projects/linux·blob master · refs

281 lines · 7.2 KiB

1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * Copyright (C) 2009-2010 IBM Corporation
4 *
5 * Authors:
6 * Mimi Zohar <[email protected]>
7 */
8
9#ifdef pr_fmt
10#undef pr_fmt
11#endif
12
13#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15#include <linux/types.h>
16#include <linux/integrity.h>
17#include <linux/secure_boot.h>
18#include <crypto/sha1.h>
19#include <crypto/hash.h>
20#include <linux/key.h>
21#include <linux/audit.h>
22#include <linux/lsm_hooks.h>
23
24enum evm_ima_xattr_type {
25 IMA_XATTR_DIGEST = 0x01,
26 EVM_XATTR_HMAC,
27 EVM_IMA_XATTR_DIGSIG,
28 IMA_XATTR_DIGEST_NG,
29 EVM_XATTR_PORTABLE_DIGSIG,
30 IMA_VERITY_DIGSIG,
31 IMA_XATTR_LAST
32};
33
34struct evm_ima_xattr_data {
35 /* New members must be added within the __struct_group() macro below. */
36 __struct_group(evm_ima_xattr_data_hdr, hdr, __packed,
37 u8 type;
38 );
39 u8 data[];
40} __packed;
41static_assert(offsetof(struct evm_ima_xattr_data, data) == sizeof(struct evm_ima_xattr_data_hdr),
42 "struct member likely outside of __struct_group()");
43
44/* Only used in the EVM HMAC code. */
45struct evm_xattr {
46 struct evm_ima_xattr_data_hdr data;
47 u8 digest[SHA1_DIGEST_SIZE];
48} __packed;
49
50#define IMA_MAX_DIGEST_SIZE HASH_MAX_DIGESTSIZE
51
52struct ima_digest_data {
53 /* New members must be added within the __struct_group() macro below. */
54 __struct_group(ima_digest_data_hdr, hdr, __packed,
55 u8 algo;
56 u8 length;
57 union {
58 struct {
59 u8 unused;
60 u8 type;
61 } sha1;
62 struct {
63 u8 type;
64 u8 algo;
65 } ng;
66 u8 data[2];
67 } xattr;
68 );
69 u8 digest[];
70} __packed;
71static_assert(offsetof(struct ima_digest_data, digest) == sizeof(struct ima_digest_data_hdr),
72 "struct member likely outside of __struct_group()");
73
74/*
75 * Instead of wrapping the ima_digest_data struct inside a local structure
76 * with the maximum hash size, define ima_max_digest_data struct.
77 */
78struct ima_max_digest_data {
79 struct ima_digest_data_hdr hdr;
80 u8 digest[HASH_MAX_DIGESTSIZE];
81} __packed;
82
83/*
84 * signature header format v2 - for using with asymmetric keys
85 *
86 * The signature_v2_hdr struct includes a signature format version
87 * to simplify defining new signature formats.
88 *
89 * signature format:
90 * version 2: regular file data hash based signature
91 * version 3: struct ima_file_id data based signature
92 */
93struct signature_v2_hdr {
94 uint8_t type; /* xattr type */
95 uint8_t version; /* signature format version */
96 uint8_t hash_algo; /* Digest algorithm [enum hash_algo] */
97 __be32 keyid; /* IMA key identifier - not X509/PGP specific */
98 __be16 sig_size; /* signature size */
99 uint8_t sig[]; /* signature payload */
100} __packed;
101
102/*
103 * IMA signature version 3 disambiguates the data that is signed, by
104 * indirectly signing the hash of the ima_file_id structure data,
105 * containing either the fsverity_descriptor struct digest or, in the
106 * future, the regular IMA file hash.
107 *
108 * (The hash of the ima_file_id structure is only of the portion used.)
109 */
110struct ima_file_id {
111 __u8 hash_type; /* xattr type [enum evm_ima_xattr_type] */
112 __u8 hash_algorithm; /* Digest algorithm [enum hash_algo] */
113 __u8 hash[HASH_MAX_DIGESTSIZE];
114} __packed;
115
116int integrity_kernel_read(struct file *file, loff_t offset,
117 void *addr, unsigned long count);
118int __init integrity_fs_init(void);
119void __init integrity_fs_fini(void);
120
121#define INTEGRITY_KEYRING_EVM 0
122#define INTEGRITY_KEYRING_IMA 1
123#define INTEGRITY_KEYRING_PLATFORM 2
124#define INTEGRITY_KEYRING_MACHINE 3
125#define INTEGRITY_KEYRING_MAX 4
126
127extern struct dentry *integrity_dir;
128
129struct modsig;
130
131#ifdef CONFIG_INTEGRITY_SIGNATURE
132
133int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
134 const char *digest, int digestlen, u8 algo);
135int integrity_modsig_verify(unsigned int id, const struct modsig *modsig);
136
137int __init integrity_init_keyring(const unsigned int id);
138int __init integrity_load_x509(const unsigned int id, const char *path);
139int __init integrity_load_cert(const unsigned int id, const char *source,
140 const void *data, size_t len, key_perm_t perm);
141#else
142
143static inline int integrity_digsig_verify(const unsigned int id,
144 const char *sig, int siglen,
145 const char *digest, int digestlen,
146 u8 algo)
147{
148 return -EOPNOTSUPP;
149}
150
151static inline int integrity_modsig_verify(unsigned int id,
152 const struct modsig *modsig)
153{
154 return -EOPNOTSUPP;
155}
156
157static inline int integrity_init_keyring(const unsigned int id)
158{
159 return 0;
160}
161
162static inline int __init integrity_load_cert(const unsigned int id,
163 const char *source,
164 const void *data, size_t len,
165 key_perm_t perm)
166{
167 return 0;
168}
169#endif /* CONFIG_INTEGRITY_SIGNATURE */
170
171#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
172int asymmetric_verify(struct key *keyring, const char *sig,
173 int siglen, const char *data, int datalen);
174int asymmetric_verify_v3(struct key *keyring, const char *sig,
175 int siglen, const char *data, int datalen, u8 algo);
176#else
177static inline int asymmetric_verify(struct key *keyring, const char *sig,
178 int siglen, const char *data, int datalen)
179{
180 return -EOPNOTSUPP;
181}
182
183static inline int asymmetric_verify_v3(struct key *keyring,
184 const char *sig, int siglen,
185 const char *data, int datalen, u8 algo)
186{
187 return -EOPNOTSUPP;
188}
189#endif
190
191#ifdef CONFIG_IMA_APPRAISE_MODSIG
192int ima_modsig_verify(struct key *keyring, const struct modsig *modsig);
193#else
194static inline int ima_modsig_verify(struct key *keyring,
195 const struct modsig *modsig)
196{
197 return -EOPNOTSUPP;
198}
199#endif
200
201#ifdef CONFIG_IMA_LOAD_X509
202void __init ima_load_x509(void);
203#else
204static inline void ima_load_x509(void)
205{
206}
207#endif
208
209#ifdef CONFIG_EVM_LOAD_X509
210void __init evm_load_x509(void);
211#else
212static inline void evm_load_x509(void)
213{
214}
215#endif
216
217#ifdef CONFIG_INTEGRITY_AUDIT
218/* declarations */
219void integrity_audit_msg(int audit_msgno, struct inode *inode,
220 const unsigned char *fname, const char *op,
221 const char *cause, int result, int info);
222
223void integrity_audit_message(int audit_msgno, struct inode *inode,
224 const unsigned char *fname, const char *op,
225 const char *cause, int result, int info,
226 int errno);
227
228static inline struct audit_buffer *
229integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
230{
231 return audit_log_start(ctx, gfp_mask, type);
232}
233
234#else
235static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
236 const unsigned char *fname,
237 const char *op, const char *cause,
238 int result, int info)
239{
240}
241
242static inline void integrity_audit_message(int audit_msgno,
243 struct inode *inode,
244 const unsigned char *fname,
245 const char *op, const char *cause,
246 int result, int info, int errno)
247{
248}
249
250static inline struct audit_buffer *
251integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
252{
253 return NULL;
254}
255
256#endif
257
258#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
259void __init add_to_platform_keyring(const char *source, const void *data,
260 size_t len);
261#else
262static inline void __init add_to_platform_keyring(const char *source,
263 const void *data, size_t len)
264{
265}
266#endif
267
268#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
269void __init add_to_machine_keyring(const char *source, const void *data, size_t len);
270bool __init imputed_trust_enabled(void);
271#else
272static inline void __init add_to_machine_keyring(const char *source,
273 const void *data, size_t len)
274{
275}
276
277static inline bool __init imputed_trust_enabled(void)
278{
279 return false;
280}
281#endif