security/integrity/ima/ima_policy.c

   1 /*
   2  * Copyright (C) 2008 IBM Corporation
   3  * Author: Mimi Zohar <zohar@us.ibm.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, version 2 of the License.
   8  *
   9  * ima_policy.c
  10  *      - initialize default measure policy rules
  11  *
  12  */
  13 #include <linux/init.h>
  14 #include <linux/list.h>
  15 #include <linux/fs.h>
  16 #include <linux/security.h>
  17 #include <linux/magic.h>
  18 #include <linux/parser.h>
  19 #include <linux/slab.h>
  20 #include <linux/rculist.h>
  21 #include <linux/genhd.h>
  22 #include <linux/seq_file.h>
  23
  24 #include "ima.h"
  25
  26 /* flags definitions */
  27 #define IMA_FUNC        0x0001
  28 #define IMA_MASK        0x0002
  29 #define IMA_FSMAGIC     0x0004
  30 #define IMA_UID         0x0008
  31 #define IMA_FOWNER      0x0010
  32 #define IMA_FSUUID      0x0020
  33 #define IMA_INMASK      0x0040
  34 #define IMA_EUID        0x0080
  35 #define IMA_PCR         0x0100
  36 #define IMA_FSNAME      0x0200
  37
  38 #define UNKNOWN         0
  39 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  40 #define DONT_MEASURE    0x0002
  41 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  42 #define DONT_APPRAISE   0x0008
  43 #define AUDIT           0x0040
  44 #define HASH            0x0100
  45 #define DONT_HASH       0x0200
  46
  47 #define INVALID_PCR(a) (((a) < 0) || \
  48         (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8))
  49
  50 int ima_policy_flag;
  51 static int temp_ima_appraise;
  52 static int build_ima_appraise __ro_after_init;
  53
  54 #define MAX_LSM_RULES 6
  55 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  56         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  57 };
  58
  59 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  60
  61 struct ima_rule_entry {
  62         struct list_head list;
  63         int action;
  64         unsigned int flags;
  65         enum ima_hooks func;
  66         int mask;
  67         unsigned long fsmagic;
  68         uuid_t fsuuid;
  69         kuid_t uid;
  70         kuid_t fowner;
  71         bool (*uid_op)(kuid_t, kuid_t);    /* Handlers for operators       */
  72         bool (*fowner_op)(kuid_t, kuid_t); /* uid_eq(), uid_gt(), uid_lt() */
  73         int pcr;
  74         struct {
  75                 void *rule;     /* LSM file metadata specific */
  76                 void *args_p;   /* audit value */
  77                 int type;       /* audit type */
  78         } lsm[MAX_LSM_RULES];
  79         char *fsname;
  80 };
  81
  82 /*
  83  * Without LSM specific knowledge, the default policy can only be
  84  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  85  */
  86
  87 /*
  88  * The minimum rule set to allow for full TCB coverage.  Measures all files
  89  * opened or mmap for exec and everything read by root.  Dangerous because
  90  * normal users can easily run the machine out of memory simply building
  91  * and running executables.
  92  */
  93 static struct ima_rule_entry dont_measure_rules[] __ro_after_init = {
  94         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  95         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
  96         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
  97         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
  98         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  99         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 100         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 101         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 102         {.action = DONT_MEASURE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
 103         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
 104          .flags = IMA_FSMAGIC},
 105         {.action = DONT_MEASURE, .fsmagic = CGROUP2_SUPER_MAGIC,
 106          .flags = IMA_FSMAGIC},
 107         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
 108 };
 109
 110 static struct ima_rule_entry original_measurement_rules[] __ro_after_init = {
 111         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 112          .flags = IMA_FUNC | IMA_MASK},
 113         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 114          .flags = IMA_FUNC | IMA_MASK},
 115         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 116          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 117          .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 118         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 119         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 120 };
 121
 122 static struct ima_rule_entry default_measurement_rules[] __ro_after_init = {
 123         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 124          .flags = IMA_FUNC | IMA_MASK},
 125         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 126          .flags = IMA_FUNC | IMA_MASK},
 127         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 128          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 129          .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 130         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 131          .uid = GLOBAL_ROOT_UID, .uid_op = &uid_eq,
 132          .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 133         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 134         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 135         {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
 136 };
 137
 138 static struct ima_rule_entry default_appraise_rules[] __ro_after_init = {
 139         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 140         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 141         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 142         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 143         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 144         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 145         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 146         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 147         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 148         {.action = DONT_APPRAISE, .fsmagic = SMACK_MAGIC, .flags = IMA_FSMAGIC},
 149         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 150         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 151         {.action = DONT_APPRAISE, .fsmagic = CGROUP2_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 152 #ifdef CONFIG_IMA_WRITE_POLICY
 153         {.action = APPRAISE, .func = POLICY_CHECK,
 154         .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 155 #endif
 156 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 157         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
 158          .flags = IMA_FOWNER},
 159 #else
 160         /* force signature */
 161         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .fowner_op = &uid_eq,
 162          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 163 #endif
 164 };
 165
 166 static struct ima_rule_entry build_appraise_rules[] __ro_after_init = {
 167 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS
 168         {.action = APPRAISE, .func = MODULE_CHECK,
 169          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 170 #endif
 171 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS
 172         {.action = APPRAISE, .func = FIRMWARE_CHECK,
 173          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 174 #endif
 175 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS
 176         {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
 177          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 178 #endif
 179 #ifdef CONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS
 180         {.action = APPRAISE, .func = POLICY_CHECK,
 181          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 182 #endif
 183 };
 184
 185 static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
 186         {.action = APPRAISE, .func = MODULE_CHECK,
 187          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 188         {.action = APPRAISE, .func = FIRMWARE_CHECK,
 189          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 190         {.action = APPRAISE, .func = KEXEC_KERNEL_CHECK,
 191          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 192         {.action = APPRAISE, .func = POLICY_CHECK,
 193          .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 194 };
 195
 196 static LIST_HEAD(ima_default_rules);
 197 static LIST_HEAD(ima_policy_rules);
 198 static LIST_HEAD(ima_temp_rules);
 199 static struct list_head *ima_rules;
 200
 201 static int ima_policy __initdata;
 202
 203 static int __init default_measure_policy_setup(char *str)
 204 {
 205         if (ima_policy)
 206                 return 1;
 207
 208         ima_policy = ORIGINAL_TCB;
 209         return 1;
 210 }
 211 __setup("ima_tcb", default_measure_policy_setup);
 212
 213 static bool ima_use_appraise_tcb __initdata;
 214 static bool ima_use_secure_boot __initdata;
 215 static bool ima_fail_unverifiable_sigs __ro_after_init;
 216 static int __init policy_setup(char *str)
 217 {
 218         char *p;
 219
 220         while ((p = strsep(&str, " |\n")) != NULL) {
 221                 if (*p == ' ')
 222                         continue;
 223                 if ((strcmp(p, "tcb") == 0) && !ima_policy)
 224                         ima_policy = DEFAULT_TCB;
 225                 else if (strcmp(p, "appraise_tcb") == 0)
 226                         ima_use_appraise_tcb = true;
 227                 else if (strcmp(p, "secure_boot") == 0)
 228                         ima_use_secure_boot = true;
 229                 else if (strcmp(p, "fail_securely") == 0)
 230                         ima_fail_unverifiable_sigs = true;
 231         }
 232
 233         return 1;
 234 }
 235 __setup("ima_policy=", policy_setup);
 236
 237 static int __init default_appraise_policy_setup(char *str)
 238 {
 239         ima_use_appraise_tcb = true;
 240         return 1;
 241 }
 242 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 243
 244 /*
 245  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 246  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 247  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
 248  * they don't.
 249  */
 250 static void ima_lsm_update_rules(void)
 251 {
 252         struct ima_rule_entry *entry;
 253         int result;
 254         int i;
 255
 256         list_for_each_entry(entry, &ima_policy_rules, list) {
 257                 for (i = 0; i < MAX_LSM_RULES; i++) {
 258                         if (!entry->lsm[i].rule)
 259                                 continue;
 260                         result = security_filter_rule_init(entry->lsm[i].type,
 261                                                            Audit_equal,
 262                                                            entry->lsm[i].args_p,
 263                                                            &entry->lsm[i].rule);
 264                         BUG_ON(!entry->lsm[i].rule);
 265                 }
 266         }
 267 }
 268
 269 /**
 270  * ima_match_rules - determine whether an inode matches the measure rule.
 271  * @rule: a pointer to a rule
 272  * @inode: a pointer to an inode
 273  * @cred: a pointer to a credentials structure for user validation
 274  * @secid: the secid of the task to be validated
 275  * @func: LIM hook identifier
 276  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 277  *
 278  * Returns true on rule match, false on failure.
 279  */
 280 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 281                             const struct cred *cred, u32 secid,
 282                             enum ima_hooks func, int mask)
 283 {
 284         int i;
 285
 286         if ((rule->flags & IMA_FUNC) &&
 287             (rule->func != func && func != POST_SETATTR))
 288                 return false;
 289         if ((rule->flags & IMA_MASK) &&
 290             (rule->mask != mask && func != POST_SETATTR))
 291                 return false;
 292         if ((rule->flags & IMA_INMASK) &&
 293             (!(rule->mask & mask) && func != POST_SETATTR))
 294                 return false;
 295         if ((rule->flags & IMA_FSMAGIC)
 296             && rule->fsmagic != inode->i_sb->s_magic)
 297                 return false;
 298         if ((rule->flags & IMA_FSNAME)
 299             && strcmp(rule->fsname, inode->i_sb->s_type->name))
 300                 return false;
 301         if ((rule->flags & IMA_FSUUID) &&
 302             !uuid_equal(&rule->fsuuid, &inode->i_sb->s_uuid))
 303                 return false;
 304         if ((rule->flags & IMA_UID) && !rule->uid_op(cred->uid, rule->uid))
 305                 return false;
 306         if (rule->flags & IMA_EUID) {
 307                 if (has_capability_noaudit(current, CAP_SETUID)) {
 308                         if (!rule->uid_op(cred->euid, rule->uid)
 309                             && !rule->uid_op(cred->suid, rule->uid)
 310                             && !rule->uid_op(cred->uid, rule->uid))
 311                                 return false;
 312                 } else if (!rule->uid_op(cred->euid, rule->uid))
 313                         return false;
 314         }
 315
 316         if ((rule->flags & IMA_FOWNER) &&
 317             !rule->fowner_op(inode->i_uid, rule->fowner))
 318                 return false;
 319         for (i = 0; i < MAX_LSM_RULES; i++) {
 320                 int rc = 0;
 321                 u32 osid;
 322                 int retried = 0;
 323
 324                 if (!rule->lsm[i].rule)
 325                         continue;
 326 retry:
 327                 switch (i) {
 328                 case LSM_OBJ_USER:
 329                 case LSM_OBJ_ROLE:
 330                 case LSM_OBJ_TYPE:
 331                         security_inode_getsecid(inode, &osid);
 332                         rc = security_filter_rule_match(osid,
 333                                                         rule->lsm[i].type,
 334                                                         Audit_equal,
 335                                                         rule->lsm[i].rule,
 336                                                         NULL);
 337                         break;
 338                 case LSM_SUBJ_USER:
 339                 case LSM_SUBJ_ROLE:
 340                 case LSM_SUBJ_TYPE:
 341                         rc = security_filter_rule_match(secid,
 342                                                         rule->lsm[i].type,
 343                                                         Audit_equal,
 344                                                         rule->lsm[i].rule,
 345                                                         NULL);
 346                 default:
 347                         break;
 348                 }
 349                 if ((rc < 0) && (!retried)) {
 350                         retried = 1;
 351                         ima_lsm_update_rules();
 352                         goto retry;
 353                 }
 354                 if (!rc)
 355                         return false;
 356         }
 357         return true;
 358 }
 359
 360 /*
 361  * In addition to knowing that we need to appraise the file in general,
 362  * we need to differentiate between calling hooks, for hook specific rules.
 363  */
 364 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
 365 {
 366         if (!(rule->flags & IMA_FUNC))
 367                 return IMA_FILE_APPRAISE;
 368
 369         switch (func) {
 370         case MMAP_CHECK:
 371                 return IMA_MMAP_APPRAISE;
 372         case BPRM_CHECK:
 373                 return IMA_BPRM_APPRAISE;
 374         case CREDS_CHECK:
 375                 return IMA_CREDS_APPRAISE;
 376         case FILE_CHECK:
 377         case POST_SETATTR:
 378                 return IMA_FILE_APPRAISE;
 379         case MODULE_CHECK ... MAX_CHECK - 1:
 380         default:
 381                 return IMA_READ_APPRAISE;
 382         }
 383 }
 384
 385 /**
 386  * ima_match_policy - decision based on LSM and other conditions
 387  * @inode: pointer to an inode for which the policy decision is being made
 388  * @cred: pointer to a credentials structure for which the policy decision is
 389  *        being made
 390  * @secid: LSM secid of the task to be validated
 391  * @func: IMA hook identifier
 392  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 393  * @pcr: set the pcr to extend
 394  *
 395  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 396  * conditions.
 397  *
 398  * Since the IMA policy may be updated multiple times we need to lock the
 399  * list when walking it.  Reads are many orders of magnitude more numerous
 400  * than writes so ima_match_policy() is classical RCU candidate.
 401  */
 402 int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
 403                      enum ima_hooks func, int mask, int flags, int *pcr)
 404 {
 405         struct ima_rule_entry *entry;
 406         int action = 0, actmask = flags | (flags << 1);
 407
 408         rcu_read_lock();
 409         list_for_each_entry_rcu(entry, ima_rules, list) {
 410
 411                 if (!(entry->action & actmask))
 412                         continue;
 413
 414                 if (!ima_match_rules(entry, inode, cred, secid, func, mask))
 415                         continue;
 416
 417                 action |= entry->flags & IMA_ACTION_FLAGS;
 418
 419                 action |= entry->action & IMA_DO_MASK;
 420                 if (entry->action & IMA_APPRAISE) {
 421                         action |= get_subaction(entry, func);
 422                         action &= ~IMA_HASH;
 423                         if (ima_fail_unverifiable_sigs)
 424                                 action |= IMA_FAIL_UNVERIFIABLE_SIGS;
 425                 }
 426
 427                 if (entry->action & IMA_DO_MASK)
 428                         actmask &= ~(entry->action | entry->action << 1);
 429                 else
 430                         actmask &= ~(entry->action | entry->action >> 1);
 431
 432                 if ((pcr) && (entry->flags & IMA_PCR))
 433                         *pcr = entry->pcr;
 434
 435                 if (!actmask)
 436                         break;
 437         }
 438         rcu_read_unlock();
 439
 440         return action;
 441 }
 442
 443 /*
 444  * Initialize the ima_policy_flag variable based on the currently
 445  * loaded policy.  Based on this flag, the decision to short circuit
 446  * out of a function or not call the function in the first place
 447  * can be made earlier.
 448  */
 449 void ima_update_policy_flag(void)
 450 {
 451         struct ima_rule_entry *entry;
 452
 453         list_for_each_entry(entry, ima_rules, list) {
 454                 if (entry->action & IMA_DO_MASK)
 455                         ima_policy_flag |= entry->action;
 456         }
 457
 458         ima_appraise |= (build_ima_appraise | temp_ima_appraise);
 459         if (!ima_appraise)
 460                 ima_policy_flag &= ~IMA_APPRAISE;
 461 }
 462
 463 static int ima_appraise_flag(enum ima_hooks func)
 464 {
 465         if (func == MODULE_CHECK)
 466                 return IMA_APPRAISE_MODULES;
 467         else if (func == FIRMWARE_CHECK)
 468                 return IMA_APPRAISE_FIRMWARE;
 469         else if (func == POLICY_CHECK)
 470                 return IMA_APPRAISE_POLICY;
 471         else if (func == KEXEC_KERNEL_CHECK)
 472                 return IMA_APPRAISE_KEXEC;
 473         return 0;
 474 }
 475
 476 /**
 477  * ima_init_policy - initialize the default measure rules.
 478  *
 479  * ima_rules points to either the ima_default_rules or the
 480  * the new ima_policy_rules.
 481  */
 482 void __init ima_init_policy(void)
 483 {
 484         int i, measure_entries, appraise_entries, secure_boot_entries;
 485
 486         /* if !ima_policy set entries = 0 so we load NO default rules */
 487         measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 488         appraise_entries = ima_use_appraise_tcb ?
 489                          ARRAY_SIZE(default_appraise_rules) : 0;
 490         secure_boot_entries = ima_use_secure_boot ?
 491                         ARRAY_SIZE(secure_boot_rules) : 0;
 492
 493         for (i = 0; i < measure_entries; i++)
 494                 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
 495
 496         switch (ima_policy) {
 497         case ORIGINAL_TCB:
 498                 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
 499                         list_add_tail(&original_measurement_rules[i].list,
 500                                       &ima_default_rules);
 501                 break;
 502         case DEFAULT_TCB:
 503                 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
 504                         list_add_tail(&default_measurement_rules[i].list,
 505                                       &ima_default_rules);
 506         default:
 507                 break;
 508         }
 509
 510         /*
 511          * Insert the builtin "secure_boot" policy rules requiring file
 512          * signatures, prior to any other appraise rules.
 513          */
 514         for (i = 0; i < secure_boot_entries; i++) {
 515                 list_add_tail(&secure_boot_rules[i].list, &ima_default_rules);
 516                 temp_ima_appraise |=
 517                     ima_appraise_flag(secure_boot_rules[i].func);
 518         }
 519
 520         /*
 521          * Insert the build time appraise rules requiring file signatures
 522          * for both the initial and custom policies, prior to other appraise
 523          * rules.
 524          */
 525         for (i = 0; i < ARRAY_SIZE(build_appraise_rules); i++) {
 526                 struct ima_rule_entry *entry;
 527
 528                 if (!secure_boot_entries)
 529                         list_add_tail(&build_appraise_rules[i].list,
 530                                       &ima_default_rules);
 531
 532                 entry = kmemdup(&build_appraise_rules[i], sizeof(*entry),
 533                                 GFP_KERNEL);
 534                 if (entry)
 535                         list_add_tail(&entry->list, &ima_policy_rules);
 536                 build_ima_appraise |=
 537                         ima_appraise_flag(build_appraise_rules[i].func);
 538         }
 539
 540         for (i = 0; i < appraise_entries; i++) {
 541                 list_add_tail(&default_appraise_rules[i].list,
 542                               &ima_default_rules);
 543                 if (default_appraise_rules[i].func == POLICY_CHECK)
 544                         temp_ima_appraise |= IMA_APPRAISE_POLICY;
 545         }
 546
 547         ima_rules = &ima_default_rules;
 548         ima_update_policy_flag();
 549 }
 550
 551 /* Make sure we have a valid policy, at least containing some rules. */
 552 int ima_check_policy(void)
 553 {
 554         if (list_empty(&ima_temp_rules))
 555                 return -EINVAL;
 556         return 0;
 557 }
 558
 559 /**
 560  * ima_update_policy - update default_rules with new measure rules
 561  *
 562  * Called on file .release to update the default rules with a complete new
 563  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 564  * they make a queue.  The policy may be updated multiple times and this is the
 565  * RCU updater.
 566  *
 567  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 568  * we switch from the default policy to user defined.
 569  */
 570 void ima_update_policy(void)
 571 {
 572         struct list_head *policy = &ima_policy_rules;
 573
 574         list_splice_tail_init_rcu(&ima_temp_rules, policy, synchronize_rcu);
 575
 576         if (ima_rules != policy) {
 577                 ima_policy_flag = 0;
 578                 ima_rules = policy;
 579         }
 580         ima_update_policy_flag();
 581 }
 582
 583 /* Keep the enumeration in sync with the policy_tokens! */
 584 enum {
 585         Opt_measure, Opt_dont_measure,
 586         Opt_appraise, Opt_dont_appraise,
 587         Opt_audit, Opt_hash, Opt_dont_hash,
 588         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 589         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 590         Opt_func, Opt_mask, Opt_fsmagic, Opt_fsname,
 591         Opt_fsuuid, Opt_uid_eq, Opt_euid_eq, Opt_fowner_eq,
 592         Opt_uid_gt, Opt_euid_gt, Opt_fowner_gt,
 593         Opt_uid_lt, Opt_euid_lt, Opt_fowner_lt,
 594         Opt_appraise_type, Opt_permit_directio,
 595         Opt_pcr, Opt_err
 596 };
 597
 598 static const match_table_t policy_tokens = {
 599         {Opt_measure, "measure"},
 600         {Opt_dont_measure, "dont_measure"},
 601         {Opt_appraise, "appraise"},
 602         {Opt_dont_appraise, "dont_appraise"},
 603         {Opt_audit, "audit"},
 604         {Opt_hash, "hash"},
 605         {Opt_dont_hash, "dont_hash"},
 606         {Opt_obj_user, "obj_user=%s"},
 607         {Opt_obj_role, "obj_role=%s"},
 608         {Opt_obj_type, "obj_type=%s"},
 609         {Opt_subj_user, "subj_user=%s"},
 610         {Opt_subj_role, "subj_role=%s"},
 611         {Opt_subj_type, "subj_type=%s"},
 612         {Opt_func, "func=%s"},
 613         {Opt_mask, "mask=%s"},
 614         {Opt_fsmagic, "fsmagic=%s"},
 615         {Opt_fsname, "fsname=%s"},
 616         {Opt_fsuuid, "fsuuid=%s"},
 617         {Opt_uid_eq, "uid=%s"},
 618         {Opt_euid_eq, "euid=%s"},
 619         {Opt_fowner_eq, "fowner=%s"},
 620         {Opt_uid_gt, "uid>%s"},
 621         {Opt_euid_gt, "euid>%s"},
 622         {Opt_fowner_gt, "fowner>%s"},
 623         {Opt_uid_lt, "uid<%s"},
 624         {Opt_euid_lt, "euid<%s"},
 625         {Opt_fowner_lt, "fowner<%s"},
 626         {Opt_appraise_type, "appraise_type=%s"},
 627         {Opt_permit_directio, "permit_directio"},
 628         {Opt_pcr, "pcr=%s"},
 629         {Opt_err, NULL}
 630 };
 631
 632 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 633                              substring_t *args, int lsm_rule, int audit_type)
 634 {
 635         int result;
 636
 637         if (entry->lsm[lsm_rule].rule)
 638                 return -EINVAL;
 639
 640         entry->lsm[lsm_rule].args_p = match_strdup(args);
 641         if (!entry->lsm[lsm_rule].args_p)
 642                 return -ENOMEM;
 643
 644         entry->lsm[lsm_rule].type = audit_type;
 645         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 646                                            Audit_equal,
 647                                            entry->lsm[lsm_rule].args_p,
 648                                            &entry->lsm[lsm_rule].rule);
 649         if (!entry->lsm[lsm_rule].rule) {
 650                 kfree(entry->lsm[lsm_rule].args_p);
 651                 return -EINVAL;
 652         }
 653
 654         return result;
 655 }
 656
 657 static void ima_log_string_op(struct audit_buffer *ab, char *key, char *value,
 658                               bool (*rule_operator)(kuid_t, kuid_t))
 659 {
 660         if (!ab)
 661                 return;
 662
 663         if (rule_operator == &uid_gt)
 664                 audit_log_format(ab, "%s>", key);
 665         else if (rule_operator == &uid_lt)
 666                 audit_log_format(ab, "%s<", key);
 667         else
 668                 audit_log_format(ab, "%s=", key);
 669         audit_log_format(ab, "%s ", value);
 670 }
 671 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
 672 {
 673         ima_log_string_op(ab, key, value, NULL);
 674 }
 675
 676 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 677 {
 678         struct audit_buffer *ab;
 679         char *from;
 680         char *p;
 681         bool uid_token;
 682         int result = 0;
 683
 684         ab = integrity_audit_log_start(audit_context(), GFP_KERNEL,
 685                                        AUDIT_INTEGRITY_POLICY_RULE);
 686
 687         entry->uid = INVALID_UID;
 688         entry->fowner = INVALID_UID;
 689         entry->uid_op = &uid_eq;
 690         entry->fowner_op = &uid_eq;
 691         entry->action = UNKNOWN;
 692         while ((p = strsep(&rule, " \t")) != NULL) {
 693                 substring_t args[MAX_OPT_ARGS];
 694                 int token;
 695                 unsigned long lnum;
 696
 697                 if (result < 0)
 698                         break;
 699                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
 700                         continue;
 701                 token = match_token(p, policy_tokens, args);
 702                 switch (token) {
 703                 case Opt_measure:
 704                         ima_log_string(ab, "action", "measure");
 705
 706                         if (entry->action != UNKNOWN)
 707                                 result = -EINVAL;
 708
 709                         entry->action = MEASURE;
 710                         break;
 711                 case Opt_dont_measure:
 712                         ima_log_string(ab, "action", "dont_measure");
 713
 714                         if (entry->action != UNKNOWN)
 715                                 result = -EINVAL;
 716
 717                         entry->action = DONT_MEASURE;
 718                         break;
 719                 case Opt_appraise:
 720                         ima_log_string(ab, "action", "appraise");
 721
 722                         if (entry->action != UNKNOWN)
 723                                 result = -EINVAL;
 724
 725                         entry->action = APPRAISE;
 726                         break;
 727                 case Opt_dont_appraise:
 728                         ima_log_string(ab, "action", "dont_appraise");
 729
 730                         if (entry->action != UNKNOWN)
 731                                 result = -EINVAL;
 732
 733                         entry->action = DONT_APPRAISE;
 734                         break;
 735                 case Opt_audit:
 736                         ima_log_string(ab, "action", "audit");
 737
 738                         if (entry->action != UNKNOWN)
 739                                 result = -EINVAL;
 740
 741                         entry->action = AUDIT;
 742                         break;
 743                 case Opt_hash:
 744                         ima_log_string(ab, "action", "hash");
 745
 746                         if (entry->action != UNKNOWN)
 747                                 result = -EINVAL;
 748
 749                         entry->action = HASH;
 750                         break;
 751                 case Opt_dont_hash:
 752                         ima_log_string(ab, "action", "dont_hash");
 753
 754                         if (entry->action != UNKNOWN)
 755                                 result = -EINVAL;
 756
 757                         entry->action = DONT_HASH;
 758                         break;
 759                 case Opt_func:
 760                         ima_log_string(ab, "func", args[0].from);
 761
 762                         if (entry->func)
 763                                 result = -EINVAL;
 764
 765                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
 766                                 entry->func = FILE_CHECK;
 767                         /* PATH_CHECK is for backwards compat */
 768                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
 769                                 entry->func = FILE_CHECK;
 770                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
 771                                 entry->func = MODULE_CHECK;
 772                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
 773                                 entry->func = FIRMWARE_CHECK;
 774                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
 775                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
 776                                 entry->func = MMAP_CHECK;
 777                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
 778                                 entry->func = BPRM_CHECK;
 779                         else if (strcmp(args[0].from, "CREDS_CHECK") == 0)
 780                                 entry->func = CREDS_CHECK;
 781                         else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
 782                                  0)
 783                                 entry->func = KEXEC_KERNEL_CHECK;
 784                         else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
 785                                  == 0)
 786                                 entry->func = KEXEC_INITRAMFS_CHECK;
 787                         else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
 788                                 entry->func = POLICY_CHECK;
 789                         else
 790                                 result = -EINVAL;
 791                         if (!result)
 792                                 entry->flags |= IMA_FUNC;
 793                         break;
 794                 case Opt_mask:
 795                         ima_log_string(ab, "mask", args[0].from);
 796
 797                         if (entry->mask)
 798                                 result = -EINVAL;
 799
 800                         from = args[0].from;
 801                         if (*from == '^')
 802                                 from++;
 803
 804                         if ((strcmp(from, "MAY_EXEC")) == 0)
 805                                 entry->mask = MAY_EXEC;
 806                         else if (strcmp(from, "MAY_WRITE") == 0)
 807                                 entry->mask = MAY_WRITE;
 808                         else if (strcmp(from, "MAY_READ") == 0)
 809                                 entry->mask = MAY_READ;
 810                         else if (strcmp(from, "MAY_APPEND") == 0)
 811                                 entry->mask = MAY_APPEND;
 812                         else
 813                                 result = -EINVAL;
 814                         if (!result)
 815                                 entry->flags |= (*args[0].from == '^')
 816                                      ? IMA_INMASK : IMA_MASK;
 817                         break;
 818                 case Opt_fsmagic:
 819                         ima_log_string(ab, "fsmagic", args[0].from);
 820
 821                         if (entry->fsmagic) {
 822                                 result = -EINVAL;
 823                                 break;
 824                         }
 825
 826                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
 827                         if (!result)
 828                                 entry->flags |= IMA_FSMAGIC;
 829                         break;
 830                 case Opt_fsname:
 831                         ima_log_string(ab, "fsname", args[0].from);
 832
 833                         entry->fsname = kstrdup(args[0].from, GFP_KERNEL);
 834                         if (!entry->fsname) {
 835                                 result = -ENOMEM;
 836                                 break;
 837                         }
 838                         result = 0;
 839                         entry->flags |= IMA_FSNAME;
 840                         break;
 841                 case Opt_fsuuid:
 842                         ima_log_string(ab, "fsuuid", args[0].from);
 843
 844                         if (!uuid_is_null(&entry->fsuuid)) {
 845                                 result = -EINVAL;
 846                                 break;
 847                         }
 848
 849                         result = uuid_parse(args[0].from, &entry->fsuuid);
 850                         if (!result)
 851                                 entry->flags |= IMA_FSUUID;
 852                         break;
 853                 case Opt_uid_gt:
 854                 case Opt_euid_gt:
 855                         entry->uid_op = &uid_gt;
 856                 case Opt_uid_lt:
 857                 case Opt_euid_lt:
 858                         if ((token == Opt_uid_lt) || (token == Opt_euid_lt))
 859                                 entry->uid_op = &uid_lt;
 860                 case Opt_uid_eq:
 861                 case Opt_euid_eq:
 862                         uid_token = (token == Opt_uid_eq) ||
 863                                     (token == Opt_uid_gt) ||
 864                                     (token == Opt_uid_lt);
 865
 866                         ima_log_string_op(ab, uid_token ? "uid" : "euid",
 867                                           args[0].from, entry->uid_op);
 868
 869                         if (uid_valid(entry->uid)) {
 870                                 result = -EINVAL;
 871                                 break;
 872                         }
 873
 874                         result = kstrtoul(args[0].from, 10, &lnum);
 875                         if (!result) {
 876                                 entry->uid = make_kuid(current_user_ns(),
 877                                                        (uid_t) lnum);
 878                                 if (!uid_valid(entry->uid) ||
 879                                     (uid_t)lnum != lnum)
 880                                         result = -EINVAL;
 881                                 else
 882                                         entry->flags |= uid_token
 883                                             ? IMA_UID : IMA_EUID;
 884                         }
 885                         break;
 886                 case Opt_fowner_gt:
 887                         entry->fowner_op = &uid_gt;
 888                 case Opt_fowner_lt:
 889                         if (token == Opt_fowner_lt)
 890                                 entry->fowner_op = &uid_lt;
 891                 case Opt_fowner_eq:
 892                         ima_log_string_op(ab, "fowner", args[0].from,
 893                                           entry->fowner_op);
 894
 895                         if (uid_valid(entry->fowner)) {
 896                                 result = -EINVAL;
 897                                 break;
 898                         }
 899
 900                         result = kstrtoul(args[0].from, 10, &lnum);
 901                         if (!result) {
 902                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
 903                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
 904                                         result = -EINVAL;
 905                                 else
 906                                         entry->flags |= IMA_FOWNER;
 907                         }
 908                         break;
 909                 case Opt_obj_user:
 910                         ima_log_string(ab, "obj_user", args[0].from);
 911                         result = ima_lsm_rule_init(entry, args,
 912                                                    LSM_OBJ_USER,
 913                                                    AUDIT_OBJ_USER);
 914                         break;
 915                 case Opt_obj_role:
 916                         ima_log_string(ab, "obj_role", args[0].from);
 917                         result = ima_lsm_rule_init(entry, args,
 918                                                    LSM_OBJ_ROLE,
 919                                                    AUDIT_OBJ_ROLE);
 920                         break;
 921                 case Opt_obj_type:
 922                         ima_log_string(ab, "obj_type", args[0].from);
 923                         result = ima_lsm_rule_init(entry, args,
 924                                                    LSM_OBJ_TYPE,
 925                                                    AUDIT_OBJ_TYPE);
 926                         break;
 927                 case Opt_subj_user:
 928                         ima_log_string(ab, "subj_user", args[0].from);
 929                         result = ima_lsm_rule_init(entry, args,
 930                                                    LSM_SUBJ_USER,
 931                                                    AUDIT_SUBJ_USER);
 932                         break;
 933                 case Opt_subj_role:
 934                         ima_log_string(ab, "subj_role", args[0].from);
 935                         result = ima_lsm_rule_init(entry, args,
 936                                                    LSM_SUBJ_ROLE,
 937                                                    AUDIT_SUBJ_ROLE);
 938                         break;
 939                 case Opt_subj_type:
 940                         ima_log_string(ab, "subj_type", args[0].from);
 941                         result = ima_lsm_rule_init(entry, args,
 942                                                    LSM_SUBJ_TYPE,
 943                                                    AUDIT_SUBJ_TYPE);
 944                         break;
 945                 case Opt_appraise_type:
 946                         if (entry->action != APPRAISE) {
 947                                 result = -EINVAL;
 948                                 break;
 949                         }
 950
 951                         ima_log_string(ab, "appraise_type", args[0].from);
 952                         if ((strcmp(args[0].from, "imasig")) == 0)
 953                                 entry->flags |= IMA_DIGSIG_REQUIRED;
 954                         else
 955                                 result = -EINVAL;
 956                         break;
 957                 case Opt_permit_directio:
 958                         entry->flags |= IMA_PERMIT_DIRECTIO;
 959                         break;
 960                 case Opt_pcr:
 961                         if (entry->action != MEASURE) {
 962                                 result = -EINVAL;
 963                                 break;
 964                         }
 965                         ima_log_string(ab, "pcr", args[0].from);
 966
 967                         result = kstrtoint(args[0].from, 10, &entry->pcr);
 968                         if (result || INVALID_PCR(entry->pcr))
 969                                 result = -EINVAL;
 970                         else
 971                                 entry->flags |= IMA_PCR;
 972
 973                         break;
 974                 case Opt_err:
 975                         ima_log_string(ab, "UNKNOWN", p);
 976                         result = -EINVAL;
 977                         break;
 978                 }
 979         }
 980         if (!result && (entry->action == UNKNOWN))
 981                 result = -EINVAL;
 982         else if (entry->action == APPRAISE)
 983                 temp_ima_appraise |= ima_appraise_flag(entry->func);
 984
 985         audit_log_format(ab, "res=%d", !result);
 986         audit_log_end(ab);
 987         return result;
 988 }
 989
 990 /**
 991  * ima_parse_add_rule - add a rule to ima_policy_rules
 992  * @rule - ima measurement policy rule
 993  *
 994  * Avoid locking by allowing just one writer at a time in ima_write_policy()
 995  * Returns the length of the rule parsed, an error code on failure
 996  */
 997 ssize_t ima_parse_add_rule(char *rule)
 998 {
 999         static const char op[] = "update_policy";
1000         char *p;
1001         struct ima_rule_entry *entry;
1002         ssize_t result, len;
1003         int audit_info = 0;
1004
1005         p = strsep(&rule, "\n");
1006         len = strlen(p) + 1;
1007         p += strspn(p, " \t");
1008
1009         if (*p == '#' || *p == '\0')
1010                 return len;
1011
1012         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1013         if (!entry) {
1014                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
1015                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
1016                 return -ENOMEM;
1017         }
1018
1019         INIT_LIST_HEAD(&entry->list);
1020
1021         result = ima_parse_rule(p, entry);
1022         if (result) {
1023                 kfree(entry);
1024                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
1025                                     NULL, op, "invalid-policy", result,
1026                                     audit_info);
1027                 return result;
1028         }
1029
1030         list_add_tail(&entry->list, &ima_temp_rules);
1031
1032         return len;
1033 }
1034
1035 /**
1036  * ima_delete_rules() called to cleanup invalid in-flight policy.
1037  * We don't need locking as we operate on the temp list, which is
1038  * different from the active one.  There is also only one user of
1039  * ima_delete_rules() at a time.
1040  */
1041 void ima_delete_rules(void)
1042 {
1043         struct ima_rule_entry *entry, *tmp;
1044         int i;
1045
1046         temp_ima_appraise = 0;
1047         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
1048                 for (i = 0; i < MAX_LSM_RULES; i++)
1049                         kfree(entry->lsm[i].args_p);
1050
1051                 list_del(&entry->list);
1052                 kfree(entry);
1053         }
1054 }
1055
1056 #ifdef  CONFIG_IMA_READ_POLICY
1057 enum {
1058         mask_exec = 0, mask_write, mask_read, mask_append
1059 };
1060
1061 static const char *const mask_tokens[] = {
1062         "MAY_EXEC",
1063         "MAY_WRITE",
1064         "MAY_READ",
1065         "MAY_APPEND"
1066 };
1067
1068 #define __ima_hook_stringify(str)       (#str),
1069
1070 static const char *const func_tokens[] = {
1071         __ima_hooks(__ima_hook_stringify)
1072 };
1073
1074 void *ima_policy_start(struct seq_file *m, loff_t *pos)
1075 {
1076         loff_t l = *pos;
1077         struct ima_rule_entry *entry;
1078
1079         rcu_read_lock();
1080         list_for_each_entry_rcu(entry, ima_rules, list) {
1081                 if (!l--) {
1082                         rcu_read_unlock();
1083                         return entry;
1084                 }
1085         }
1086         rcu_read_unlock();
1087         return NULL;
1088 }
1089
1090 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
1091 {
1092         struct ima_rule_entry *entry = v;
1093
1094         rcu_read_lock();
1095         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
1096         rcu_read_unlock();
1097         (*pos)++;
1098
1099         return (&entry->list == ima_rules) ? NULL : entry;
1100 }
1101
1102 void ima_policy_stop(struct seq_file *m, void *v)
1103 {
1104 }
1105
1106 #define pt(token)       policy_tokens[token].pattern
1107 #define mt(token)       mask_tokens[token]
1108
1109 /*
1110  * policy_func_show - display the ima_hooks policy rule
1111  */
1112 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
1113 {
1114         if (func > 0 && func < MAX_CHECK)
1115                 seq_printf(m, "func=%s ", func_tokens[func]);
1116         else
1117                 seq_printf(m, "func=%d ", func);
1118 }
1119
1120 int ima_policy_show(struct seq_file *m, void *v)
1121 {
1122         struct ima_rule_entry *entry = v;
1123         int i;
1124         char tbuf[64] = {0,};
1125
1126         rcu_read_lock();
1127
1128         if (entry->action & MEASURE)
1129                 seq_puts(m, pt(Opt_measure));
1130         if (entry->action & DONT_MEASURE)
1131                 seq_puts(m, pt(Opt_dont_measure));
1132         if (entry->action & APPRAISE)
1133                 seq_puts(m, pt(Opt_appraise));
1134         if (entry->action & DONT_APPRAISE)
1135                 seq_puts(m, pt(Opt_dont_appraise));
1136         if (entry->action & AUDIT)
1137                 seq_puts(m, pt(Opt_audit));
1138         if (entry->action & HASH)
1139                 seq_puts(m, pt(Opt_hash));
1140         if (entry->action & DONT_HASH)
1141                 seq_puts(m, pt(Opt_dont_hash));
1142
1143         seq_puts(m, " ");
1144
1145         if (entry->flags & IMA_FUNC)
1146                 policy_func_show(m, entry->func);
1147
1148         if (entry->flags & IMA_MASK) {
1149                 if (entry->mask & MAY_EXEC)
1150                         seq_printf(m, pt(Opt_mask), mt(mask_exec));
1151                 if (entry->mask & MAY_WRITE)
1152                         seq_printf(m, pt(Opt_mask), mt(mask_write));
1153                 if (entry->mask & MAY_READ)
1154                         seq_printf(m, pt(Opt_mask), mt(mask_read));
1155                 if (entry->mask & MAY_APPEND)
1156                         seq_printf(m, pt(Opt_mask), mt(mask_append));
1157                 seq_puts(m, " ");
1158         }
1159
1160         if (entry->flags & IMA_FSMAGIC) {
1161                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1162                 seq_printf(m, pt(Opt_fsmagic), tbuf);
1163                 seq_puts(m, " ");
1164         }
1165
1166         if (entry->flags & IMA_FSNAME) {
1167                 snprintf(tbuf, sizeof(tbuf), "%s", entry->fsname);
1168                 seq_printf(m, pt(Opt_fsname), tbuf);
1169                 seq_puts(m, " ");
1170         }
1171
1172         if (entry->flags & IMA_PCR) {
1173                 snprintf(tbuf, sizeof(tbuf), "%d", entry->pcr);
1174                 seq_printf(m, pt(Opt_pcr), tbuf);
1175                 seq_puts(m, " ");
1176         }
1177
1178         if (entry->flags & IMA_FSUUID) {
1179                 seq_printf(m, "fsuuid=%pU", &entry->fsuuid);
1180                 seq_puts(m, " ");
1181         }
1182
1183         if (entry->flags & IMA_UID) {
1184                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1185                 if (entry->uid_op == &uid_gt)
1186                         seq_printf(m, pt(Opt_uid_gt), tbuf);
1187                 else if (entry->uid_op == &uid_lt)
1188                         seq_printf(m, pt(Opt_uid_lt), tbuf);
1189                 else
1190                         seq_printf(m, pt(Opt_uid_eq), tbuf);
1191                 seq_puts(m, " ");
1192         }
1193
1194         if (entry->flags & IMA_EUID) {
1195                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1196                 if (entry->uid_op == &uid_gt)
1197                         seq_printf(m, pt(Opt_euid_gt), tbuf);
1198                 else if (entry->uid_op == &uid_lt)
1199                         seq_printf(m, pt(Opt_euid_lt), tbuf);
1200                 else
1201                         seq_printf(m, pt(Opt_euid_eq), tbuf);
1202                 seq_puts(m, " ");
1203         }
1204
1205         if (entry->flags & IMA_FOWNER) {
1206                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1207                 if (entry->fowner_op == &uid_gt)
1208                         seq_printf(m, pt(Opt_fowner_gt), tbuf);
1209                 else if (entry->fowner_op == &uid_lt)
1210                         seq_printf(m, pt(Opt_fowner_lt), tbuf);
1211                 else
1212                         seq_printf(m, pt(Opt_fowner_eq), tbuf);
1213                 seq_puts(m, " ");
1214         }
1215
1216         for (i = 0; i < MAX_LSM_RULES; i++) {
1217                 if (entry->lsm[i].rule) {
1218                         switch (i) {
1219                         case LSM_OBJ_USER:
1220                                 seq_printf(m, pt(Opt_obj_user),
1221                                            (char *)entry->lsm[i].args_p);
1222                                 break;
1223                         case LSM_OBJ_ROLE:
1224                                 seq_printf(m, pt(Opt_obj_role),
1225                                            (char *)entry->lsm[i].args_p);
1226                                 break;
1227                         case LSM_OBJ_TYPE:
1228                                 seq_printf(m, pt(Opt_obj_type),
1229                                            (char *)entry->lsm[i].args_p);
1230                                 break;
1231                         case LSM_SUBJ_USER:
1232                                 seq_printf(m, pt(Opt_subj_user),
1233                                            (char *)entry->lsm[i].args_p);
1234                                 break;
1235                         case LSM_SUBJ_ROLE:
1236                                 seq_printf(m, pt(Opt_subj_role),
1237                                            (char *)entry->lsm[i].args_p);
1238                                 break;
1239                         case LSM_SUBJ_TYPE:
1240                                 seq_printf(m, pt(Opt_subj_type),
1241                                            (char *)entry->lsm[i].args_p);
1242                                 break;
1243                         }
1244                 }
1245         }
1246         if (entry->flags & IMA_DIGSIG_REQUIRED)
1247                 seq_puts(m, "appraise_type=imasig ");
1248         if (entry->flags & IMA_PERMIT_DIRECTIO)
1249                 seq_puts(m, "permit_directio ");
1250         rcu_read_unlock();
1251         seq_puts(m, "\n");
1252         return 0;
1253 }
1254 #endif  /* CONFIG_IMA_READ_POLICY */