;
		case LSM_SUBJ_USER:
		case LSM_SUBJ_ROLE:
		case LSM_SUBJ_TYPE:
			security_task_getsecid(tsk, &sid);
			rc = security_filter_rule_match(sid,
							rule->lsm[i].type,
137
							Audit_equal,
M
Mimi Zohar 已提交
138 139 140 141 142 143 144 145
							rule->lsm[i].rule,
							NULL);
		default:
			break;
		}
		if (!rc)
			return false;
	}
146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179
	return true;
}

/**
 * ima_match_policy - decision based on LSM and other conditions
 * @inode: pointer to an inode for which the policy decision is being made
 * @func: IMA hook identifier
 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 *
 * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 * conditions.
 *
 * (There is no need for locking when walking the policy list,
 * as elements in the list are never deleted, nor does the list
 * change.)
 */
int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask)
{
	struct ima_measure_rule_entry *entry;

	list_for_each_entry(entry, ima_measure, list) {
		bool rc;

		rc = ima_match_rules(entry, inode, func, mask);
		if (rc)
			return entry->action;
	}
	return 0;
}

/**
 * ima_init_policy - initialize the default measure rules.
 *
 * ima_measure points to either the measure_default_rules or the
M
Mimi Zohar 已提交
180
 * the new measure_policy_rules.
181
 */
182
void __init ima_init_policy(void)
183
{
184 185 186 187 188 189 190
	int i, entries;

	/* if !ima_use_tcb set entries = 0 so we load NO default rules */
	if (ima_use_tcb)
		entries = ARRAY_SIZE(default_rules);
	else
		entries = 0;
191

192
	for (i = 0; i < entries; i++)
193 194 195
		list_add_tail(&default_rules[i].list, &measure_default_rules);
	ima_measure = &measure_default_rules;
}
M
Mimi Zohar 已提交
196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248

/**
 * ima_update_policy - update default_rules with new measure rules
 *
 * Called on file .release to update the default rules with a complete new
 * policy.  Once updated, the policy is locked, no additional rules can be
 * added to the policy.
 */
void ima_update_policy(void)
{
	const char *op = "policy_update";
	const char *cause = "already exists";
	int result = 1;
	int audit_info = 0;

	if (ima_measure == &measure_default_rules) {
		ima_measure = &measure_policy_rules;
		cause = "complete";
		result = 0;
	}
	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
			    NULL, op, cause, result, audit_info);
}

enum {
	Opt_err = -1,
	Opt_measure = 1, Opt_dont_measure,
	Opt_obj_user, Opt_obj_role, Opt_obj_type,
	Opt_subj_user, Opt_subj_role, Opt_subj_type,
	Opt_func, Opt_mask, Opt_fsmagic, Opt_uid
};

static match_table_t policy_tokens = {
	{Opt_measure, "measure"},
	{Opt_dont_measure, "dont_measure"},
	{Opt_obj_user, "obj_user=%s"},
	{Opt_obj_role, "obj_role=%s"},
	{Opt_obj_type, "obj_type=%s"},
	{Opt_subj_user, "subj_user=%s"},
	{Opt_subj_role, "subj_role=%s"},
	{Opt_subj_type, "subj_type=%s"},
	{Opt_func, "func=%s"},
	{Opt_mask, "mask=%s"},
	{Opt_fsmagic, "fsmagic=%s"},
	{Opt_uid, "uid=%s"},
	{Opt_err, NULL}
};

static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry,
			     char *args, int lsm_rule, int audit_type)
{
	int result;

249 250 251
	if (entry->lsm[lsm_rule].rule)
		return -EINVAL;

M
Mimi Zohar 已提交
252 253
	entry->lsm[lsm_rule].type = audit_type;
	result = security_filter_rule_init(entry->lsm[lsm_rule].type,
254
					   Audit_equal, args,
M
Mimi Zohar 已提交
255
					   &entry->lsm[lsm_rule].rule);
M
Mimi Zohar 已提交
256 257
	if (!entry->lsm[lsm_rule].rule)
		return -EINVAL;
M
Mimi Zohar 已提交
258 259 260
	return result;
}

261 262 263 264 265 266 267
static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
{
	audit_log_format(ab, "%s=", key);
	audit_log_untrustedstring(ab, value);
	audit_log_format(ab, " ");
}

M
Mimi Zohar 已提交
268 269 270 271 272 273
static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry)
{
	struct audit_buffer *ab;
	char *p;
	int result = 0;

M
Mimi Zohar 已提交
274
	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
M
Mimi Zohar 已提交
275

276
	entry->uid = -1;
277
	entry->action = UNKNOWN;
E
Eric Paris 已提交
278
	while ((p = strsep(&rule, " \t")) != NULL) {
M
Mimi Zohar 已提交
279 280 281 282 283 284
		substring_t args[MAX_OPT_ARGS];
		int token;
		unsigned long lnum;

		if (result < 0)
			break;
E
Eric Paris 已提交
285 286
		if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
			continue;
M
Mimi Zohar 已提交
287 288 289
		token = match_token(p, policy_tokens, args);
		switch (token) {
		case Opt_measure:
290
			ima_log_string(ab, "action", "measure");
291 292 293 294

			if (entry->action != UNKNOWN)
				result = -EINVAL;

M
Mimi Zohar 已提交
295 296 297
			entry->action = MEASURE;
			break;
		case Opt_dont_measure:
298
			ima_log_string(ab, "action", "dont_measure");
299 300 301 302

			if (entry->action != UNKNOWN)
				result = -EINVAL;

M
Mimi Zohar 已提交
303 304 305
			entry->action = DONT_MEASURE;
			break;
		case Opt_func:
306
			ima_log_string(ab, "func", args[0].from);
307 308 309 310

			if (entry->func)
				result  = -EINVAL;

311 312 313 314 315
			if (strcmp(args[0].from, "FILE_CHECK") == 0)
				entry->func = FILE_CHECK;
			/* PATH_CHECK is for backwards compat */
			else if (strcmp(args[0].from, "PATH_CHECK") == 0)
				entry->func = FILE_CHECK;
M
Mimi Zohar 已提交
316 317 318 319 320 321 322 323 324 325
			else if (strcmp(args[0].from, "FILE_MMAP") == 0)
				entry->func = FILE_MMAP;
			else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
				entry->func = BPRM_CHECK;
			else
				result = -EINVAL;
			if (!result)
				entry->flags |= IMA_FUNC;
			break;
		case Opt_mask:
326
			ima_log_string(ab, "mask", args[0].from);
327 328 329 330

			if (entry->mask)
				result = -EINVAL;

M
Mimi Zohar 已提交
331 332 333 334 335 336 337 338 339 340 341 342 343 344
			if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
				entry->mask = MAY_EXEC;
			else if (strcmp(args[0].from, "MAY_WRITE") == 0)
				entry->mask = MAY_WRITE;
			else if (strcmp(args[0].from, "MAY_READ") == 0)
				entry->mask = MAY_READ;
			else if (strcmp(args[0].from, "MAY_APPEND") == 0)
				entry->mask = MAY_APPEND;
			else
				result = -EINVAL;
			if (!result)
				entry->flags |= IMA_MASK;
			break;
		case Opt_fsmagic:
345
			ima_log_string(ab, "fsmagic", args[0].from);
346 347 348 349 350 351

			if (entry->fsmagic) {
				result = -EINVAL;
				break;
			}

M
Mimi Zohar 已提交
352 353 354 355 356 357
			result = strict_strtoul(args[0].from, 16,
						&entry->fsmagic);
			if (!result)
				entry->flags |= IMA_FSMAGIC;
			break;
		case Opt_uid:
358
			ima_log_string(ab, "uid", args[0].from);
359 360 361 362 363 364

			if (entry->uid != -1) {
				result = -EINVAL;
				break;
			}

M
Mimi Zohar 已提交
365 366 367 368 369 370 371 372 373 374
			result = strict_strtoul(args[0].from, 10, &lnum);
			if (!result) {
				entry->uid = (uid_t) lnum;
				if (entry->uid != lnum)
					result = -EINVAL;
				else
					entry->flags |= IMA_UID;
			}
			break;
		case Opt_obj_user:
375
			ima_log_string(ab, "obj_user", args[0].from);
M
Mimi Zohar 已提交
376 377 378 379 380
			result = ima_lsm_rule_init(entry, args[0].from,
						   LSM_OBJ_USER,
						   AUDIT_OBJ_USER);
			break;
		case Opt_obj_role:
381
			ima_log_string(ab, "obj_role", args[0].from);
M
Mimi Zohar 已提交
382 383 384 385 386
			result = ima_lsm_rule_init(entry, args[0].from,
						   LSM_OBJ_ROLE,
						   AUDIT_OBJ_ROLE);
			break;
		case Opt_obj_type:
387
			ima_log_string(ab, "obj_type", args[0].from);
M
Mimi Zohar 已提交
388 389 390 391 392
			result = ima_lsm_rule_init(entry, args[0].from,
						   LSM_OBJ_TYPE,
						   AUDIT_OBJ_TYPE);
			break;
		case Opt_subj_user:
393
			ima_log_string(ab, "subj_user", args[0].from);
M
Mimi Zohar 已提交
394 395 396 397 398
			result = ima_lsm_rule_init(entry, args[0].from,
						   LSM_SUBJ_USER,
						   AUDIT_SUBJ_USER);
			break;
		case Opt_subj_role:
399
			ima_log_string(ab, "subj_role", args[0].from);
M
Mimi Zohar 已提交
400 401 402 403 404
			result = ima_lsm_rule_init(entry, args[0].from,
						   LSM_SUBJ_ROLE,
						   AUDIT_SUBJ_ROLE);
			break;
		case Opt_subj_type:
405
			ima_log_string(ab, "subj_type", args[0].from);
M
Mimi Zohar 已提交
406 407 408 409 410
			result = ima_lsm_rule_init(entry, args[0].from,
						   LSM_SUBJ_TYPE,
						   AUDIT_SUBJ_TYPE);
			break;
		case Opt_err:
411
			ima_log_string(ab, "UNKNOWN", p);
412
			result = -EINVAL;
M
Mimi Zohar 已提交
413 414 415
			break;
		}
	}
416
	if (!result && (entry->action == UNKNOWN))
M
Mimi Zohar 已提交
417 418
		result = -EINVAL;

419
	audit_log_format(ab, "res=%d", !!result);
M
Mimi Zohar 已提交
420 421 422 423 424 425 426 427 428
	audit_log_end(ab);
	return result;
}

/**
 * ima_parse_add_rule - add a rule to measure_policy_rules
 * @rule - ima measurement policy rule
 *
 * Uses a mutex to protect the policy list from multiple concurrent writers.
429
 * Returns the length of the rule parsed, an error code on failure
M
Mimi Zohar 已提交
430
 */
431
ssize_t ima_parse_add_rule(char *rule)
M
Mimi Zohar 已提交
432
{
M
Mimi Zohar 已提交
433
	const char *op = "update_policy";
434
	char *p;
M
Mimi Zohar 已提交
435
	struct ima_measure_rule_entry *entry;
436
	ssize_t result, len;
M
Mimi Zohar 已提交
437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455
	int audit_info = 0;

	/* Prevent installed policy from changing */
	if (ima_measure != &measure_default_rules) {
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
				    NULL, op, "already exists",
				    -EACCES, audit_info);
		return -EACCES;
	}

	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
	if (!entry) {
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
				    NULL, op, "-ENOMEM", -ENOMEM, audit_info);
		return -ENOMEM;
	}

	INIT_LIST_HEAD(&entry->list);

456 457
	p = strsep(&rule, "\n");
	len = strlen(p) + 1;
E
Eric Paris 已提交
458 459 460 461 462 463

	if (*p == '#') {
		kfree(entry);
		return len;
	}

464
	result = ima_parse_rule(p, entry);
E
Eric Paris 已提交
465
	if (result) {
M
Mimi Zohar 已提交
466
		kfree(entry);
M
Mimi Zohar 已提交
467 468 469
		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
				    NULL, op, "invalid policy", result,
				    audit_info);
E
Eric Paris 已提交
470
		return result;
M
Mimi Zohar 已提交
471
	}
E
Eric Paris 已提交
472 473 474 475 476 477

	mutex_lock(&ima_measure_mutex);
	list_add_tail(&entry->list, &measure_policy_rules);
	mutex_unlock(&ima_measure_mutex);

	return len;
M
Mimi Zohar 已提交
478 479 480
}

/* ima_delete_rules called to cleanup invalid policy */
481
void ima_delete_rules(void)
M
Mimi Zohar 已提交
482 483 484 485 486 487 488 489 490 491
{
	struct ima_measure_rule_entry *entry, *tmp;

	mutex_lock(&ima_measure_mutex);
	list_for_each_entry_safe(entry, tmp, &measure_policy_rules, list) {
		list_del(&entry->list);
		kfree(entry);
	}
	mutex_unlock(&ima_measure_mutex);
}