@@ -48,7 +48,7 @@ Description:
template:= name of a defined IMA template type
(eg, ima-ng). Only valid when action is "measure".
pcr:= decimal value
- data_sources:= list of kernel subsystems that contain
+ data_sources:= list of kernel subsystems (eg, SeLinux) that contain
kernel in-memory data critical to the integrity of the kernel.
Only valid when action is "measure" and func is
CRITICAL_DATA.
@@ -129,3 +129,7 @@ Description:
keys added to .builtin_trusted_keys or .ima keyring:
measure func=KEY_CHECK keyrings=.builtin_trusted_keys|.ima
+
+ Example of measure rule using CRITICAL_DATA to measure critical data
+
+ measure func=CRITICAL_DATA data_sources=selinux template=ima-buf
@@ -230,6 +230,7 @@ struct modsig;
#define __ima_supported_kernel_data_sources(source) \
source(MIN_SOURCE, min_source) \
+ source(SELINUX, selinux) \
source(MAX_SOURCE, max_source)
#define __ima_enum_stringify(ENUM, str) (#str),
@@ -16,6 +16,8 @@ selinux-$(CONFIG_NETLABEL) += netlabel.o
selinux-$(CONFIG_SECURITY_INFINIBAND) += ibpkey.o
+selinux-$(CONFIG_IMA) += measure.o
+
ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
$(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h
@@ -7398,6 +7398,9 @@ int selinux_disable(struct selinux_state *state)
}
selinux_mark_disabled(state);
+ mutex_lock(&state->policy_mutex);
+ selinux_measure_state(state);
+ mutex_unlock(&state->policy_mutex);
pr_info("SELinux: Disabled at runtime.\n");
@@ -229,7 +229,8 @@ void selinux_policy_cancel(struct selinux_state *state,
struct selinux_policy *policy);
int security_read_policy(struct selinux_state *state,
void **data, size_t *len);
-
+int security_read_policy_kernel(struct selinux_state *state,
+ void **data, size_t *len);
int security_policycap_supported(struct selinux_state *state,
unsigned int req_cap);
@@ -446,4 +447,12 @@ extern void ebitmap_cache_init(void);
extern void hashtab_cache_init(void);
extern int security_sidtab_hash_stats(struct selinux_state *state, char *page);
+#ifdef CONFIG_IMA
+extern void selinux_measure_state(struct selinux_state *selinux_state);
+#else
+static inline void selinux_measure_state(struct selinux_state *selinux_state)
+{
+}
+#endif
+
#endif /* _SELINUX_SECURITY_H_ */
new file mode 100644
@@ -0,0 +1,157 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Measure SELinux state using IMA subsystem.
+ */
+#include <linux/vmalloc.h>
+#include <linux/ktime.h>
+#include <linux/ima.h>
+#include "security.h"
+
+/*
+ * This function creates a unique name by appending the timestamp to
+ * the given string. This string is passed as "event_name" to the IMA
+ * hook to measure the given SELinux data.
+ *
+ * The data provided by SELinux to the IMA subsystem for measuring may have
+ * already been measured (for instance the same state existed earlier).
+ * But for SELinux the current data represents a state change and hence
+ * needs to be measured again. To enable this, pass a unique "event_name"
+ * to the IMA hook so that IMA subsystem will always measure the given data.
+ *
+ * For example,
+ * At time T0 SELinux data to be measured is "foo". IMA measures it.
+ * At time T1 the data is changed to "bar". IMA measures it.
+ * At time T2 the data is changed to "foo" again. IMA will not measure it
+ * (since it was already measured) unless the event_name, for instance,
+ * is different in this call.
+ */
+static char *selinux_event_name(const char *name_prefix)
+{
+ char *event_name = NULL;
+ struct timespec64 cur_time;
+
+ ktime_get_real_ts64(&cur_time);
+ event_name = kasprintf(GFP_KERNEL, "%s-%lld:%09ld", name_prefix,
+ cur_time.tv_sec, cur_time.tv_nsec);
+ if (!event_name) {
+ pr_err("%s: event name not allocated.\n", __func__);
+ return NULL;
+ }
+
+ return event_name;
+}
+
+static int read_selinux_state(char **state_str, int *state_str_len,
+ struct selinux_state *state)
+{
+ char *buf, *str_fmt = "%s=%d;";
+ int i, buf_len, curr;
+ bool initialized = selinux_initialized(state);
+ bool enabled = !selinux_disabled(state);
+ bool enforcing = enforcing_enabled(state);
+ bool checkreqprot = checkreqprot_get(state);
+
+ buf_len = snprintf(NULL, 0, str_fmt, "initialized", initialized);
+ buf_len += snprintf(NULL, 0, str_fmt, "enabled", enabled);
+ buf_len += snprintf(NULL, 0, str_fmt, "enforcing", enforcing);
+ buf_len += snprintf(NULL, 0, str_fmt, "checkreqprot", checkreqprot);
+
+ for (i = 0; i < __POLICYDB_CAPABILITY_MAX; i++) {
+ buf_len += snprintf(NULL, 0, str_fmt,
+ selinux_policycap_names[i],
+ state->policycap[i]);
+ }
+ ++buf_len;
+
+ buf = kzalloc(buf_len, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ curr = scnprintf(buf, buf_len, str_fmt,
+ "initialized", initialized);
+ curr += scnprintf((buf + curr), (buf_len - curr), str_fmt,
+ "enabled", enabled);
+ curr += scnprintf((buf + curr), (buf_len - curr), str_fmt,
+ "enforcing", enforcing);
+ curr += scnprintf((buf + curr), (buf_len - curr), str_fmt,
+ "checkreqprot", checkreqprot);
+
+ for (i = 0; i < __POLICYDB_CAPABILITY_MAX; i++) {
+ curr += scnprintf((buf + curr), (buf_len - curr), str_fmt,
+ selinux_policycap_names[i],
+ state->policycap[i]);
+ }
+
+ *state_str = buf;
+ *state_str_len = curr;
+
+ return 0;
+}
+
+/*
+ * selinux_measure_state - Measure SELinux state configuration and hash of
+ * the SELinux policy.
+ * @state: selinux state struct
+ *
+ * NOTE: This function must be called with policy_mutex held.
+ */
+void selinux_measure_state(struct selinux_state *state)
+{
+ void *policy = NULL;
+ char *state_event_name = NULL;
+ char *policy_event_name = NULL;
+ char *state_str = NULL;
+ size_t policy_len;
+ int state_str_len, rc = 0;
+ bool initialized = selinux_initialized(state);
+
+ /*
+ * Get a unique string for measuring the current SELinux state.
+ */
+ state_event_name = selinux_event_name("selinux-state");
+ if (!state_event_name) {
+ pr_err("%s: Event name for state not allocated.\n",
+ __func__);
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ rc = read_selinux_state(&state_str, &state_str_len, state);
+ if (rc) {
+ pr_err("%s: Failed to read state %d.\n", __func__, rc);
+ goto out;
+ }
+
+ ima_measure_critical_data("selinux", state_event_name,
+ state_str, state_str_len, false);
+
+ /*
+ * Measure SELinux policy only after initialization is completed.
+ */
+ if (!initialized)
+ goto out;
+
+ policy_event_name = selinux_event_name("selinux-policy-hash");
+ if (!policy_event_name) {
+ pr_err("%s: Event name for policy not allocated.\n",
+ __func__);
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ rc = security_read_policy_kernel(state, &policy, &policy_len);
+ if (rc) {
+ pr_err("%s: Failed to read policy %d.\n", __func__, rc);
+ goto out;
+ }
+
+ ima_measure_critical_data("selinux", policy_event_name,
+ policy, policy_len, true);
+
+ vfree(policy);
+
+out:
+ kfree(policy_event_name);
+ kfree(state_str);
+ kfree(state_event_name);
+}
@@ -182,6 +182,10 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
selinux_status_update_setenforce(state, new_value);
if (!new_value)
call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
+
+ mutex_lock(&state->policy_mutex);
+ selinux_measure_state(state);
+ mutex_unlock(&state->policy_mutex);
}
length = count;
out:
@@ -762,6 +766,11 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
checkreqprot_set(fsi->state, (new_value ? 1 : 0));
length = count;
+
+ mutex_lock(&fsi->state->policy_mutex);
+ selinux_measure_state(fsi->state);
+ mutex_unlock(&fsi->state->policy_mutex);
+
out:
kfree(page);
return length;
@@ -2180,6 +2180,7 @@ static void selinux_notify_policy_change(struct selinux_state *state,
selinux_status_update_policyload(state, seqno);
selinux_netlbl_cache_invalidate();
selinux_xfrm_notify_policyload();
+ selinux_measure_state(state);
}
void selinux_policy_commit(struct selinux_state *state,
@@ -3875,8 +3876,33 @@ int security_netlbl_sid_to_secattr(struct selinux_state *state,
}
#endif /* CONFIG_NETLABEL */
+/**
+ * security_read_selinux_policy - read the policy.
+ * @policy: SELinux policy
+ * @data: binary policy data
+ * @len: length of data in bytes
+ *
+ */
+static int security_read_selinux_policy(struct selinux_policy *policy,
+ void *data, size_t *len)
+{
+ int rc;
+ struct policy_file fp;
+
+ fp.data = data;
+ fp.len = *len;
+
+ rc = policydb_write(&policy->policydb, &fp);
+ if (rc)
+ return rc;
+
+ *len = (unsigned long)fp.data - (unsigned long)data;
+ return 0;
+}
+
/**
* security_read_policy - read the policy.
+ * @state: selinux_state
* @data: binary policy data
* @len: length of data in bytes
*
@@ -3885,8 +3911,6 @@ int security_read_policy(struct selinux_state *state,
void **data, size_t *len)
{
struct selinux_policy *policy;
- int rc;
- struct policy_file fp;
policy = rcu_dereference_protected(
state->policy, lockdep_is_held(&state->policy_mutex));
@@ -3898,14 +3922,43 @@ int security_read_policy(struct selinux_state *state,
if (!*data)
return -ENOMEM;
- fp.data = *data;
- fp.len = *len;
+ return security_read_selinux_policy(policy, *data, len);
+}
- rc = policydb_write(&policy->policydb, &fp);
- if (rc)
- return rc;
+/**
+ * security_read_policy_kernel - read the policy.
+ * @state: selinux_state
+ * @data: binary policy data
+ * @len: length of data in bytes
+ *
+ * Allocates kernel memory for reading SELinux policy.
+ * This function is for internal use only and should not
+ * be used for returning data to user space.
+ *
+ * This function must be called with policy_mutex held.
+ */
+int security_read_policy_kernel(struct selinux_state *state,
+ void **data, size_t *len)
+{
+ struct selinux_policy *policy;
+ int rc = 0;
- *len = (unsigned long)fp.data - (unsigned long)*data;
- return 0;
+ policy = rcu_dereference_protected(
+ state->policy, lockdep_is_held(&state->policy_mutex));
+ if (!policy) {
+ rc = -EINVAL;
+ goto out;
+ }
+
+ *len = policy->policydb.len;
+ *data = vmalloc(*len);
+ if (!*data) {
+ rc = -ENOMEM;
+ goto out;
+ }
+ rc = security_read_selinux_policy(policy, *data, len);
+
+out:
+ return rc;
}