projects/linux·blob master · refs

576 lines · 15.2 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (C) 2005,2006,2007,2008 IBM Corporation
4 *
5 * Authors:
6 * Serge Hallyn <[email protected]>
7 * Reiner Sailer <[email protected]>
8 * Mimi Zohar <[email protected]>
9 *
10 * File: ima_queue.c
11 * Implements queues that store template measurements and
12 * maintains aggregate over the stored measurements
13 * in the pre-configured TPM PCR (if available).
14 * The measurement list is append-only. No entry is
15 * ever removed or changed during the boot-cycle.
16 */
17
18#include <linux/rculist.h>
19#include <linux/reboot.h>
20#include <linux/slab.h>
21#include "ima.h"
22
23#define AUDIT_CAUSE_LEN_MAX 32
24
25bool ima_flush_htable;
26
27static int __init ima_flush_htable_setup(char *str)
28{
29 if (IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE)) {
30 pr_warn("Hash table not enabled, ignoring request to flush\n");
31 return 1;
32 }
33
34 ima_flush_htable = true;
35 return 1;
36}
37__setup("ima_flush_htable", ima_flush_htable_setup);
38
39/* pre-allocated array of tpm_digest structures to extend a PCR */
40static struct tpm_digest *digests;
41
42LIST_HEAD(ima_measurements); /* list of all measurements */
43LIST_HEAD(ima_measurements_staged); /* list of staged measurements */
44#ifdef CONFIG_IMA_KEXEC
45static unsigned long binary_runtime_size[BINARY__LAST];
46#else
47static unsigned long binary_runtime_size[BINARY__LAST] = {
48 [0 ... BINARY__LAST - 1] = ULONG_MAX
49};
50#endif
51
52atomic_long_t ima_num_records[BINARY__LAST] = {
53 [0 ... BINARY__LAST - 1] = ATOMIC_LONG_INIT(0)
54};
55atomic_long_t ima_num_violations = ATOMIC_LONG_INIT(0);
56
57/* key: inode (before secure-hashing a file) */
58struct hlist_head __rcu *ima_htable;
59
60/* mutex protects atomicity of extending and staging measurement list
61 * and extending the TPM PCR aggregate. Since tpm_extend can take
62 * long (and the tpm driver uses a mutex), we can't use the spinlock.
63 */
64static DEFINE_MUTEX(ima_extend_list_mutex);
65
66/*
67 * Used internally by the kernel to suspend measurements.
68 * Protected by ima_extend_list_mutex.
69 */
70static bool ima_measurements_suspended;
71
72/* Callers must call synchronize_rcu() and free the hash table. */
73static struct hlist_head *ima_alloc_replace_htable(void)
74{
75 struct hlist_head *old_htable, *new_htable;
76
77 /* Initializing to zeros is equivalent to call HLIST_HEAD_INIT. */
78 new_htable = kzalloc_objs(struct hlist_head, IMA_MEASURE_HTABLE_SIZE);
79 if (!new_htable)
80 return ERR_PTR(-ENOMEM);
81
82 old_htable = rcu_replace_pointer(ima_htable, new_htable,
83 lockdep_is_held(&ima_extend_list_mutex));
84
85 return old_htable;
86}
87
88int __init ima_init_htable(void)
89{
90 struct hlist_head *old_htable;
91
92 mutex_lock(&ima_extend_list_mutex);
93 old_htable = ima_alloc_replace_htable();
94 mutex_unlock(&ima_extend_list_mutex);
95
96 if (IS_ERR(old_htable))
97 return PTR_ERR(old_htable);
98
99 /* Synchronize_rcu() and kfree() not necessary, only for robustness. */
100 synchronize_rcu();
101 kfree(old_htable);
102 return 0;
103}
104
105/* lookup up the digest value in the hash table, and return the entry */
106static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value,
107 int pcr)
108{
109 struct ima_queue_entry *qe, *ret = NULL;
110 struct hlist_head *htable;
111 unsigned int key;
112 int rc;
113
114 key = ima_hash_key(digest_value);
115 rcu_read_lock();
116 htable = rcu_dereference(ima_htable);
117 hlist_for_each_entry_rcu(qe, &htable[key], hnext) {
118 rc = memcmp(qe->entry->digests[ima_hash_algo_idx].digest,
119 digest_value, hash_digest_size[ima_hash_algo]);
120 if ((rc == 0) && (qe->entry->pcr == pcr)) {
121 ret = qe;
122 break;
123 }
124 }
125 rcu_read_unlock();
126 return ret;
127}
128
129/*
130 * Calculate the memory required for serializing a single
131 * binary_runtime_measurement list entry, which contains a
132 * couple of variable length fields (e.g template name and data).
133 */
134static int get_binary_runtime_size(struct ima_template_entry *entry)
135{
136 int size = 0;
137
138 size += sizeof(u32); /* pcr */
139 size += TPM_DIGEST_SIZE;
140 size += sizeof(int); /* template name size field */
141 size += strlen(entry->template_desc->name);
142 size += sizeof(entry->template_data_len);
143 size += entry->template_data_len;
144 return size;
145}
146
147static void ima_update_binary_runtime_size(struct ima_template_entry *entry,
148 enum binary_lists binary_list)
149{
150 int size;
151
152 if (binary_runtime_size[binary_list] == ULONG_MAX)
153 return;
154
155 size = get_binary_runtime_size(entry);
156 binary_runtime_size[binary_list] =
157 (binary_runtime_size[binary_list] < ULONG_MAX - size) ?
158 binary_runtime_size[binary_list] + size : ULONG_MAX;
159}
160
161/* ima_add_template_entry helper function:
162 * - Add template entry to the measurement list and hash table, for
163 * all entries except those carried across kexec.
164 *
165 * (Called with ima_extend_list_mutex held.)
166 */
167static int ima_add_digest_entry(struct ima_template_entry *entry,
168 bool update_htable)
169{
170 struct ima_queue_entry *qe;
171 struct hlist_head *htable;
172 unsigned int key;
173
174 qe = kmalloc_obj(*qe);
175 if (qe == NULL) {
176 pr_err("OUT OF MEMORY ERROR creating queue entry\n");
177 return -ENOMEM;
178 }
179 qe->entry = entry;
180
181 INIT_LIST_HEAD(&qe->later);
182 list_add_tail_rcu(&qe->later, &ima_measurements);
183
184 htable = rcu_dereference_protected(ima_htable,
185 lockdep_is_held(&ima_extend_list_mutex));
186
187 atomic_long_inc(&ima_num_records[BINARY]);
188 atomic_long_inc(&ima_num_records[BINARY_FULL]);
189
190 if (update_htable) {
191 key = ima_hash_key(entry->digests[ima_hash_algo_idx].digest);
192 hlist_add_head_rcu(&qe->hnext, &htable[key]);
193 }
194
195 ima_update_binary_runtime_size(entry, BINARY);
196 ima_update_binary_runtime_size(entry, BINARY_FULL);
197
198 return 0;
199}
200
201/*
202 * Return the amount of memory required for serializing the
203 * entire binary_runtime_measurement list, including the ima_kexec_hdr
204 * structure.
205 */
206unsigned long ima_get_binary_runtime_size(enum binary_lists binary_list)
207{
208 unsigned long val;
209
210 mutex_lock(&ima_extend_list_mutex);
211 val = binary_runtime_size[binary_list];
212 mutex_unlock(&ima_extend_list_mutex);
213
214 if (val >= (ULONG_MAX - sizeof(struct ima_kexec_hdr)))
215 return ULONG_MAX;
216 else
217 return val + sizeof(struct ima_kexec_hdr);
218}
219
220static int ima_pcr_extend(struct tpm_digest *digests_arg, int pcr)
221{
222 int result = 0;
223
224 if (!ima_tpm_chip)
225 return result;
226
227 result = tpm_pcr_extend(ima_tpm_chip, pcr, digests_arg);
228 if (result != 0)
229 pr_err("Error Communicating to TPM chip, result: %d\n", result);
230 return result;
231}
232
233/*
234 * Add template entry to the measurement list and hash table, and
235 * extend the pcr.
236 *
237 * On systems which support carrying the IMA measurement list across
238 * kexec, maintain the total memory size required for serializing the
239 * binary_runtime_measurements.
240 */
241int ima_add_template_entry(struct ima_template_entry *entry, int violation,
242 const char *op, struct inode *inode,
243 const unsigned char *filename)
244{
245 u8 *digest = entry->digests[ima_hash_algo_idx].digest;
246 struct tpm_digest *digests_arg = entry->digests;
247 const char *audit_cause = "hash_added";
248 char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
249 int audit_info = 1;
250 int result = 0, tpmresult = 0;
251
252 mutex_lock(&ima_extend_list_mutex);
253
254 /*
255 * Avoid appending to the measurement log when the TPM subsystem has
256 * been shut down while preparing for system reboot.
257 */
258 if (ima_measurements_suspended) {
259 audit_cause = "measurements_suspended";
260 audit_info = 0;
261 result = -ENODEV;
262 goto out;
263 }
264
265 if (!violation && !IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE)) {
266 if (ima_lookup_digest_entry(digest, entry->pcr)) {
267 audit_cause = "hash_exists";
268 result = -EEXIST;
269 goto out;
270 }
271 }
272
273 result = ima_add_digest_entry(entry,
274 !IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE));
275 if (result < 0) {
276 audit_cause = "ENOMEM";
277 audit_info = 0;
278 goto out;
279 }
280
281 if (violation) /* invalidate pcr */
282 digests_arg = digests;
283
284 tpmresult = ima_pcr_extend(digests_arg, entry->pcr);
285 if (tpmresult != 0) {
286 snprintf(tpm_audit_cause, AUDIT_CAUSE_LEN_MAX, "TPM_error(%d)",
287 tpmresult);
288 audit_cause = tpm_audit_cause;
289 audit_info = 0;
290 }
291out:
292 mutex_unlock(&ima_extend_list_mutex);
293 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
294 op, audit_cause, result, audit_info);
295 return result;
296}
297
298/**
299 * ima_queue_stage - Stage all measurements
300 *
301 * If the staged measurements list is empty, the current measurements list is
302 * not empty, and measurement is not suspended, move the measurements from the
303 * current list to the staged one, and update the number of records and binary
304 * run-time size accordingly.
305 *
306 * Do not allow staging after measurement is suspended, so that dumping
307 * measurements can be done in a lockless way.
308 *
309 * Return: Zero on success, a negative value otherwise.
310 */
311int ima_queue_stage(void)
312{
313 int ret = 0;
314
315 mutex_lock(&ima_extend_list_mutex);
316 if (!list_empty(&ima_measurements_staged)) {
317 ret = -EEXIST;
318 goto out_unlock;
319 }
320
321 if (list_empty(&ima_measurements)) {
322 ret = -ENOENT;
323 goto out_unlock;
324 }
325
326 if (ima_measurements_suspended) {
327 ret = -EACCES;
328 goto out_unlock;
329 }
330
331 list_replace(&ima_measurements, &ima_measurements_staged);
332 INIT_LIST_HEAD(&ima_measurements);
333
334 atomic_long_set(&ima_num_records[BINARY_STAGED],
335 atomic_long_read(&ima_num_records[BINARY]));
336 atomic_long_set(&ima_num_records[BINARY], 0);
337
338 if (IS_ENABLED(CONFIG_IMA_KEXEC)) {
339 binary_runtime_size[BINARY_STAGED] =
340 binary_runtime_size[BINARY];
341 binary_runtime_size[BINARY] = 0;
342 }
343out_unlock:
344 mutex_unlock(&ima_extend_list_mutex);
345 return ret;
346}
347
348static void ima_queue_delete(struct list_head *head, bool flush_htable);
349
350/**
351 * ima_queue_staged_delete_all - Delete staged measurements
352 *
353 * Move staged measurements to a temporary list, ima_measurements_trim, update
354 * the number of records and the binary run-time size accordingly. Finally,
355 * delete measurements in the temporary list.
356 *
357 * Refuse to delete staged measurements if measurement is suspended, so that
358 * dump can be done in a lockless way and user space is notified about staged
359 * measurements being carried over to the secondary kernel, so that it does not
360 * save them twice.
361 *
362 * Return: Zero on success, a negative value otherwise.
363 */
364int ima_queue_staged_delete_all(void)
365{
366 struct hlist_head *old_queue = NULL;
367 LIST_HEAD(ima_measurements_trim);
368
369 mutex_lock(&ima_extend_list_mutex);
370 if (list_empty(&ima_measurements_staged)) {
371 mutex_unlock(&ima_extend_list_mutex);
372 return -ENOENT;
373 }
374
375 if (ima_measurements_suspended) {
376 mutex_unlock(&ima_extend_list_mutex);
377 return -ESTALE;
378 }
379
380 list_replace(&ima_measurements_staged, &ima_measurements_trim);
381 INIT_LIST_HEAD(&ima_measurements_staged);
382
383 atomic_long_set(&ima_num_records[BINARY_STAGED], 0);
384
385 if (IS_ENABLED(CONFIG_IMA_KEXEC))
386 binary_runtime_size[BINARY_STAGED] = 0;
387
388 if (ima_flush_htable) {
389 old_queue = ima_alloc_replace_htable();
390 if (IS_ERR(old_queue)) {
391 mutex_unlock(&ima_extend_list_mutex);
392 return PTR_ERR(old_queue);
393 }
394 }
395
396 mutex_unlock(&ima_extend_list_mutex);
397
398 if (ima_flush_htable) {
399 synchronize_rcu();
400 kfree(old_queue);
401 }
402
403 ima_queue_delete(&ima_measurements_trim, ima_flush_htable);
404 return 0;
405}
406
407/**
408 * ima_queue_delete_partial - Delete current measurements
409 * @req_value: Number of measurements to delete
410 *
411 * Delete the requested number of measurements from the current measurements
412 * list, and update the number of records and the binary run-time size
413 * accordingly.
414 *
415 * Refuse to delete current measurements if measurement is suspended, so that
416 * dump can be done in a lockless way and user space is notified about current
417 * measurements being carried over to the secondary kernel, so that it does not
418 * save them twice.
419 *
420 * Return: Zero on success, a negative value otherwise.
421 */
422int ima_queue_delete_partial(unsigned long req_value)
423{
424 unsigned long req_value_copy = req_value;
425 unsigned long size_to_remove = 0, num_to_remove = 0;
426 LIST_HEAD(ima_measurements_trim);
427 struct ima_queue_entry *qe;
428 int ret = 0;
429
430 /*
431 * list_for_each_entry_rcu() without rcu_read_lock() is fine because
432 * only list append can happen concurrently. No list replace due to the
433 * staging/delete writers mutual exclusion.
434 */
435 list_for_each_entry_rcu(qe, &ima_measurements, later, true) {
436 size_to_remove += get_binary_runtime_size(qe->entry);
437 num_to_remove++;
438
439 if (--req_value_copy == 0)
440 break;
441 }
442
443 /* Not enough records to delete. */
444 if (req_value_copy > 0)
445 return -ENOENT;
446
447 mutex_lock(&ima_extend_list_mutex);
448 if (ima_measurements_suspended) {
449 mutex_unlock(&ima_extend_list_mutex);
450 return -ESTALE;
451 }
452
453 /*
454 * qe remains valid because ima_fs.c enforces single-writer exclusion.
455 */
456 __list_cut_position(&ima_measurements_trim, &ima_measurements,
457 &qe->later);
458
459 atomic_long_sub(num_to_remove, &ima_num_records[BINARY]);
460
461 if (IS_ENABLED(CONFIG_IMA_KEXEC))
462 binary_runtime_size[BINARY] -= size_to_remove;
463
464 mutex_unlock(&ima_extend_list_mutex);
465
466 ima_queue_delete(&ima_measurements_trim, false);
467 return ret;
468}
469
470/**
471 * ima_queue_delete - Delete measurements
472 * @head: List head measurements are deleted from
473 * @flush_htable: Whether or not the hash table is being flushed
474 *
475 * Delete the measurements from the passed list head completely if the
476 * hash table is not enabled or is being flushed, or partially (only the
477 * template data), if the hash table is used.
478 */
479static void ima_queue_delete(struct list_head *head, bool flush_htable)
480{
481 struct ima_queue_entry *qe, *qe_tmp;
482 unsigned int i;
483
484 list_for_each_entry_safe(qe, qe_tmp, head, later) {
485 /*
486 * Safe to free template_data here without synchronize_rcu()
487 * because the only htable reader, ima_lookup_digest_entry(),
488 * accesses only entry->digests, not template_data. If new
489 * htable readers are added that access template_data, a
490 * synchronize_rcu() is required here.
491 */
492 for (i = 0; i < qe->entry->template_desc->num_fields; i++) {
493 kfree(qe->entry->template_data[i].data);
494 qe->entry->template_data[i].data = NULL;
495 qe->entry->template_data[i].len = 0;
496 }
497
498 list_del(&qe->later);
499
500 /* No leak if condition is false, referenced by ima_htable. */
501 if (IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE) || flush_htable) {
502 kfree(qe->entry->digests);
503 kfree(qe->entry);
504 kfree(qe);
505 }
506 }
507}
508
509int ima_restore_measurement_entry(struct ima_template_entry *entry)
510{
511 int result = 0;
512
513 mutex_lock(&ima_extend_list_mutex);
514 result = ima_add_digest_entry(entry, 0);
515 mutex_unlock(&ima_extend_list_mutex);
516 return result;
517}
518
519static void ima_measurements_suspend(void)
520{
521 mutex_lock(&ima_extend_list_mutex);
522 ima_measurements_suspended = true;
523 mutex_unlock(&ima_extend_list_mutex);
524}
525
526static int ima_reboot_notifier(struct notifier_block *nb,
527 unsigned long action,
528 void *data)
529{
530#ifdef CONFIG_IMA_KEXEC
531 if (action == SYS_RESTART && data && !strcmp(data, "kexec reboot"))
532 ima_measure_kexec_event("kexec_execute");
533#endif
534
535 ima_measurements_suspend();
536
537 return NOTIFY_DONE;
538}
539
540static struct notifier_block ima_reboot_nb = {
541 .notifier_call = ima_reboot_notifier,
542};
543
544void __init ima_init_reboot_notifier(void)
545{
546 register_reboot_notifier(&ima_reboot_nb);
547}
548
549int __init ima_init_digests(void)
550{
551 u16 digest_size;
552 u16 crypto_id;
553 int i;
554
555 if (!ima_tpm_chip)
556 return 0;
557
558 digests = kzalloc_objs(*digests, ima_tpm_chip->nr_allocated_banks,
559 GFP_NOFS);
560 if (!digests)
561 return -ENOMEM;
562
563 for (i = 0; i < ima_tpm_chip->nr_allocated_banks; i++) {
564 digests[i].alg_id = ima_tpm_chip->allocated_banks[i].alg_id;
565 digest_size = ima_tpm_chip->allocated_banks[i].digest_size;
566 crypto_id = ima_tpm_chip->allocated_banks[i].crypto_id;
567
568 /* for unmapped TPM algorithms digest is still a padded SHA1 */
569 if (crypto_id == HASH_ALGO__LAST)
570 digest_size = SHA1_DIGEST_SIZE;
571
572 memset(digests[i].digest, 0xff, digest_size);
573 }
574
575 return 0;
576}