ima_queue_keys.c 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (C) 2019 Microsoft Corporation
  4. *
  5. * Author: Lakshmi Ramasubramanian ([email protected])
  6. *
  7. * File: ima_queue_keys.c
  8. * Enables deferred processing of keys
  9. */
  10. #include <linux/user_namespace.h>
  11. #include <linux/workqueue.h>
  12. #include <keys/asymmetric-type.h>
  13. #include "ima.h"
  14. /*
  15. * Flag to indicate whether a key can be processed
  16. * right away or should be queued for processing later.
  17. */
  18. static bool ima_process_keys;
  19. /*
  20. * To synchronize access to the list of keys that need to be measured
  21. */
  22. static DEFINE_MUTEX(ima_keys_lock);
  23. static LIST_HEAD(ima_keys);
  24. /*
  25. * If custom IMA policy is not loaded then keys queued up
  26. * for measurement should be freed. This worker is used
  27. * for handling this scenario.
  28. */
  29. static long ima_key_queue_timeout = 300000; /* 5 Minutes */
  30. static void ima_keys_handler(struct work_struct *work);
  31. static DECLARE_DELAYED_WORK(ima_keys_delayed_work, ima_keys_handler);
  32. static bool timer_expired;
  33. /*
  34. * This worker function frees keys that may still be
  35. * queued up in case custom IMA policy was not loaded.
  36. */
  37. static void ima_keys_handler(struct work_struct *work)
  38. {
  39. timer_expired = true;
  40. ima_process_queued_keys();
  41. }
  42. /*
  43. * This function sets up a worker to free queued keys in case
  44. * custom IMA policy was never loaded.
  45. */
  46. void ima_init_key_queue(void)
  47. {
  48. schedule_delayed_work(&ima_keys_delayed_work,
  49. msecs_to_jiffies(ima_key_queue_timeout));
  50. }
  51. static void ima_free_key_entry(struct ima_key_entry *entry)
  52. {
  53. if (entry) {
  54. kfree(entry->payload);
  55. kfree(entry->keyring_name);
  56. kfree(entry);
  57. }
  58. }
  59. static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring,
  60. const void *payload,
  61. size_t payload_len)
  62. {
  63. int rc = 0;
  64. const char *audit_cause = "ENOMEM";
  65. struct ima_key_entry *entry;
  66. entry = kzalloc(sizeof(*entry), GFP_KERNEL);
  67. if (entry) {
  68. entry->payload = kmemdup(payload, payload_len, GFP_KERNEL);
  69. entry->keyring_name = kstrdup(keyring->description,
  70. GFP_KERNEL);
  71. entry->payload_len = payload_len;
  72. }
  73. if ((entry == NULL) || (entry->payload == NULL) ||
  74. (entry->keyring_name == NULL)) {
  75. rc = -ENOMEM;
  76. goto out;
  77. }
  78. INIT_LIST_HEAD(&entry->list);
  79. out:
  80. if (rc) {
  81. integrity_audit_message(AUDIT_INTEGRITY_PCR, NULL,
  82. keyring->description,
  83. func_measure_str(KEY_CHECK),
  84. audit_cause, rc, 0, rc);
  85. ima_free_key_entry(entry);
  86. entry = NULL;
  87. }
  88. return entry;
  89. }
  90. bool ima_queue_key(struct key *keyring, const void *payload,
  91. size_t payload_len)
  92. {
  93. bool queued = false;
  94. struct ima_key_entry *entry;
  95. entry = ima_alloc_key_entry(keyring, payload, payload_len);
  96. if (!entry)
  97. return false;
  98. mutex_lock(&ima_keys_lock);
  99. if (!ima_process_keys) {
  100. list_add_tail(&entry->list, &ima_keys);
  101. queued = true;
  102. }
  103. mutex_unlock(&ima_keys_lock);
  104. if (!queued)
  105. ima_free_key_entry(entry);
  106. return queued;
  107. }
  108. /*
  109. * ima_process_queued_keys() - process keys queued for measurement
  110. *
  111. * This function sets ima_process_keys to true and processes queued keys.
  112. * From here on keys will be processed right away (not queued).
  113. */
  114. void ima_process_queued_keys(void)
  115. {
  116. struct ima_key_entry *entry, *tmp;
  117. bool process = false;
  118. if (ima_process_keys)
  119. return;
  120. /*
  121. * Since ima_process_keys is set to true, any new key will be
  122. * processed immediately and not be queued to ima_keys list.
  123. * First one setting the ima_process_keys flag to true will
  124. * process the queued keys.
  125. */
  126. mutex_lock(&ima_keys_lock);
  127. if (!ima_process_keys) {
  128. ima_process_keys = true;
  129. process = true;
  130. }
  131. mutex_unlock(&ima_keys_lock);
  132. if (!process)
  133. return;
  134. if (!timer_expired)
  135. cancel_delayed_work_sync(&ima_keys_delayed_work);
  136. list_for_each_entry_safe(entry, tmp, &ima_keys, list) {
  137. if (!timer_expired)
  138. process_buffer_measurement(&init_user_ns, NULL,
  139. entry->payload,
  140. entry->payload_len,
  141. entry->keyring_name,
  142. KEY_CHECK, 0,
  143. entry->keyring_name,
  144. false, NULL, 0);
  145. list_del(&entry->list);
  146. ima_free_key_entry(entry);
  147. }
  148. }
  149. inline bool ima_should_queue_key(void)
  150. {
  151. return !ima_process_keys;
  152. }