1/* 2 * Copyright (C) 2013 Politecnico di Torino, Italy 3 * TORSEC group -- http://security.polito.it 4 * 5 * Author: Roberto Sassu <roberto.sassu@polito.it> 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License as 9 * published by the Free Software Foundation, version 2 of the 10 * License. 11 * 12 * File: ima_template_lib.c 13 * Library of supported template fields. 14 */ 15#include <crypto/hash_info.h> 16 17#include "ima_template_lib.h" 18 19static bool ima_template_hash_algo_allowed(u8 algo) 20{ 21 if (algo == HASH_ALGO_SHA1 || algo == HASH_ALGO_MD5) 22 return true; 23 24 return false; 25} 26 27enum data_formats { 28 DATA_FMT_DIGEST = 0, 29 DATA_FMT_DIGEST_WITH_ALGO, 30 DATA_FMT_STRING, 31 DATA_FMT_HEX 32}; 33 34static int ima_write_template_field_data(const void *data, const u32 datalen, 35 enum data_formats datafmt, 36 struct ima_field_data *field_data) 37{ 38 u8 *buf, *buf_ptr; 39 u32 buflen = datalen; 40 41 if (datafmt == DATA_FMT_STRING) 42 buflen = datalen + 1; 43 44 buf = kzalloc(buflen, GFP_KERNEL); 45 if (!buf) 46 return -ENOMEM; 47 48 memcpy(buf, data, datalen); 49 50 /* 51 * Replace all space characters with underscore for event names and 52 * strings. This avoid that, during the parsing of a measurements list, 53 * filenames with spaces or that end with the suffix ' (deleted)' are 54 * split into multiple template fields (the space is the delimitator 55 * character for measurements lists in ASCII format). 56 */ 57 if (datafmt == DATA_FMT_STRING) { 58 for (buf_ptr = buf; buf_ptr - buf < datalen; buf_ptr++) 59 if (*buf_ptr == ' ') 60 *buf_ptr = '_'; 61 } 62 63 field_data->data = buf; 64 field_data->len = buflen; 65 return 0; 66} 67 68static void ima_show_template_data_ascii(struct seq_file *m, 69 enum ima_show_type show, 70 enum data_formats datafmt, 71 struct ima_field_data *field_data) 72{ 73 u8 *buf_ptr = field_data->data; 74 u32 buflen = field_data->len; 75 76 switch (datafmt) { 77 case DATA_FMT_DIGEST_WITH_ALGO: 78 buf_ptr = strnchr(field_data->data, buflen, ':'); 79 if (buf_ptr != field_data->data) 80 seq_printf(m, "%s", field_data->data); 81 82 /* skip ':' and '\0' */ 83 buf_ptr += 2; 84 buflen -= buf_ptr - field_data->data; 85 case DATA_FMT_DIGEST: 86 case DATA_FMT_HEX: 87 if (!buflen) 88 break; 89 ima_print_digest(m, buf_ptr, buflen); 90 break; 91 case DATA_FMT_STRING: 92 seq_printf(m, "%s", buf_ptr); 93 break; 94 default: 95 break; 96 } 97} 98 99static void ima_show_template_data_binary(struct seq_file *m, 100 enum ima_show_type show, 101 enum data_formats datafmt, 102 struct ima_field_data *field_data) 103{ 104 u32 len = (show == IMA_SHOW_BINARY_OLD_STRING_FMT) ? 105 strlen(field_data->data) : field_data->len; 106 107 if (show != IMA_SHOW_BINARY_NO_FIELD_LEN) 108 ima_putc(m, &len, sizeof(len)); 109 110 if (!len) 111 return; 112 113 ima_putc(m, field_data->data, len); 114} 115 116static void ima_show_template_field_data(struct seq_file *m, 117 enum ima_show_type show, 118 enum data_formats datafmt, 119 struct ima_field_data *field_data) 120{ 121 switch (show) { 122 case IMA_SHOW_ASCII: 123 ima_show_template_data_ascii(m, show, datafmt, field_data); 124 break; 125 case IMA_SHOW_BINARY: 126 case IMA_SHOW_BINARY_NO_FIELD_LEN: 127 case IMA_SHOW_BINARY_OLD_STRING_FMT: 128 ima_show_template_data_binary(m, show, datafmt, field_data); 129 break; 130 default: 131 break; 132 } 133} 134 135void ima_show_template_digest(struct seq_file *m, enum ima_show_type show, 136 struct ima_field_data *field_data) 137{ 138 ima_show_template_field_data(m, show, DATA_FMT_DIGEST, field_data); 139} 140 141void ima_show_template_digest_ng(struct seq_file *m, enum ima_show_type show, 142 struct ima_field_data *field_data) 143{ 144 ima_show_template_field_data(m, show, DATA_FMT_DIGEST_WITH_ALGO, 145 field_data); 146} 147 148void ima_show_template_string(struct seq_file *m, enum ima_show_type show, 149 struct ima_field_data *field_data) 150{ 151 ima_show_template_field_data(m, show, DATA_FMT_STRING, field_data); 152} 153 154void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, 155 struct ima_field_data *field_data) 156{ 157 ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data); 158} 159 160static int ima_eventdigest_init_common(u8 *digest, u32 digestsize, u8 hash_algo, 161 struct ima_field_data *field_data) 162{ 163 /* 164 * digest formats: 165 * - DATA_FMT_DIGEST: digest 166 * - DATA_FMT_DIGEST_WITH_ALGO: [<hash algo>] + ':' + '\0' + digest, 167 * where <hash algo> is provided if the hash algoritm is not 168 * SHA1 or MD5 169 */ 170 u8 buffer[CRYPTO_MAX_ALG_NAME + 2 + IMA_MAX_DIGEST_SIZE] = { 0 }; 171 enum data_formats fmt = DATA_FMT_DIGEST; 172 u32 offset = 0; 173 174 if (hash_algo < HASH_ALGO__LAST) { 175 fmt = DATA_FMT_DIGEST_WITH_ALGO; 176 offset += snprintf(buffer, CRYPTO_MAX_ALG_NAME + 1, "%s", 177 hash_algo_name[hash_algo]); 178 buffer[offset] = ':'; 179 offset += 2; 180 } 181 182 if (digest) 183 memcpy(buffer + offset, digest, digestsize); 184 else 185 /* 186 * If digest is NULL, the event being recorded is a violation. 187 * Make room for the digest by increasing the offset of 188 * IMA_DIGEST_SIZE. 189 */ 190 offset += IMA_DIGEST_SIZE; 191 192 return ima_write_template_field_data(buffer, offset + digestsize, 193 fmt, field_data); 194} 195 196/* 197 * This function writes the digest of an event (with size limit). 198 */ 199int ima_eventdigest_init(struct integrity_iint_cache *iint, struct file *file, 200 const unsigned char *filename, 201 struct evm_ima_xattr_data *xattr_value, int xattr_len, 202 struct ima_field_data *field_data) 203{ 204 struct { 205 struct ima_digest_data hdr; 206 char digest[IMA_MAX_DIGEST_SIZE]; 207 } hash; 208 u8 *cur_digest = NULL; 209 u32 cur_digestsize = 0; 210 struct inode *inode; 211 int result; 212 213 memset(&hash, 0, sizeof(hash)); 214 215 if (!iint) /* recording a violation. */ 216 goto out; 217 218 if (ima_template_hash_algo_allowed(iint->ima_hash->algo)) { 219 cur_digest = iint->ima_hash->digest; 220 cur_digestsize = iint->ima_hash->length; 221 goto out; 222 } 223 224 if (!file) /* missing info to re-calculate the digest */ 225 return -EINVAL; 226 227 inode = file_inode(file); 228 hash.hdr.algo = ima_template_hash_algo_allowed(ima_hash_algo) ? 229 ima_hash_algo : HASH_ALGO_SHA1; 230 result = ima_calc_file_hash(file, &hash.hdr); 231 if (result) { 232 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, 233 filename, "collect_data", 234 "failed", result, 0); 235 return result; 236 } 237 cur_digest = hash.hdr.digest; 238 cur_digestsize = hash.hdr.length; 239out: 240 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 241 HASH_ALGO__LAST, field_data); 242} 243 244/* 245 * This function writes the digest of an event (without size limit). 246 */ 247int ima_eventdigest_ng_init(struct integrity_iint_cache *iint, 248 struct file *file, const unsigned char *filename, 249 struct evm_ima_xattr_data *xattr_value, 250 int xattr_len, struct ima_field_data *field_data) 251{ 252 u8 *cur_digest = NULL, hash_algo = HASH_ALGO_SHA1; 253 u32 cur_digestsize = 0; 254 255 /* If iint is NULL, we are recording a violation. */ 256 if (!iint) 257 goto out; 258 259 cur_digest = iint->ima_hash->digest; 260 cur_digestsize = iint->ima_hash->length; 261 262 hash_algo = iint->ima_hash->algo; 263out: 264 return ima_eventdigest_init_common(cur_digest, cur_digestsize, 265 hash_algo, field_data); 266} 267 268static int ima_eventname_init_common(struct integrity_iint_cache *iint, 269 struct file *file, 270 const unsigned char *filename, 271 struct ima_field_data *field_data, 272 bool size_limit) 273{ 274 const char *cur_filename = NULL; 275 u32 cur_filename_len = 0; 276 277 BUG_ON(filename == NULL && file == NULL); 278 279 if (filename) { 280 cur_filename = filename; 281 cur_filename_len = strlen(filename); 282 283 if (!size_limit || cur_filename_len <= IMA_EVENT_NAME_LEN_MAX) 284 goto out; 285 } 286 287 if (file) { 288 cur_filename = file->f_path.dentry->d_name.name; 289 cur_filename_len = strlen(cur_filename); 290 } else 291 /* 292 * Truncate filename if the latter is too long and 293 * the file descriptor is not available. 294 */ 295 cur_filename_len = IMA_EVENT_NAME_LEN_MAX; 296out: 297 return ima_write_template_field_data(cur_filename, cur_filename_len, 298 DATA_FMT_STRING, field_data); 299} 300 301/* 302 * This function writes the name of an event (with size limit). 303 */ 304int ima_eventname_init(struct integrity_iint_cache *iint, struct file *file, 305 const unsigned char *filename, 306 struct evm_ima_xattr_data *xattr_value, int xattr_len, 307 struct ima_field_data *field_data) 308{ 309 return ima_eventname_init_common(iint, file, filename, 310 field_data, true); 311} 312 313/* 314 * This function writes the name of an event (without size limit). 315 */ 316int ima_eventname_ng_init(struct integrity_iint_cache *iint, struct file *file, 317 const unsigned char *filename, 318 struct evm_ima_xattr_data *xattr_value, int xattr_len, 319 struct ima_field_data *field_data) 320{ 321 return ima_eventname_init_common(iint, file, filename, 322 field_data, false); 323} 324 325/* 326 * ima_eventsig_init - include the file signature as part of the template data 327 */ 328int ima_eventsig_init(struct integrity_iint_cache *iint, struct file *file, 329 const unsigned char *filename, 330 struct evm_ima_xattr_data *xattr_value, int xattr_len, 331 struct ima_field_data *field_data) 332{ 333 enum data_formats fmt = DATA_FMT_HEX; 334 int rc = 0; 335 336 if ((!xattr_value) || (xattr_value->type != EVM_IMA_XATTR_DIGSIG)) 337 goto out; 338 339 rc = ima_write_template_field_data(xattr_value, xattr_len, fmt, 340 field_data); 341out: 342 return rc; 343} 344