Open Menu / security / selinux / ima.c 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
// SPDX-License-Identifier: GPL-2.0+
/*
 * Copyright (C) 2021 Microsoft Corporation
 *
 * Author: Lakshmi Ramasubramanian (nramas@linux.microsoft.com)
 *
 * Measure critical data structures maintained by SELinux
 * using IMA subsystem.
 */
#include <linux/vmalloc.h>
#include <linux/ima.h>
#include <linux/seq_buf.h>
#include "security.h"
#include "ima.h"

static int selinux_ima_config_len __ro_after_init;

/*
 * selinux_ima_config_len_init - Compute the configuration settings string length
 *
 * The string is fixed text plus one digit per setting, so its length
 * is known at boot.
 */
void __init selinux_ima_config_len_init(void)
{
	int buf_len, suffix_len, i;

	buf_len = strlen("initialized=0;enforcing=0;checkreqprot=0;") + 1;
	suffix_len = strlen("=0;");

	for (i = 0; i < __POLICYDB_CAP_MAX; i++)
		buf_len += strlen(selinux_policycap_names[i]) + suffix_len;

	selinux_ima_config_len = buf_len;
}

/*
 * selinux_ima_collect_state - Read selinux configuration settings
 *
 * On success returns the configuration settings string.
 * On error, returns NULL.
 */
static char *selinux_ima_collect_state(void)
{
	struct seq_buf s;
	char *buf;
	int i;

	buf = kzalloc(selinux_ima_config_len, GFP_KERNEL);
	if (!buf)
		return NULL;

	seq_buf_init(&s, buf, selinux_ima_config_len);

	seq_buf_printf(&s, "initialized=%d;enforcing=%d;checkreqprot=%d;",
		       selinux_initialized(), enforcing_enabled(),
		       checkreqprot_get());

	for (i = 0; i < __POLICYDB_CAP_MAX; i++)
		seq_buf_printf(&s, "%s=%d;", selinux_policycap_names[i],
			       selinux_state.policycap[i]);

	WARN_ON(seq_buf_has_overflowed(&s));

	return buf;
}

/*
 * selinux_ima_measure_state_locked - Measure SELinux state and hash of policy
 */
void selinux_ima_measure_state_locked(void)
{
	char *state_str = NULL;
	void *policy = NULL;
	size_t policy_len;
	int rc = 0;

	lockdep_assert_held(&selinux_state.policy_mutex);

	state_str = selinux_ima_collect_state();
	if (!state_str) {
		pr_err("SELinux: %s: failed to read state.\n", __func__);
		return;
	}

	ima_measure_critical_data("selinux", "selinux-state",
				  state_str, strlen(state_str), false,
				  NULL, 0);

	kfree(state_str);

	/*
	 * Measure SELinux policy only after initialization is completed.
	 */
	if (!selinux_initialized())
		return;

	rc = security_read_state_kernel(&policy, &policy_len);
	if (rc) {
		pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc);
		return;
	}

	ima_measure_critical_data("selinux", "selinux-policy-hash",
				  policy, policy_len, true,
				  NULL, 0);

	vfree(policy);
}

/*
 * selinux_ima_measure_state - Measure SELinux state and hash of policy
 */
void selinux_ima_measure_state(void)
{
	lockdep_assert_not_held(&selinux_state.policy_mutex);

	mutex_lock(&selinux_state.policy_mutex);
	selinux_ima_measure_state_locked();
	mutex_unlock(&selinux_state.policy_mutex);
}