1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
// SPDX-License-Identifier: GPL-2.0+
/*
* Copyright (C) 2021 Microsoft Corporation
*
* Author: Lakshmi Ramasubramanian (nramas@linux.microsoft.com)
*
* Measure critical data structures maintained by SELinux
* using IMA subsystem.
*/
#include <linux/vmalloc.h>
#include <linux/ima.h>
#include <linux/seq_buf.h>
#include "security.h"
#include "ima.h"
static int selinux_ima_config_len __ro_after_init;
/*
* selinux_ima_config_len_init - Compute the configuration settings string length
*
* The string is fixed text plus one digit per setting, so its length
* is known at boot.
*/
void __init selinux_ima_config_len_init(void)
{
int buf_len, suffix_len, i;
buf_len = strlen("initialized=0;enforcing=0;checkreqprot=0;") + 1;
suffix_len = strlen("=0;");
for (i = 0; i < __POLICYDB_CAP_MAX; i++)
buf_len += strlen(selinux_policycap_names[i]) + suffix_len;
selinux_ima_config_len = buf_len;
}
/*
* selinux_ima_collect_state - Read selinux configuration settings
*
* On success returns the configuration settings string.
* On error, returns NULL.
*/
static char *selinux_ima_collect_state(void)
{
struct seq_buf s;
char *buf;
int i;
buf = kzalloc(selinux_ima_config_len, GFP_KERNEL);
if (!buf)
return NULL;
seq_buf_init(&s, buf, selinux_ima_config_len);
seq_buf_printf(&s, "initialized=%d;enforcing=%d;checkreqprot=%d;",
selinux_initialized(), enforcing_enabled(),
checkreqprot_get());
for (i = 0; i < __POLICYDB_CAP_MAX; i++)
seq_buf_printf(&s, "%s=%d;", selinux_policycap_names[i],
selinux_state.policycap[i]);
WARN_ON(seq_buf_has_overflowed(&s));
return buf;
}
/*
* selinux_ima_measure_state_locked - Measure SELinux state and hash of policy
*/
void selinux_ima_measure_state_locked(void)
{
char *state_str = NULL;
void *policy = NULL;
size_t policy_len;
int rc = 0;
lockdep_assert_held(&selinux_state.policy_mutex);
state_str = selinux_ima_collect_state();
if (!state_str) {
pr_err("SELinux: %s: failed to read state.\n", __func__);
return;
}
ima_measure_critical_data("selinux", "selinux-state",
state_str, strlen(state_str), false,
NULL, 0);
kfree(state_str);
/*
* Measure SELinux policy only after initialization is completed.
*/
if (!selinux_initialized())
return;
rc = security_read_state_kernel(&policy, &policy_len);
if (rc) {
pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc);
return;
}
ima_measure_critical_data("selinux", "selinux-policy-hash",
policy, policy_len, true,
NULL, 0);
vfree(policy);
}
/*
* selinux_ima_measure_state - Measure SELinux state and hash of policy
*/
void selinux_ima_measure_state(void)
{
lockdep_assert_not_held(&selinux_state.policy_mutex);
mutex_lock(&selinux_state.policy_mutex);
selinux_ima_measure_state_locked();
mutex_unlock(&selinux_state.policy_mutex);
}
|
