projects/linux·blob v7.2 · refs

393 lines · 10.3 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
4 */
5
6#include <linux/fs.h>
7#include <linux/types.h>
8#include <linux/slab.h>
9#include <linux/file.h>
10#include <linux/sched.h>
11#include <linux/rcupdate.h>
12#include <linux/moduleparam.h>
13#include <linux/fsverity.h>
14
15#include "ipe.h"
16#include "eval.h"
17#include "policy.h"
18#include "audit.h"
19#include "digest.h"
20
21struct ipe_policy __rcu *ipe_active_policy;
22bool success_audit;
23bool enforce = true;
24#define INO_BLOCK_DEV(ino) ((ino)->i_sb->s_bdev)
25
26#define FILE_SUPERBLOCK(f) ((f)->f_path.mnt->mnt_sb)
27
28/**
29 * build_ipe_sb_ctx() - Build initramfs field of an ipe evaluation context.
30 * @ctx: Supplies a pointer to the context to be populated.
31 * @file: Supplies the file struct of the file triggered IPE event.
32 */
33static void build_ipe_sb_ctx(struct ipe_eval_ctx *ctx, const struct file *const file)
34{
35 ctx->initramfs = ipe_sb(FILE_SUPERBLOCK(file))->initramfs;
36}
37
38#ifdef CONFIG_IPE_PROP_DM_VERITY
39/**
40 * build_ipe_bdev_ctx() - Build ipe_bdev field of an evaluation context.
41 * @ctx: Supplies a pointer to the context to be populated.
42 * @ino: Supplies the inode struct of the file triggered IPE event.
43 */
44static void build_ipe_bdev_ctx(struct ipe_eval_ctx *ctx, const struct inode *const ino)
45{
46 if (INO_BLOCK_DEV(ino))
47 ctx->ipe_bdev = ipe_bdev(INO_BLOCK_DEV(ino));
48}
49#else
50static void build_ipe_bdev_ctx(struct ipe_eval_ctx *ctx, const struct inode *const ino)
51{
52}
53#endif /* CONFIG_IPE_PROP_DM_VERITY */
54
55#ifdef CONFIG_IPE_PROP_FS_VERITY
56#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
57static void build_ipe_inode_blob_ctx(struct ipe_eval_ctx *ctx,
58 const struct inode *const ino)
59{
60 ctx->ipe_inode = ipe_inode(ctx->ino);
61}
62#else
63static inline void build_ipe_inode_blob_ctx(struct ipe_eval_ctx *ctx,
64 const struct inode *const ino)
65{
66}
67#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
68
69/**
70 * build_ipe_inode_ctx() - Build inode fields of an evaluation context.
71 * @ctx: Supplies a pointer to the context to be populated.
72 * @ino: Supplies the inode struct of the file triggered IPE event.
73 */
74static void build_ipe_inode_ctx(struct ipe_eval_ctx *ctx, const struct inode *const ino)
75{
76 ctx->ino = ino;
77 build_ipe_inode_blob_ctx(ctx, ino);
78}
79#else
80static void build_ipe_inode_ctx(struct ipe_eval_ctx *ctx, const struct inode *const ino)
81{
82}
83#endif /* CONFIG_IPE_PROP_FS_VERITY */
84
85/**
86 * ipe_build_eval_ctx() - Build an ipe evaluation context.
87 * @ctx: Supplies a pointer to the context to be populated.
88 * @file: Supplies a pointer to the file to associated with the evaluation.
89 * @op: Supplies the IPE policy operation associated with the evaluation.
90 * @hook: Supplies the LSM hook associated with the evaluation.
91 */
92void ipe_build_eval_ctx(struct ipe_eval_ctx *ctx,
93 const struct file *file,
94 enum ipe_op_type op,
95 enum ipe_hook_type hook)
96{
97 struct inode *ino;
98
99 ctx->file = file;
100 ctx->op = op;
101 ctx->hook = hook;
102
103 if (file) {
104 build_ipe_sb_ctx(ctx, file);
105 ino = d_real_inode(file->f_path.dentry);
106 build_ipe_bdev_ctx(ctx, ino);
107 build_ipe_inode_ctx(ctx, ino);
108 }
109}
110
111/**
112 * evaluate_boot_verified() - Evaluate @ctx for the boot verified property.
113 * @ctx: Supplies a pointer to the context being evaluated.
114 *
115 * Return:
116 * * %true - The current @ctx match the @p
117 * * %false - The current @ctx doesn't match the @p
118 */
119static bool evaluate_boot_verified(const struct ipe_eval_ctx *const ctx)
120{
121 return ctx->initramfs;
122}
123
124#ifdef CONFIG_IPE_PROP_DM_VERITY
125/**
126 * evaluate_dmv_roothash() - Evaluate @ctx against a dmv roothash property.
127 * @ctx: Supplies a pointer to the context being evaluated.
128 * @p: Supplies a pointer to the property being evaluated.
129 *
130 * Return:
131 * * %true - The current @ctx match the @p
132 * * %false - The current @ctx doesn't match the @p
133 */
134static bool evaluate_dmv_roothash(const struct ipe_eval_ctx *const ctx,
135 struct ipe_prop *p)
136{
137 return !!ctx->ipe_bdev &&
138 !!ctx->ipe_bdev->root_hash &&
139 ipe_digest_eval(p->value,
140 ctx->ipe_bdev->root_hash);
141}
142#else
143static bool evaluate_dmv_roothash(const struct ipe_eval_ctx *const ctx,
144 struct ipe_prop *p)
145{
146 return false;
147}
148#endif /* CONFIG_IPE_PROP_DM_VERITY */
149
150#ifdef CONFIG_IPE_PROP_DM_VERITY_SIGNATURE
151/**
152 * evaluate_dmv_sig_false() - Evaluate @ctx against a dmv sig false property.
153 * @ctx: Supplies a pointer to the context being evaluated.
154 *
155 * Return:
156 * * %true - The current @ctx match the property
157 * * %false - The current @ctx doesn't match the property
158 */
159static bool evaluate_dmv_sig_false(const struct ipe_eval_ctx *const ctx)
160{
161 return !ctx->ipe_bdev || (!ctx->ipe_bdev->dm_verity_signed);
162}
163
164/**
165 * evaluate_dmv_sig_true() - Evaluate @ctx against a dmv sig true property.
166 * @ctx: Supplies a pointer to the context being evaluated.
167 *
168 * Return:
169 * * %true - The current @ctx match the property
170 * * %false - The current @ctx doesn't match the property
171 */
172static bool evaluate_dmv_sig_true(const struct ipe_eval_ctx *const ctx)
173{
174 return !evaluate_dmv_sig_false(ctx);
175}
176#else
177static bool evaluate_dmv_sig_false(const struct ipe_eval_ctx *const ctx)
178{
179 return false;
180}
181
182static bool evaluate_dmv_sig_true(const struct ipe_eval_ctx *const ctx)
183{
184 return false;
185}
186#endif /* CONFIG_IPE_PROP_DM_VERITY_SIGNATURE */
187
188#ifdef CONFIG_IPE_PROP_FS_VERITY
189/**
190 * evaluate_fsv_digest() - Evaluate @ctx against a fsv digest property.
191 * @ctx: Supplies a pointer to the context being evaluated.
192 * @p: Supplies a pointer to the property being evaluated.
193 *
194 * Return:
195 * * %true - The current @ctx match the @p
196 * * %false - The current @ctx doesn't match the @p
197 */
198static bool evaluate_fsv_digest(const struct ipe_eval_ctx *const ctx,
199 struct ipe_prop *p)
200{
201 enum hash_algo alg;
202 u8 digest[FS_VERITY_MAX_DIGEST_SIZE];
203 struct digest_info info;
204
205 if (!ctx->ino)
206 return false;
207 if (!fsverity_get_digest((struct inode *)ctx->ino,
208 digest,
209 NULL,
210 &alg))
211 return false;
212
213 info.alg = hash_algo_name[alg];
214 info.digest = digest;
215 info.digest_len = hash_digest_size[alg];
216
217 return ipe_digest_eval(p->value, &info);
218}
219#else
220static bool evaluate_fsv_digest(const struct ipe_eval_ctx *const ctx,
221 struct ipe_prop *p)
222{
223 return false;
224}
225#endif /* CONFIG_IPE_PROP_FS_VERITY */
226
227#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
228/**
229 * evaluate_fsv_sig_false() - Evaluate @ctx against a fsv sig false property.
230 * @ctx: Supplies a pointer to the context being evaluated.
231 *
232 * Return:
233 * * %true - The current @ctx match the property
234 * * %false - The current @ctx doesn't match the property
235 */
236static bool evaluate_fsv_sig_false(const struct ipe_eval_ctx *const ctx)
237{
238 return !ctx->ino ||
239 !IS_VERITY(ctx->ino) ||
240 !ctx->ipe_inode ||
241 !ctx->ipe_inode->fs_verity_signed;
242}
243
244/**
245 * evaluate_fsv_sig_true() - Evaluate @ctx against a fsv sig true property.
246 * @ctx: Supplies a pointer to the context being evaluated.
247 *
248 * Return:
249 * * %true - The current @ctx match the property
250 * * %false - The current @ctx doesn't match the property
251 */
252static bool evaluate_fsv_sig_true(const struct ipe_eval_ctx *const ctx)
253{
254 return !evaluate_fsv_sig_false(ctx);
255}
256#else
257static bool evaluate_fsv_sig_false(const struct ipe_eval_ctx *const ctx)
258{
259 return false;
260}
261
262static bool evaluate_fsv_sig_true(const struct ipe_eval_ctx *const ctx)
263{
264 return false;
265}
266#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
267
268/**
269 * evaluate_property() - Analyze @ctx against a rule property.
270 * @ctx: Supplies a pointer to the context to be evaluated.
271 * @p: Supplies a pointer to the property to be evaluated.
272 *
273 * This function Determines whether the specified @ctx
274 * matches the conditions defined by a rule property @p.
275 *
276 * Return:
277 * * %true - The current @ctx match the @p
278 * * %false - The current @ctx doesn't match the @p
279 */
280static bool evaluate_property(const struct ipe_eval_ctx *const ctx,
281 struct ipe_prop *p)
282{
283 switch (p->type) {
284 case IPE_PROP_BOOT_VERIFIED_FALSE:
285 return !evaluate_boot_verified(ctx);
286 case IPE_PROP_BOOT_VERIFIED_TRUE:
287 return evaluate_boot_verified(ctx);
288 case IPE_PROP_DMV_ROOTHASH:
289 return evaluate_dmv_roothash(ctx, p);
290 case IPE_PROP_DMV_SIG_FALSE:
291 return evaluate_dmv_sig_false(ctx);
292 case IPE_PROP_DMV_SIG_TRUE:
293 return evaluate_dmv_sig_true(ctx);
294 case IPE_PROP_FSV_DIGEST:
295 return evaluate_fsv_digest(ctx, p);
296 case IPE_PROP_FSV_SIG_FALSE:
297 return evaluate_fsv_sig_false(ctx);
298 case IPE_PROP_FSV_SIG_TRUE:
299 return evaluate_fsv_sig_true(ctx);
300 default:
301 return false;
302 }
303}
304
305/**
306 * ipe_evaluate_event() - Analyze @ctx against the current active policy.
307 * @ctx: Supplies a pointer to the context to be evaluated.
308 *
309 * This is the loop where all policy evaluations happen against the IPE policy.
310 *
311 * Return:
312 * * %0 - Success
313 * * %-EACCES - @ctx did not pass evaluation
314 */
315int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
316{
317 const struct ipe_op_table *rules = NULL;
318 const struct ipe_rule *rule = NULL;
319 struct ipe_policy *pol = NULL;
320 struct ipe_prop *prop = NULL;
321 enum ipe_action_type action;
322 enum ipe_match match_type;
323 bool match = false;
324 int rc = 0;
325
326 rcu_read_lock();
327
328 pol = rcu_dereference(ipe_active_policy);
329 if (!pol) {
330 rcu_read_unlock();
331 return 0;
332 }
333
334 if (ctx->op == IPE_OP_INVALID) {
335 if (pol->parsed->global_default_action == IPE_ACTION_INVALID) {
336 WARN(1, "no default rule set for unknown op, ALLOW it");
337 action = IPE_ACTION_ALLOW;
338 } else {
339 action = pol->parsed->global_default_action;
340 }
341 match_type = IPE_MATCH_GLOBAL;
342 goto eval;
343 }
344
345 rules = &pol->parsed->rules[ctx->op];
346
347 list_for_each_entry(rule, &rules->rules, next) {
348 match = true;
349
350 list_for_each_entry(prop, &rule->props, next) {
351 match = evaluate_property(ctx, prop);
352 if (!match)
353 break;
354 }
355
356 if (match)
357 break;
358 }
359
360 if (match) {
361 action = rule->action;
362 match_type = IPE_MATCH_RULE;
363 } else if (rules->default_action != IPE_ACTION_INVALID) {
364 action = rules->default_action;
365 match_type = IPE_MATCH_TABLE;
366 } else {
367 action = pol->parsed->global_default_action;
368 match_type = IPE_MATCH_GLOBAL;
369 }
370
371eval:
372 ipe_audit_match(ctx, match_type, action, rule);
373 rcu_read_unlock();
374
375 if (action == IPE_ACTION_DENY)
376 rc = -EACCES;
377
378 if (!READ_ONCE(enforce))
379 rc = 0;
380
381 return rc;
382}
383
384/* Set the right module name */
385#ifdef KBUILD_MODNAME
386#undef KBUILD_MODNAME
387#define KBUILD_MODNAME "ipe"
388#endif
389
390module_param(success_audit, bool, 0400);
391MODULE_PARM_DESC(success_audit, "Start IPE with success auditing enabled");
392module_param(enforce, bool, 0400);
393MODULE_PARM_DESC(enforce, "Start IPE in enforce or permissive mode");