evm_main.c 15.5 KB
Newer Older
Mimi Zohar's avatar
Mimi Zohar committed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
/*
 * Copyright (C) 2005-2010 IBM Corporation
 *
 * Author:
 * Mimi Zohar <zohar@us.ibm.com>
 * Kylene Hall <kjhall@us.ibm.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 2 of the License.
 *
 * File: evm_main.c
 *	implements evm_inode_setxattr, evm_inode_post_setxattr,
 *	evm_inode_removexattr, and evm_verifyxattr
 */

17 18
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

Mimi Zohar's avatar
Mimi Zohar committed
19 20
#include <linux/module.h>
#include <linux/crypto.h>
21
#include <linux/audit.h>
Mimi Zohar's avatar
Mimi Zohar committed
22 23
#include <linux/xattr.h>
#include <linux/integrity.h>
24
#include <linux/evm.h>
25 26
#include <linux/magic.h>

27
#include <crypto/hash.h>
28
#include <crypto/algapi.h>
Mimi Zohar's avatar
Mimi Zohar committed
29 30 31 32
#include "evm.h"

int evm_initialized;

33
static const char * const integrity_status_msg[] = {
34
	"pass", "pass_immutable", "fail", "no_label", "no_xattrs", "unknown"
35
};
36
int evm_hmac_attrs;
Mimi Zohar's avatar
Mimi Zohar committed
37 38 39 40 41 42 43

char *evm_config_xattrnames[] = {
#ifdef CONFIG_SECURITY_SELINUX
	XATTR_NAME_SELINUX,
#endif
#ifdef CONFIG_SECURITY_SMACK
	XATTR_NAME_SMACK,
44 45 46 47 48
#ifdef CONFIG_EVM_EXTRA_SMACK_XATTRS
	XATTR_NAME_SMACKEXEC,
	XATTR_NAME_SMACKTRANSMUTE,
	XATTR_NAME_SMACKMMAP,
#endif
49
#endif
50 51 52
#ifdef CONFIG_SECURITY_APPARMOR
	XATTR_NAME_APPARMOR,
#endif
53 54
#ifdef CONFIG_IMA_APPRAISE
	XATTR_NAME_IMA,
Mimi Zohar's avatar
Mimi Zohar committed
55 56 57 58 59
#endif
	XATTR_NAME_CAPS,
	NULL
};

60 61 62 63 64 65 66 67 68
static int evm_fixmode;
static int __init evm_set_fixmode(char *str)
{
	if (strncmp(str, "fix", 3) == 0)
		evm_fixmode = 1;
	return 0;
}
__setup("evm=", evm_set_fixmode);

69 70 71 72 73 74 75 76
static void __init evm_init_config(void)
{
#ifdef CONFIG_EVM_ATTR_FSUUID
	evm_hmac_attrs |= EVM_ATTR_FSUUID;
#endif
	pr_info("HMAC attrs: 0x%x\n", evm_hmac_attrs);
}

77 78 79 80 81
static bool evm_key_loaded(void)
{
	return (bool)(evm_initialized & EVM_KEY_MASK);
}

82 83
static int evm_find_protected_xattrs(struct dentry *dentry)
{
84
	struct inode *inode = d_backing_inode(dentry);
85 86 87 88
	char **xattr;
	int error;
	int count = 0;

89
	if (!(inode->i_opflags & IOP_XATTR))
90 91 92
		return -EOPNOTSUPP;

	for (xattr = evm_config_xattrnames; *xattr != NULL; xattr++) {
93
		error = __vfs_getxattr(dentry, inode, *xattr, NULL, 0);
94 95 96 97 98 99 100 101 102 103 104
		if (error < 0) {
			if (error == -ENODATA)
				continue;
			return error;
		}
		count++;
	}

	return count;
}

Mimi Zohar's avatar
Mimi Zohar committed
105 106 107 108
/*
 * evm_verify_hmac - calculate and compare the HMAC with the EVM xattr
 *
 * Compute the HMAC on the dentry's protected set of extended attributes
109 110 111 112 113 114
 * and compare it against the stored security.evm xattr.
 *
 * For performance:
 * - use the previoulsy retrieved xattr value and length to calculate the
 *   HMAC.)
 * - cache the verification result in the iint, when available.
Mimi Zohar's avatar
Mimi Zohar committed
115 116 117 118 119 120 121 122 123
 *
 * Returns integrity status
 */
static enum integrity_status evm_verify_hmac(struct dentry *dentry,
					     const char *xattr_name,
					     char *xattr_value,
					     size_t xattr_value_len,
					     struct integrity_iint_cache *iint)
{
124 125
	struct evm_ima_xattr_data *xattr_data = NULL;
	struct evm_ima_xattr_data calc;
126
	enum integrity_status evm_status = INTEGRITY_PASS;
127
	struct inode *inode;
128
	int rc, xattr_len;
Mimi Zohar's avatar
Mimi Zohar committed
129

130 131
	if (iint && (iint->evm_status == INTEGRITY_PASS ||
		     iint->evm_status == INTEGRITY_PASS_IMMUTABLE))
132
		return iint->evm_status;
Mimi Zohar's avatar
Mimi Zohar committed
133

134 135
	/* if status is not PASS, try to check again - against -ENOMEM */

136 137 138 139
	/* first need to know the sig type */
	rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0,
				GFP_NOFS);
	if (rc <= 0) {
140 141
		evm_status = INTEGRITY_FAIL;
		if (rc == -ENODATA) {
142 143 144 145 146
			rc = evm_find_protected_xattrs(dentry);
			if (rc > 0)
				evm_status = INTEGRITY_NOLABEL;
			else if (rc == 0)
				evm_status = INTEGRITY_NOXATTRS; /* new file */
147 148
		} else if (rc == -EOPNOTSUPP) {
			evm_status = INTEGRITY_UNKNOWN;
149
		}
150 151
		goto out;
	}
Mimi Zohar's avatar
Mimi Zohar committed
152

153
	xattr_len = rc;
154 155 156 157

	/* check value type */
	switch (xattr_data->type) {
	case EVM_XATTR_HMAC:
158 159 160 161
		if (xattr_len != sizeof(struct evm_ima_xattr_data)) {
			evm_status = INTEGRITY_FAIL;
			goto out;
		}
162 163 164 165
		rc = evm_calc_hmac(dentry, xattr_name, xattr_value,
				   xattr_value_len, calc.digest);
		if (rc)
			break;
166
		rc = crypto_memneq(xattr_data->digest, calc.digest,
167 168 169 170 171
			    sizeof(calc.digest));
		if (rc)
			rc = -EINVAL;
		break;
	case EVM_IMA_XATTR_DIGSIG:
172
	case EVM_XATTR_PORTABLE_DIGSIG:
173
		rc = evm_calc_hash(dentry, xattr_name, xattr_value,
174 175
				   xattr_value_len, xattr_data->type,
				   calc.digest);
176 177 178
		if (rc)
			break;
		rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM,
179
					(const char *)xattr_data, xattr_len,
180 181
					calc.digest, sizeof(calc.digest));
		if (!rc) {
182 183
			inode = d_backing_inode(dentry);

184 185 186 187
			if (xattr_data->type == EVM_XATTR_PORTABLE_DIGSIG) {
				if (iint)
					iint->flags |= EVM_IMMUTABLE_DIGSIG;
				evm_status = INTEGRITY_PASS_IMMUTABLE;
188 189 190
			} else if (!IS_RDONLY(inode) &&
				   !(inode->i_sb->s_readonly_remount) &&
				   !IS_IMMUTABLE(inode)) {
191 192 193
				evm_update_evmxattr(dentry, xattr_name,
						    xattr_value,
						    xattr_value_len);
194
			}
195 196 197 198 199 200 201 202 203 204
		}
		break;
	default:
		rc = -EINVAL;
		break;
	}

	if (rc)
		evm_status = (rc == -ENODATA) ?
				INTEGRITY_NOXATTRS : INTEGRITY_FAIL;
205 206 207
out:
	if (iint)
		iint->evm_status = evm_status;
208
	kfree(xattr_data);
209
	return evm_status;
Mimi Zohar's avatar
Mimi Zohar committed
210 211 212 213 214 215 216 217 218 219 220 221 222 223 224
}

static int evm_protected_xattr(const char *req_xattr_name)
{
	char **xattrname;
	int namelen;
	int found = 0;

	namelen = strlen(req_xattr_name);
	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
		if ((strlen(*xattrname) == namelen)
		    && (strncmp(req_xattr_name, *xattrname, namelen) == 0)) {
			found = 1;
			break;
		}
225 226 227 228 229 230
		if (strncmp(req_xattr_name,
			    *xattrname + XATTR_SECURITY_PREFIX_LEN,
			    strlen(req_xattr_name)) == 0) {
			found = 1;
			break;
		}
Mimi Zohar's avatar
Mimi Zohar committed
231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252
	}
	return found;
}

/**
 * evm_verifyxattr - verify the integrity of the requested xattr
 * @dentry: object of the verify xattr
 * @xattr_name: requested xattr
 * @xattr_value: requested xattr value
 * @xattr_value_len: requested xattr value length
 *
 * Calculate the HMAC for the given dentry and verify it against the stored
 * security.evm xattr. For performance, use the xattr value and length
 * previously retrieved to calculate the HMAC.
 *
 * Returns the xattr integrity status.
 *
 * This function requires the caller to lock the inode's i_mutex before it
 * is executed.
 */
enum integrity_status evm_verifyxattr(struct dentry *dentry,
				      const char *xattr_name,
253 254
				      void *xattr_value, size_t xattr_value_len,
				      struct integrity_iint_cache *iint)
Mimi Zohar's avatar
Mimi Zohar committed
255
{
256
	if (!evm_key_loaded() || !evm_protected_xattr(xattr_name))
Mimi Zohar's avatar
Mimi Zohar committed
257 258
		return INTEGRITY_UNKNOWN;

259
	if (!iint) {
260
		iint = integrity_iint_find(d_backing_inode(dentry));
261 262 263 264
		if (!iint)
			return INTEGRITY_UNKNOWN;
	}
	return evm_verify_hmac(dentry, xattr_name, xattr_value,
Mimi Zohar's avatar
Mimi Zohar committed
265 266 267 268
				 xattr_value_len, iint);
}
EXPORT_SYMBOL_GPL(evm_verifyxattr);

269 270 271 272 273 274 275 276 277
/*
 * evm_verify_current_integrity - verify the dentry's metadata integrity
 * @dentry: pointer to the affected dentry
 *
 * Verify and return the dentry's metadata integrity. The exceptions are
 * before EVM is initialized or in 'fix' mode.
 */
static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
{
278
	struct inode *inode = d_backing_inode(dentry);
279

280
	if (!evm_key_loaded() || !S_ISREG(inode->i_mode) || evm_fixmode)
281 282 283 284
		return 0;
	return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
}

285 286 287
/*
 * evm_protect_xattr - protect the EVM extended attribute
 *
288 289 290 291 292 293 294
 * Prevent security.evm from being modified or removed without the
 * necessary permissions or when the existing value is invalid.
 *
 * The posix xattr acls are 'system' prefixed, which normally would not
 * affect security.evm.  An interesting side affect of writing posix xattr
 * acls is their modifying of the i_mode, which is included in security.evm.
 * For posix xattr acls only, permit security.evm, even if it currently
295
 * doesn't exist, to be updated unless the EVM signature is immutable.
296 297 298 299 300 301 302 303 304
 */
static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
			     const void *xattr_value, size_t xattr_value_len)
{
	enum integrity_status evm_status;

	if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
		if (!capable(CAP_SYS_ADMIN))
			return -EPERM;
305 306 307 308 309
	} else if (!evm_protected_xattr(xattr_name)) {
		if (!posix_xattr_acl(xattr_name))
			return 0;
		evm_status = evm_verify_current_integrity(dentry);
		if ((evm_status == INTEGRITY_PASS) ||
310
		    (evm_status == INTEGRITY_NOXATTRS))
311
			return 0;
312
		goto out;
313
	}
314

315
	evm_status = evm_verify_current_integrity(dentry);
316 317 318
	if (evm_status == INTEGRITY_NOXATTRS) {
		struct integrity_iint_cache *iint;

319
		iint = integrity_iint_find(d_backing_inode(dentry));
320 321
		if (iint && (iint->flags & IMA_NEW_FILE))
			return 0;
322 323

		/* exception for pseudo filesystems */
324 325
		if (dentry->d_sb->s_magic == TMPFS_MAGIC
		    || dentry->d_sb->s_magic == SYSFS_MAGIC)
326 327 328 329 330 331 332
			return 0;

		integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
				    dentry->d_inode, dentry->d_name.name,
				    "update_metadata",
				    integrity_status_msg[evm_status],
				    -EPERM, 0);
333
	}
334 335
out:
	if (evm_status != INTEGRITY_PASS)
336
		integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
337 338 339
				    dentry->d_name.name, "appraise_metadata",
				    integrity_status_msg[evm_status],
				    -EPERM, 0);
340 341 342
	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
}

Mimi Zohar's avatar
Mimi Zohar committed
343 344 345 346 347 348 349
/**
 * evm_inode_setxattr - protect the EVM extended attribute
 * @dentry: pointer to the affected dentry
 * @xattr_name: pointer to the affected extended attribute name
 * @xattr_value: pointer to the new extended attribute value
 * @xattr_value_len: pointer to the new extended attribute value length
 *
350 351 352 353 354
 * Before allowing the 'security.evm' protected xattr to be updated,
 * verify the existing value is valid.  As only the kernel should have
 * access to the EVM encrypted key needed to calculate the HMAC, prevent
 * userspace from writing HMAC value.  Writing 'security.evm' requires
 * requires CAP_SYS_ADMIN privileges.
Mimi Zohar's avatar
Mimi Zohar committed
355 356 357 358
 */
int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
		       const void *xattr_value, size_t xattr_value_len)
{
359 360
	const struct evm_ima_xattr_data *xattr_data = xattr_value;

361 362 363 364 365 366
	/* Policy permits modification of the protected xattrs even though
	 * there's no HMAC key loaded
	 */
	if (evm_initialized & EVM_ALLOW_METADATA_WRITES)
		return 0;

367 368 369
	if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
		if (!xattr_value_len)
			return -EINVAL;
370 371
		if (xattr_data->type != EVM_IMA_XATTR_DIGSIG &&
		    xattr_data->type != EVM_XATTR_PORTABLE_DIGSIG)
372 373
			return -EPERM;
	}
374 375
	return evm_protect_xattr(dentry, xattr_name, xattr_value,
				 xattr_value_len);
Mimi Zohar's avatar
Mimi Zohar committed
376 377 378 379 380 381 382
}

/**
 * evm_inode_removexattr - protect the EVM extended attribute
 * @dentry: pointer to the affected dentry
 * @xattr_name: pointer to the affected extended attribute name
 *
383 384
 * Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that
 * the current value is valid.
Mimi Zohar's avatar
Mimi Zohar committed
385 386 387
 */
int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name)
{
388 389 390 391 392 393
	/* Policy permits modification of the protected xattrs even though
	 * there's no HMAC key loaded
	 */
	if (evm_initialized & EVM_ALLOW_METADATA_WRITES)
		return 0;

394
	return evm_protect_xattr(dentry, xattr_name, NULL, 0);
Mimi Zohar's avatar
Mimi Zohar committed
395 396
}

397 398 399 400 401 402 403 404 405
static void evm_reset_status(struct inode *inode)
{
	struct integrity_iint_cache *iint;

	iint = integrity_iint_find(inode);
	if (iint)
		iint->evm_status = INTEGRITY_UNKNOWN;
}

Mimi Zohar's avatar
Mimi Zohar committed
406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421
/**
 * evm_inode_post_setxattr - update 'security.evm' to reflect the changes
 * @dentry: pointer to the affected dentry
 * @xattr_name: pointer to the affected extended attribute name
 * @xattr_value: pointer to the new extended attribute value
 * @xattr_value_len: pointer to the new extended attribute value length
 *
 * Update the HMAC stored in 'security.evm' to reflect the change.
 *
 * No need to take the i_mutex lock here, as this function is called from
 * __vfs_setxattr_noperm().  The caller of which has taken the inode's
 * i_mutex lock.
 */
void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name,
			     const void *xattr_value, size_t xattr_value_len)
{
422 423
	if (!evm_key_loaded() || (!evm_protected_xattr(xattr_name)
				  && !posix_xattr_acl(xattr_name)))
Mimi Zohar's avatar
Mimi Zohar committed
424 425
		return;

426 427
	evm_reset_status(dentry->d_inode);

Mimi Zohar's avatar
Mimi Zohar committed
428 429 430 431 432 433 434 435 436
	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
}

/**
 * evm_inode_post_removexattr - update 'security.evm' after removing the xattr
 * @dentry: pointer to the affected dentry
 * @xattr_name: pointer to the affected extended attribute name
 *
 * Update the HMAC stored in 'security.evm' to reflect removal of the xattr.
437 438 439
 *
 * No need to take the i_mutex lock here, as this function is called from
 * vfs_removexattr() which takes the i_mutex.
Mimi Zohar's avatar
Mimi Zohar committed
440 441 442
 */
void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name)
{
443
	if (!evm_key_loaded() || !evm_protected_xattr(xattr_name))
Mimi Zohar's avatar
Mimi Zohar committed
444 445
		return;

446 447
	evm_reset_status(dentry->d_inode);

Mimi Zohar's avatar
Mimi Zohar committed
448 449 450
	evm_update_evmxattr(dentry, xattr_name, NULL, 0);
}

451 452 453
/**
 * evm_inode_setattr - prevent updating an invalid EVM extended attribute
 * @dentry: pointer to the affected dentry
454 455 456
 *
 * Permit update of file attributes when files have a valid EVM signature,
 * except in the case of them having an immutable portable signature.
457 458 459 460 461 462
 */
int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
{
	unsigned int ia_valid = attr->ia_valid;
	enum integrity_status evm_status;

463 464 465 466 467 468
	/* Policy permits modification of the protected attrs even though
	 * there's no HMAC key loaded
	 */
	if (evm_initialized & EVM_ALLOW_METADATA_WRITES)
		return 0;

469
	if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)))
470 471
		return 0;
	evm_status = evm_verify_current_integrity(dentry);
472 473 474
	if ((evm_status == INTEGRITY_PASS) ||
	    (evm_status == INTEGRITY_NOXATTRS))
		return 0;
475
	integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
476 477
			    dentry->d_name.name, "appraise_metadata",
			    integrity_status_msg[evm_status], -EPERM, 0);
478
	return -EPERM;
479 480
}

Mimi Zohar's avatar
Mimi Zohar committed
481 482 483 484 485 486 487 488 489 490 491 492 493
/**
 * evm_inode_post_setattr - update 'security.evm' after modifying metadata
 * @dentry: pointer to the affected dentry
 * @ia_valid: for the UID and GID status
 *
 * For now, update the HMAC stored in 'security.evm' to reflect UID/GID
 * changes.
 *
 * This function is called from notify_change(), which expects the caller
 * to lock the inode's i_mutex.
 */
void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
{
494
	if (!evm_key_loaded())
Mimi Zohar's avatar
Mimi Zohar committed
495 496 497 498 499 500
		return;

	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))
		evm_update_evmxattr(dentry, NULL, NULL, 0);
}

501 502 503 504 505 506 507 508 509 510
/*
 * evm_inode_init_security - initializes security.evm
 */
int evm_inode_init_security(struct inode *inode,
				 const struct xattr *lsm_xattr,
				 struct xattr *evm_xattr)
{
	struct evm_ima_xattr_data *xattr_data;
	int rc;

511
	if (!evm_key_loaded() || !evm_protected_xattr(lsm_xattr->name))
512
		return 0;
513 514 515 516 517 518 519 520 521 522 523 524

	xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
	if (!xattr_data)
		return -ENOMEM;

	xattr_data->type = EVM_XATTR_HMAC;
	rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
	if (rc < 0)
		goto out;

	evm_xattr->value = xattr_data;
	evm_xattr->value_len = sizeof(*xattr_data);
525
	evm_xattr->name = XATTR_EVM_SUFFIX;
526 527 528 529 530 531 532
	return 0;
out:
	kfree(xattr_data);
	return rc;
}
EXPORT_SYMBOL_GPL(evm_inode_init_security);

533 534 535
#ifdef CONFIG_EVM_LOAD_X509
void __init evm_load_x509(void)
{
536 537 538 539 540
	int rc;

	rc = integrity_load_x509(INTEGRITY_KEYRING_EVM, CONFIG_EVM_X509_PATH);
	if (!rc)
		evm_initialized |= EVM_INIT_X509;
541 542 543
}
#endif

Mimi Zohar's avatar
Mimi Zohar committed
544 545 546 547
static int __init init_evm(void)
{
	int error;

548 549
	evm_init_config();

550 551 552 553
	error = integrity_init_keyring(INTEGRITY_KEYRING_EVM);
	if (error)
		return error;

Mimi Zohar's avatar
Mimi Zohar committed
554 555
	error = evm_init_secfs();
	if (error < 0) {
556
		pr_info("Error registering secfs\n");
557
		return error;
Mimi Zohar's avatar
Mimi Zohar committed
558
	}
559 560

	return 0;
Mimi Zohar's avatar
Mimi Zohar committed
561 562 563 564 565 566 567 568 569 570
}

/*
 * evm_display_config - list the EVM protected security extended attributes
 */
static int __init evm_display_config(void)
{
	char **xattrname;

	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++)
571
		pr_info("%s\n", *xattrname);
Mimi Zohar's avatar
Mimi Zohar committed
572 573 574 575 576 577 578 579
	return 0;
}

pure_initcall(evm_display_config);
late_initcall(init_evm);

MODULE_DESCRIPTION("Extended Verification Module");
MODULE_LICENSE("GPL");