2009-02-04 22:06:58 +08:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2008 IBM Corporation
|
|
|
|
* Author: Mimi Zohar <zohar@us.ibm.com>
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
|
|
|
* the Free Software Foundation, version 2 of the License.
|
|
|
|
*
|
|
|
|
* ima_policy.c
|
|
|
|
* - initialize default measure policy rules
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/list.h>
|
|
|
|
#include <linux/security.h>
|
|
|
|
#include <linux/magic.h>
|
2009-02-04 22:07:00 +08:00
|
|
|
#include <linux/parser.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 16:04:11 +08:00
|
|
|
#include <linux/slab.h>
|
2009-02-04 22:06:58 +08:00
|
|
|
|
|
|
|
#include "ima.h"
|
|
|
|
|
|
|
|
/* flags definitions */
|
|
|
|
#define IMA_FUNC 0x0001
|
|
|
|
#define IMA_MASK 0x0002
|
|
|
|
#define IMA_FSMAGIC 0x0004
|
|
|
|
#define IMA_UID 0x0008
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
#define IMA_FOWNER 0x0010
|
2009-02-04 22:06:58 +08:00
|
|
|
|
2012-09-13 01:51:32 +08:00
|
|
|
#define UNKNOWN 0
|
|
|
|
#define MEASURE 0x0001 /* same as IMA_MEASURE */
|
|
|
|
#define DONT_MEASURE 0x0002
|
|
|
|
#define APPRAISE 0x0004 /* same as IMA_APPRAISE */
|
|
|
|
#define DONT_APPRAISE 0x0008
|
2012-06-15 01:04:36 +08:00
|
|
|
#define AUDIT 0x0040
|
2009-02-04 22:07:00 +08:00
|
|
|
|
|
|
|
#define MAX_LSM_RULES 6
|
|
|
|
enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
|
|
|
|
LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
|
|
|
|
};
|
2009-02-04 22:06:58 +08:00
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
struct ima_rule_entry {
|
2009-02-04 22:06:58 +08:00
|
|
|
struct list_head list;
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 23:15:05 +08:00
|
|
|
int action;
|
2009-02-04 22:06:58 +08:00
|
|
|
unsigned int flags;
|
|
|
|
enum ima_hooks func;
|
|
|
|
int mask;
|
|
|
|
unsigned long fsmagic;
|
2012-05-26 08:24:12 +08:00
|
|
|
kuid_t uid;
|
2012-10-03 12:38:48 +08:00
|
|
|
kuid_t fowner;
|
2009-02-04 22:07:00 +08:00
|
|
|
struct {
|
|
|
|
void *rule; /* LSM file metadata specific */
|
2013-01-04 03:19:09 +08:00
|
|
|
void *args_p; /* audit value */
|
2009-02-04 22:07:00 +08:00
|
|
|
int type; /* audit type */
|
|
|
|
} lsm[MAX_LSM_RULES];
|
2009-02-04 22:06:58 +08:00
|
|
|
};
|
|
|
|
|
2009-05-22 03:47:06 +08:00
|
|
|
/*
|
|
|
|
* Without LSM specific knowledge, the default policy can only be
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
* written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
|
2009-02-04 22:07:00 +08:00
|
|
|
*/
|
2009-05-22 03:47:06 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* The minimum rule set to allow for full TCB coverage. Measures all files
|
|
|
|
* opened or mmap for exec and everything read by root. Dangerous because
|
|
|
|
* normal users can easily run the machine out of memory simply building
|
|
|
|
* and running executables.
|
|
|
|
*/
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
static struct ima_rule_entry default_rules[] = {
|
2009-05-18 22:26:10 +08:00
|
|
|
{.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
|
2009-02-04 22:06:58 +08:00
|
|
|
{.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
|
2011-10-18 19:16:28 +08:00
|
|
|
{.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
|
2012-06-25 17:18:09 +08:00
|
|
|
{.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
|
2009-05-18 22:26:10 +08:00
|
|
|
{.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
|
2012-12-14 00:15:04 +08:00
|
|
|
{.action = MEASURE,.func = MMAP_CHECK,.mask = MAY_EXEC,
|
2009-02-04 22:06:58 +08:00
|
|
|
.flags = IMA_FUNC | IMA_MASK},
|
|
|
|
{.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
|
|
|
|
.flags = IMA_FUNC | IMA_MASK},
|
2012-05-26 08:24:12 +08:00
|
|
|
{.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = GLOBAL_ROOT_UID,
|
2009-05-22 03:47:06 +08:00
|
|
|
.flags = IMA_FUNC | IMA_MASK | IMA_UID},
|
2012-10-16 10:10:08 +08:00
|
|
|
{.action = MEASURE,.func = MODULE_CHECK, .flags = IMA_FUNC},
|
2009-02-04 22:06:58 +08:00
|
|
|
};
|
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
static struct ima_rule_entry default_appraise_rules[] = {
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
|
|
|
|
{.action = DONT_APPRAISE,.fsmagic = CGROUP_SUPER_MAGIC,.flags = IMA_FSMAGIC},
|
2012-10-03 12:38:48 +08:00
|
|
|
{.action = APPRAISE,.fowner = GLOBAL_ROOT_UID,.flags = IMA_FOWNER},
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
static LIST_HEAD(ima_default_rules);
|
|
|
|
static LIST_HEAD(ima_policy_rules);
|
|
|
|
static struct list_head *ima_rules;
|
2009-02-04 22:06:58 +08:00
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
static DEFINE_MUTEX(ima_rules_mutex);
|
2009-02-04 22:07:00 +08:00
|
|
|
|
2009-05-22 03:47:06 +08:00
|
|
|
static bool ima_use_tcb __initdata;
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
static int __init default_measure_policy_setup(char *str)
|
2009-05-22 03:47:06 +08:00
|
|
|
{
|
|
|
|
ima_use_tcb = 1;
|
|
|
|
return 1;
|
|
|
|
}
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
__setup("ima_tcb", default_measure_policy_setup);
|
|
|
|
|
|
|
|
static bool ima_use_appraise_tcb __initdata;
|
|
|
|
static int __init default_appraise_policy_setup(char *str)
|
|
|
|
{
|
|
|
|
ima_use_appraise_tcb = 1;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
__setup("ima_appraise_tcb", default_appraise_policy_setup);
|
2009-05-22 03:47:06 +08:00
|
|
|
|
2013-01-04 03:19:09 +08:00
|
|
|
/*
|
|
|
|
* Although the IMA policy does not change, the LSM policy can be
|
|
|
|
* reloaded, leaving the IMA LSM based rules referring to the old,
|
|
|
|
* stale LSM policy.
|
|
|
|
*
|
|
|
|
* Update the IMA LSM based rules to reflect the reloaded LSM policy.
|
|
|
|
* We assume the rules still exist; and BUG_ON() if they don't.
|
|
|
|
*/
|
|
|
|
static void ima_lsm_update_rules(void)
|
|
|
|
{
|
|
|
|
struct ima_rule_entry *entry, *tmp;
|
|
|
|
int result;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
mutex_lock(&ima_rules_mutex);
|
|
|
|
list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) {
|
|
|
|
for (i = 0; i < MAX_LSM_RULES; i++) {
|
|
|
|
if (!entry->lsm[i].rule)
|
|
|
|
continue;
|
|
|
|
result = security_filter_rule_init(entry->lsm[i].type,
|
|
|
|
Audit_equal,
|
|
|
|
entry->lsm[i].args_p,
|
|
|
|
&entry->lsm[i].rule);
|
|
|
|
BUG_ON(!entry->lsm[i].rule);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
mutex_unlock(&ima_rules_mutex);
|
|
|
|
}
|
|
|
|
|
2009-02-04 22:06:58 +08:00
|
|
|
/**
|
|
|
|
* ima_match_rules - determine whether an inode matches the measure rule.
|
|
|
|
* @rule: a pointer to a rule
|
|
|
|
* @inode: a pointer to an inode
|
|
|
|
* @func: LIM hook identifier
|
|
|
|
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
|
|
|
|
*
|
|
|
|
* Returns true on rule match, false on failure.
|
|
|
|
*/
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
static bool ima_match_rules(struct ima_rule_entry *rule,
|
2009-02-04 22:06:58 +08:00
|
|
|
struct inode *inode, enum ima_hooks func, int mask)
|
|
|
|
{
|
|
|
|
struct task_struct *tsk = current;
|
2012-01-18 11:11:28 +08:00
|
|
|
const struct cred *cred = current_cred();
|
2009-02-04 22:07:00 +08:00
|
|
|
int i;
|
2009-02-04 22:06:58 +08:00
|
|
|
|
|
|
|
if ((rule->flags & IMA_FUNC) && rule->func != func)
|
|
|
|
return false;
|
|
|
|
if ((rule->flags & IMA_MASK) && rule->mask != mask)
|
|
|
|
return false;
|
|
|
|
if ((rule->flags & IMA_FSMAGIC)
|
|
|
|
&& rule->fsmagic != inode->i_sb->s_magic)
|
|
|
|
return false;
|
2012-05-26 08:24:12 +08:00
|
|
|
if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
|
2009-02-04 22:06:58 +08:00
|
|
|
return false;
|
2012-10-03 12:38:48 +08:00
|
|
|
if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
return false;
|
2009-02-04 22:07:00 +08:00
|
|
|
for (i = 0; i < MAX_LSM_RULES; i++) {
|
2009-05-06 01:12:48 +08:00
|
|
|
int rc = 0;
|
2009-02-04 22:07:00 +08:00
|
|
|
u32 osid, sid;
|
2013-01-04 03:19:09 +08:00
|
|
|
int retried = 0;
|
2009-02-04 22:07:00 +08:00
|
|
|
|
|
|
|
if (!rule->lsm[i].rule)
|
|
|
|
continue;
|
2013-01-04 03:19:09 +08:00
|
|
|
retry:
|
2009-02-04 22:07:00 +08:00
|
|
|
switch (i) {
|
|
|
|
case LSM_OBJ_USER:
|
|
|
|
case LSM_OBJ_ROLE:
|
|
|
|
case LSM_OBJ_TYPE:
|
|
|
|
security_inode_getsecid(inode, &osid);
|
|
|
|
rc = security_filter_rule_match(osid,
|
|
|
|
rule->lsm[i].type,
|
2009-05-06 01:12:48 +08:00
|
|
|
Audit_equal,
|
2009-02-04 22:07:00 +08:00
|
|
|
rule->lsm[i].rule,
|
|
|
|
NULL);
|
|
|
|
break;
|
|
|
|
case LSM_SUBJ_USER:
|
|
|
|
case LSM_SUBJ_ROLE:
|
|
|
|
case LSM_SUBJ_TYPE:
|
|
|
|
security_task_getsecid(tsk, &sid);
|
|
|
|
rc = security_filter_rule_match(sid,
|
|
|
|
rule->lsm[i].type,
|
2009-05-06 01:12:48 +08:00
|
|
|
Audit_equal,
|
2009-02-04 22:07:00 +08:00
|
|
|
rule->lsm[i].rule,
|
|
|
|
NULL);
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
2013-01-04 03:19:09 +08:00
|
|
|
if ((rc < 0) && (!retried)) {
|
|
|
|
retried = 1;
|
|
|
|
ima_lsm_update_rules();
|
|
|
|
goto retry;
|
|
|
|
}
|
2009-02-04 22:07:00 +08:00
|
|
|
if (!rc)
|
|
|
|
return false;
|
|
|
|
}
|
2009-02-04 22:06:58 +08:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* ima_match_policy - decision based on LSM and other conditions
|
|
|
|
* @inode: pointer to an inode for which the policy decision is being made
|
|
|
|
* @func: IMA hook identifier
|
|
|
|
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
|
|
|
|
*
|
|
|
|
* Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
|
|
|
|
* conditions.
|
|
|
|
*
|
|
|
|
* (There is no need for locking when walking the policy list,
|
|
|
|
* as elements in the list are never deleted, nor does the list
|
|
|
|
* change.)
|
|
|
|
*/
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 23:15:05 +08:00
|
|
|
int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
|
|
|
|
int flags)
|
2009-02-04 22:06:58 +08:00
|
|
|
{
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
struct ima_rule_entry *entry;
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 23:15:05 +08:00
|
|
|
int action = 0, actmask = flags | (flags << 1);
|
2009-02-04 22:06:58 +08:00
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
list_for_each_entry(entry, ima_rules, list) {
|
2009-02-04 22:06:58 +08:00
|
|
|
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 23:15:05 +08:00
|
|
|
if (!(entry->action & actmask))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
if (!ima_match_rules(entry, inode, func, mask))
|
|
|
|
continue;
|
2009-02-04 22:06:58 +08:00
|
|
|
|
2012-09-13 01:51:32 +08:00
|
|
|
action |= entry->action & IMA_DO_MASK;
|
|
|
|
if (entry->action & IMA_DO_MASK)
|
|
|
|
actmask &= ~(entry->action | entry->action << 1);
|
|
|
|
else
|
|
|
|
actmask &= ~(entry->action | entry->action >> 1);
|
2009-02-04 22:06:58 +08:00
|
|
|
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 23:15:05 +08:00
|
|
|
if (!actmask)
|
|
|
|
break;
|
2009-02-04 22:06:58 +08:00
|
|
|
}
|
ima: integrity appraisal extension
IMA currently maintains an integrity measurement list used to assert the
integrity of the running system to a third party. The IMA-appraisal
extension adds local integrity validation and enforcement of the
measurement against a "good" value stored as an extended attribute
'security.ima'. The initial methods for validating 'security.ima' are
hashed based, which provides file data integrity, and digital signature
based, which in addition to providing file data integrity, provides
authenticity.
This patch creates and maintains the 'security.ima' xattr, containing
the file data hash measurement. Protection of the xattr is provided by
EVM, if enabled and configured.
Based on policy, IMA calls evm_verifyxattr() to verify a file's metadata
integrity and, assuming success, compares the file's current hash value
with the one stored as an extended attribute in 'security.ima'.
Changelov v4:
- changed iint cache flags to hex values
Changelog v3:
- change appraisal default for filesystems without xattr support to fail
Changelog v2:
- fix audit msg 'res' value
- removed unused 'ima_appraise=' values
Changelog v1:
- removed unused iint mutex (Dmitry Kasatkin)
- setattr hook must not reset appraised (Dmitry Kasatkin)
- evm_verifyxattr() now differentiates between no 'security.evm' xattr
(INTEGRITY_NOLABEL) and no EVM 'protected' xattrs included in the
'security.evm' (INTEGRITY_NOXATTRS).
- replace hash_status with ima_status (Dmitry Kasatkin)
- re-initialize slab element ima_status on free (Dmitry Kasatkin)
- include 'security.ima' in EVM if CONFIG_IMA_APPRAISE, not CONFIG_IMA
- merged half "ima: ima_must_appraise_or_measure API change" (Dmitry Kasatkin)
- removed unnecessary error variable in process_measurement() (Dmitry Kasatkin)
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured
(moved ima_inode_post_setattr() to ima_appraise.c)
- make sure ima_collect_measurement() can read file
Changelog:
- add 'iint' to evm_verifyxattr() call (Dimitry Kasatkin)
- fix the race condition between chmod, which takes the i_mutex and then
iint->mutex, and ima_file_free() and process_measurement(), which take
the locks in the reverse order, by eliminating iint->mutex. (Dmitry Kasatkin)
- cleanup of ima_appraise_measurement() (Dmitry Kasatkin)
- changes as a result of the iint not allocated for all regular files, but
only for those measured/appraised.
- don't try to appraise new/empty files
- expanded ima_appraisal description in ima/Kconfig
- IMA appraise definitions required even if IMA_APPRAISE not enabled
- add return value to ima_must_appraise() stub
- unconditionally set status = INTEGRITY_PASS *after* testing status,
not before. (Found by Joe Perches)
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2012-02-13 23:15:05 +08:00
|
|
|
|
|
|
|
return action;
|
2009-02-04 22:06:58 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* ima_init_policy - initialize the default measure rules.
|
|
|
|
*
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
* ima_rules points to either the ima_default_rules or the
|
|
|
|
* the new ima_policy_rules.
|
2009-02-04 22:06:58 +08:00
|
|
|
*/
|
2009-05-22 03:43:32 +08:00
|
|
|
void __init ima_init_policy(void)
|
2009-02-04 22:06:58 +08:00
|
|
|
{
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
int i, measure_entries, appraise_entries;
|
2009-05-22 03:47:06 +08:00
|
|
|
|
|
|
|
/* if !ima_use_tcb set entries = 0 so we load NO default rules */
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
measure_entries = ima_use_tcb ? ARRAY_SIZE(default_rules) : 0;
|
|
|
|
appraise_entries = ima_use_appraise_tcb ?
|
|
|
|
ARRAY_SIZE(default_appraise_rules) : 0;
|
|
|
|
|
|
|
|
for (i = 0; i < measure_entries + appraise_entries; i++) {
|
|
|
|
if (i < measure_entries)
|
|
|
|
list_add_tail(&default_rules[i].list,
|
|
|
|
&ima_default_rules);
|
|
|
|
else {
|
|
|
|
int j = i - measure_entries;
|
|
|
|
|
|
|
|
list_add_tail(&default_appraise_rules[j].list,
|
|
|
|
&ima_default_rules);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
ima_rules = &ima_default_rules;
|
2009-02-04 22:06:58 +08:00
|
|
|
}
|
2009-02-04 22:07:00 +08:00
|
|
|
|
|
|
|
/**
|
|
|
|
* ima_update_policy - update default_rules with new measure rules
|
|
|
|
*
|
|
|
|
* Called on file .release to update the default rules with a complete new
|
|
|
|
* policy. Once updated, the policy is locked, no additional rules can be
|
|
|
|
* added to the policy.
|
|
|
|
*/
|
|
|
|
void ima_update_policy(void)
|
|
|
|
{
|
|
|
|
const char *op = "policy_update";
|
|
|
|
const char *cause = "already exists";
|
|
|
|
int result = 1;
|
|
|
|
int audit_info = 0;
|
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
if (ima_rules == &ima_default_rules) {
|
|
|
|
ima_rules = &ima_policy_rules;
|
2009-02-04 22:07:00 +08:00
|
|
|
cause = "complete";
|
|
|
|
result = 0;
|
|
|
|
}
|
|
|
|
integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
|
|
|
|
NULL, op, cause, result, audit_info);
|
|
|
|
}
|
|
|
|
|
|
|
|
enum {
|
|
|
|
Opt_err = -1,
|
|
|
|
Opt_measure = 1, Opt_dont_measure,
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
Opt_appraise, Opt_dont_appraise,
|
2012-06-15 01:04:36 +08:00
|
|
|
Opt_audit,
|
2009-02-04 22:07:00 +08:00
|
|
|
Opt_obj_user, Opt_obj_role, Opt_obj_type,
|
|
|
|
Opt_subj_user, Opt_subj_role, Opt_subj_type,
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner
|
2009-02-04 22:07:00 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
static match_table_t policy_tokens = {
|
|
|
|
{Opt_measure, "measure"},
|
|
|
|
{Opt_dont_measure, "dont_measure"},
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
{Opt_appraise, "appraise"},
|
|
|
|
{Opt_dont_appraise, "dont_appraise"},
|
2012-06-15 01:04:36 +08:00
|
|
|
{Opt_audit, "audit"},
|
2009-02-04 22:07:00 +08:00
|
|
|
{Opt_obj_user, "obj_user=%s"},
|
|
|
|
{Opt_obj_role, "obj_role=%s"},
|
|
|
|
{Opt_obj_type, "obj_type=%s"},
|
|
|
|
{Opt_subj_user, "subj_user=%s"},
|
|
|
|
{Opt_subj_role, "subj_role=%s"},
|
|
|
|
{Opt_subj_type, "subj_type=%s"},
|
|
|
|
{Opt_func, "func=%s"},
|
|
|
|
{Opt_mask, "mask=%s"},
|
|
|
|
{Opt_fsmagic, "fsmagic=%s"},
|
|
|
|
{Opt_uid, "uid=%s"},
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
{Opt_fowner, "fowner=%s"},
|
2009-02-04 22:07:00 +08:00
|
|
|
{Opt_err, NULL}
|
|
|
|
};
|
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
static int ima_lsm_rule_init(struct ima_rule_entry *entry,
|
2013-01-04 03:19:09 +08:00
|
|
|
substring_t *args, int lsm_rule, int audit_type)
|
2009-02-04 22:07:00 +08:00
|
|
|
{
|
|
|
|
int result;
|
|
|
|
|
2010-04-20 22:21:01 +08:00
|
|
|
if (entry->lsm[lsm_rule].rule)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2013-01-04 03:19:09 +08:00
|
|
|
entry->lsm[lsm_rule].args_p = match_strdup(args);
|
|
|
|
if (!entry->lsm[lsm_rule].args_p)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2009-02-04 22:07:00 +08:00
|
|
|
entry->lsm[lsm_rule].type = audit_type;
|
|
|
|
result = security_filter_rule_init(entry->lsm[lsm_rule].type,
|
2013-01-04 03:19:09 +08:00
|
|
|
Audit_equal,
|
|
|
|
entry->lsm[lsm_rule].args_p,
|
2009-02-04 22:07:00 +08:00
|
|
|
&entry->lsm[lsm_rule].rule);
|
2013-01-04 03:19:09 +08:00
|
|
|
if (!entry->lsm[lsm_rule].rule) {
|
|
|
|
kfree(entry->lsm[lsm_rule].args_p);
|
2011-01-04 06:59:10 +08:00
|
|
|
return -EINVAL;
|
2013-01-04 03:19:09 +08:00
|
|
|
}
|
|
|
|
|
2009-02-04 22:07:00 +08:00
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
2010-04-20 22:21:30 +08:00
|
|
|
static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
|
|
|
|
{
|
|
|
|
audit_log_format(ab, "%s=", key);
|
|
|
|
audit_log_untrustedstring(ab, value);
|
|
|
|
audit_log_format(ab, " ");
|
|
|
|
}
|
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
|
2009-02-04 22:07:00 +08:00
|
|
|
{
|
|
|
|
struct audit_buffer *ab;
|
|
|
|
char *p;
|
|
|
|
int result = 0;
|
|
|
|
|
2009-02-12 00:12:28 +08:00
|
|
|
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
|
2009-02-04 22:07:00 +08:00
|
|
|
|
2012-05-26 08:24:12 +08:00
|
|
|
entry->uid = INVALID_UID;
|
2012-10-03 12:38:48 +08:00
|
|
|
entry->fowner = INVALID_UID;
|
2010-04-20 22:21:07 +08:00
|
|
|
entry->action = UNKNOWN;
|
2010-04-20 22:21:18 +08:00
|
|
|
while ((p = strsep(&rule, " \t")) != NULL) {
|
2009-02-04 22:07:00 +08:00
|
|
|
substring_t args[MAX_OPT_ARGS];
|
|
|
|
int token;
|
|
|
|
unsigned long lnum;
|
|
|
|
|
|
|
|
if (result < 0)
|
|
|
|
break;
|
2010-04-20 22:21:18 +08:00
|
|
|
if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
|
|
|
|
continue;
|
2009-02-04 22:07:00 +08:00
|
|
|
token = match_token(p, policy_tokens, args);
|
|
|
|
switch (token) {
|
|
|
|
case Opt_measure:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "action", "measure");
|
2010-04-20 22:21:01 +08:00
|
|
|
|
|
|
|
if (entry->action != UNKNOWN)
|
|
|
|
result = -EINVAL;
|
|
|
|
|
2009-02-04 22:07:00 +08:00
|
|
|
entry->action = MEASURE;
|
|
|
|
break;
|
|
|
|
case Opt_dont_measure:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "action", "dont_measure");
|
2010-04-20 22:21:01 +08:00
|
|
|
|
|
|
|
if (entry->action != UNKNOWN)
|
|
|
|
result = -EINVAL;
|
|
|
|
|
2009-02-04 22:07:00 +08:00
|
|
|
entry->action = DONT_MEASURE;
|
|
|
|
break;
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
case Opt_appraise:
|
|
|
|
ima_log_string(ab, "action", "appraise");
|
|
|
|
|
|
|
|
if (entry->action != UNKNOWN)
|
|
|
|
result = -EINVAL;
|
|
|
|
|
|
|
|
entry->action = APPRAISE;
|
|
|
|
break;
|
|
|
|
case Opt_dont_appraise:
|
|
|
|
ima_log_string(ab, "action", "dont_appraise");
|
|
|
|
|
|
|
|
if (entry->action != UNKNOWN)
|
|
|
|
result = -EINVAL;
|
|
|
|
|
|
|
|
entry->action = DONT_APPRAISE;
|
|
|
|
break;
|
2012-06-15 01:04:36 +08:00
|
|
|
case Opt_audit:
|
|
|
|
ima_log_string(ab, "action", "audit");
|
|
|
|
|
|
|
|
if (entry->action != UNKNOWN)
|
|
|
|
result = -EINVAL;
|
|
|
|
|
|
|
|
entry->action = AUDIT;
|
|
|
|
break;
|
2009-02-04 22:07:00 +08:00
|
|
|
case Opt_func:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "func", args[0].from);
|
2010-04-20 22:21:01 +08:00
|
|
|
|
|
|
|
if (entry->func)
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
result = -EINVAL;
|
2010-04-20 22:21:01 +08:00
|
|
|
|
2010-01-27 06:02:41 +08:00
|
|
|
if (strcmp(args[0].from, "FILE_CHECK") == 0)
|
|
|
|
entry->func = FILE_CHECK;
|
|
|
|
/* PATH_CHECK is for backwards compat */
|
|
|
|
else if (strcmp(args[0].from, "PATH_CHECK") == 0)
|
|
|
|
entry->func = FILE_CHECK;
|
2012-10-16 10:10:08 +08:00
|
|
|
else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
|
|
|
|
entry->func = MODULE_CHECK;
|
2012-12-14 00:15:04 +08:00
|
|
|
else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
|
|
|
|
|| (strcmp(args[0].from, "MMAP_CHECK") == 0))
|
|
|
|
entry->func = MMAP_CHECK;
|
2009-02-04 22:07:00 +08:00
|
|
|
else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
|
|
|
|
entry->func = BPRM_CHECK;
|
|
|
|
else
|
|
|
|
result = -EINVAL;
|
|
|
|
if (!result)
|
|
|
|
entry->flags |= IMA_FUNC;
|
|
|
|
break;
|
|
|
|
case Opt_mask:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "mask", args[0].from);
|
2010-04-20 22:21:01 +08:00
|
|
|
|
|
|
|
if (entry->mask)
|
|
|
|
result = -EINVAL;
|
|
|
|
|
2009-02-04 22:07:00 +08:00
|
|
|
if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
|
|
|
|
entry->mask = MAY_EXEC;
|
|
|
|
else if (strcmp(args[0].from, "MAY_WRITE") == 0)
|
|
|
|
entry->mask = MAY_WRITE;
|
|
|
|
else if (strcmp(args[0].from, "MAY_READ") == 0)
|
|
|
|
entry->mask = MAY_READ;
|
|
|
|
else if (strcmp(args[0].from, "MAY_APPEND") == 0)
|
|
|
|
entry->mask = MAY_APPEND;
|
|
|
|
else
|
|
|
|
result = -EINVAL;
|
|
|
|
if (!result)
|
|
|
|
entry->flags |= IMA_MASK;
|
|
|
|
break;
|
|
|
|
case Opt_fsmagic:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "fsmagic", args[0].from);
|
2010-04-20 22:21:01 +08:00
|
|
|
|
|
|
|
if (entry->fsmagic) {
|
|
|
|
result = -EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2009-02-04 22:07:00 +08:00
|
|
|
result = strict_strtoul(args[0].from, 16,
|
|
|
|
&entry->fsmagic);
|
|
|
|
if (!result)
|
|
|
|
entry->flags |= IMA_FSMAGIC;
|
|
|
|
break;
|
|
|
|
case Opt_uid:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "uid", args[0].from);
|
2010-04-20 22:21:01 +08:00
|
|
|
|
2012-05-26 08:24:12 +08:00
|
|
|
if (uid_valid(entry->uid)) {
|
2010-04-20 22:21:01 +08:00
|
|
|
result = -EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2009-02-04 22:07:00 +08:00
|
|
|
result = strict_strtoul(args[0].from, 10, &lnum);
|
|
|
|
if (!result) {
|
2012-05-26 08:24:12 +08:00
|
|
|
entry->uid = make_kuid(current_user_ns(), (uid_t)lnum);
|
|
|
|
if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum))
|
2009-02-04 22:07:00 +08:00
|
|
|
result = -EINVAL;
|
|
|
|
else
|
|
|
|
entry->flags |= IMA_UID;
|
|
|
|
}
|
|
|
|
break;
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
case Opt_fowner:
|
|
|
|
ima_log_string(ab, "fowner", args[0].from);
|
|
|
|
|
2012-10-03 12:38:48 +08:00
|
|
|
if (uid_valid(entry->fowner)) {
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
result = -EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
result = strict_strtoul(args[0].from, 10, &lnum);
|
|
|
|
if (!result) {
|
2012-10-03 12:38:48 +08:00
|
|
|
entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
|
|
|
|
if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
result = -EINVAL;
|
|
|
|
else
|
|
|
|
entry->flags |= IMA_FOWNER;
|
|
|
|
}
|
|
|
|
break;
|
2009-02-04 22:07:00 +08:00
|
|
|
case Opt_obj_user:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "obj_user", args[0].from);
|
2013-01-04 03:19:09 +08:00
|
|
|
result = ima_lsm_rule_init(entry, args,
|
2009-02-04 22:07:00 +08:00
|
|
|
LSM_OBJ_USER,
|
|
|
|
AUDIT_OBJ_USER);
|
|
|
|
break;
|
|
|
|
case Opt_obj_role:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "obj_role", args[0].from);
|
2013-01-04 03:19:09 +08:00
|
|
|
result = ima_lsm_rule_init(entry, args,
|
2009-02-04 22:07:00 +08:00
|
|
|
LSM_OBJ_ROLE,
|
|
|
|
AUDIT_OBJ_ROLE);
|
|
|
|
break;
|
|
|
|
case Opt_obj_type:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "obj_type", args[0].from);
|
2013-01-04 03:19:09 +08:00
|
|
|
result = ima_lsm_rule_init(entry, args,
|
2009-02-04 22:07:00 +08:00
|
|
|
LSM_OBJ_TYPE,
|
|
|
|
AUDIT_OBJ_TYPE);
|
|
|
|
break;
|
|
|
|
case Opt_subj_user:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "subj_user", args[0].from);
|
2013-01-04 03:19:09 +08:00
|
|
|
result = ima_lsm_rule_init(entry, args,
|
2009-02-04 22:07:00 +08:00
|
|
|
LSM_SUBJ_USER,
|
|
|
|
AUDIT_SUBJ_USER);
|
|
|
|
break;
|
|
|
|
case Opt_subj_role:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "subj_role", args[0].from);
|
2013-01-04 03:19:09 +08:00
|
|
|
result = ima_lsm_rule_init(entry, args,
|
2009-02-04 22:07:00 +08:00
|
|
|
LSM_SUBJ_ROLE,
|
|
|
|
AUDIT_SUBJ_ROLE);
|
|
|
|
break;
|
|
|
|
case Opt_subj_type:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "subj_type", args[0].from);
|
2013-01-04 03:19:09 +08:00
|
|
|
result = ima_lsm_rule_init(entry, args,
|
2009-02-04 22:07:00 +08:00
|
|
|
LSM_SUBJ_TYPE,
|
|
|
|
AUDIT_SUBJ_TYPE);
|
|
|
|
break;
|
|
|
|
case Opt_err:
|
2010-04-20 22:21:30 +08:00
|
|
|
ima_log_string(ab, "UNKNOWN", p);
|
2010-04-20 22:21:13 +08:00
|
|
|
result = -EINVAL;
|
2009-02-04 22:07:00 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
2010-04-20 22:21:01 +08:00
|
|
|
if (!result && (entry->action == UNKNOWN))
|
2009-02-04 22:07:00 +08:00
|
|
|
result = -EINVAL;
|
|
|
|
|
2012-02-15 06:11:07 +08:00
|
|
|
audit_log_format(ab, "res=%d", !result);
|
2009-02-04 22:07:00 +08:00
|
|
|
audit_log_end(ab);
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
* ima_parse_add_rule - add a rule to ima_policy_rules
|
2009-02-04 22:07:00 +08:00
|
|
|
* @rule - ima measurement policy rule
|
|
|
|
*
|
|
|
|
* Uses a mutex to protect the policy list from multiple concurrent writers.
|
2010-04-20 22:20:54 +08:00
|
|
|
* Returns the length of the rule parsed, an error code on failure
|
2009-02-04 22:07:00 +08:00
|
|
|
*/
|
2010-04-20 22:20:54 +08:00
|
|
|
ssize_t ima_parse_add_rule(char *rule)
|
2009-02-04 22:07:00 +08:00
|
|
|
{
|
2009-02-12 00:12:28 +08:00
|
|
|
const char *op = "update_policy";
|
2010-04-20 22:20:54 +08:00
|
|
|
char *p;
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
struct ima_rule_entry *entry;
|
2010-04-20 22:20:54 +08:00
|
|
|
ssize_t result, len;
|
2009-02-04 22:07:00 +08:00
|
|
|
int audit_info = 0;
|
|
|
|
|
|
|
|
/* Prevent installed policy from changing */
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
if (ima_rules != &ima_default_rules) {
|
2009-02-04 22:07:00 +08:00
|
|
|
integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
|
|
|
|
NULL, op, "already exists",
|
|
|
|
-EACCES, audit_info);
|
|
|
|
return -EACCES;
|
|
|
|
}
|
|
|
|
|
|
|
|
entry = kzalloc(sizeof(*entry), GFP_KERNEL);
|
|
|
|
if (!entry) {
|
|
|
|
integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
|
|
|
|
NULL, op, "-ENOMEM", -ENOMEM, audit_info);
|
|
|
|
return -ENOMEM;
|
|
|
|
}
|
|
|
|
|
|
|
|
INIT_LIST_HEAD(&entry->list);
|
|
|
|
|
2010-04-20 22:20:54 +08:00
|
|
|
p = strsep(&rule, "\n");
|
|
|
|
len = strlen(p) + 1;
|
2010-04-20 22:21:24 +08:00
|
|
|
|
|
|
|
if (*p == '#') {
|
|
|
|
kfree(entry);
|
|
|
|
return len;
|
|
|
|
}
|
|
|
|
|
2010-04-20 22:20:54 +08:00
|
|
|
result = ima_parse_rule(p, entry);
|
2010-04-20 22:21:24 +08:00
|
|
|
if (result) {
|
2009-02-04 22:07:00 +08:00
|
|
|
kfree(entry);
|
2009-02-12 00:12:28 +08:00
|
|
|
integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
|
|
|
|
NULL, op, "invalid policy", result,
|
|
|
|
audit_info);
|
2010-04-20 22:21:24 +08:00
|
|
|
return result;
|
2009-02-12 00:12:28 +08:00
|
|
|
}
|
2010-04-20 22:21:24 +08:00
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
mutex_lock(&ima_rules_mutex);
|
|
|
|
list_add_tail(&entry->list, &ima_policy_rules);
|
|
|
|
mutex_unlock(&ima_rules_mutex);
|
2010-04-20 22:21:24 +08:00
|
|
|
|
|
|
|
return len;
|
2009-02-04 22:07:00 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* ima_delete_rules called to cleanup invalid policy */
|
2009-02-05 06:28:26 +08:00
|
|
|
void ima_delete_rules(void)
|
2009-02-04 22:07:00 +08:00
|
|
|
{
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
struct ima_rule_entry *entry, *tmp;
|
2013-01-04 03:19:09 +08:00
|
|
|
int i;
|
2009-02-04 22:07:00 +08:00
|
|
|
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
mutex_lock(&ima_rules_mutex);
|
|
|
|
list_for_each_entry_safe(entry, tmp, &ima_policy_rules, list) {
|
2013-01-04 03:19:09 +08:00
|
|
|
for (i = 0; i < MAX_LSM_RULES; i++)
|
|
|
|
kfree(entry->lsm[i].args_p);
|
|
|
|
|
2009-02-04 22:07:00 +08:00
|
|
|
list_del(&entry->list);
|
|
|
|
kfree(entry);
|
|
|
|
}
|
ima: add appraise action keywords and default rules
Unlike the IMA measurement policy, the appraise policy can not be dependent
on runtime process information, such as the task uid, as the 'security.ima'
xattr is written on file close and must be updated each time the file changes,
regardless of the current task uid.
This patch extends the policy language with 'fowner', defines an appraise
policy, which appraises all files owned by root, and defines 'ima_appraise_tcb',
a new boot command line option, to enable the appraise policy.
Changelog v3:
- separate the measure from the appraise rules in order to support measuring
without appraising and appraising without measuring.
- change appraisal default for filesystems without xattr support to fail
- update default appraise policy for cgroups
Changelog v1:
- don't appraise RAMFS (Dmitry Kasatkin)
- merged rest of "ima: ima_must_appraise_or_measure API change" commit
(Dmtiry Kasatkin)
ima_must_appraise_or_measure() called ima_match_policy twice, which
searched the policy for a matching rule. Once for a matching measurement
rule and subsequently for an appraisal rule. Searching the policy twice
is unnecessary overhead, which could be noticeable with a large policy.
The new version of ima_must_appraise_or_measure() does everything in a
single iteration using a new version of ima_match_policy(). It returns
IMA_MEASURE, IMA_APPRAISE mask.
With the use of action mask only one efficient matching function
is enough. Removed other specific versions of matching functions.
Changelog:
- change 'owner' to 'fowner' to conform to the new LSM conditions posted by
Roberto Sassu.
- fix calls to ima_log_string()
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
2011-03-10 11:25:48 +08:00
|
|
|
mutex_unlock(&ima_rules_mutex);
|
2009-02-04 22:07:00 +08:00
|
|
|
}
|