~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/integrity/ima/ima_init.c

Version: ~ [ linux-5.11 ] ~ [ linux-5.10.17 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.99 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.176 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.221 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.257 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.257 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (C) 2005,2006,2007,2008 IBM Corporation
  3  *
  4  * Authors:
  5  * Reiner Sailer      <sailer@watson.ibm.com>
  6  * Leendert van Doorn <leendert@watson.ibm.com>
  7  * Mimi Zohar         <zohar@us.ibm.com>
  8  *
  9  * This program is free software; you can redistribute it and/or
 10  * modify it under the terms of the GNU General Public License as
 11  * published by the Free Software Foundation, version 2 of the
 12  * License.
 13  *
 14  * File: ima_init.c
 15  *             initialization and cleanup functions
 16  */
 17 
 18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 19 
 20 #include <linux/module.h>
 21 #include <linux/scatterlist.h>
 22 #include <linux/slab.h>
 23 #include <linux/err.h>
 24 
 25 #include "ima.h"
 26 
 27 /* name for boot aggregate entry */
 28 static const char *boot_aggregate_name = "boot_aggregate";
 29 int ima_used_chip;
 30 
 31 /* Add the boot aggregate to the IMA measurement list and extend
 32  * the PCR register.
 33  *
 34  * Calculate the boot aggregate, a SHA1 over tpm registers 0-7,
 35  * assuming a TPM chip exists, and zeroes if the TPM chip does not
 36  * exist.  Add the boot aggregate measurement to the measurement
 37  * list and extend the PCR register.
 38  *
 39  * If a tpm chip does not exist, indicate the core root of trust is
 40  * not hardware based by invalidating the aggregate PCR value.
 41  * (The aggregate PCR value is invalidated by adding one value to
 42  * the measurement list and extending the aggregate PCR value with
 43  * a different value.) Violations add a zero entry to the measurement
 44  * list and extend the aggregate PCR value with ff...ff's.
 45  */
 46 static int __init ima_add_boot_aggregate(void)
 47 {
 48         static const char op[] = "add_boot_aggregate";
 49         const char *audit_cause = "ENOMEM";
 50         struct ima_template_entry *entry;
 51         struct integrity_iint_cache tmp_iint, *iint = &tmp_iint;
 52         struct ima_event_data event_data = {iint, NULL, boot_aggregate_name,
 53                                             NULL, 0, NULL};
 54         int result = -ENOMEM;
 55         int violation = 0;
 56         struct {
 57                 struct ima_digest_data hdr;
 58                 char digest[TPM_DIGEST_SIZE];
 59         } hash;
 60 
 61         memset(iint, 0, sizeof(*iint));
 62         memset(&hash, 0, sizeof(hash));
 63         iint->ima_hash = &hash.hdr;
 64         iint->ima_hash->algo = HASH_ALGO_SHA1;
 65         iint->ima_hash->length = SHA1_DIGEST_SIZE;
 66 
 67         if (ima_used_chip) {
 68                 result = ima_calc_boot_aggregate(&hash.hdr);
 69                 if (result < 0) {
 70                         audit_cause = "hashing_error";
 71                         goto err_out;
 72                 }
 73         }
 74 
 75         result = ima_alloc_init_template(&event_data, &entry);
 76         if (result < 0) {
 77                 audit_cause = "alloc_entry";
 78                 goto err_out;
 79         }
 80 
 81         result = ima_store_template(entry, violation, NULL,
 82                                     boot_aggregate_name);
 83         if (result < 0) {
 84                 ima_free_template_entry(entry);
 85                 audit_cause = "store_entry";
 86                 goto err_out;
 87         }
 88         return 0;
 89 err_out:
 90         integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
 91                             audit_cause, result, 0);
 92         return result;
 93 }
 94 
 95 #ifdef CONFIG_IMA_LOAD_X509
 96 void __init ima_load_x509(void)
 97 {
 98         int unset_flags = ima_policy_flag & IMA_APPRAISE;
 99 
100         ima_policy_flag &= ~unset_flags;
101         integrity_load_x509(INTEGRITY_KEYRING_IMA, CONFIG_IMA_X509_PATH);
102         ima_policy_flag |= unset_flags;
103 }
104 #endif
105 
106 int __init ima_init(void)
107 {
108         u8 pcr_i[TPM_DIGEST_SIZE];
109         int rc;
110 
111         ima_used_chip = 0;
112         rc = tpm_pcr_read(TPM_ANY_NUM, 0, pcr_i);
113         if (rc == 0)
114                 ima_used_chip = 1;
115 
116         if (!ima_used_chip)
117                 pr_info("No TPM chip found, activating TPM-bypass!\n");
118 
119         rc = integrity_init_keyring(INTEGRITY_KEYRING_IMA);
120         if (rc)
121                 return rc;
122 
123         rc = ima_init_crypto();
124         if (rc)
125                 return rc;
126         rc = ima_init_template();
127         if (rc != 0)
128                 return rc;
129 
130         rc = ima_add_boot_aggregate();  /* boot aggregate must be first entry */
131         if (rc != 0)
132                 return rc;
133 
134         ima_init_policy();
135 
136         return ima_fs_init();
137 }
138 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp