2 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
5 * Reiner Sailer <sailer@watson.ibm.com>
6 * Serge Hallyn <serue@us.ibm.com>
7 * Kylene Hall <kylene@us.ibm.com>
8 * Mimi Zohar <zohar@us.ibm.com>
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation, version 2 of the
16 * implements the IMA hooks: ima_bprm_check, ima_file_mmap,
19 #include <linux/module.h>
20 #include <linux/file.h>
21 #include <linux/binfmts.h>
22 #include <linux/mount.h>
23 #include <linux/mman.h>
24 #include <linux/slab.h>
30 char *ima_hash
= "sha1";
31 static int __init
hash_setup(char *str
)
33 if (strncmp(str
, "md5", 3) == 0)
37 __setup("ima_hash=", hash_setup
);
39 struct ima_imbalance
{
40 struct hlist_node node
;
41 unsigned long fsmagic
;
45 * ima_limit_imbalance - emit one imbalance message per filesystem type
47 * Maintain list of filesystem types that do not measure files properly.
48 * Return false if unknown, true if known.
50 static bool ima_limit_imbalance(struct file
*file
)
52 static DEFINE_SPINLOCK(ima_imbalance_lock
);
53 static HLIST_HEAD(ima_imbalance_list
);
55 struct super_block
*sb
= file
->f_dentry
->d_sb
;
56 struct ima_imbalance
*entry
;
57 struct hlist_node
*node
;
61 hlist_for_each_entry_rcu(entry
, node
, &ima_imbalance_list
, node
) {
62 if (entry
->fsmagic
== sb
->s_magic
) {
71 entry
= kmalloc(sizeof(*entry
), GFP_NOFS
);
74 entry
->fsmagic
= sb
->s_magic
;
75 spin_lock(&ima_imbalance_lock
);
77 * we could have raced and something else might have added this fs
78 * to the list, but we don't really care
80 hlist_add_head_rcu(&entry
->node
, &ima_imbalance_list
);
81 spin_unlock(&ima_imbalance_lock
);
82 printk(KERN_INFO
"IMA: unmeasured files on fsmagic: %lX\n",
89 * ima_counts_get - increment file counts
91 * Maintain read/write counters for all files, but only
92 * invalidate the PCR for measured files:
93 * - Opening a file for write when already open for read,
94 * results in a time of measure, time of use (ToMToU) error.
95 * - Opening a file for read when already open for write,
96 * could result in a file measurement error.
99 void ima_counts_get(struct file
*file
)
101 struct dentry
*dentry
= file
->f_path
.dentry
;
102 struct inode
*inode
= dentry
->d_inode
;
103 fmode_t mode
= file
->f_mode
;
105 bool send_tomtou
= false, send_writers
= false;
107 if (!S_ISREG(inode
->i_mode
))
110 spin_lock(&inode
->i_lock
);
112 if (!ima_initialized
)
115 if (mode
& FMODE_WRITE
) {
116 if (atomic_read(&inode
->i_readcount
) && IS_IMA(inode
))
121 rc
= ima_must_measure(NULL
, inode
, MAY_READ
, FILE_CHECK
);
125 if (atomic_read(&inode
->i_writecount
) > 0)
128 /* remember the vfs deals with i_writecount */
129 if ((mode
& (FMODE_READ
| FMODE_WRITE
)) == FMODE_READ
)
130 atomic_inc(&inode
->i_readcount
);
132 spin_unlock(&inode
->i_lock
);
135 ima_add_violation(inode
, dentry
->d_name
.name
, "invalid_pcr",
138 ima_add_violation(inode
, dentry
->d_name
.name
, "invalid_pcr",
143 * Decrement ima counts
145 static void ima_dec_counts(struct inode
*inode
, struct file
*file
)
147 mode_t mode
= file
->f_mode
;
149 assert_spin_locked(&inode
->i_lock
);
151 if ((mode
& (FMODE_READ
| FMODE_WRITE
)) == FMODE_READ
) {
152 if (unlikely(atomic_read(&inode
->i_readcount
) == 0)) {
153 if (!ima_limit_imbalance(file
)) {
154 printk(KERN_INFO
"%s: open/free imbalance (r:%u)\n",
156 atomic_read(&inode
->i_readcount
));
161 atomic_dec(&inode
->i_readcount
);
165 static void ima_check_last_writer(struct ima_iint_cache
*iint
,
169 mode_t mode
= file
->f_mode
;
171 BUG_ON(!mutex_is_locked(&iint
->mutex
));
172 assert_spin_locked(&inode
->i_lock
);
174 if (mode
& FMODE_WRITE
&&
175 atomic_read(&inode
->i_writecount
) == 1 &&
176 iint
->version
!= inode
->i_version
)
177 iint
->flags
&= ~IMA_MEASURED
;
180 static void ima_file_free_iint(struct ima_iint_cache
*iint
, struct inode
*inode
,
183 mutex_lock(&iint
->mutex
);
184 spin_lock(&inode
->i_lock
);
186 ima_dec_counts(inode
, file
);
187 ima_check_last_writer(iint
, inode
, file
);
189 spin_unlock(&inode
->i_lock
);
190 mutex_unlock(&iint
->mutex
);
193 static void ima_file_free_noiint(struct inode
*inode
, struct file
*file
)
195 spin_lock(&inode
->i_lock
);
197 ima_dec_counts(inode
, file
);
199 spin_unlock(&inode
->i_lock
);
203 * ima_file_free - called on __fput()
204 * @file: pointer to file structure being freed
206 * Flag files that changed, based on i_version;
207 * and decrement the i_readcount.
209 void ima_file_free(struct file
*file
)
211 struct inode
*inode
= file
->f_dentry
->d_inode
;
212 struct ima_iint_cache
*iint
;
214 if (!iint_initialized
|| !S_ISREG(inode
->i_mode
))
217 iint
= ima_iint_find(inode
);
220 ima_file_free_iint(iint
, inode
, file
);
222 ima_file_free_noiint(inode
, file
);
226 static int process_measurement(struct file
*file
, const unsigned char *filename
,
227 int mask
, int function
)
229 struct inode
*inode
= file
->f_dentry
->d_inode
;
230 struct ima_iint_cache
*iint
;
233 if (!ima_initialized
|| !S_ISREG(inode
->i_mode
))
236 rc
= ima_must_measure(NULL
, inode
, mask
, function
);
240 iint
= ima_iint_find(inode
);
242 rc
= ima_inode_alloc(inode
);
243 if (!rc
|| rc
== -EEXIST
)
248 mutex_lock(&iint
->mutex
);
250 rc
= ima_must_measure(iint
, inode
, mask
, function
);
254 rc
= ima_collect_measurement(iint
, file
);
256 ima_store_measurement(iint
, file
, filename
);
258 mutex_unlock(&iint
->mutex
);
263 * ima_file_mmap - based on policy, collect/store measurement.
264 * @file: pointer to the file to be measured (May be NULL)
265 * @prot: contains the protection that will be applied by the kernel.
267 * Measure files being mmapped executable based on the ima_must_measure()
270 * Return 0 on success, an error code on failure.
271 * (Based on the results of appraise_measurement().)
273 int ima_file_mmap(struct file
*file
, unsigned long prot
)
279 if (prot
& PROT_EXEC
)
280 rc
= process_measurement(file
, file
->f_dentry
->d_name
.name
,
281 MAY_EXEC
, FILE_MMAP
);
286 * ima_bprm_check - based on policy, collect/store measurement.
287 * @bprm: contains the linux_binprm structure
289 * The OS protects against an executable file, already open for write,
290 * from being executed in deny_write_access() and an executable file,
291 * already open for execute, from being modified in get_write_access().
292 * So we can be certain that what we verify and measure here is actually
293 * what is being executed.
295 * Return 0 on success, an error code on failure.
296 * (Based on the results of appraise_measurement().)
298 int ima_bprm_check(struct linux_binprm
*bprm
)
302 rc
= process_measurement(bprm
->file
, bprm
->filename
,
303 MAY_EXEC
, BPRM_CHECK
);
308 * ima_path_check - based on policy, collect/store measurement.
309 * @file: pointer to the file to be measured
310 * @mask: contains MAY_READ, MAY_WRITE or MAY_EXECUTE
312 * Measure files based on the ima_must_measure() policy decision.
314 * Always return 0 and audit dentry_open failures.
315 * (Return code will be based upon measurement appraisal.)
317 int ima_file_check(struct file
*file
, int mask
)
321 rc
= process_measurement(file
, file
->f_dentry
->d_name
.name
,
322 mask
& (MAY_READ
| MAY_WRITE
| MAY_EXEC
),
326 EXPORT_SYMBOL_GPL(ima_file_check
);
328 static int __init
init_ima(void)
337 static void __exit
cleanup_ima(void)
342 late_initcall(init_ima
); /* Start IMA after the TPM is available */
344 MODULE_DESCRIPTION("Integrity Measurement Architecture");
345 MODULE_LICENSE("GPL");