integrity: IMA hooks

This patch replaces the generic integrity hooks, for which IMA registered itself, with IMA integrity hooks in the appropriate places directly in the fs directory. Signed-off-by: Mimi Zohar <zohar@us.ibm.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: James Morris <jmorris@namei.org>

integrity: IMA hooks
This patch replaces the generic integrity hooks, for which IMA registered itself, with IMA integrity hooks in the appropriate places directly in the fs directory. Signed-off-by: Mimi Zohar <zohar@us.ibm.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: James Morris <jmorris@namei.org>
Mimi Zohar · James Morris
1 parent 659aaf2bb5
Showing 7 changed files with 86 additions and 7 deletions Side-by-side Diff
Documentation/kernel-parameters.txt
fs/exec.c
fs/file_table.c
fs/inode.c
fs/namei.c
include/linux/ima.h
mm/mmap.c
@@ -44,6 +44,7 @@
 	FB	The frame buffer device is enabled.
 	HW	Appropriate hardware is enabled.
 	IA-64	IA-64 architecture is enabled.
+	IMA     Integrity measurement architecture is enabled.
 	IOSCHED	More than one I/O scheduler is enabled.
 	IP_PNP	IP DHCP, BOOTP, or RARP is enabled.
 	ISAPNP	ISA PnP code is enabled.
@@ -45,6 +45,7 @@
 #include <linux/proc_fs.h>
 #include <linux/mount.h>
 #include <linux/security.h>
+#include <linux/ima.h>
 #include <linux/syscalls.h>
 #include <linux/tsacct_kern.h>
 #include <linux/cn_proc.h>
@@ -130,6 +131,9 @@
 	error = vfs_permission(&nd, MAY_READ | MAY_EXEC | MAY_OPEN);
 	if (error)
 		goto exit;
+	error = ima_path_check(&nd.path, MAY_READ | MAY_EXEC | MAY_OPEN);
+	if (error)
+		goto exit;
  
 	file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
 	error = PTR_ERR(file);
@@ -683,6 +687,9 @@
 	err = vfs_permission(&nd, MAY_EXEC | MAY_OPEN);
 	if (err)
 		goto out_path_put;
+	err = ima_path_check(&nd.path, MAY_EXEC | MAY_OPEN);
+	if (err)
+		goto out_path_put;
  
 	file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
 	if (IS_ERR(file))
@@ -1207,6 +1214,9 @@
 	}
 #endif
 	retval = security_bprm_check(bprm);
+	if (retval)
+		return retval;
+	retval = ima_bprm_check(bprm);
 	if (retval)
 		return retval;
  
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/security.h>
+#include <linux/ima.h>
 #include <linux/eventpoll.h>
 #include <linux/rcupdate.h>
 #include <linux/mount.h>
@@ -276,6 +277,7 @@
 	if (file->f_op && file->f_op->release)
 		file->f_op->release(inode, file);
 	security_file_free(file);
+	ima_file_free(file);
 	if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))
 		cdev_put(inode->i_cdev);
 	fops_put(file->f_op);
@@ -17,6 +17,7 @@
 #include <linux/hash.h>
 #include <linux/swap.h>
 #include <linux/security.h>
+#include <linux/ima.h>
 #include <linux/pagemap.h>
 #include <linux/cdev.h>
 #include <linux/bootmem.h>
  
@@ -144,14 +145,14 @@
 	inode->i_cdev = NULL;
 	inode->i_rdev = 0;
 	inode->dirtied_when = 0;
-	if (security_inode_alloc(inode)) {
-		if (inode->i_sb->s_op->destroy_inode)
-			inode->i_sb->s_op->destroy_inode(inode);
-		else
-			kmem_cache_free(inode_cachep, (inode));
-		return NULL;
-	}
  
+	if (security_inode_alloc(inode))
+		goto out_free_inode;
+
+	/* allocate and initialize an i_integrity */
+	if (ima_inode_alloc(inode))
+		goto out_free_security;
+
 	spin_lock_init(&inode->i_lock);
 	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
  
@@ -186,6 +187,15 @@
 	inode->i_mapping = mapping;
  
 	return inode;
+
+out_free_security:
+	security_inode_free(inode);
+out_free_inode:
+	if (inode->i_sb->s_op->destroy_inode)
+		inode->i_sb->s_op->destroy_inode(inode);
+	else
+		kmem_cache_free(inode_cachep, (inode));
+	return NULL;
 }
 EXPORT_SYMBOL(inode_init_always);
  
@@ -24,6 +24,7 @@
 #include <linux/fsnotify.h>
 #include <linux/personality.h>
 #include <linux/security.h>
+#include <linux/ima.h>
 #include <linux/syscalls.h>
 #include <linux/mount.h>
 #include <linux/audit.h>
@@ -860,6 +861,8 @@
 		err = exec_permission_lite(inode);
 		if (err == -EAGAIN)
 			err = vfs_permission(nd, MAY_EXEC);
+		if (!err)
+			err = ima_path_check(&nd->path, MAY_EXEC);
  		if (err)
 			break;
  
@@ -1523,6 +1526,11 @@
 	}
  
 	error = vfs_permission(nd, acc_mode);
+	if (error)
+		return error;
+
+	error = ima_path_check(&nd->path,
+			       acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC));
 	if (error)
 		return error;
 	/*
+/*
+ * Copyright (C) 2008 IBM Corporation
+ * Author: Mimi Zohar <zohar@us.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ */
+
+#include <linux/fs.h>
+
+#ifndef _LINUX_IMA_H
+#define _LINUX_IMA_H
+
+static inline int ima_bprm_check(struct linux_binprm *bprm)
+{
+	return 0;
+}
+
+static inline int ima_inode_alloc(struct inode *inode)
+{
+	return 0;
+}
+
+static inline void ima_inode_free(struct inode *inode)
+{
+	return;
+}
+
+static inline int ima_path_check(struct path *path, int mask)
+{
+	return 0;
+}
+
+static inline void ima_file_free(struct file *file)
+{
+	return;
+}
+
+static inline int ima_file_mmap(struct file *file, unsigned long prot)
+{
+	return 0;
+}
+#endif /* _LINUX_IMA_H */
@@ -20,6 +20,7 @@
 #include <linux/fs.h>
 #include <linux/personality.h>
 #include <linux/security.h>
+#include <linux/ima.h>
 #include <linux/hugetlb.h>
 #include <linux/profile.h>
 #include <linux/module.h>
@@ -1048,6 +1049,9 @@
 	}
  
 	error = security_file_mmap(file, reqprot, prot, flags, addr, 0);
+	if (error)
+		return error;
+	error = ima_file_mmap(file, prot);
 	if (error)
 		return error;
...	...	@@ -44,6 +44,7 @@
44	44	FB The frame buffer device is enabled.
45	45	HW Appropriate hardware is enabled.
46	46	IA-64 IA-64 architecture is enabled.
	47	+ IMA Integrity measurement architecture is enabled.
47	48	IOSCHED More than one I/O scheduler is enabled.
48	49	IP_PNP IP DHCP, BOOTP, or RARP is enabled.
49	50	ISAPNP ISA PnP code is enabled.
...	...	@@ -45,6 +45,7 @@
45	45	#include <linux/proc_fs.h>
46	46	#include <linux/mount.h>
47	47	#include <linux/security.h>
	48	+#include <linux/ima.h>
48	49	#include <linux/syscalls.h>
49	50	#include <linux/tsacct_kern.h>
50	51	#include <linux/cn_proc.h>
...	...	@@ -130,6 +131,9 @@
130	131	error = vfs_permission(&nd, MAY_READ \| MAY_EXEC \| MAY_OPEN);
131	132	if (error)
132	133	goto exit;
	134	+ error = ima_path_check(&nd.path, MAY_READ \| MAY_EXEC \| MAY_OPEN);
	135	+ if (error)
	136	+ goto exit;
133	137
134	138	file = nameidata_to_filp(&nd, O_RDONLY\|O_LARGEFILE);
135	139	error = PTR_ERR(file);
...	...	@@ -683,6 +687,9 @@
683	687	err = vfs_permission(&nd, MAY_EXEC \| MAY_OPEN);
684	688	if (err)
685	689	goto out_path_put;
	690	+ err = ima_path_check(&nd.path, MAY_EXEC \| MAY_OPEN);
	691	+ if (err)
	692	+ goto out_path_put;
686	693
687	694	file = nameidata_to_filp(&nd, O_RDONLY\|O_LARGEFILE);
688	695	if (IS_ERR(file))
...	...	@@ -1207,6 +1214,9 @@
1207	1214	}
1208	1215	#endif
1209	1216	retval = security_bprm_check(bprm);
	1217	+ if (retval)
	1218	+ return retval;
	1219	+ retval = ima_bprm_check(bprm);
1210	1220	if (retval)
1211	1221	return retval;
1212	1222
...	...	@@ -13,6 +13,7 @@
13	13	#include <linux/module.h>
14	14	#include <linux/fs.h>
15	15	#include <linux/security.h>
	16	+#include <linux/ima.h>
16	17	#include <linux/eventpoll.h>
17	18	#include <linux/rcupdate.h>
18	19	#include <linux/mount.h>
...	...	@@ -276,6 +277,7 @@
276	277	if (file->f_op && file->f_op->release)
277	278	file->f_op->release(inode, file);
278	279	security_file_free(file);
	280	+ ima_file_free(file);
279	281	if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))
280	282	cdev_put(inode->i_cdev);
281	283	fops_put(file->f_op);
...	...	@@ -17,6 +17,7 @@
17	17	#include <linux/hash.h>
18	18	#include <linux/swap.h>
19	19	#include <linux/security.h>
	20	+#include <linux/ima.h>
20	21	#include <linux/pagemap.h>
21	22	#include <linux/cdev.h>
22	23	#include <linux/bootmem.h>
23	24
...	...	@@ -144,14 +145,14 @@
144	145	inode->i_cdev = NULL;
145	146	inode->i_rdev = 0;
146	147	inode->dirtied_when = 0;
147		- if (security_inode_alloc(inode)) {
148		- if (inode->i_sb->s_op->destroy_inode)
149		- inode->i_sb->s_op->destroy_inode(inode);
150		- else
151		- kmem_cache_free(inode_cachep, (inode));
152		- return NULL;
153		- }
154	148
	149	+ if (security_inode_alloc(inode))
	150	+ goto out_free_inode;
	151	+
	152	+ /* allocate and initialize an i_integrity */
	153	+ if (ima_inode_alloc(inode))
	154	+ goto out_free_security;
	155	+
155	156	spin_lock_init(&inode->i_lock);
156	157	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
157	158
...	...	@@ -186,6 +187,15 @@
186	187	inode->i_mapping = mapping;
187	188
188	189	return inode;
	190	+
	191	+out_free_security:
	192	+ security_inode_free(inode);
	193	+out_free_inode:
	194	+ if (inode->i_sb->s_op->destroy_inode)
	195	+ inode->i_sb->s_op->destroy_inode(inode);
	196	+ else
	197	+ kmem_cache_free(inode_cachep, (inode));
	198	+ return NULL;
189	199	}
190	200	EXPORT_SYMBOL(inode_init_always);
191	201
...	...	@@ -24,6 +24,7 @@
24	24	#include <linux/fsnotify.h>
25	25	#include <linux/personality.h>
26	26	#include <linux/security.h>
	27	+#include <linux/ima.h>
27	28	#include <linux/syscalls.h>
28	29	#include <linux/mount.h>
29	30	#include <linux/audit.h>
...	...	@@ -860,6 +861,8 @@
860	861	err = exec_permission_lite(inode);
861	862	if (err == -EAGAIN)
862	863	err = vfs_permission(nd, MAY_EXEC);
	864	+ if (!err)
	865	+ err = ima_path_check(&nd->path, MAY_EXEC);
863	866	if (err)
864	867	break;
865	868
...	...	@@ -1523,6 +1526,11 @@
1523	1526	}
1524	1527
1525	1528	error = vfs_permission(nd, acc_mode);
	1529	+ if (error)
	1530	+ return error;
	1531	+
	1532	+ error = ima_path_check(&nd->path,
	1533	+ acc_mode & (MAY_READ \| MAY_WRITE \| MAY_EXEC));
1526	1534	if (error)
1527	1535	return error;
1528	1536	/*
	1	+/*
	2	+ * Copyright (C) 2008 IBM Corporation
	3	+ * Author: Mimi Zohar <zohar@us.ibm.com>
	4	+ *
	5	+ * This program is free software; you can redistribute it and/or modify
	6	+ * it under the terms of the GNU General Public License as published by
	7	+ * the Free Software Foundation, version 2 of the License.
	8	+ */
	9	+
	10	+#include <linux/fs.h>
	11	+
	12	+#ifndef _LINUX_IMA_H
	13	+#define _LINUX_IMA_H
	14	+
	15	+static inline int ima_bprm_check(struct linux_binprm *bprm)
	16	+{
	17	+ return 0;
	18	+}
	19	+
	20	+static inline int ima_inode_alloc(struct inode *inode)
	21	+{
	22	+ return 0;
	23	+}
	24	+
	25	+static inline void ima_inode_free(struct inode *inode)
	26	+{
	27	+ return;
	28	+}
	29	+
	30	+static inline int ima_path_check(struct path *path, int mask)
	31	+{
	32	+ return 0;
	33	+}
	34	+
	35	+static inline void ima_file_free(struct file *file)
	36	+{
	37	+ return;
	38	+}
	39	+
	40	+static inline int ima_file_mmap(struct file *file, unsigned long prot)
	41	+{
	42	+ return 0;
	43	+}
	44	+#endif /* _LINUX_IMA_H */
...	...	@@ -20,6 +20,7 @@
20	20	#include <linux/fs.h>
21	21	#include <linux/personality.h>
22	22	#include <linux/security.h>
	23	+#include <linux/ima.h>
23	24	#include <linux/hugetlb.h>
24	25	#include <linux/profile.h>
25	26	#include <linux/module.h>
...	...	@@ -1048,6 +1049,9 @@
1048	1049	}
1049	1050
1050	1051	error = security_file_mmap(file, reqprot, prot, flags, addr, 0);
	1052	+ if (error)
	1053	+ return error;
	1054	+ error = ima_file_mmap(file, prot);
1051	1055	if (error)
1052	1056	return error;
1053	1057