1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2010 IBM Corporation
4 *
5 * Authors:
6 * Mimi Zohar <zohar@us.ibm.com>
7 *
8 * File: evm_secfs.c
9 * - Used to signal when key is on keyring
10 * - Get the key and enable EVM
11 */
12
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15 #include <linux/audit.h>
16 #include <linux/uaccess.h>
17 #include <linux/init.h>
18 #include <linux/mutex.h>
19 #include "evm.h"
20
21 static struct dentry *evm_dir;
22 static struct dentry *evm_init_tpm;
23 static struct dentry *evm_symlink;
24
25 #ifdef CONFIG_EVM_ADD_XATTRS
26 static struct dentry *evm_xattrs;
27 static DEFINE_MUTEX(xattr_list_mutex);
28 static int evm_xattrs_locked;
29 #endif
30
31 /**
32 * evm_read_key - read() for <securityfs>/evm
33 *
34 * @filp: file pointer, not actually used
35 * @buf: where to put the result
36 * @count: maximum to send along
37 * @ppos: where to start
38 *
39 * Returns number of bytes read or error code, as appropriate
40 */
evm_read_key(struct file * filp,char __user * buf,size_t count,loff_t * ppos)41 static ssize_t evm_read_key(struct file *filp, char __user *buf,
42 size_t count, loff_t *ppos)
43 {
44 char temp[80];
45 ssize_t rc;
46
47 if (*ppos != 0)
48 return 0;
49
50 sprintf(temp, "%d", (evm_initialized & ~EVM_SETUP_COMPLETE));
51 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
52
53 return rc;
54 }
55
56 /**
57 * evm_write_key - write() for <securityfs>/evm
58 * @file: file pointer, not actually used
59 * @buf: where to get the data from
60 * @count: bytes sent
61 * @ppos: where to start
62 *
63 * Used to signal that key is on the kernel key ring.
64 * - get the integrity hmac key from the kernel key ring
65 * - create list of hmac protected extended attributes
66 * Returns number of bytes written or error code, as appropriate
67 */
evm_write_key(struct file * file,const char __user * buf,size_t count,loff_t * ppos)68 static ssize_t evm_write_key(struct file *file, const char __user *buf,
69 size_t count, loff_t *ppos)
70 {
71 unsigned int i;
72 int ret;
73
74 if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_SETUP_COMPLETE))
75 return -EPERM;
76
77 ret = kstrtouint_from_user(buf, count, 0, &i);
78
79 if (ret)
80 return ret;
81
82 /* Reject invalid values */
83 if (!i || (i & ~EVM_INIT_MASK) != 0)
84 return -EINVAL;
85
86 /*
87 * Don't allow a request to enable metadata writes if
88 * an HMAC key is loaded.
89 */
90 if ((i & EVM_ALLOW_METADATA_WRITES) &&
91 (evm_initialized & EVM_INIT_HMAC) != 0)
92 return -EPERM;
93
94 if (i & EVM_INIT_HMAC) {
95 ret = evm_init_key();
96 if (ret != 0)
97 return ret;
98 /* Forbid further writes after the symmetric key is loaded */
99 i |= EVM_SETUP_COMPLETE;
100 }
101
102 evm_initialized |= i;
103
104 /* Don't allow protected metadata modification if a symmetric key
105 * is loaded
106 */
107 if (evm_initialized & EVM_INIT_HMAC)
108 evm_initialized &= ~(EVM_ALLOW_METADATA_WRITES);
109
110 return count;
111 }
112
113 static const struct file_operations evm_key_ops = {
114 .read = evm_read_key,
115 .write = evm_write_key,
116 };
117
118 #ifdef CONFIG_EVM_ADD_XATTRS
119 /**
120 * evm_read_xattrs - read() for <securityfs>/evm_xattrs
121 *
122 * @filp: file pointer, not actually used
123 * @buf: where to put the result
124 * @count: maximum to send along
125 * @ppos: where to start
126 *
127 * Returns number of bytes read or error code, as appropriate
128 */
evm_read_xattrs(struct file * filp,char __user * buf,size_t count,loff_t * ppos)129 static ssize_t evm_read_xattrs(struct file *filp, char __user *buf,
130 size_t count, loff_t *ppos)
131 {
132 char *temp;
133 int offset = 0;
134 ssize_t rc, size = 0;
135 struct xattr_list *xattr;
136
137 if (*ppos != 0)
138 return 0;
139
140 rc = mutex_lock_interruptible(&xattr_list_mutex);
141 if (rc)
142 return -ERESTARTSYS;
143
144 list_for_each_entry(xattr, &evm_config_xattrnames, list)
145 size += strlen(xattr->name) + 1;
146
147 temp = kmalloc(size + 1, GFP_KERNEL);
148 if (!temp) {
149 mutex_unlock(&xattr_list_mutex);
150 return -ENOMEM;
151 }
152
153 list_for_each_entry(xattr, &evm_config_xattrnames, list) {
154 sprintf(temp + offset, "%s\n", xattr->name);
155 offset += strlen(xattr->name) + 1;
156 }
157
158 mutex_unlock(&xattr_list_mutex);
159 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
160
161 kfree(temp);
162
163 return rc;
164 }
165
166 /**
167 * evm_write_xattrs - write() for <securityfs>/evm_xattrs
168 * @file: file pointer, not actually used
169 * @buf: where to get the data from
170 * @count: bytes sent
171 * @ppos: where to start
172 *
173 * Returns number of bytes written or error code, as appropriate
174 */
evm_write_xattrs(struct file * file,const char __user * buf,size_t count,loff_t * ppos)175 static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
176 size_t count, loff_t *ppos)
177 {
178 int len, err;
179 struct xattr_list *xattr, *tmp;
180 struct audit_buffer *ab;
181 struct iattr newattrs;
182 struct inode *inode;
183
184 if (!capable(CAP_SYS_ADMIN) || evm_xattrs_locked)
185 return -EPERM;
186
187 if (*ppos != 0)
188 return -EINVAL;
189
190 if (count > XATTR_NAME_MAX)
191 return -E2BIG;
192
193 ab = audit_log_start(audit_context(), GFP_KERNEL,
194 AUDIT_INTEGRITY_EVM_XATTR);
195 if (!ab)
196 return -ENOMEM;
197
198 xattr = kmalloc(sizeof(struct xattr_list), GFP_KERNEL);
199 if (!xattr) {
200 err = -ENOMEM;
201 goto out;
202 }
203
204 xattr->name = memdup_user_nul(buf, count);
205 if (IS_ERR(xattr->name)) {
206 err = PTR_ERR(xattr->name);
207 xattr->name = NULL;
208 goto out;
209 }
210
211 /* Remove any trailing newline */
212 len = strlen(xattr->name);
213 if (len && xattr->name[len-1] == '\n')
214 xattr->name[len-1] = '\0';
215
216 audit_log_format(ab, "xattr=");
217 audit_log_untrustedstring(ab, xattr->name);
218
219 if (strcmp(xattr->name, ".") == 0) {
220 evm_xattrs_locked = 1;
221 newattrs.ia_mode = S_IFREG | 0440;
222 newattrs.ia_valid = ATTR_MODE;
223 inode = evm_xattrs->d_inode;
224 inode_lock(inode);
225 err = simple_setattr(evm_xattrs, &newattrs);
226 inode_unlock(inode);
227 if (!err)
228 err = count;
229 goto out;
230 }
231
232 if (strncmp(xattr->name, XATTR_SECURITY_PREFIX,
233 XATTR_SECURITY_PREFIX_LEN) != 0) {
234 err = -EINVAL;
235 goto out;
236 }
237
238 /*
239 * xattr_list_mutex guards against races in evm_read_xattrs().
240 * Entries are only added to the evm_config_xattrnames list
241 * and never deleted. Therefore, the list is traversed
242 * using list_for_each_entry_lockless() without holding
243 * the mutex in evm_calc_hmac_or_hash(), evm_find_protected_xattrs()
244 * and evm_protected_xattr().
245 */
246 mutex_lock(&xattr_list_mutex);
247 list_for_each_entry(tmp, &evm_config_xattrnames, list) {
248 if (strcmp(xattr->name, tmp->name) == 0) {
249 err = -EEXIST;
250 mutex_unlock(&xattr_list_mutex);
251 goto out;
252 }
253 }
254 list_add_tail_rcu(&xattr->list, &evm_config_xattrnames);
255 mutex_unlock(&xattr_list_mutex);
256
257 audit_log_format(ab, " res=0");
258 audit_log_end(ab);
259 return count;
260 out:
261 audit_log_format(ab, " res=%d", err);
262 audit_log_end(ab);
263 if (xattr) {
264 kfree(xattr->name);
265 kfree(xattr);
266 }
267 return err;
268 }
269
270 static const struct file_operations evm_xattr_ops = {
271 .read = evm_read_xattrs,
272 .write = evm_write_xattrs,
273 };
274
evm_init_xattrs(void)275 static int evm_init_xattrs(void)
276 {
277 evm_xattrs = securityfs_create_file("evm_xattrs", 0660, evm_dir, NULL,
278 &evm_xattr_ops);
279 if (!evm_xattrs || IS_ERR(evm_xattrs))
280 return -EFAULT;
281
282 return 0;
283 }
284 #else
evm_init_xattrs(void)285 static int evm_init_xattrs(void)
286 {
287 return 0;
288 }
289 #endif
290
evm_init_secfs(void)291 int __init evm_init_secfs(void)
292 {
293 int error = 0;
294
295 evm_dir = securityfs_create_dir("evm", integrity_dir);
296 if (!evm_dir || IS_ERR(evm_dir))
297 return -EFAULT;
298
299 evm_init_tpm = securityfs_create_file("evm", 0660,
300 evm_dir, NULL, &evm_key_ops);
301 if (!evm_init_tpm || IS_ERR(evm_init_tpm)) {
302 error = -EFAULT;
303 goto out;
304 }
305
306 evm_symlink = securityfs_create_symlink("evm", NULL,
307 "integrity/evm/evm", NULL);
308 if (!evm_symlink || IS_ERR(evm_symlink)) {
309 error = -EFAULT;
310 goto out;
311 }
312
313 if (evm_init_xattrs() != 0) {
314 error = -EFAULT;
315 goto out;
316 }
317
318 return 0;
319 out:
320 securityfs_remove(evm_symlink);
321 securityfs_remove(evm_init_tpm);
322 securityfs_remove(evm_dir);
323 return error;
324 }
325