Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
Pull integrity updates from Mimi Zohar:
"There are two main changes, one feature removal, some code cleanup,
and a number of bug fixes.
Main changes:
- Detecting secure boot mode was limited to IMA. Make detecting
secure boot mode accessible to EVM and other LSMs
- IMA sigv3 support was limited to fsverity. Add IMA sigv3 support
for IMA regular file hashes and EVM portable signatures
Remove:
- Remove IMA support for asychronous hash calculation originally
added for hardware acceleration
Cleanup:
- Remove unnecessary Kconfig CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG
tests
- Add descriptions of the IMA atomic flags
Bug fixes:
- Like IMA, properly limit EVM "fix" mode
- Define and call evm_fix_hmac() to update security.evm
- Fallback to using i_version to detect file change for filesystems
that do not support STATX_CHANGE_COOKIE
- Address missing kernel support for configured (new) TPM hash
algorithms
- Add missing crypto_shash_final() return value"
* tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
evm: Enforce signatures version 3 with new EVM policy 'bit 3'
integrity: Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG
ima: add support to require IMA sigv3 signatures
ima: add regular file data hash signature version 3 support
ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures
ima: remove buggy support for asynchronous hashes
integrity: Eliminate weak definition of arch_get_secureboot()
ima: Add code comments to explain IMA iint cache atomic_flags
ima_fs: Correctly create securityfs files for unsupported hash algos
ima: check return value of crypto_shash_final() in boot aggregate
ima: Define and use a digest_size field in the ima_algo_desc structure
powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG
ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG
ima: fallback to using i_version to detect file change
evm: fix security.evm for a file with IMA signature
s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
evm: Don't enable fix mode when secure boot is enabled
integrity: Make arch_ima_get_secureboot integrity-wide
+400
-588
+1
Documentation/ABI/testing/evm
+1
Documentation/ABI/testing/evm
···
26
26
2 Permit modification of EVM-protected metadata at
27
27
runtime. Not supported if HMAC validation and
28
28
creation is enabled (deprecated).
29
+
3 Require asymmetric signatures to be version 3
29
30
31 Disable further runtime modification of EVM policy
30
31
=== ==================================================
31
32
+6
-4
Documentation/ABI/testing/ima_policy
+6
-4
Documentation/ABI/testing/ima_policy
···
53
53
where 'imasig' is the original or the signature
54
54
format v2.
55
55
where 'modsig' is an appended signature,
56
-
where 'sigv3' is the signature format v3. (Currently
57
-
limited to fsverity digest based signatures
58
-
stored in security.ima xattr. Requires
59
-
specifying "digest_type=verity" first.)
56
+
where 'sigv3' is the signature format v3.
60
57
61
58
appraise_flag:= [check_blacklist] (deprecated)
62
59
Setting the check_blacklist flag is no longer necessary.
···
182
185
183
186
appraise func=BPRM_CHECK digest_type=verity \
184
187
appraise_type=sigv3
188
+
189
+
Example of a regular IMA file hash 'appraise' rule requiring
190
+
signature version 3 format stored in security.ima xattr.
191
+
192
+
appraise func=BPRM_CHECK appraise_type=sigv3
185
193
186
194
All of these policy rules could, for example, be constrained
187
195
either based on a filesystem's UUID (fsuuid) or based on LSM
-17
Documentation/admin-guide/kernel-parameters.txt
-17
Documentation/admin-guide/kernel-parameters.txt
···
2410
2410
[IMA] Define a custom template format.
2411
2411
Format: { "field1|...|fieldN" }
2412
2412
2413
-
ima.ahash_minsize= [IMA] Minimum file size for asynchronous hash usage
2414
-
Format: <min_file_size>
2415
-
Set the minimal file size for using asynchronous hash.
2416
-
If left unspecified, ahash usage is disabled.
2417
-
2418
-
ahash performance varies for different data sizes on
2419
-
different crypto accelerators. This option can be used
2420
-
to achieve the best performance for a particular HW.
2421
-
2422
-
ima.ahash_bufsize= [IMA] Asynchronous hash buffer size
2423
-
Format: <bufsize>
2424
-
Set hashing buffer size. Default: 4k.
2425
-
2426
-
ahash performance varies for different chunk sizes on
2427
-
different crypto accelerators. This option can be used
2428
-
to achieve best performance for particular HW.
2429
-
2430
2413
ima= [IMA] Enable or disable IMA
2431
2414
Format: { "off" | "on" }
2432
2415
Default: "on"
+1
MAINTAINERS
+1
MAINTAINERS
+3
arch/Kconfig
+3
arch/Kconfig
+1
arch/powerpc/Kconfig
+1
arch/powerpc/Kconfig
···
1058
1058
depends on IMA_ARCH_POLICY
1059
1059
imply IMA_SECURE_AND_OR_TRUSTED_BOOT
1060
1060
select PSERIES_PLPKS if PPC_PSERIES
1061
+
select HAVE_ARCH_GET_SECUREBOOT
1061
1062
help
1062
1063
Systems with firmware secure boot enabled need to define security
1063
1064
policies to extend secure boot to the OS. This config allows a user
+1
-7
arch/powerpc/kernel/ima_arch.c
+1
-7
arch/powerpc/kernel/ima_arch.c
···
7
7
#include <linux/ima.h>
8
8
#include <asm/secure_boot.h>
9
9
10
-
bool arch_ima_get_secureboot(void)
11
-
{
12
-
return is_ppc_secureboot_enabled();
13
-
}
14
-
15
10
/*
16
11
* The "secure_rules" are enabled only on "secureboot" enabled systems.
17
12
* These rules verify the file signatures against known good values.
···
58
63
const char *const *arch_get_ima_policy(void)
59
64
{
60
65
if (is_ppc_secureboot_enabled()) {
61
-
if (IS_ENABLED(CONFIG_MODULE_SIG))
62
-
set_module_sig_enforced();
66
+
set_module_sig_enforced();
63
67
64
68
if (is_ppc_trustedboot_enabled())
65
69
return secure_and_trusted_rules;
+6
arch/powerpc/kernel/secure_boot.c
+6
arch/powerpc/kernel/secure_boot.c
···
5
5
*/
6
6
#include <linux/types.h>
7
7
#include <linux/of.h>
8
+
#include <linux/secure_boot.h>
8
9
#include <linux/string_choices.h>
9
10
#include <asm/secure_boot.h>
10
11
···
43
42
pr_info("Secure boot mode %s\n", str_enabled_disabled(enabled));
44
43
45
44
return enabled;
45
+
}
46
+
47
+
bool arch_get_secureboot(void)
48
+
{
49
+
return is_ppc_secureboot_enabled();
46
50
}
47
51
48
52
bool is_ppc_trustedboot_enabled(void)
+1
-1
arch/s390/Kconfig
+1
-1
arch/s390/Kconfig
···
80
80
#
81
81
# Note: keep this list sorted alphabetically
82
82
#
83
-
imply IMA_SECURE_AND_OR_TRUSTED_BOOT
84
83
select ALTERNATE_USER_ADDRESS_SPACE
85
84
select ARCH_32BIT_USTAT_F_TINODE
86
85
select ARCH_CORRECT_STACKTRACE_ON_KRETPROBE
···
180
181
select GENERIC_IOREMAP if PCI
181
182
select HAVE_ALIGNED_STRUCT_PAGE
182
183
select HAVE_ARCH_AUDITSYSCALL
184
+
select HAVE_ARCH_GET_SECUREBOOT
183
185
select HAVE_ARCH_JUMP_LABEL
184
186
select HAVE_ARCH_JUMP_LABEL_RELATIVE
185
187
select HAVE_ARCH_KASAN
-1
arch/s390/kernel/Makefile
-1
arch/s390/kernel/Makefile
···
71
71
obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o
72
72
obj-$(CONFIG_KEXEC_FILE) += kexec_elf.o
73
73
obj-$(CONFIG_CERT_STORE) += cert_store.o
74
-
obj-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT) += ima_arch.o
75
74
76
75
obj-$(CONFIG_PERF_EVENTS) += perf_event.o
77
76
obj-$(CONFIG_PERF_EVENTS) += perf_cpum_cf.o perf_cpum_sf.o
-14
arch/s390/kernel/ima_arch.c
-14
arch/s390/kernel/ima_arch.c
+6
arch/s390/kernel/ipl.c
+6
arch/s390/kernel/ipl.c
···
21
21
#include <linux/crash_dump.h>
22
22
#include <linux/debug_locks.h>
23
23
#include <linux/vmalloc.h>
24
+
#include <linux/secure_boot.h>
24
25
#include <asm/asm-extable.h>
25
26
#include <asm/machine.h>
26
27
#include <asm/diag.h>
···
2386
2385
/* Disable lowcore protection */
2387
2386
local_ctl_clear_bit(0, CR0_LOW_ADDRESS_PROTECTION_BIT);
2388
2387
diag_amode31_ops.diag308_reset();
2388
+
}
2389
+
2390
+
bool arch_get_secureboot(void)
2391
+
{
2392
+
return ipl_secure_flag;
2389
2393
}
2390
2394
2391
2395
#ifdef CONFIG_KEXEC_FILE
+2
-2
arch/x86/include/asm/efi.h
+2
-2
arch/x86/include/asm/efi.h
···
401
401
extern void __init efi_memmap_insert(struct efi_memory_map *old_memmap,
402
402
void *buf, struct efi_mem_range *mem);
403
403
404
-
extern enum efi_secureboot_mode __x86_ima_efi_boot_mode(void);
404
+
enum efi_secureboot_mode __x86_efi_boot_mode(void);
405
405
406
-
#define arch_ima_efi_boot_mode __x86_ima_efi_boot_mode()
406
+
#define arch_efi_boot_mode __x86_efi_boot_mode()
407
407
408
408
#ifdef CONFIG_EFI_RUNTIME_MAP
409
409
int efi_get_runtime_map_size(void);
+1
-1
arch/x86/platform/efi/efi.c
+1
-1
arch/x86/platform/efi/efi.c
+8
include/linux/evm.h
+8
include/linux/evm.h
···
18
18
const char *xattr_name,
19
19
void *xattr_value,
20
20
size_t xattr_value_len);
21
+
int evm_fix_hmac(struct dentry *dentry, const char *xattr_name,
22
+
const char *xattr_value, size_t xattr_value_len);
21
23
int evm_inode_init_security(struct inode *inode, struct inode *dir,
22
24
const struct qstr *qstr, struct xattr *xattrs,
23
25
int *xattr_count);
···
52
50
size_t xattr_value_len)
53
51
{
54
52
return INTEGRITY_UNKNOWN;
53
+
}
54
+
55
+
static inline int evm_fix_hmac(struct dentry *dentry, const char *xattr_name,
56
+
const char *xattr_value, size_t xattr_value_len)
57
+
{
58
+
return -EOPNOTSUPP;
55
59
}
56
60
#endif
57
61
+1
-6
include/linux/ima.h
+1
-6
include/linux/ima.h
···
11
11
#include <linux/fs.h>
12
12
#include <linux/security.h>
13
13
#include <linux/kexec.h>
14
+
#include <linux/secure_boot.h>
14
15
#include <crypto/hash_info.h>
15
16
struct linux_binprm;
16
17
···
74
73
#endif
75
74
76
75
#ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
77
-
extern bool arch_ima_get_secureboot(void);
78
76
extern const char * const *arch_get_ima_policy(void);
79
77
#else
80
-
static inline bool arch_ima_get_secureboot(void)
81
-
{
82
-
return false;
83
-
}
84
-
85
78
static inline const char * const *arch_get_ima_policy(void)
86
79
{
87
80
return NULL;
+23
include/linux/secure_boot.h
+23
include/linux/secure_boot.h
···
1
+
/* SPDX-License-Identifier: GPL-2.0-only */
2
+
/*
3
+
* Copyright (C) 2026 Red Hat, Inc. All Rights Reserved.
4
+
*
5
+
* Author: Coiby Xu <coxu@redhat.com>
6
+
*/
7
+
8
+
#ifndef _LINUX_SECURE_BOOT_H
9
+
#define _LINUX_SECURE_BOOT_H
10
+
11
+
#include <linux/types.h>
12
+
13
+
#ifdef CONFIG_HAVE_ARCH_GET_SECUREBOOT
14
+
/*
15
+
* Returns true if the platform secure boot is enabled.
16
+
* Returns false if disabled or not supported.
17
+
*/
18
+
bool arch_get_secureboot(void);
19
+
#else
20
+
static inline bool arch_get_secureboot(void) { return false; }
21
+
#endif
22
+
23
+
#endif /* _LINUX_SECURE_BOOT_H */
+1
security/integrity/Makefile
+1
security/integrity/Makefile
···
18
18
integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \
19
19
platform_certs/load_powerpc.o \
20
20
platform_certs/keyring_handler.o
21
+
integrity-$(CONFIG_EFI) += efi_secureboot.o
21
22
# The relative order of the 'ima' and 'evm' LSMs depends on the order below.
22
23
obj-$(CONFIG_IMA) += ima/
23
24
obj-$(CONFIG_EVM) += evm/
+5
-3
security/integrity/digsig.c
+5
-3
security/integrity/digsig.c
···
59
59
}
60
60
61
61
int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
62
-
const char *digest, int digestlen)
62
+
const char *digest, int digestlen, u8 algo)
63
63
{
64
64
struct key *keyring;
65
65
···
76
76
return digsig_verify(keyring, sig + 1, siglen - 1, digest,
77
77
digestlen);
78
78
case 2: /* regular file data hash based signature */
79
-
case 3: /* struct ima_file_id data based signature */
80
79
return asymmetric_verify(keyring, sig, siglen, digest,
81
-
digestlen);
80
+
digestlen);
81
+
case 3: /* struct ima_file_id data based signature */
82
+
return asymmetric_verify_v3(keyring, sig, siglen, digest,
83
+
digestlen, algo);
82
84
}
83
85
84
86
return -EOPNOTSUPP;
+59
security/integrity/digsig_asymmetric.c
+59
security/integrity/digsig_asymmetric.c
···
131
131
pr_debug("%s() = %d\n", __func__, ret);
132
132
return ret;
133
133
}
134
+
135
+
/*
136
+
* calc_file_id_hash - calculate the hash of the ima_file_id struct data
137
+
* @type: xattr type [enum evm_ima_xattr_type]
138
+
* @algo: hash algorithm [enum hash_algo]
139
+
* @digest: pointer to the digest to be hashed
140
+
* @hash: (out) pointer to the hash
141
+
*
142
+
* IMA signature version 3 disambiguates the data that is signed by
143
+
* indirectly signing the hash of the ima_file_id structure data.
144
+
*
145
+
* Return 0 on success, error code otherwise.
146
+
*/
147
+
static int calc_file_id_hash(enum evm_ima_xattr_type type,
148
+
enum hash_algo algo, const u8 *digest,
149
+
struct ima_max_digest_data *hash)
150
+
{
151
+
struct ima_file_id file_id = {.hash_type = type, .hash_algorithm = algo};
152
+
size_t digest_size = hash_digest_size[algo];
153
+
struct crypto_shash *tfm;
154
+
size_t file_id_size;
155
+
int rc;
156
+
157
+
if (type != IMA_VERITY_DIGSIG && type != EVM_IMA_XATTR_DIGSIG &&
158
+
type != EVM_XATTR_PORTABLE_DIGSIG)
159
+
return -EINVAL;
160
+
161
+
tfm = crypto_alloc_shash(hash_algo_name[algo], 0, 0);
162
+
if (IS_ERR(tfm))
163
+
return PTR_ERR(tfm);
164
+
165
+
memcpy(file_id.hash, digest, digest_size);
166
+
167
+
/* Calculate the ima_file_id struct hash on the portion used. */
168
+
file_id_size = sizeof(file_id) - (HASH_MAX_DIGESTSIZE - digest_size);
169
+
170
+
hash->hdr.algo = algo;
171
+
hash->hdr.length = digest_size;
172
+
rc = crypto_shash_tfm_digest(tfm, (const u8 *)&file_id, file_id_size,
173
+
hash->digest);
174
+
175
+
crypto_free_shash(tfm);
176
+
return rc;
177
+
}
178
+
179
+
int asymmetric_verify_v3(struct key *keyring, const char *sig, int siglen,
180
+
const char *data, int datalen, u8 algo)
181
+
{
182
+
struct signature_v2_hdr *hdr = (struct signature_v2_hdr *)sig;
183
+
struct ima_max_digest_data hash;
184
+
int rc;
185
+
186
+
rc = calc_file_id_hash(hdr->type, algo, data, &hash);
187
+
if (rc)
188
+
return -EINVAL;
189
+
190
+
return asymmetric_verify(keyring, sig, siglen, hash.digest,
191
+
hash.hdr.length);
192
+
}
+56
security/integrity/efi_secureboot.c
+56
security/integrity/efi_secureboot.c
···
1
+
// SPDX-License-Identifier: GPL-1.0+
2
+
/*
3
+
* Copyright (C) 2018 IBM Corporation
4
+
*/
5
+
#include <linux/efi.h>
6
+
#include <linux/secure_boot.h>
7
+
#include <asm/efi.h>
8
+
9
+
#ifndef arch_efi_boot_mode
10
+
#define arch_efi_boot_mode efi_secureboot_mode_unset
11
+
#endif
12
+
13
+
static enum efi_secureboot_mode get_sb_mode(void)
14
+
{
15
+
enum efi_secureboot_mode mode;
16
+
17
+
if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {
18
+
pr_info("integrity: secureboot mode unknown, no efi\n");
19
+
return efi_secureboot_mode_unknown;
20
+
}
21
+
22
+
mode = efi_get_secureboot_mode(efi.get_variable);
23
+
if (mode == efi_secureboot_mode_disabled)
24
+
pr_info("integrity: secureboot mode disabled\n");
25
+
else if (mode == efi_secureboot_mode_unknown)
26
+
pr_info("integrity: secureboot mode unknown\n");
27
+
else
28
+
pr_info("integrity: secureboot mode enabled\n");
29
+
return mode;
30
+
}
31
+
32
+
/*
33
+
* Query secure boot status
34
+
*
35
+
* Note don't call this function too early e.g. in __setup hook otherwise the
36
+
* kernel may hang when calling efi_get_secureboot_mode.
37
+
*
38
+
*/
39
+
bool arch_get_secureboot(void)
40
+
{
41
+
static enum efi_secureboot_mode sb_mode;
42
+
static bool initialized;
43
+
44
+
if (!initialized && efi_enabled(EFI_BOOT)) {
45
+
sb_mode = arch_efi_boot_mode;
46
+
47
+
if (sb_mode == efi_secureboot_mode_unset)
48
+
sb_mode = get_sb_mode();
49
+
initialized = true;
50
+
}
51
+
52
+
if (sb_mode == efi_secureboot_mode_enabled)
53
+
return true;
54
+
else
55
+
return false;
56
+
}
+2
-1
security/integrity/evm/evm.h
+2
-1
security/integrity/evm/evm.h
···
20
20
#define EVM_INIT_HMAC 0x0001
21
21
#define EVM_INIT_X509 0x0002
22
22
#define EVM_ALLOW_METADATA_WRITES 0x0004
23
+
#define EVM_SIGV3_REQUIRED 0x0008
23
24
#define EVM_SETUP_COMPLETE 0x80000000 /* userland has signaled key load */
24
25
25
26
#define EVM_KEY_MASK (EVM_INIT_HMAC | EVM_INIT_X509)
26
27
#define EVM_INIT_MASK (EVM_INIT_HMAC | EVM_INIT_X509 | EVM_SETUP_COMPLETE | \
27
-
EVM_ALLOW_METADATA_WRITES)
28
+
EVM_ALLOW_METADATA_WRITES | EVM_SIGV3_REQUIRED)
28
29
29
30
struct xattr_list {
30
31
struct list_head list;
+63
-10
security/integrity/evm/evm_main.c
+63
-10
security/integrity/evm/evm_main.c
···
72
72
73
73
LIST_HEAD(evm_config_xattrnames);
74
74
75
-
static int evm_fixmode __ro_after_init;
76
-
static int __init evm_set_fixmode(char *str)
77
-
{
78
-
if (strncmp(str, "fix", 3) == 0)
79
-
evm_fixmode = 1;
80
-
else
81
-
pr_err("invalid \"%s\" mode", str);
75
+
static char *evm_cmdline __initdata;
76
+
core_param(evm, evm_cmdline, charp, 0);
82
77
83
-
return 1;
78
+
static int evm_fixmode __ro_after_init;
79
+
static void __init evm_set_fixmode(void)
80
+
{
81
+
if (!evm_cmdline)
82
+
return;
83
+
84
+
if (strncmp(evm_cmdline, "fix", 3) == 0) {
85
+
if (arch_get_secureboot()) {
86
+
pr_info("Secure boot enabled: ignoring evm=fix");
87
+
return;
88
+
}
89
+
evm_fixmode = 1;
90
+
} else {
91
+
pr_err("invalid \"%s\" mode", evm_cmdline);
92
+
}
84
93
}
85
-
__setup("evm=", evm_set_fixmode);
86
94
87
95
static void __init evm_init_config(void)
88
96
{
···
134
126
return false;
135
127
136
128
return true;
129
+
}
130
+
131
+
static bool evm_sigv3_required(void)
132
+
{
133
+
if (evm_initialized & EVM_SIGV3_REQUIRED)
134
+
return true;
135
+
136
+
return false;
137
137
}
138
138
139
139
static int evm_find_protected_xattrs(struct dentry *dentry)
···
266
250
}
267
251
268
252
hdr = (struct signature_v2_hdr *)xattr_data;
253
+
254
+
if (evm_sigv3_required() && hdr->version != 3) {
255
+
evm_status = INTEGRITY_FAIL;
256
+
goto out;
257
+
}
258
+
269
259
digest.hdr.algo = hdr->hash_algo;
270
260
rc = evm_calc_hash(dentry, xattr_name, xattr_value,
271
261
xattr_value_len, xattr_data->type, &digest,
···
280
258
break;
281
259
rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM,
282
260
(const char *)xattr_data, xattr_len,
283
-
digest.digest, digest.hdr.length);
261
+
digest.digest, digest.hdr.length,
262
+
digest.hdr.algo);
284
263
if (!rc) {
285
264
if (xattr_data->type == EVM_XATTR_PORTABLE_DIGSIG) {
286
265
if (iint)
···
811
788
}
812
789
813
790
/**
791
+
* evm_fix_hmac - Calculate the HMAC and add it to security.evm for fix mode
792
+
* @dentry: pointer to the affected dentry which doesn't yet have security.evm
793
+
* xattr
794
+
* @xattr_name: pointer to the affected extended attribute name
795
+
* @xattr_value: pointer to the new extended attribute value
796
+
* @xattr_value_len: pointer to the new extended attribute value length
797
+
*
798
+
* Expects to be called with i_mutex locked.
799
+
*
800
+
* Return: 0 on success, -EPERM/-ENOMEM/-EOPNOTSUPP on failure
801
+
*/
802
+
int evm_fix_hmac(struct dentry *dentry, const char *xattr_name,
803
+
const char *xattr_value, size_t xattr_value_len)
804
+
805
+
{
806
+
if (!evm_fixmode || !evm_revalidate_status((xattr_name)))
807
+
return -EPERM;
808
+
809
+
if (!(evm_initialized & EVM_INIT_HMAC))
810
+
return -EPERM;
811
+
812
+
if (is_unsupported_hmac_fs(dentry))
813
+
return -EOPNOTSUPP;
814
+
815
+
return evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
816
+
}
817
+
818
+
/**
814
819
* evm_inode_post_setxattr - update 'security.evm' to reflect the changes
815
820
* @dentry: pointer to the affected dentry
816
821
* @xattr_name: pointer to the affected extended attribute name
···
1169
1118
struct list_head *pos, *q;
1170
1119
1171
1120
evm_init_config();
1121
+
1122
+
evm_set_fixmode();
1172
1123
1173
1124
error = integrity_init_keyring(INTEGRITY_KEYRING_EVM);
1174
1125
if (error)
+28
-1
security/integrity/ima/ima.h
+28
-1
security/integrity/ima/ima.h
···
53
53
struct ima_algo_desc {
54
54
struct crypto_shash *tfm;
55
55
enum hash_algo algo;
56
+
unsigned int digest_size;
56
57
};
57
58
58
59
/* set during initialization */
···
145
144
#define IMA_DIGSIG_REQUIRED 0x01000000
146
145
#define IMA_PERMIT_DIRECTIO 0x02000000
147
146
#define IMA_NEW_FILE 0x04000000
147
+
#define IMA_SIGV3_REQUIRED 0x08000000
148
148
#define IMA_FAIL_UNVERIFIABLE_SIGS 0x10000000
149
149
#define IMA_MODSIG_ALLOWED 0x20000000
150
150
#define IMA_CHECK_BLACKLIST 0x40000000
···
178
176
IMA_BPRM_APPRAISED | IMA_READ_APPRAISED | \
179
177
IMA_CREDS_APPRAISED)
180
178
181
-
/* IMA iint cache atomic_flags */
179
+
/*
180
+
* IMA iint cache atomic_flags
181
+
*
182
+
* IMA_CHANGE_ATTR - indicates that chATTR() was called (chmod, chown, chgrp)
183
+
* and file attributes have changed. On file open, it causes IMA to clear
184
+
* iint->flags to re-evaluate policy and perform IMA functions again.
185
+
*
186
+
* IMA_CHANGE_XATTR - indicates that setxattr or removexattr was called and
187
+
* extended attributes have changed. On file open, it causes IMA to clear
188
+
* iint->flags IMA_DONE_MASK to re-appraise.
189
+
*
190
+
* IMA_UPDATE_XATTR - indicates that security.ima needs to be updated. It is
191
+
* cleared if file policy changes and no update is needed.
192
+
*
193
+
* IMA_DIGSIG - indicates that file security.ima has signature and file
194
+
* security.ima must not update on file close.
195
+
*
196
+
* IMA_MAY_EMIT_TOMTOU - indicates to add Time-of-Measure-Time-of-Use (ToMToU)
197
+
* integrity violation (a file that is already opened for read is opened for
198
+
* write) to the measurement list and to also emit an audit message.
199
+
*
200
+
* IMA_EMITTED_OPENWRITERS - indicates to add open-writers integrity violation
201
+
* (a file that is already opened for write is opened for read) to the
202
+
* measurement list and to also emit an audit message.
203
+
*
204
+
*/
182
205
#define IMA_CHANGE_XATTR 0
183
206
#define IMA_UPDATE_XATTR 1
184
207
#define IMA_CHANGE_ATTR 2
+9
-4
security/integrity/ima/ima_api.c
+9
-4
security/integrity/ima/ima_api.c
···
269
269
goto out;
270
270
271
271
/*
272
-
* Detecting file change is based on i_version. On filesystems
273
-
* which do not support i_version, support was originally limited
274
-
* to an initial measurement/appraisal/audit, but was modified to
275
-
* assume the file changed.
272
+
* Detect file change based on STATX_CHANGE_COOKIE, when supported,
273
+
* and fallback to detecting file change based on i_version.
274
+
*
275
+
* On filesystems which did not support i_version, support was
276
+
* originally limited to an initial measurement/appraisal/audit,
277
+
* but was later modified to assume the file changed.
276
278
*/
277
279
result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE,
278
280
AT_STATX_SYNC_AS_STAT);
279
281
if (!result && (stat.result_mask & STATX_CHANGE_COOKIE))
280
282
i_version = stat.change_cookie;
283
+
else if (IS_I_VERSION(real_inode))
284
+
i_version = inode_peek_iversion(real_inode);
285
+
281
286
hash.hdr.algo = algo;
282
287
hash.hdr.length = hash_digest_size[algo];
283
288
+27
-52
security/integrity/ima/ima_appraise.c
+27
-52
security/integrity/ima/ima_appraise.c
···
27
27
void __init ima_appraise_parse_cmdline(void)
28
28
{
29
29
const char *str = ima_appraise_cmdline_default;
30
-
bool sb_state = arch_ima_get_secureboot();
30
+
bool sb_state = arch_get_secureboot();
31
31
int appraisal_state = ima_appraise;
32
32
33
33
if (!str)
···
235
235
}
236
236
237
237
/*
238
-
* calc_file_id_hash - calculate the hash of the ima_file_id struct data
239
-
* @type: xattr type [enum evm_ima_xattr_type]
240
-
* @algo: hash algorithm [enum hash_algo]
241
-
* @digest: pointer to the digest to be hashed
242
-
* @hash: (out) pointer to the hash
243
-
*
244
-
* IMA signature version 3 disambiguates the data that is signed by
245
-
* indirectly signing the hash of the ima_file_id structure data.
246
-
*
247
-
* Signing the ima_file_id struct is currently only supported for
248
-
* IMA_VERITY_DIGSIG type xattrs.
249
-
*
250
-
* Return 0 on success, error code otherwise.
251
-
*/
252
-
static int calc_file_id_hash(enum evm_ima_xattr_type type,
253
-
enum hash_algo algo, const u8 *digest,
254
-
struct ima_digest_data *hash)
255
-
{
256
-
struct ima_file_id file_id = {
257
-
.hash_type = IMA_VERITY_DIGSIG, .hash_algorithm = algo};
258
-
unsigned int unused = HASH_MAX_DIGESTSIZE - hash_digest_size[algo];
259
-
260
-
if (type != IMA_VERITY_DIGSIG)
261
-
return -EINVAL;
262
-
263
-
memcpy(file_id.hash, digest, hash_digest_size[algo]);
264
-
265
-
hash->algo = algo;
266
-
hash->length = hash_digest_size[algo];
267
-
268
-
return ima_calc_buffer_hash(&file_id, sizeof(file_id) - unused, hash);
269
-
}
270
-
271
-
/*
272
238
* xattr_verify - verify xattr digest or signature
273
239
*
274
240
* Verify whether the hash or signature matches the file contents.
···
245
279
struct evm_ima_xattr_data *xattr_value, int xattr_len,
246
280
enum integrity_status *status, const char **cause)
247
281
{
248
-
struct ima_max_digest_data hash;
249
282
struct signature_v2_hdr *sig;
250
283
int rc = -EINVAL, hash_start = 0;
251
284
int mask;
···
297
332
}
298
333
299
334
sig = (typeof(sig))xattr_value;
300
-
if (sig->version >= 3) {
335
+
if (sig->version > 3) {
301
336
*cause = "invalid-signature-version";
302
337
*status = INTEGRITY_FAIL;
303
338
break;
304
339
}
340
+
341
+
if ((iint->flags & IMA_SIGV3_REQUIRED) && sig->version != 3) {
342
+
*cause = "IMA-sigv3-required";
343
+
*status = INTEGRITY_FAIL;
344
+
break;
345
+
}
346
+
305
347
rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
306
348
(const char *)xattr_value,
307
349
xattr_len,
308
350
iint->ima_hash->digest,
309
-
iint->ima_hash->length);
351
+
iint->ima_hash->length,
352
+
iint->ima_hash->algo);
310
353
if (rc == -EOPNOTSUPP) {
311
354
*status = INTEGRITY_UNKNOWN;
312
355
break;
···
325
352
(const char *)xattr_value,
326
353
xattr_len,
327
354
iint->ima_hash->digest,
328
-
iint->ima_hash->length);
355
+
iint->ima_hash->length,
356
+
iint->ima_hash->algo);
357
+
329
358
if (rc) {
330
359
*cause = "invalid-signature";
331
360
*status = INTEGRITY_FAIL;
···
353
378
break;
354
379
}
355
380
356
-
rc = calc_file_id_hash(IMA_VERITY_DIGSIG, iint->ima_hash->algo,
357
-
iint->ima_hash->digest,
358
-
container_of(&hash.hdr,
359
-
struct ima_digest_data, hdr));
360
-
if (rc) {
361
-
*cause = "sigv3-hashing-error";
362
-
*status = INTEGRITY_FAIL;
363
-
break;
364
-
}
365
-
366
381
rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
367
382
(const char *)xattr_value,
368
-
xattr_len, hash.digest,
369
-
hash.hdr.length);
370
-
if (rc) {
383
+
xattr_len,
384
+
iint->ima_hash->digest,
385
+
iint->ima_hash->length,
386
+
iint->ima_hash->algo);
387
+
if (rc == -EOPNOTSUPP) {
388
+
*status = INTEGRITY_UNKNOWN;
389
+
break;
390
+
} else if (rc) {
371
391
*cause = "invalid-verity-signature";
372
392
*status = INTEGRITY_FAIL;
373
393
} else {
···
560
590
(!xattr_value ||
561
591
xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
562
592
if (!ima_fix_xattr(dentry, iint))
593
+
status = INTEGRITY_PASS;
594
+
} else if (status == INTEGRITY_NOLABEL) {
595
+
if (!evm_fix_hmac(dentry, XATTR_NAME_IMA,
596
+
(const char *)xattr_value,
597
+
xattr_len))
563
598
status = INTEGRITY_PASS;
564
599
}
565
600
+16
-374
security/integrity/ima/ima_crypto.c
+16
-374
security/integrity/ima/ima_crypto.c
···
11
11
*/
12
12
13
13
#include <linux/kernel.h>
14
-
#include <linux/moduleparam.h>
15
-
#include <linux/ratelimit.h>
16
14
#include <linux/file.h>
17
15
#include <linux/crypto.h>
18
-
#include <linux/scatterlist.h>
19
16
#include <linux/err.h>
20
17
#include <linux/slab.h>
21
18
#include <crypto/hash.h>
22
19
23
20
#include "ima.h"
24
21
25
-
/* minimum file size for ahash use */
26
-
static unsigned long ima_ahash_minsize;
27
-
module_param_named(ahash_minsize, ima_ahash_minsize, ulong, 0644);
28
-
MODULE_PARM_DESC(ahash_minsize, "Minimum file size for ahash use");
29
-
30
-
/* default is 0 - 1 page. */
31
-
static int ima_maxorder;
32
-
static unsigned int ima_bufsize = PAGE_SIZE;
33
-
34
-
static int param_set_bufsize(const char *val, const struct kernel_param *kp)
35
-
{
36
-
unsigned long long size;
37
-
int order;
38
-
39
-
size = memparse(val, NULL);
40
-
order = get_order(size);
41
-
if (order > MAX_PAGE_ORDER)
42
-
return -EINVAL;
43
-
ima_maxorder = order;
44
-
ima_bufsize = PAGE_SIZE << order;
45
-
return 0;
46
-
}
47
-
48
-
static const struct kernel_param_ops param_ops_bufsize = {
49
-
.set = param_set_bufsize,
50
-
.get = param_get_uint,
51
-
};
52
-
#define param_check_bufsize(name, p) __param_check(name, p, unsigned int)
53
-
54
-
module_param_named(ahash_bufsize, ima_bufsize, bufsize, 0644);
55
-
MODULE_PARM_DESC(ahash_bufsize, "Maximum ahash buffer size");
56
-
57
22
static struct crypto_shash *ima_shash_tfm;
58
-
static struct crypto_ahash *ima_ahash_tfm;
59
23
60
24
int ima_sha1_idx __ro_after_init;
61
25
int ima_hash_algo_idx __ro_after_init;
···
73
109
74
110
int __init ima_init_crypto(void)
75
111
{
112
+
unsigned int digest_size;
76
113
enum hash_algo algo;
77
114
long rc;
78
115
int i;
···
112
147
113
148
for (i = 0; i < NR_BANKS(ima_tpm_chip); i++) {
114
149
algo = ima_tpm_chip->allocated_banks[i].crypto_id;
150
+
digest_size = ima_tpm_chip->allocated_banks[i].digest_size;
115
151
ima_algo_array[i].algo = algo;
152
+
ima_algo_array[i].digest_size = digest_size;
116
153
117
154
/* unknown TPM algorithm */
118
155
if (algo == HASH_ALGO__LAST)
···
150
183
}
151
184
152
185
ima_algo_array[ima_sha1_idx].algo = HASH_ALGO_SHA1;
186
+
ima_algo_array[ima_sha1_idx].digest_size = SHA1_DIGEST_SIZE;
153
187
}
154
188
155
189
if (ima_hash_algo_idx >= NR_BANKS(ima_tpm_chip) &&
156
190
ima_hash_algo_idx != ima_sha1_idx) {
191
+
digest_size = hash_digest_size[ima_hash_algo];
157
192
ima_algo_array[ima_hash_algo_idx].tfm = ima_shash_tfm;
158
193
ima_algo_array[ima_hash_algo_idx].algo = ima_hash_algo;
194
+
ima_algo_array[ima_hash_algo_idx].digest_size = digest_size;
159
195
}
160
196
161
197
return 0;
···
188
218
return;
189
219
190
220
crypto_free_shash(tfm);
191
-
}
192
-
193
-
/**
194
-
* ima_alloc_pages() - Allocate contiguous pages.
195
-
* @max_size: Maximum amount of memory to allocate.
196
-
* @allocated_size: Returned size of actual allocation.
197
-
* @last_warn: Should the min_size allocation warn or not.
198
-
*
199
-
* Tries to do opportunistic allocation for memory first trying to allocate
200
-
* max_size amount of memory and then splitting that until zero order is
201
-
* reached. Allocation is tried without generating allocation warnings unless
202
-
* last_warn is set. Last_warn set affects only last allocation of zero order.
203
-
*
204
-
* By default, ima_maxorder is 0 and it is equivalent to kmalloc(GFP_KERNEL)
205
-
*
206
-
* Return pointer to allocated memory, or NULL on failure.
207
-
*/
208
-
static void *ima_alloc_pages(loff_t max_size, size_t *allocated_size,
209
-
int last_warn)
210
-
{
211
-
void *ptr;
212
-
int order = ima_maxorder;
213
-
gfp_t gfp_mask = __GFP_RECLAIM | __GFP_NOWARN | __GFP_NORETRY;
214
-
215
-
if (order)
216
-
order = min(get_order(max_size), order);
217
-
218
-
for (; order; order--) {
219
-
ptr = (void *)__get_free_pages(gfp_mask, order);
220
-
if (ptr) {
221
-
*allocated_size = PAGE_SIZE << order;
222
-
return ptr;
223
-
}
224
-
}
225
-
226
-
/* order is zero - one page */
227
-
228
-
gfp_mask = GFP_KERNEL;
229
-
230
-
if (!last_warn)
231
-
gfp_mask |= __GFP_NOWARN;
232
-
233
-
ptr = (void *)__get_free_pages(gfp_mask, 0);
234
-
if (ptr) {
235
-
*allocated_size = PAGE_SIZE;
236
-
return ptr;
237
-
}
238
-
239
-
*allocated_size = 0;
240
-
return NULL;
241
-
}
242
-
243
-
/**
244
-
* ima_free_pages() - Free pages allocated by ima_alloc_pages().
245
-
* @ptr: Pointer to allocated pages.
246
-
* @size: Size of allocated buffer.
247
-
*/
248
-
static void ima_free_pages(void *ptr, size_t size)
249
-
{
250
-
if (!ptr)
251
-
return;
252
-
free_pages((unsigned long)ptr, get_order(size));
253
-
}
254
-
255
-
static struct crypto_ahash *ima_alloc_atfm(enum hash_algo algo)
256
-
{
257
-
struct crypto_ahash *tfm = ima_ahash_tfm;
258
-
int rc;
259
-
260
-
if (algo < 0 || algo >= HASH_ALGO__LAST)
261
-
algo = ima_hash_algo;
262
-
263
-
if (algo != ima_hash_algo || !tfm) {
264
-
tfm = crypto_alloc_ahash(hash_algo_name[algo], 0, 0);
265
-
if (!IS_ERR(tfm)) {
266
-
if (algo == ima_hash_algo)
267
-
ima_ahash_tfm = tfm;
268
-
} else {
269
-
rc = PTR_ERR(tfm);
270
-
pr_err("Can not allocate %s (reason: %d)\n",
271
-
hash_algo_name[algo], rc);
272
-
}
273
-
}
274
-
return tfm;
275
-
}
276
-
277
-
static void ima_free_atfm(struct crypto_ahash *tfm)
278
-
{
279
-
if (tfm != ima_ahash_tfm)
280
-
crypto_free_ahash(tfm);
281
-
}
282
-
283
-
static inline int ahash_wait(int err, struct crypto_wait *wait)
284
-
{
285
-
286
-
err = crypto_wait_req(err, wait);
287
-
288
-
if (err)
289
-
pr_crit_ratelimited("ahash calculation failed: err: %d\n", err);
290
-
291
-
return err;
292
-
}
293
-
294
-
static int ima_calc_file_hash_atfm(struct file *file,
295
-
struct ima_digest_data *hash,
296
-
struct crypto_ahash *tfm)
297
-
{
298
-
loff_t i_size, offset;
299
-
char *rbuf[2] = { NULL, };
300
-
int rc, rbuf_len, active = 0, ahash_rc = 0;
301
-
struct ahash_request *req;
302
-
struct scatterlist sg[1];
303
-
struct crypto_wait wait;
304
-
size_t rbuf_size[2];
305
-
306
-
hash->length = crypto_ahash_digestsize(tfm);
307
-
308
-
req = ahash_request_alloc(tfm, GFP_KERNEL);
309
-
if (!req)
310
-
return -ENOMEM;
311
-
312
-
crypto_init_wait(&wait);
313
-
ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
314
-
CRYPTO_TFM_REQ_MAY_SLEEP,
315
-
crypto_req_done, &wait);
316
-
317
-
rc = ahash_wait(crypto_ahash_init(req), &wait);
318
-
if (rc)
319
-
goto out1;
320
-
321
-
i_size = i_size_read(file_inode(file));
322
-
323
-
if (i_size == 0)
324
-
goto out2;
325
-
326
-
/*
327
-
* Try to allocate maximum size of memory.
328
-
* Fail if even a single page cannot be allocated.
329
-
*/
330
-
rbuf[0] = ima_alloc_pages(i_size, &rbuf_size[0], 1);
331
-
if (!rbuf[0]) {
332
-
rc = -ENOMEM;
333
-
goto out1;
334
-
}
335
-
336
-
/* Only allocate one buffer if that is enough. */
337
-
if (i_size > rbuf_size[0]) {
338
-
/*
339
-
* Try to allocate secondary buffer. If that fails fallback to
340
-
* using single buffering. Use previous memory allocation size
341
-
* as baseline for possible allocation size.
342
-
*/
343
-
rbuf[1] = ima_alloc_pages(i_size - rbuf_size[0],
344
-
&rbuf_size[1], 0);
345
-
}
346
-
347
-
for (offset = 0; offset < i_size; offset += rbuf_len) {
348
-
if (!rbuf[1] && offset) {
349
-
/* Not using two buffers, and it is not the first
350
-
* read/request, wait for the completion of the
351
-
* previous ahash_update() request.
352
-
*/
353
-
rc = ahash_wait(ahash_rc, &wait);
354
-
if (rc)
355
-
goto out3;
356
-
}
357
-
/* read buffer */
358
-
rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
359
-
rc = integrity_kernel_read(file, offset, rbuf[active],
360
-
rbuf_len);
361
-
if (rc != rbuf_len) {
362
-
if (rc >= 0)
363
-
rc = -EINVAL;
364
-
/*
365
-
* Forward current rc, do not overwrite with return value
366
-
* from ahash_wait()
367
-
*/
368
-
ahash_wait(ahash_rc, &wait);
369
-
goto out3;
370
-
}
371
-
372
-
if (rbuf[1] && offset) {
373
-
/* Using two buffers, and it is not the first
374
-
* read/request, wait for the completion of the
375
-
* previous ahash_update() request.
376
-
*/
377
-
rc = ahash_wait(ahash_rc, &wait);
378
-
if (rc)
379
-
goto out3;
380
-
}
381
-
382
-
sg_init_one(&sg[0], rbuf[active], rbuf_len);
383
-
ahash_request_set_crypt(req, sg, NULL, rbuf_len);
384
-
385
-
ahash_rc = crypto_ahash_update(req);
386
-
387
-
if (rbuf[1])
388
-
active = !active; /* swap buffers, if we use two */
389
-
}
390
-
/* wait for the last update request to complete */
391
-
rc = ahash_wait(ahash_rc, &wait);
392
-
out3:
393
-
ima_free_pages(rbuf[0], rbuf_size[0]);
394
-
ima_free_pages(rbuf[1], rbuf_size[1]);
395
-
out2:
396
-
if (!rc) {
397
-
ahash_request_set_crypt(req, NULL, hash->digest, 0);
398
-
rc = ahash_wait(crypto_ahash_final(req), &wait);
399
-
}
400
-
out1:
401
-
ahash_request_free(req);
402
-
return rc;
403
-
}
404
-
405
-
static int ima_calc_file_ahash(struct file *file, struct ima_digest_data *hash)
406
-
{
407
-
struct crypto_ahash *tfm;
408
-
int rc;
409
-
410
-
tfm = ima_alloc_atfm(hash->algo);
411
-
if (IS_ERR(tfm))
412
-
return PTR_ERR(tfm);
413
-
414
-
rc = ima_calc_file_hash_atfm(file, hash, tfm);
415
-
416
-
ima_free_atfm(tfm);
417
-
418
-
return rc;
419
221
}
420
222
421
223
static int ima_calc_file_hash_tfm(struct file *file,
···
241
499
return rc;
242
500
}
243
501
244
-
static int ima_calc_file_shash(struct file *file, struct ima_digest_data *hash)
245
-
{
246
-
struct crypto_shash *tfm;
247
-
int rc;
248
-
249
-
tfm = ima_alloc_tfm(hash->algo);
250
-
if (IS_ERR(tfm))
251
-
return PTR_ERR(tfm);
252
-
253
-
rc = ima_calc_file_hash_tfm(file, hash, tfm);
254
-
255
-
ima_free_tfm(tfm);
256
-
257
-
return rc;
258
-
}
259
-
260
502
/*
261
503
* ima_calc_file_hash - calculate file hash
262
-
*
263
-
* Asynchronous hash (ahash) allows using HW acceleration for calculating
264
-
* a hash. ahash performance varies for different data sizes on different
265
-
* crypto accelerators. shash performance might be better for smaller files.
266
-
* The 'ima.ahash_minsize' module parameter allows specifying the best
267
-
* minimum file size for using ahash on the system.
268
-
*
269
-
* If the ima.ahash_minsize parameter is not specified, this function uses
270
-
* shash for the hash calculation. If ahash fails, it falls back to using
271
-
* shash.
272
504
*/
273
505
int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
274
506
{
275
-
loff_t i_size;
276
507
int rc;
277
508
struct file *f = file;
278
509
bool new_file_instance = false;
510
+
struct crypto_shash *tfm;
279
511
280
512
/*
281
513
* For consistency, fail file's opened with the O_DIRECT flag on
···
273
557
new_file_instance = true;
274
558
}
275
559
276
-
i_size = i_size_read(file_inode(f));
277
-
278
-
if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
279
-
rc = ima_calc_file_ahash(f, hash);
280
-
if (!rc)
281
-
goto out;
560
+
tfm = ima_alloc_tfm(hash->algo);
561
+
if (IS_ERR(tfm)) {
562
+
rc = PTR_ERR(tfm);
563
+
} else {
564
+
rc = ima_calc_file_hash_tfm(f, hash, tfm);
565
+
ima_free_tfm(tfm);
282
566
}
283
-
284
-
rc = ima_calc_file_shash(f, hash);
285
-
out:
286
567
if (new_file_instance)
287
568
fput(f);
288
569
return rc;
···
368
655
return rc;
369
656
}
370
657
371
-
static int calc_buffer_ahash_atfm(const void *buf, loff_t len,
372
-
struct ima_digest_data *hash,
373
-
struct crypto_ahash *tfm)
374
-
{
375
-
struct ahash_request *req;
376
-
struct scatterlist sg;
377
-
struct crypto_wait wait;
378
-
int rc, ahash_rc = 0;
379
-
380
-
hash->length = crypto_ahash_digestsize(tfm);
381
-
382
-
req = ahash_request_alloc(tfm, GFP_KERNEL);
383
-
if (!req)
384
-
return -ENOMEM;
385
-
386
-
crypto_init_wait(&wait);
387
-
ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
388
-
CRYPTO_TFM_REQ_MAY_SLEEP,
389
-
crypto_req_done, &wait);
390
-
391
-
rc = ahash_wait(crypto_ahash_init(req), &wait);
392
-
if (rc)
393
-
goto out;
394
-
395
-
sg_init_one(&sg, buf, len);
396
-
ahash_request_set_crypt(req, &sg, NULL, len);
397
-
398
-
ahash_rc = crypto_ahash_update(req);
399
-
400
-
/* wait for the update request to complete */
401
-
rc = ahash_wait(ahash_rc, &wait);
402
-
if (!rc) {
403
-
ahash_request_set_crypt(req, NULL, hash->digest, 0);
404
-
rc = ahash_wait(crypto_ahash_final(req), &wait);
405
-
}
406
-
out:
407
-
ahash_request_free(req);
408
-
return rc;
409
-
}
410
-
411
-
static int calc_buffer_ahash(const void *buf, loff_t len,
412
-
struct ima_digest_data *hash)
413
-
{
414
-
struct crypto_ahash *tfm;
415
-
int rc;
416
-
417
-
tfm = ima_alloc_atfm(hash->algo);
418
-
if (IS_ERR(tfm))
419
-
return PTR_ERR(tfm);
420
-
421
-
rc = calc_buffer_ahash_atfm(buf, len, hash, tfm);
422
-
423
-
ima_free_atfm(tfm);
424
-
425
-
return rc;
426
-
}
427
-
428
658
static int calc_buffer_shash_tfm(const void *buf, loff_t size,
429
659
struct ima_digest_data *hash,
430
660
struct crypto_shash *tfm)
···
398
742
return rc;
399
743
}
400
744
401
-
static int calc_buffer_shash(const void *buf, loff_t len,
402
-
struct ima_digest_data *hash)
745
+
int ima_calc_buffer_hash(const void *buf, loff_t len,
746
+
struct ima_digest_data *hash)
403
747
{
404
748
struct crypto_shash *tfm;
405
749
int rc;
···
412
756
413
757
ima_free_tfm(tfm);
414
758
return rc;
415
-
}
416
-
417
-
int ima_calc_buffer_hash(const void *buf, loff_t len,
418
-
struct ima_digest_data *hash)
419
-
{
420
-
int rc;
421
-
422
-
if (ima_ahash_minsize && len >= ima_ahash_minsize) {
423
-
rc = calc_buffer_ahash(buf, len, hash);
424
-
if (!rc)
425
-
return 0;
426
-
}
427
-
428
-
return calc_buffer_shash(buf, len, hash);
429
759
}
430
760
431
761
static void ima_pcrread(u32 idx, struct tpm_digest *d)
···
474
832
}
475
833
}
476
834
if (!rc)
477
-
crypto_shash_final(shash, digest);
835
+
rc = crypto_shash_final(shash, digest);
478
836
return rc;
479
837
}
480
838
+4
-49
security/integrity/ima/ima_efi.c
+4
-49
security/integrity/ima/ima_efi.c
···
2
2
/*
3
3
* Copyright (C) 2018 IBM Corporation
4
4
*/
5
-
#include <linux/efi.h>
6
5
#include <linux/module.h>
7
6
#include <linux/ima.h>
8
-
#include <asm/efi.h>
9
-
10
-
#ifndef arch_ima_efi_boot_mode
11
-
#define arch_ima_efi_boot_mode efi_secureboot_mode_unset
12
-
#endif
13
-
14
-
static enum efi_secureboot_mode get_sb_mode(void)
15
-
{
16
-
enum efi_secureboot_mode mode;
17
-
18
-
if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {
19
-
pr_info("ima: secureboot mode unknown, no efi\n");
20
-
return efi_secureboot_mode_unknown;
21
-
}
22
-
23
-
mode = efi_get_secureboot_mode(efi.get_variable);
24
-
if (mode == efi_secureboot_mode_disabled)
25
-
pr_info("ima: secureboot mode disabled\n");
26
-
else if (mode == efi_secureboot_mode_unknown)
27
-
pr_info("ima: secureboot mode unknown\n");
28
-
else
29
-
pr_info("ima: secureboot mode enabled\n");
30
-
return mode;
31
-
}
32
-
33
-
bool arch_ima_get_secureboot(void)
34
-
{
35
-
static enum efi_secureboot_mode sb_mode;
36
-
static bool initialized;
37
-
38
-
if (!initialized && efi_enabled(EFI_BOOT)) {
39
-
sb_mode = arch_ima_efi_boot_mode;
40
-
41
-
if (sb_mode == efi_secureboot_mode_unset)
42
-
sb_mode = get_sb_mode();
43
-
initialized = true;
44
-
}
45
-
46
-
if (sb_mode == efi_secureboot_mode_enabled)
47
-
return true;
48
-
else
49
-
return false;
50
-
}
7
+
#include <linux/secure_boot.h>
51
8
52
9
/* secureboot arch rules */
53
10
static const char * const sb_arch_rules[] = {
···
24
67
25
68
const char * const *arch_get_ima_policy(void)
26
69
{
27
-
if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
28
-
if (IS_ENABLED(CONFIG_MODULE_SIG))
29
-
set_module_sig_enforced();
30
-
if (IS_ENABLED(CONFIG_KEXEC_SIG))
31
-
set_kexec_sig_enforced();
70
+
if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_get_secureboot()) {
71
+
set_module_sig_enforced();
72
+
set_kexec_sig_enforced();
32
73
return sb_arch_rules;
33
74
}
34
75
return NULL;
+18
-16
security/integrity/ima/ima_fs.c
+18
-16
security/integrity/ima/ima_fs.c
···
132
132
char *template_name;
133
133
u32 pcr, namelen, template_data_len; /* temporary fields */
134
134
bool is_ima_template = false;
135
-
enum hash_algo algo;
136
135
int i, algo_idx;
137
136
138
137
algo_idx = ima_sha1_idx;
139
-
algo = HASH_ALGO_SHA1;
140
138
141
-
if (m->file != NULL) {
139
+
if (m->file != NULL)
142
140
algo_idx = (unsigned long)file_inode(m->file)->i_private;
143
-
algo = ima_algo_array[algo_idx].algo;
144
-
}
145
141
146
142
/* get entry */
147
143
e = qe->entry;
···
156
160
ima_putc(m, &pcr, sizeof(e->pcr));
157
161
158
162
/* 2nd: template digest */
159
-
ima_putc(m, e->digests[algo_idx].digest, hash_digest_size[algo]);
163
+
ima_putc(m, e->digests[algo_idx].digest,
164
+
ima_algo_array[algo_idx].digest_size);
160
165
161
166
/* 3rd: template name size */
162
167
namelen = !ima_canonical_fmt ? strlen(template_name) :
···
226
229
struct ima_queue_entry *qe = v;
227
230
struct ima_template_entry *e;
228
231
char *template_name;
229
-
enum hash_algo algo;
230
232
int i, algo_idx;
231
233
232
234
algo_idx = ima_sha1_idx;
233
-
algo = HASH_ALGO_SHA1;
234
235
235
-
if (m->file != NULL) {
236
+
if (m->file != NULL)
236
237
algo_idx = (unsigned long)file_inode(m->file)->i_private;
237
-
algo = ima_algo_array[algo_idx].algo;
238
-
}
239
238
240
239
/* get entry */
241
240
e = qe->entry;
···
245
252
seq_printf(m, "%2d ", e->pcr);
246
253
247
254
/* 2nd: template hash */
248
-
ima_print_digest(m, e->digests[algo_idx].digest, hash_digest_size[algo]);
255
+
ima_print_digest(m, e->digests[algo_idx].digest,
256
+
ima_algo_array[algo_idx].digest_size);
249
257
250
258
/* 3th: template name */
251
259
seq_printf(m, " %s", template_name);
···
398
404
char file_name[NAME_MAX + 1];
399
405
struct dentry *dentry;
400
406
401
-
sprintf(file_name, "ascii_runtime_measurements_%s",
402
-
hash_algo_name[algo]);
407
+
if (algo == HASH_ALGO__LAST)
408
+
sprintf(file_name, "ascii_runtime_measurements_tpm_alg_%x",
409
+
ima_tpm_chip->allocated_banks[i].alg_id);
410
+
else
411
+
sprintf(file_name, "ascii_runtime_measurements_%s",
412
+
hash_algo_name[algo]);
403
413
dentry = securityfs_create_file(file_name, S_IRUSR | S_IRGRP,
404
414
ima_dir, (void *)(uintptr_t)i,
405
415
&ima_ascii_measurements_ops);
406
416
if (IS_ERR(dentry))
407
417
return PTR_ERR(dentry);
408
418
409
-
sprintf(file_name, "binary_runtime_measurements_%s",
410
-
hash_algo_name[algo]);
419
+
if (algo == HASH_ALGO__LAST)
420
+
sprintf(file_name, "binary_runtime_measurements_tpm_alg_%x",
421
+
ima_tpm_chip->allocated_banks[i].alg_id);
422
+
else
423
+
sprintf(file_name, "binary_runtime_measurements_%s",
424
+
hash_algo_name[algo]);
411
425
dentry = securityfs_create_file(file_name, S_IRUSR | S_IRGRP,
412
426
ima_dir, (void *)(uintptr_t)i,
413
427
&ima_measurements_ops);
+27
-10
security/integrity/ima/ima_main.c
+27
-10
security/integrity/ima/ima_main.c
···
180
180
"invalid_pcr", "open_writers");
181
181
}
182
182
183
+
/*
184
+
* Detect file change based on STATX_CHANGE_COOKIE, when supported, and
185
+
* fallback to detecting file change based on i_version. On filesystems
186
+
* which do not support either, assume the file changed.
187
+
*/
188
+
static bool ima_detect_file_change(struct ima_iint_cache *iint,
189
+
struct inode *inode, struct file *file)
190
+
{
191
+
struct kstat stat;
192
+
int result;
193
+
194
+
result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE,
195
+
AT_STATX_SYNC_AS_STAT);
196
+
197
+
if (!result && stat.result_mask & STATX_CHANGE_COOKIE)
198
+
return stat.change_cookie != iint->real_inode.version;
199
+
200
+
if (IS_I_VERSION(inode))
201
+
return !inode_eq_iversion(inode, iint->real_inode.version);
202
+
203
+
return true;
204
+
}
205
+
183
206
static void ima_check_last_writer(struct ima_iint_cache *iint,
184
207
struct inode *inode, struct file *file)
185
208
{
···
214
191
215
192
mutex_lock(&iint->mutex);
216
193
if (atomic_read(&inode->i_writecount) == 1) {
217
-
struct kstat stat;
218
-
219
194
clear_bit(IMA_EMITTED_OPENWRITERS, &iint->atomic_flags);
220
195
221
196
update = test_and_clear_bit(IMA_UPDATE_XATTR,
222
197
&iint->atomic_flags);
223
-
if ((iint->flags & IMA_NEW_FILE) ||
224
-
vfs_getattr_nosec(&file->f_path, &stat,
225
-
STATX_CHANGE_COOKIE,
226
-
AT_STATX_SYNC_AS_STAT) ||
227
-
!(stat.result_mask & STATX_CHANGE_COOKIE) ||
228
-
stat.change_cookie != iint->real_inode.version) {
198
+
199
+
if (iint->flags & IMA_NEW_FILE ||
200
+
ima_detect_file_change(iint, inode, file)) {
229
201
iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
230
202
iint->measured_pcrs = 0;
231
203
if (update)
···
971
953
972
954
switch (id) {
973
955
case LOADING_KEXEC_IMAGE:
974
-
if (IS_ENABLED(CONFIG_KEXEC_SIG)
975
-
&& arch_ima_get_secureboot()) {
956
+
if (IS_ENABLED(CONFIG_KEXEC_SIG) && arch_get_secureboot()) {
976
957
pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
977
958
return -EACCES;
978
959
}
+10
-12
security/integrity/ima/ima_policy.c
+10
-12
security/integrity/ima/ima_policy.c
···
1298
1298
IMA_GID | IMA_EGID |
1299
1299
IMA_FGROUP | IMA_DIGSIG_REQUIRED |
1300
1300
IMA_PERMIT_DIRECTIO | IMA_VALIDATE_ALGOS |
1301
-
IMA_CHECK_BLACKLIST | IMA_VERITY_REQUIRED))
1301
+
IMA_CHECK_BLACKLIST | IMA_VERITY_REQUIRED |
1302
+
IMA_SIGV3_REQUIRED))
1302
1303
return false;
1303
1304
1304
1305
break;
···
1834
1833
break;
1835
1834
case Opt_digest_type:
1836
1835
ima_log_string(ab, "digest_type", args[0].from);
1837
-
if (entry->flags & IMA_DIGSIG_REQUIRED)
1838
-
result = -EINVAL;
1839
-
else if ((strcmp(args[0].from, "verity")) == 0)
1836
+
if ((strcmp(args[0].from, "verity")) == 0)
1840
1837
entry->flags |= IMA_VERITY_REQUIRED;
1841
1838
else
1842
1839
result = -EINVAL;
···
1848
1849
else
1849
1850
entry->flags |= IMA_DIGSIG_REQUIRED | IMA_CHECK_BLACKLIST;
1850
1851
} else if (strcmp(args[0].from, "sigv3") == 0) {
1851
-
/* Only fsverity supports sigv3 for now */
1852
-
if (entry->flags & IMA_VERITY_REQUIRED)
1853
-
entry->flags |= IMA_DIGSIG_REQUIRED | IMA_CHECK_BLACKLIST;
1854
-
else
1855
-
result = -EINVAL;
1852
+
entry->flags |= IMA_SIGV3_REQUIRED |
1853
+
IMA_DIGSIG_REQUIRED |
1854
+
IMA_CHECK_BLACKLIST;
1856
1855
} else if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) &&
1857
1856
strcmp(args[0].from, "imasig|modsig") == 0) {
1858
-
if (entry->flags & IMA_VERITY_REQUIRED)
1857
+
if ((entry->flags & IMA_VERITY_REQUIRED) ||
1858
+
(entry->flags & IMA_SIGV3_REQUIRED))
1859
1859
result = -EINVAL;
1860
1860
else
1861
1861
entry->flags |= IMA_DIGSIG_REQUIRED |
···
1939
1941
1940
1942
/* d-ngv2 template field recommended for unsigned fs-verity digests */
1941
1943
if (!result && entry->action == MEASURE &&
1942
-
entry->flags & IMA_VERITY_REQUIRED) {
1944
+
(entry->flags & IMA_VERITY_REQUIRED)) {
1943
1945
template_desc = entry->template ? entry->template :
1944
1946
ima_template_desc_current();
1945
1947
check_template_field(template_desc, "d-ngv2",
···
2307
2309
if (entry->template)
2308
2310
seq_printf(m, "template=%s ", entry->template->name);
2309
2311
if (entry->flags & IMA_DIGSIG_REQUIRED) {
2310
-
if (entry->flags & IMA_VERITY_REQUIRED)
2312
+
if (entry->flags & IMA_SIGV3_REQUIRED)
2311
2313
seq_puts(m, "appraise_type=sigv3 ");
2312
2314
else if (entry->flags & IMA_MODSIG_ALLOWED)
2313
2315
seq_puts(m, "appraise_type=imasig|modsig ");
+13
-2
security/integrity/integrity.h
+13
-2
security/integrity/integrity.h
···
14
14
15
15
#include <linux/types.h>
16
16
#include <linux/integrity.h>
17
+
#include <linux/secure_boot.h>
17
18
#include <crypto/sha1.h>
18
19
#include <crypto/hash.h>
19
20
#include <linux/key.h>
···
131
130
#ifdef CONFIG_INTEGRITY_SIGNATURE
132
131
133
132
int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
134
-
const char *digest, int digestlen);
133
+
const char *digest, int digestlen, u8 algo);
135
134
int integrity_modsig_verify(unsigned int id, const struct modsig *modsig);
136
135
137
136
int __init integrity_init_keyring(const unsigned int id);
···
142
141
143
142
static inline int integrity_digsig_verify(const unsigned int id,
144
143
const char *sig, int siglen,
145
-
const char *digest, int digestlen)
144
+
const char *digest, int digestlen,
145
+
u8 algo)
146
146
{
147
147
return -EOPNOTSUPP;
148
148
}
···
171
169
#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
172
170
int asymmetric_verify(struct key *keyring, const char *sig,
173
171
int siglen, const char *data, int datalen);
172
+
int asymmetric_verify_v3(struct key *keyring, const char *sig,
173
+
int siglen, const char *data, int datalen, u8 algo);
174
174
#else
175
175
static inline int asymmetric_verify(struct key *keyring, const char *sig,
176
176
int siglen, const char *data, int datalen)
177
+
{
178
+
return -EOPNOTSUPP;
179
+
}
180
+
181
+
static inline int asymmetric_verify_v3(struct key *keyring,
182
+
const char *sig, int siglen,
183
+
const char *data, int datalen, u8 algo)
177
184
{
178
185
return -EOPNOTSUPP;
179
186
}
+1
-1
security/integrity/platform_certs/load_uefi.c
+1
-1
security/integrity/platform_certs/load_uefi.c