projects/linux·blob master · refs

354 lines · 9.1 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
4 */
5
6#include <linux/fs.h>
7#include <linux/fs_struct.h>
8#include <linux/types.h>
9#include <linux/binfmts.h>
10#include <linux/mman.h>
11#include <linux/blk_types.h>
12#include <linux/rcupdate.h>
13
14#include "ipe.h"
15#include "hooks.h"
16#include "eval.h"
17#include "digest.h"
18
19/**
20 * ipe_bprm_check_security() - ipe security hook function for bprm check.
21 * @bprm: Supplies a pointer to a linux_binprm structure to source the file
22 * being evaluated.
23 *
24 * This LSM hook is called when a binary is loaded through the exec
25 * family of system calls.
26 *
27 * Return:
28 * * %0 - Success
29 * * %-EACCES - Did not pass IPE policy
30 */
31int ipe_bprm_check_security(struct linux_binprm *bprm)
32{
33 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
34
35 ipe_build_eval_ctx(&ctx, bprm->file, IPE_OP_EXEC, IPE_HOOK_BPRM_CHECK);
36 return ipe_evaluate_event(&ctx);
37}
38
39/**
40 * ipe_bprm_creds_for_exec() - ipe security hook function for bprm creds check.
41 * @bprm: Supplies a pointer to a linux_binprm structure to source the file
42 * being evaluated.
43 *
44 * This LSM hook is called when userspace signals the kernel to check a file
45 * for execution through the execveat syscall with the AT_EXECVE_CHECK flag.
46 * The hook triggers IPE policy evaluation on the script file and returns
47 * the policy decision to userspace. The userspace program receives the
48 * return code and can decide whether to proceed with script execution.
49 *
50 * Return:
51 * * %0 - Success
52 * * %-EACCES - Did not pass IPE policy
53 */
54int ipe_bprm_creds_for_exec(struct linux_binprm *bprm)
55{
56 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
57
58 if (!bprm->is_check)
59 return 0;
60
61 ipe_build_eval_ctx(&ctx, bprm->file, IPE_OP_EXEC,
62 IPE_HOOK_BPRM_CREDS_FOR_EXEC);
63 return ipe_evaluate_event(&ctx);
64}
65
66/**
67 * ipe_mmap_file() - ipe security hook function for mmap check.
68 * @f: File being mmap'd. Can be NULL in the case of anonymous memory.
69 * @reqprot: The requested protection on the mmap, passed from usermode.
70 * @prot: The effective protection on the mmap, resolved from reqprot and
71 * system configuration.
72 * @flags: Unused.
73 *
74 * This hook is called when a file is loaded through the mmap
75 * family of system calls.
76 *
77 * Return:
78 * * %0 - Success
79 * * %-EACCES - Did not pass IPE policy
80 */
81int ipe_mmap_file(struct file *f, unsigned long reqprot __always_unused,
82 unsigned long prot, unsigned long flags)
83{
84 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
85
86 if (prot & PROT_EXEC) {
87 ipe_build_eval_ctx(&ctx, f, IPE_OP_EXEC, IPE_HOOK_MMAP);
88 return ipe_evaluate_event(&ctx);
89 }
90
91 return 0;
92}
93
94/**
95 * ipe_file_mprotect() - ipe security hook function for mprotect check.
96 * @vma: Existing virtual memory area created by mmap or similar.
97 * @reqprot: The requested protection on the mmap, passed from usermode.
98 * @prot: The effective protection on the mmap, resolved from reqprot and
99 * system configuration.
100 *
101 * This LSM hook is called when a mmap'd region of memory is changing
102 * its protections via mprotect.
103 *
104 * Return:
105 * * %0 - Success
106 * * %-EACCES - Did not pass IPE policy
107 */
108int ipe_file_mprotect(struct vm_area_struct *vma,
109 unsigned long reqprot __always_unused,
110 unsigned long prot)
111{
112 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
113
114 /* Already Executable */
115 if (vma->vm_flags & VM_EXEC)
116 return 0;
117
118 if (prot & PROT_EXEC) {
119 ipe_build_eval_ctx(&ctx, vma->vm_file, IPE_OP_EXEC, IPE_HOOK_MPROTECT);
120 return ipe_evaluate_event(&ctx);
121 }
122
123 return 0;
124}
125
126/**
127 * ipe_kernel_read_file() - ipe security hook function for kernel read.
128 * @file: Supplies a pointer to the file structure being read in from disk.
129 * @id: Supplies the enumeration identifying the purpose of the read.
130 * @contents: Unused.
131 *
132 * This LSM hook is called when a file is read from disk in the kernel.
133 *
134 * Return:
135 * * %0 - Success
136 * * %-EACCES - Did not pass IPE policy
137 */
138int ipe_kernel_read_file(struct file *file, enum kernel_read_file_id id,
139 bool contents)
140{
141 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
142 enum ipe_op_type op;
143
144 switch (id) {
145 case READING_FIRMWARE:
146 op = IPE_OP_FIRMWARE;
147 break;
148 case READING_MODULE:
149 case READING_MODULE_COMPRESSED:
150 op = IPE_OP_KERNEL_MODULE;
151 break;
152 case READING_KEXEC_INITRAMFS:
153 op = IPE_OP_KEXEC_INITRAMFS;
154 break;
155 case READING_KEXEC_IMAGE:
156 op = IPE_OP_KEXEC_IMAGE;
157 break;
158 case READING_POLICY:
159 op = IPE_OP_POLICY;
160 break;
161 case READING_X509_CERTIFICATE:
162 op = IPE_OP_X509;
163 break;
164 default:
165 op = IPE_OP_INVALID;
166 WARN(1, "no rule setup for kernel_read_file enum %d", id);
167 }
168
169 ipe_build_eval_ctx(&ctx, file, op, IPE_HOOK_KERNEL_READ);
170 return ipe_evaluate_event(&ctx);
171}
172
173/**
174 * ipe_kernel_load_data() - ipe security hook function for kernel load data.
175 * @id: Supplies the enumeration identifying the purpose of the load.
176 * @contents: Unused.
177 *
178 * This LSM hook is called when a data buffer provided by userspace is loading
179 * into the kernel.
180 *
181 * Return:
182 * * %0 - Success
183 * * %-EACCES - Did not pass IPE policy
184 */
185int ipe_kernel_load_data(enum kernel_load_data_id id, bool contents)
186{
187 struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
188 enum ipe_op_type op;
189
190 switch (id) {
191 case LOADING_FIRMWARE:
192 op = IPE_OP_FIRMWARE;
193 break;
194 case LOADING_MODULE:
195 op = IPE_OP_KERNEL_MODULE;
196 break;
197 case LOADING_KEXEC_INITRAMFS:
198 op = IPE_OP_KEXEC_INITRAMFS;
199 break;
200 case LOADING_KEXEC_IMAGE:
201 op = IPE_OP_KEXEC_IMAGE;
202 break;
203 case LOADING_POLICY:
204 op = IPE_OP_POLICY;
205 break;
206 case LOADING_X509_CERTIFICATE:
207 op = IPE_OP_X509;
208 break;
209 default:
210 op = IPE_OP_INVALID;
211 WARN(1, "no rule setup for kernel_load_data enum %d", id);
212 }
213
214 ipe_build_eval_ctx(&ctx, NULL, op, IPE_HOOK_KERNEL_LOAD);
215 return ipe_evaluate_event(&ctx);
216}
217
218/**
219 * ipe_unpack_initramfs() - Mark the current rootfs as initramfs.
220 */
221void ipe_unpack_initramfs(void)
222{
223 ipe_sb(current->fs->root.mnt->mnt_sb)->initramfs = true;
224}
225
226#ifdef CONFIG_IPE_PROP_DM_VERITY
227/**
228 * ipe_bdev_free_security() - Free IPE's LSM blob of block_devices.
229 * @bdev: Supplies a pointer to a block_device that contains the structure
230 * to free.
231 */
232void ipe_bdev_free_security(struct block_device *bdev)
233{
234 struct ipe_bdev *blob = ipe_bdev(bdev);
235
236 ipe_digest_free(rcu_access_pointer(blob->root_hash));
237}
238
239static void ipe_set_dmverity_roothash(struct ipe_bdev *blob,
240 struct digest_info *info)
241{
242 struct digest_info *old;
243
244 /* Protected by device-mapper's md->suspend_lock */
245 old = rcu_replace_pointer(blob->root_hash, info, true);
246 if (old) {
247 synchronize_rcu();
248 ipe_digest_free(old);
249 }
250}
251
252#ifdef CONFIG_IPE_PROP_DM_VERITY_SIGNATURE
253static void ipe_set_dmverity_signature(struct ipe_bdev *blob,
254 const void *value,
255 size_t size)
256{
257 blob->dm_verity_signed = size > 0 && value;
258}
259#else
260static inline void ipe_set_dmverity_signature(struct ipe_bdev *blob,
261 const void *value,
262 size_t size)
263{
264}
265#endif /* CONFIG_IPE_PROP_DM_VERITY_SIGNATURE */
266
267/**
268 * ipe_bdev_setintegrity() - Save integrity data from a bdev to IPE's LSM blob.
269 * @bdev: Supplies a pointer to a block_device that contains the LSM blob.
270 * @type: Supplies the integrity type.
271 * @value: Supplies the value to store.
272 * @size: The size of @value.
273 *
274 * This hook is currently used to save dm-verity's root hash or the existence
275 * of a validated signed dm-verity root hash into LSM blob.
276 *
277 * Return: %0 on success. If an error occurs, the function will return the
278 * -errno.
279 */
280int ipe_bdev_setintegrity(struct block_device *bdev, enum lsm_integrity_type type,
281 const void *value, size_t size)
282{
283 const struct dm_verity_digest *digest = NULL;
284 struct ipe_bdev *blob = ipe_bdev(bdev);
285 struct digest_info *info = NULL;
286
287 if (type == LSM_INT_DMVERITY_SIG_VALID) {
288 ipe_set_dmverity_signature(blob, value, size);
289
290 return 0;
291 }
292
293 if (type != LSM_INT_DMVERITY_ROOTHASH)
294 return -EINVAL;
295
296 if (!value) {
297 ipe_set_dmverity_roothash(blob, NULL);
298
299 return 0;
300 }
301 digest = value;
302
303 info = kzalloc_obj(*info);
304 if (!info)
305 return -ENOMEM;
306
307 info->digest = kmemdup(digest->digest, digest->digest_len, GFP_KERNEL);
308 if (!info->digest)
309 goto err;
310
311 info->alg = kstrdup(digest->alg, GFP_KERNEL);
312 if (!info->alg)
313 goto err;
314
315 info->digest_len = digest->digest_len;
316
317 ipe_set_dmverity_roothash(blob, info);
318
319 return 0;
320err:
321 ipe_digest_free(info);
322
323 return -ENOMEM;
324}
325#endif /* CONFIG_IPE_PROP_DM_VERITY */
326
327#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
328/**
329 * ipe_inode_setintegrity() - save integrity data from a inode to IPE's LSM blob.
330 * @inode: The inode to source the security blob from.
331 * @type: Supplies the integrity type.
332 * @value: The value to be stored.
333 * @size: The size of @value.
334 *
335 * This hook is currently used to save the existence of a validated fs-verity
336 * builtin signature into LSM blob.
337 *
338 * Return: %0 on success. If an error occurs, the function will return the
339 * -errno.
340 */
341int ipe_inode_setintegrity(const struct inode *inode,
342 enum lsm_integrity_type type,
343 const void *value, size_t size)
344{
345 struct ipe_inode *inode_sec = ipe_inode(inode);
346
347 if (type == LSM_INT_FSVERITY_BUILTINSIG_VALID) {
348 inode_sec->fs_verity_signed = size > 0 && value;
349 return 0;
350 }
351
352 return -EINVAL;
353}
354#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */