~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/integrity/ima/ima_init.c

Version: ~ [ linux-5.8-rc4 ] ~ [ linux-5.7.7 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.50 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.131 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.187 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.229 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.229 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (C) 2005,2006,2007,2008 IBM Corporation
  3  *
  4  * Authors:
  5  * Reiner Sailer      <sailer@watson.ibm.com>
  6  * Leendert van Doorn <leendert@watson.ibm.com>
  7  * Mimi Zohar         <zohar@us.ibm.com>
  8  *
  9  * This program is free software; you can redistribute it and/or
 10  * modify it under the terms of the GNU General Public License as
 11  * published by the Free Software Foundation, version 2 of the
 12  * License.
 13  *
 14  * File: ima_init.c
 15  *             initialization and cleanup functions
 16  */
 17 #include <linux/module.h>
 18 #include <linux/scatterlist.h>
 19 #include <linux/slab.h>
 20 #include <linux/err.h>
 21 #include "ima.h"
 22 
 23 /* name for boot aggregate entry */
 24 static const char *boot_aggregate_name = "boot_aggregate";
 25 int ima_used_chip;
 26 
 27 /* Add the boot aggregate to the IMA measurement list and extend
 28  * the PCR register.
 29  *
 30  * Calculate the boot aggregate, a SHA1 over tpm registers 0-7,
 31  * assuming a TPM chip exists, and zeroes if the TPM chip does not
 32  * exist.  Add the boot aggregate measurement to the measurement
 33  * list and extend the PCR register.
 34  *
 35  * If a tpm chip does not exist, indicate the core root of trust is
 36  * not hardware based by invalidating the aggregate PCR value.
 37  * (The aggregate PCR value is invalidated by adding one value to
 38  * the measurement list and extending the aggregate PCR value with
 39  * a different value.) Violations add a zero entry to the measurement
 40  * list and extend the aggregate PCR value with ff...ff's.
 41  */
 42 static void __init ima_add_boot_aggregate(void)
 43 {
 44         struct ima_template_entry *entry;
 45         const char *op = "add_boot_aggregate";
 46         const char *audit_cause = "ENOMEM";
 47         int result = -ENOMEM;
 48         int violation = 1;
 49 
 50         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
 51         if (!entry)
 52                 goto err_out;
 53 
 54         memset(&entry->template, 0, sizeof(entry->template));
 55         strncpy(entry->template.file_name, boot_aggregate_name,
 56                 IMA_EVENT_NAME_LEN_MAX);
 57         if (ima_used_chip) {
 58                 violation = 0;
 59                 result = ima_calc_boot_aggregate(entry->template.digest);
 60                 if (result < 0) {
 61                         audit_cause = "hashing_error";
 62                         kfree(entry);
 63                         goto err_out;
 64                 }
 65         }
 66         result = ima_store_template(entry, violation, NULL);
 67         if (result < 0)
 68                 kfree(entry);
 69         return;
 70 err_out:
 71         integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
 72                             audit_cause, result, 0);
 73 }
 74 
 75 int __init ima_init(void)
 76 {
 77         u8 pcr_i[IMA_DIGEST_SIZE];
 78         int rc;
 79 
 80         ima_used_chip = 0;
 81         rc = tpm_pcr_read(TPM_ANY_NUM, 0, pcr_i);
 82         if (rc == 0)
 83                 ima_used_chip = 1;
 84 
 85         if (!ima_used_chip)
 86                 pr_info("IMA: No TPM chip found, activating TPM-bypass!\n");
 87 
 88         rc = ima_init_crypto();
 89         if (rc)
 90                 return rc;
 91         ima_add_boot_aggregate();       /* boot aggregate must be first entry */
 92         ima_init_policy();
 93 
 94         return ima_fs_init();
 95 }
 96 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp