^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * Copyright (C) 2005,2006,2007,2008 IBM Corporation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Authors:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Mimi Zohar <zohar@us.ibm.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Kylene Hall <kjhall@us.ibm.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * File: ima_crypto.c
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * Calculates md5/sha1 file hash, template hash, boot-aggreate hash
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/moduleparam.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/ratelimit.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/file.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/crypto.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/scatterlist.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/err.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <crypto/hash.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include "ima.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) /* minimum file size for ahash use */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) static unsigned long ima_ahash_minsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) module_param_named(ahash_minsize, ima_ahash_minsize, ulong, 0644);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) MODULE_PARM_DESC(ahash_minsize, "Minimum file size for ahash use");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) /* default is 0 - 1 page. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) static int ima_maxorder;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) static unsigned int ima_bufsize = PAGE_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) static int param_set_bufsize(const char *val, const struct kernel_param *kp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) unsigned long long size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) int order;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) size = memparse(val, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) order = get_order(size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) if (order >= MAX_ORDER)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) ima_maxorder = order;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) ima_bufsize = PAGE_SIZE << order;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) static const struct kernel_param_ops param_ops_bufsize = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) .set = param_set_bufsize,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) .get = param_get_uint,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) #define param_check_bufsize(name, p) __param_check(name, p, unsigned int)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) module_param_named(ahash_bufsize, ima_bufsize, bufsize, 0644);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) MODULE_PARM_DESC(ahash_bufsize, "Maximum ahash buffer size");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) static struct crypto_shash *ima_shash_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) static struct crypto_ahash *ima_ahash_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) struct ima_algo_desc {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) struct crypto_shash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) enum hash_algo algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) int ima_sha1_idx __ro_after_init;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) int ima_hash_algo_idx __ro_after_init;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) * Additional number of slots reserved, as needed, for SHA1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) * and IMA default algo.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) int ima_extra_slots __ro_after_init;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) static struct ima_algo_desc *ima_algo_array;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) static int __init ima_init_ima_crypto(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) long rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) ima_shash_tfm = crypto_alloc_shash(hash_algo_name[ima_hash_algo], 0, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) if (IS_ERR(ima_shash_tfm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) rc = PTR_ERR(ima_shash_tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) pr_err("Can not allocate %s (reason: %ld)\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) hash_algo_name[ima_hash_algo], rc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) pr_info("Allocated hash algorithm: %s\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) hash_algo_name[ima_hash_algo]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) static struct crypto_shash *ima_alloc_tfm(enum hash_algo algo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) struct crypto_shash *tfm = ima_shash_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) int rc, i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) if (algo < 0 || algo >= HASH_ALGO__LAST)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) algo = ima_hash_algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) if (algo == ima_hash_algo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) return tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) for (i = 0; i < NR_BANKS(ima_tpm_chip) + ima_extra_slots; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) if (ima_algo_array[i].tfm && ima_algo_array[i].algo == algo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) return ima_algo_array[i].tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) tfm = crypto_alloc_shash(hash_algo_name[algo], 0, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) if (IS_ERR(tfm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) rc = PTR_ERR(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) pr_err("Can not allocate %s (reason: %d)\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) hash_algo_name[algo], rc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) return tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) int __init ima_init_crypto(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) enum hash_algo algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) long rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) rc = ima_init_ima_crypto();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) ima_sha1_idx = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) ima_hash_algo_idx = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) for (i = 0; i < NR_BANKS(ima_tpm_chip); i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) algo = ima_tpm_chip->allocated_banks[i].crypto_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) if (algo == HASH_ALGO_SHA1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) ima_sha1_idx = i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) if (algo == ima_hash_algo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) ima_hash_algo_idx = i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) if (ima_sha1_idx < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) ima_sha1_idx = NR_BANKS(ima_tpm_chip) + ima_extra_slots++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) if (ima_hash_algo == HASH_ALGO_SHA1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) ima_hash_algo_idx = ima_sha1_idx;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) if (ima_hash_algo_idx < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) ima_hash_algo_idx = NR_BANKS(ima_tpm_chip) + ima_extra_slots++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) ima_algo_array = kcalloc(NR_BANKS(ima_tpm_chip) + ima_extra_slots,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) sizeof(*ima_algo_array), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) if (!ima_algo_array) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) rc = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) for (i = 0; i < NR_BANKS(ima_tpm_chip); i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) algo = ima_tpm_chip->allocated_banks[i].crypto_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) ima_algo_array[i].algo = algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) /* unknown TPM algorithm */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) if (algo == HASH_ALGO__LAST)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) if (algo == ima_hash_algo) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) ima_algo_array[i].tfm = ima_shash_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) ima_algo_array[i].tfm = ima_alloc_tfm(algo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) if (IS_ERR(ima_algo_array[i].tfm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) if (algo == HASH_ALGO_SHA1) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) rc = PTR_ERR(ima_algo_array[i].tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) ima_algo_array[i].tfm = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) goto out_array;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) ima_algo_array[i].tfm = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) if (ima_sha1_idx >= NR_BANKS(ima_tpm_chip)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) if (ima_hash_algo == HASH_ALGO_SHA1) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) ima_algo_array[ima_sha1_idx].tfm = ima_shash_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) ima_algo_array[ima_sha1_idx].tfm =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) ima_alloc_tfm(HASH_ALGO_SHA1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) if (IS_ERR(ima_algo_array[ima_sha1_idx].tfm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) rc = PTR_ERR(ima_algo_array[ima_sha1_idx].tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) goto out_array;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) ima_algo_array[ima_sha1_idx].algo = HASH_ALGO_SHA1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) if (ima_hash_algo_idx >= NR_BANKS(ima_tpm_chip) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) ima_hash_algo_idx != ima_sha1_idx) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) ima_algo_array[ima_hash_algo_idx].tfm = ima_shash_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) ima_algo_array[ima_hash_algo_idx].algo = ima_hash_algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) out_array:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) for (i = 0; i < NR_BANKS(ima_tpm_chip) + ima_extra_slots; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) if (!ima_algo_array[i].tfm ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) ima_algo_array[i].tfm == ima_shash_tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) crypto_free_shash(ima_algo_array[i].tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) crypto_free_shash(ima_shash_tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) static void ima_free_tfm(struct crypto_shash *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) if (tfm == ima_shash_tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) for (i = 0; i < NR_BANKS(ima_tpm_chip) + ima_extra_slots; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) if (ima_algo_array[i].tfm == tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) crypto_free_shash(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) * ima_alloc_pages() - Allocate contiguous pages.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) * @max_size: Maximum amount of memory to allocate.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) * @allocated_size: Returned size of actual allocation.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) * @last_warn: Should the min_size allocation warn or not.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) * Tries to do opportunistic allocation for memory first trying to allocate
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) * max_size amount of memory and then splitting that until zero order is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) * reached. Allocation is tried without generating allocation warnings unless
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) * last_warn is set. Last_warn set affects only last allocation of zero order.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) * By default, ima_maxorder is 0 and it is equivalent to kmalloc(GFP_KERNEL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) * Return pointer to allocated memory, or NULL on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) static void *ima_alloc_pages(loff_t max_size, size_t *allocated_size,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) int last_warn)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) void *ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) int order = ima_maxorder;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) gfp_t gfp_mask = __GFP_RECLAIM | __GFP_NOWARN | __GFP_NORETRY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) if (order)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) order = min(get_order(max_size), order);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) for (; order; order--) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) ptr = (void *)__get_free_pages(gfp_mask, order);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) if (ptr) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) *allocated_size = PAGE_SIZE << order;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) return ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) /* order is zero - one page */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) gfp_mask = GFP_KERNEL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) if (!last_warn)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) gfp_mask |= __GFP_NOWARN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) ptr = (void *)__get_free_pages(gfp_mask, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) if (ptr) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) *allocated_size = PAGE_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) return ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) *allocated_size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) * ima_free_pages() - Free pages allocated by ima_alloc_pages().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) * @ptr: Pointer to allocated pages.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) * @size: Size of allocated buffer.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) static void ima_free_pages(void *ptr, size_t size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) if (!ptr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) free_pages((unsigned long)ptr, get_order(size));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) static struct crypto_ahash *ima_alloc_atfm(enum hash_algo algo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) struct crypto_ahash *tfm = ima_ahash_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) if (algo < 0 || algo >= HASH_ALGO__LAST)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) algo = ima_hash_algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) if (algo != ima_hash_algo || !tfm) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) tfm = crypto_alloc_ahash(hash_algo_name[algo], 0, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) if (!IS_ERR(tfm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) if (algo == ima_hash_algo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) ima_ahash_tfm = tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) rc = PTR_ERR(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) pr_err("Can not allocate %s (reason: %d)\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) hash_algo_name[algo], rc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) return tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) static void ima_free_atfm(struct crypto_ahash *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) if (tfm != ima_ahash_tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) crypto_free_ahash(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) static inline int ahash_wait(int err, struct crypto_wait *wait)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) err = crypto_wait_req(err, wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) pr_crit_ratelimited("ahash calculation failed: err: %d\n", err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) static int ima_calc_file_hash_atfm(struct file *file,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) struct ima_digest_data *hash,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) struct crypto_ahash *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) loff_t i_size, offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) char *rbuf[2] = { NULL, };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) int rc, rbuf_len, active = 0, ahash_rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) struct ahash_request *req;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) struct scatterlist sg[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) struct crypto_wait wait;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) size_t rbuf_size[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) hash->length = crypto_ahash_digestsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) req = ahash_request_alloc(tfm, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) if (!req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) crypto_init_wait(&wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) CRYPTO_TFM_REQ_MAY_SLEEP,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) crypto_req_done, &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) rc = ahash_wait(crypto_ahash_init(req), &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) goto out1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) i_size = i_size_read(file_inode(file));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) if (i_size == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) goto out2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) * Try to allocate maximum size of memory.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) * Fail if even a single page cannot be allocated.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) rbuf[0] = ima_alloc_pages(i_size, &rbuf_size[0], 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) if (!rbuf[0]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) rc = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) goto out1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) /* Only allocate one buffer if that is enough. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) if (i_size > rbuf_size[0]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) * Try to allocate secondary buffer. If that fails fallback to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) * using single buffering. Use previous memory allocation size
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) * as baseline for possible allocation size.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) rbuf[1] = ima_alloc_pages(i_size - rbuf_size[0],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) &rbuf_size[1], 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) for (offset = 0; offset < i_size; offset += rbuf_len) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) if (!rbuf[1] && offset) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) /* Not using two buffers, and it is not the first
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) * read/request, wait for the completion of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) * previous ahash_update() request.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) rc = ahash_wait(ahash_rc, &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) goto out3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) /* read buffer */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) rc = integrity_kernel_read(file, offset, rbuf[active],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) rbuf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) if (rc != rbuf_len) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) if (rc >= 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) rc = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) * Forward current rc, do not overwrite with return value
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) * from ahash_wait()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) ahash_wait(ahash_rc, &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) goto out3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) if (rbuf[1] && offset) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) /* Using two buffers, and it is not the first
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) * read/request, wait for the completion of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) * previous ahash_update() request.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) rc = ahash_wait(ahash_rc, &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) goto out3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) sg_init_one(&sg[0], rbuf[active], rbuf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) ahash_request_set_crypt(req, sg, NULL, rbuf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) ahash_rc = crypto_ahash_update(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) if (rbuf[1])
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) active = !active; /* swap buffers, if we use two */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) /* wait for the last update request to complete */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) rc = ahash_wait(ahash_rc, &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) out3:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) ima_free_pages(rbuf[0], rbuf_size[0]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) ima_free_pages(rbuf[1], rbuf_size[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) out2:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) if (!rc) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) ahash_request_set_crypt(req, NULL, hash->digest, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) rc = ahash_wait(crypto_ahash_final(req), &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) out1:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) ahash_request_free(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) static int ima_calc_file_ahash(struct file *file, struct ima_digest_data *hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) struct crypto_ahash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) tfm = ima_alloc_atfm(hash->algo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) if (IS_ERR(tfm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) return PTR_ERR(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) rc = ima_calc_file_hash_atfm(file, hash, tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) ima_free_atfm(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) static int ima_calc_file_hash_tfm(struct file *file,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) struct ima_digest_data *hash,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) struct crypto_shash *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) loff_t i_size, offset = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) char *rbuf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) SHASH_DESC_ON_STACK(shash, tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) shash->tfm = tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) hash->length = crypto_shash_digestsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) rc = crypto_shash_init(shash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) i_size = i_size_read(file_inode(file));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) if (i_size == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) rbuf = kzalloc(PAGE_SIZE, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) if (!rbuf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) while (offset < i_size) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) int rbuf_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) rbuf_len = integrity_kernel_read(file, offset, rbuf, PAGE_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) if (rbuf_len < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) rc = rbuf_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) if (rbuf_len == 0) { /* unexpected EOF */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) rc = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) offset += rbuf_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) rc = crypto_shash_update(shash, rbuf, rbuf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) kfree(rbuf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) if (!rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) rc = crypto_shash_final(shash, hash->digest);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) static int ima_calc_file_shash(struct file *file, struct ima_digest_data *hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) struct crypto_shash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) tfm = ima_alloc_tfm(hash->algo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) if (IS_ERR(tfm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) return PTR_ERR(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515) rc = ima_calc_file_hash_tfm(file, hash, tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) ima_free_tfm(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) * ima_calc_file_hash - calculate file hash
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525) * Asynchronous hash (ahash) allows using HW acceleration for calculating
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526) * a hash. ahash performance varies for different data sizes on different
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) * crypto accelerators. shash performance might be better for smaller files.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528) * The 'ima.ahash_minsize' module parameter allows specifying the best
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) * minimum file size for using ahash on the system.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) * If the ima.ahash_minsize parameter is not specified, this function uses
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) * shash for the hash calculation. If ahash fails, it falls back to using
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) * shash.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) loff_t i_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539) struct file *f = file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540) bool new_file_instance = false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) * For consistency, fail file's opened with the O_DIRECT flag on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) * filesystems mounted with/without DAX option.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) if (file->f_flags & O_DIRECT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547) hash->length = hash_digest_size[ima_hash_algo];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) hash->algo = ima_hash_algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) /* Open a new file instance in O_RDONLY if we cannot read */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) if (!(file->f_mode & FMODE_READ)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) int flags = file->f_flags & ~(O_WRONLY | O_APPEND |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555) O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) flags |= O_RDONLY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) f = dentry_open(&file->f_path, flags, file->f_cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) if (IS_ERR(f))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) return PTR_ERR(f);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) new_file_instance = true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) i_size = i_size_read(file_inode(f));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567) rc = ima_calc_file_ahash(f, hash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) if (!rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) rc = ima_calc_file_shash(f, hash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574) if (new_file_instance)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) fput(f);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580) * Calculate the hash of template data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582) static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583) struct ima_template_entry *entry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) int tfm_idx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586) SHASH_DESC_ON_STACK(shash, ima_algo_array[tfm_idx].tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587) struct ima_template_desc *td = entry->template_desc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) int num_fields = entry->template_desc->num_fields;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589) int rc, i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) shash->tfm = ima_algo_array[tfm_idx].tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) rc = crypto_shash_init(shash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597) for (i = 0; i < num_fields; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) u8 buffer[IMA_EVENT_NAME_LEN_MAX + 1] = { 0 };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599) u8 *data_to_hash = field_data[i].data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600) u32 datalen = field_data[i].len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601) u32 datalen_to_hash =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602) !ima_canonical_fmt ? datalen : cpu_to_le32(datalen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604) if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605) rc = crypto_shash_update(shash,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606) (const u8 *) &datalen_to_hash,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607) sizeof(datalen_to_hash));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610) } else if (strcmp(td->fields[i]->field_id, "n") == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) memcpy(buffer, data_to_hash, datalen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) data_to_hash = buffer;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 613) datalen = IMA_EVENT_NAME_LEN_MAX + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 614) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 615) rc = crypto_shash_update(shash, data_to_hash, datalen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 616) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 617) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 618) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 619)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 620) if (!rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 621) rc = crypto_shash_final(shash, entry->digests[tfm_idx].digest);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 622)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 623) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 624) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 625)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 626) int ima_calc_field_array_hash(struct ima_field_data *field_data,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 627) struct ima_template_entry *entry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 628) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 629) u16 alg_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 630) int rc, i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 631)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 632) rc = ima_calc_field_array_hash_tfm(field_data, entry, ima_sha1_idx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 633) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 634) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 635)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 636) entry->digests[ima_sha1_idx].alg_id = TPM_ALG_SHA1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 637)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 638) for (i = 0; i < NR_BANKS(ima_tpm_chip) + ima_extra_slots; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 639) if (i == ima_sha1_idx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 640) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 641)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 642) if (i < NR_BANKS(ima_tpm_chip)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 643) alg_id = ima_tpm_chip->allocated_banks[i].alg_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 644) entry->digests[i].alg_id = alg_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 645) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 646)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 647) /* for unmapped TPM algorithms digest is still a padded SHA1 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 648) if (!ima_algo_array[i].tfm) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 649) memcpy(entry->digests[i].digest,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 650) entry->digests[ima_sha1_idx].digest,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 651) TPM_DIGEST_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 652) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 653) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 654)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 655) rc = ima_calc_field_array_hash_tfm(field_data, entry, i);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 656) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 657) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 658) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 659) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 660) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 661)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 662) static int calc_buffer_ahash_atfm(const void *buf, loff_t len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 663) struct ima_digest_data *hash,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 664) struct crypto_ahash *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 665) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 666) struct ahash_request *req;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 667) struct scatterlist sg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 668) struct crypto_wait wait;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 669) int rc, ahash_rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 670)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 671) hash->length = crypto_ahash_digestsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 672)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 673) req = ahash_request_alloc(tfm, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 674) if (!req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 675) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 676)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 677) crypto_init_wait(&wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 678) ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 679) CRYPTO_TFM_REQ_MAY_SLEEP,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 680) crypto_req_done, &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 681)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 682) rc = ahash_wait(crypto_ahash_init(req), &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 683) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 684) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 685)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 686) sg_init_one(&sg, buf, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 687) ahash_request_set_crypt(req, &sg, NULL, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 688)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 689) ahash_rc = crypto_ahash_update(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 690)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 691) /* wait for the update request to complete */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 692) rc = ahash_wait(ahash_rc, &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 693) if (!rc) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 694) ahash_request_set_crypt(req, NULL, hash->digest, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 695) rc = ahash_wait(crypto_ahash_final(req), &wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 696) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 697) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 698) ahash_request_free(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 699) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 700) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 701)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 702) static int calc_buffer_ahash(const void *buf, loff_t len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 703) struct ima_digest_data *hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 704) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 705) struct crypto_ahash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 706) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 707)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 708) tfm = ima_alloc_atfm(hash->algo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 709) if (IS_ERR(tfm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 710) return PTR_ERR(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 711)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 712) rc = calc_buffer_ahash_atfm(buf, len, hash, tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 713)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 714) ima_free_atfm(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 715)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 716) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 717) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 718)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 719) static int calc_buffer_shash_tfm(const void *buf, loff_t size,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 720) struct ima_digest_data *hash,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 721) struct crypto_shash *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 722) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 723) SHASH_DESC_ON_STACK(shash, tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 724) unsigned int len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 725) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 726)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 727) shash->tfm = tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 728)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 729) hash->length = crypto_shash_digestsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 730)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 731) rc = crypto_shash_init(shash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 732) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 733) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 734)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 735) while (size) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 736) len = size < PAGE_SIZE ? size : PAGE_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 737) rc = crypto_shash_update(shash, buf, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 738) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 739) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 740) buf += len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 741) size -= len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 742) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 743)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 744) if (!rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 745) rc = crypto_shash_final(shash, hash->digest);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 746) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 747) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 748)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 749) static int calc_buffer_shash(const void *buf, loff_t len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 750) struct ima_digest_data *hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 751) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 752) struct crypto_shash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 753) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 754)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 755) tfm = ima_alloc_tfm(hash->algo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 756) if (IS_ERR(tfm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 757) return PTR_ERR(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 758)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 759) rc = calc_buffer_shash_tfm(buf, len, hash, tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 760)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 761) ima_free_tfm(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 762) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 763) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 764)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 765) int ima_calc_buffer_hash(const void *buf, loff_t len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 766) struct ima_digest_data *hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 767) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 768) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 769)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 770) if (ima_ahash_minsize && len >= ima_ahash_minsize) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 771) rc = calc_buffer_ahash(buf, len, hash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 772) if (!rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 773) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 774) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 775)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 776) return calc_buffer_shash(buf, len, hash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 777) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 778)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 779) static void ima_pcrread(u32 idx, struct tpm_digest *d)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 780) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 781) if (!ima_tpm_chip)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 782) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 783)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 784) if (tpm_pcr_read(ima_tpm_chip, idx, d) != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 785) pr_err("Error Communicating to TPM chip\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 786) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 787)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 788) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 789) * The boot_aggregate is a cumulative hash over TPM registers 0 - 7. With
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 790) * TPM 1.2 the boot_aggregate was based on reading the SHA1 PCRs, but with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 791) * TPM 2.0 hash agility, TPM chips could support multiple TPM PCR banks,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 792) * allowing firmware to configure and enable different banks.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 793) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 794) * Knowing which TPM bank is read to calculate the boot_aggregate digest
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 795) * needs to be conveyed to a verifier. For this reason, use the same
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 796) * hash algorithm for reading the TPM PCRs as for calculating the boot
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 797) * aggregate digest as stored in the measurement list.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 798) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 799) static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 800) struct crypto_shash *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 801) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 802) struct tpm_digest d = { .alg_id = alg_id, .digest = {0} };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 803) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 804) u32 i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 805) SHASH_DESC_ON_STACK(shash, tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 806)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 807) shash->tfm = tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 808)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 809) pr_devel("calculating the boot-aggregate based on TPM bank: %04x\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 810) d.alg_id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 811)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 812) rc = crypto_shash_init(shash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 813) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 814) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 815)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 816) /* cumulative digest over TPM registers 0-7 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 817) for (i = TPM_PCR0; i < TPM_PCR8; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 818) ima_pcrread(i, &d);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 819) /* now accumulate with current aggregate */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 820) rc = crypto_shash_update(shash, d.digest,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 821) crypto_shash_digestsize(tfm));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 822) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 823) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 824) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 825) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 826) * Extend cumulative digest over TPM registers 8-9, which contain
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 827) * measurement for the kernel command line (reg. 8) and image (reg. 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 828) * in a typical PCR allocation. Registers 8-9 are only included in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 829) * non-SHA1 boot_aggregate digests to avoid ambiguity.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 830) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 831) if (alg_id != TPM_ALG_SHA1) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 832) for (i = TPM_PCR8; i < TPM_PCR10; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 833) ima_pcrread(i, &d);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 834) rc = crypto_shash_update(shash, d.digest,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 835) crypto_shash_digestsize(tfm));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 836) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 837) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 838) if (!rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 839) crypto_shash_final(shash, digest);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 840) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 841) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 842)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 843) int ima_calc_boot_aggregate(struct ima_digest_data *hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 844) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 845) struct crypto_shash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 846) u16 crypto_id, alg_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 847) int rc, i, bank_idx = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 848)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 849) for (i = 0; i < ima_tpm_chip->nr_allocated_banks; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 850) crypto_id = ima_tpm_chip->allocated_banks[i].crypto_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 851) if (crypto_id == hash->algo) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 852) bank_idx = i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 853) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 854) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 855)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 856) if (crypto_id == HASH_ALGO_SHA256)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 857) bank_idx = i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 858)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 859) if (bank_idx == -1 && crypto_id == HASH_ALGO_SHA1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 860) bank_idx = i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 861) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 862)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 863) if (bank_idx == -1) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 864) pr_err("No suitable TPM algorithm for boot aggregate\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 865) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 866) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 867)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 868) hash->algo = ima_tpm_chip->allocated_banks[bank_idx].crypto_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 869)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 870) tfm = ima_alloc_tfm(hash->algo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 871) if (IS_ERR(tfm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 872) return PTR_ERR(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 873)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 874) hash->length = crypto_shash_digestsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 875) alg_id = ima_tpm_chip->allocated_banks[bank_idx].alg_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 876) rc = ima_calc_boot_aggregate_tfm(hash->digest, alg_id, tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 877)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 878) ima_free_tfm(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 879)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 880) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 881) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags